The purpose of this post is to show how you can query the "Volatile Environment" variables from the View agent to get WMI information. I though I would share what I have done to maybe help others in similar situations.
Requirements:
The requirements for this view environment is to allow client drive redirection for internal users and disable it for external users.
The users are always in the same pool, and in this case we only have one connection server and one security server.
Because this is a feature that is either on or off and no built in way to control this, the thought is that we can create a GPO that and run off a WMI query to determine if the users are inside the network or outside of the network and disable client drive redirection based on the IP.
Lets Filter!
So we can create a simple GPO to disable CDR , however we do not want this to happen internally so we need something to query off of. It would seam this would be an easy task however I ran into the first issue with getting a WMI query for the registry key. There is no pre-defined value in the OS to do this. So we must do this on our own by creating and registering a MOF file that allows us to query the settings.
Where is the info?
View agent populates the "HKCU\Volatile Environment" key with a bunch of information, we are specifically looking for the "ViewClient_IP_Address" , however i figures since im already creating a MOF why not add all!
WTF MOF!?
So im going to skipp this part for now, but if you want to know more about MOF's read this:
https://technet.microsoft.com/en-us/library/cc180827.aspx
The MOF I created can
be found here.
Load the MOF.
Copy the MOF to your parrent image in %systemroot%\System32\wbem\ and load it by runing the following command in the above directory:
Mofcomp -class:forceupdate VMwareView.mof
(Ill look into the auto recover stuff later, but for now lets test it)
Testing:
Connect to your View VM with the Viewclient and lets test.
Success!
How to disable CDR.
So I tried several different methods, however after some digging I found that the best way to do this is to call a script placed on the VM that stops the service.
This is the service "tsdrvdisvc"
This is exactly what i need, I see how i missed it as its not labeled like the rest of the VMware services.
This first example is to just stop the service on logon with a net stop tsdrvdisvc command.
We will put this in C;\temp\script.bat
We also need to create a GPO that runs when the user logs on.
After applying first lets make sure it does what it is supposed to.
It does not.
Why, the user does not have permission (because they are not admins).
Lets fix this, we need a tool from
MS called subinacl to give the domain users permissions to the services.
once installed run the following:
subinacl.exe /service tsdrvdisvc /grant="yourdomain\Your Group"=top
ok, so lets reboot and try again.
Success! the service is stopped on logon.
Ok, now lest create some WMI Magic!
We already
installed the MOF, the though is we can query for an IP range and if its not in that range then dont apply the policy.
So here is my WMI filter.
SELECT * FROM VMwareView WHERE ViewClient_IP_Address LIKE "192.168.%.%"
Now I have a new problem, it would appear that the variables are not getting populated fast enough , the query runs but because nothing is populated it returns false and does not apply so now what?
Well guess we will just do it the old fashioned way, script it!
replace your .bat
with this .vbs. Delete the old GPO, Create a new one and set the logon script to point to
the new script.
I have set a delay at the top of the script for 10 seconds for the population of the variables, your results may vary, feel free to adjust as need.
Hope this helps any one that needs it.
Comments
Post a Comment