Find Registry Changes recently made

I found this very handy little utility that searches for registry key changes made recently, or in fact made between any given time period. It shows the Key Path and the time and date stamp for when the registry key was changed.

This tool could be used as an alernative to regmon and or registry snapshots utils for trying to find keys that have been changed. The Util is very fast to run.

The tool is made by Appsense and is a free download from their website.

http://www.appsense.com/mstools/regrecent.aspx

Delete AppSense Events from SQL Database

Appsense has no automated method of cleaning up all the events it records.
This can mean the SQL database can grow very large. My current database is around
4GB.

To clean up the database I perform the following actions within the appsense management console to delete older events that i no longer need.

Open Appsense Management Console
Click Alerts Tab
Click Delete Event
Choose time range of the data to be deleted (I typically delete anything older than 1 month)
It may take some time to delete but you should get an completed message along with a count of how many events were deleted.

It would be a nice feature if the appsense console automated this housekeeping but for the moment this manual process is required.

Appsense EM Order of Execution

Appsense Environment Manager Logon rules intergrate with the windows logon process.
It is important to understand the order that this executes in order to deliver the correct settings and ensure a fast logon experience for users.

I got the following information on the EM Agent run order from a Appsense Technician.
Im not to sure about the last entry as if you are using EM with a Hybrid profile solution then WinLogon will know nothing about loading Network and Printer Mappings.
You will likely be performing these via a script kicked of by
GPO
Usrlogon.cmd
Environment Manager - Importing the reg keys


Appsense EM Logon Order
WinLogon Starts EM Agent and run UserInit
EM Agent Starts an Agent Assist Session for the user
UserInit Load Group Policies (GPO)
UserInit Launches explorer.exe
WinLogon tells EM Agent that shell has started - EM Agent Assist runs EM actions
WinLogon restores Printer and Drive mappings - In Parallel with EM actions

Moving Appsense SQL Database

I have a unofficial Appsense Guide to moving the Appsense SQL Server database.
The task basically involves these steps

Use SQL Management Server to detach database
Move the database
Use SQL Management Server to attach database
Adjust security and roles on new database
Uninstall Appsense Management Server
Install Appsense Management server pointing at new SQL Server
Install Appsense Consoles as required

PDF document attatched with full guide and screenshots

Appsense%20Database%20Move.pdf

I performed the Move successfully at client site, with these instructions.
I also moved the Appsense Management Server to another server.
To perform this i did the following.

I added the new server to the failover list in the appsense management console.
I checked this Failover URL went out to my farm.
I then installed the Appsense Management server software on my new server.
I then stopped IIS on the old Management server
I then checked eventlog on Terminal servers to make sure they started to talk to the failover server
I then shutdown the old Appsense Management Server
The Agents seemed to have now set themselves to talk to the new server. The CCA registry key point to new server. (I thought i would have had to manually correct this key?)


NOTE : We did have a DNS Alias setup for the Appsense Management server but this turns out to be of little use as the agents still seem to store the actual server name even though the MSI push install of the Agent specified the DNS Alias. Possibly the DNS alias works when the agent is deployed with the CCA deployment tool ?

Appsense Error Code=32

Im using Appsense v7.227 Environment Manager to deliver a hybrid profile to Terminal server users. I hive off a small number of required registry keys on logoff and import them back in on logon. I perform a redirect on users file areas (appdata,desktop,favorites,cookies)

On running a trace for the logon process with the appsense tool EM_DebugGUI_v7.0.exe
I saw a number of error messages. A few were error code=32 (full message at the bottom)
The reg import does however appear to be succesful so i think the message may just be a red herring.

The error only seems to appear for registry keys that i was importing in the MERGE mode. All REPLACE mode keys were ok. Changing the option to REPLACE did not show the problem. I have a call open with Appsense into why MERGE mode produces the error code.

[CRegistryHiveObject::CopyAndBackup71Hive] ERROR: Failed to update hive filename from "hybridpath" to "hybridpath" , error code=32

I raised a call with Appsense Support for this, they have basically said this is an acceptable error message in this event.

I have performed more debug traces and i now see error code 32's with REPLACE mode registry keys, As before the registry does however seem to have imported the hive succesfully.
So again im going to have to ignore these errors.

Appsense Memory Optimization Real World Savings

I created a full report for my employer but heres some basic figures on the amount of memory savings per instance of the common applications in our environment. These figures were using the Appsense v7 Performance Manager Memory optimization.

The figures were obtained by testing on servers with upto 38 live users across 3 days, and comparing memory use on a server with the memory optimization on against an identical server with the option off.

Memory Saved

Lotus Notes : 2MB
Internet Explorer : 9MB
Adobe Reader : 31MB
Excel : 31MB
Word : 12MB
Explorer : 10MB
FinePrint : 5.6MB
PComm : 6MB
Citrix ICA Client : 5MB

NTTaskLdr.exe : 842KB
wfcrun32.exe : 5MB
Wfshell.exe : 5MB
Winlogon.exe : 2MB

Overall the savings were very impressive , and led us to increase the user loading on a 32 Bit server from 50 to 70 users.

Appsense 6 Deployment

Moving servers between deployment groups in Appsense 6 causes all the currently installed deployments to be un-installed and a reboot to be invoked. Then the packages selected in the new deployment group will be deployed.

That can be a real gotcha as the server will reboot

This is better managed in Appsense 7 onwards as they now have a scheduled agent installation option which can include On Next reboot which is a beauty of an option.

Appsense 7.1 BSOD

I saw a problem with many servers BSOD with

PROCESS_HAS_LOCKED_PAGES

This was occuring on server with PS4 R04 and Appsense 7.1

The problem was fixed by installing pse400r04w2k3021

Appsense Run a Script

To get Appsense to run a VBS script sounds simple i know but i had a nightmare getting it to run.
So Im posting to remind myself and let anyone else that gets stuck know the answer.

In the file name put c:\windows\system32\wscript.exe

In the parameter field put \\server\share\script.vbs

Then it works a charm !!

Appsense IIS permission required

Sometimes the Appsense IIS site permissions become incorrect.

For v7 these are the required permisions are below. If they are not set correctly you will get problems like events not uploading back to the management server. New Config versions not getting deployed.

access on the IIS is as follows :-
- Default web site : anonymous access
- management server : integrated windows authentication
- Deployment : anonymous access
- Events : anonymous access
- Packages : anonymous access
- Bin : integrated windows authentication
- Downloads : anonymous access
- Bin : integrated windows authentication
- Images : integrated windows authentication

Appsense Debugging

IF you get any problems with your appsense agent or config not working as expected your best bet is to use the debug tool. If you make a call to Appsense support they will most likely ask you to perform this.

The output from the debugger is very easy to read , and usually shows you the problem

You need to obtain EM_DebugGUI_v7.0.exe from the install CD or appsense support portal.

Fire it up and its all obvious from the GUI what to set.

TIP : Set the Agent Assist to on to get full logging
Log Mode 10 is full

Appsense Communications Agent Failed error 401

Appsense Communications Agent Failed error 401

To troubleshoot this you can turn on debugging of CCA. To Perform
Add HKEY_LOCAL_MACHINE\Software\AppSense Technologies\Communications Agent
Debugfile "C:\ccalog.txt" REG_SZ
DebugLevel "10" REG_DWORD

The CCA service needs a restart to pick up these settings.

The error in this case turned out to be downloads directory in IIS not having allow anonymous access ticked.

Later the problem came up again, I fixed by allowing anonymous on deployment downwards.

Permissions on the appsense IIS site need to be correct or you will get errors communication with agents, and thinks like events wont upload or new configs will not push out. I detail the correct permissions for the appsense site else where in my Knowledge base.

Appsense Allow access to network drives

Appsense can be a trick bugger to get configured correctly and trial and error is very time consuming.

Appsense rules usually block the execution of code from network drives. If you want to simply add a rule to allow users to run things from network drives with a wildcard simply add the rule

\\*

64 Bit Explorer.exe causing high CPU

During testing of a 64 bit Windows 2003 build with Appsense v8 environment manager i encountered the following problem.

Explorer.exe was constantly using around 10% CPU randomly for users for no apparent reason.

Iexplore.exe was constantly consuming 10% CPU for around 10% of connected users to the server.

The problem was with the appsense device manager hooks. (lockdownmgr.dll) Disabling Appsense agent prevented the problem occuring on new logons. We then removed the Appsense lockdown controls on explorer.exe and could start the appsense service again. In this instance we were using appsense v8, I repeated the test on Appsense v7 and the problem did not show.
I have a called logged with Appsense support for the bug with v8.

I had heard of problems with the lockdownmgr.dll in v7 of the application as well. Best advise is to rename the DLL if you are not using the lockdown component of the suite. This prevent appsense from even trying to use the hooks.