Abstract: Persistence can be enabled in a volatile secure workspace. A management service may be configured to provide a managed application image containing a managed application to a host agent on a user computing device. When a secure workspace is deployed on the user computing device, the host agent can attach the managed application image to the secure workspace to create an injected volume. The host agent can also provide image details of the managed application image to a file system filter in the secure workspace. The file system filter may cause the managed application to be loaded from the managed application image and may then redirect I/O performed by the managed application to the injected volume which in turn will cause such I/O to be persisted in the managed application image. In this way, the managed application, any files it creates or modifies, and any state will be persisted even though the secure workspace is volatile.

Abstract: Systems and methods for mitigating Information Handling System (IHS) startup latency in hoteling environments due to driver and firmware updates are described. In an embodiment, an IHS configured to: receive an indication of a selected one of a plurality of workspaces; in response to the indication, retrieve a list of driver or firmware updates corresponding to peripheral devices available in the selected workspace; identify a subset of driver or firmware updates among the list of driver or firmware updates based, at least in part, upon a comparison between the list of driver or firmware updates and a list of one or more drivers or firmware installed in the IHS; and initiate installation of the subset of one or more driver or firmware updates before the IHS arrives at the selected workspace.

Abstract: Secure workspaces can be supported in heterogenous environments. Snapshots of secure workspaces can be created when the secure workspaces are deployed on a user's primary user computing device. When a user desires to access secure workspaces on a secondary user computing device, information about and a trust for the secondary user computing device can be determined. Based on the information and the trust, it can then be determined how the snapshots of the secure workspaces will be used to make the secure workspaces available to the secondary user computing device. In some cases, a best-known configuration for a secure workspace can be determined and applied.

Abstract: Adaptive display association and placement for secure workspaces in a multi-display environment is provided. A secure workspace display manager can be configured to detect displays available on a user computing device and, in conjunction with a host agent, identify applications that are running inside secure workspaces deployed on the user computing device. The secure workspace display manager can use characteristics of the available displays and an application type of the applications running in the secure workspaces to create application-to-display mappings that will maximize the user experience in the multi-display environment. The secure workspace display manager can then move windows of the applications in accordance with the application-to-display mappings.

Abstract: Applications can be automatically grouped in a secure workspace environment. An application organizer service can be deployed on a user computing device to intelligently group applications within secure workspaces based on resource requirements, peripheral usage, threat level and/or data sharing characteristics of the applications. The application organizer service may determine these characteristics in a variety of ways including through the monitoring of the applications as they execute inside the secure workspaces.

Abstract: End-to-end distributed recovery of a user computing device on which secure workspaces are deployed is provided. An image of a user computing device and images of secure workspaces deployed on the user computing device can be created and stored. In response to a crash of the user computing device, a combined image can be created from the image of the user computing device and the images of the secure workspaces deployed on the user computing device. The combined image can then be deployed on the user computing device to recover the user computing device.

Abstract: When a containerized application for which experience management services are being performed is to be migrated to a new secure workspace on a user computing device, a workspace orchestrator can interface with a migration agent on the user computing device to cause the migration agent to perform the migration. The workspace agent can also interface with a host agent on the user computing device to provide information about the new secure workspace to which the containerized application is being migrated. When the migration is performed, the host agent can notify an experience management agent on the user computing device and provide the information about the new workspace. The experience management agent can then use the information about the new secure workspace to apply policies or configurations to the new secure workspace to thereby cause the same experience management services to be provided to the containerized application in the new secure workspace.

Abstract: Systems and methods are provided for consolidation of IHS (Information Handling System) VPN (Virtual Private Network) resources utilized by workspaces operating on the IHS, where the workspaces operate in isolation from the operating system of the IHS. A remote workspace orchestration service manages deployment of workspaces on the IHS. The workspaces are instantiated and operate according to a workspace definition provided by the workspace orchestration service. An embedded controller of the IHS registers a VPN consolidation function of the IHS with the workspace orchestration service, which notifies the workspaces of the VPN consolidation function. A VPN workspace is instantiated that operates according to a workspace definition provided by the workspace orchestration service. The respective workspace definitions of the workspaces are updated to route VPN communications to the VPN workspace.

Abstract: Systems and methods are provided for migration of workspaces configured in an IHS (Information Handling System). According to one embodiment, an IHS includes a workspace orchestration service that is executed to manage deployment of workspaces on the IHS; and computer-executable instructions to receive a request to migrate a first workspace from the IHS to a computing platform external to the IHS. Upon receipt of the request, the instructions instantiate a second workspace on the computing platform while the first workspace continues to operate on the IHS, and when the second workspace has been instantiated, copy one or more state-based parameters from the first workspace to the second workspace. When the state-based parameters have been configured on the second workspace, commence operation on the second workspace.

Abstract: Systems and methods for deploying software updates in hybrid workspace environments are described. In some embodiments, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: consolidate an Operating System (OS) and Basic Input/Output System (BIOS) inventory with a plurality of workspace inventories; resolve dependencies among a plurality of updates based upon the consolidated inventories to identify an order of deployment; and deploy the plurality of updates in the order of deployment.

Abstract: Modern Standby is enabled for unsupported applications. An enabler driver can be included on a system that supports Modern Standby and can be configured to detect when applications are loaded on the system. When an unsupported application is loaded, the enabler driver can interface with an enabler service to determine whether the unsupported application is Modern Standby capable. If so, the enabler driver can add the unsupported application to a throttle job object that the operating system uses to determine which applications should remain active during Modern Standby. In instances where an application is deployed in a container, an enabler container service can be leveraged to determine whether the containerized application is Modern Standby capable. If so, the enabler driver can add the container to the throttle job object.

Abstract: Aspects of this disclosure improve data availability by decreasing access times to obtain data from the storage device while still providing high memory density. A method may include receiving, by a controller of a non-volatile solid-state storage device, data with tags to be stored in a first portion configured as a first type and a second portion configured as a second type; receiving, by the controller, a storage command comprising an indicator, wherein at least some data associated with a tag identified by the indicator is stored in the first portion; and writing, by the controller based on receiving the storage command, the at least some data associated with the tag identified by the indicator from the first portion to the second portion. Other aspects are also disclosed.

Abstract: Modern Standby configurations can be applied on a per-application basis. When a system is transitioning into Modern Standby, a host service can select a Modern Standby configuration to be applied to each Modern Standby capable application. The host service can then create job objects, or other suitable structures or functionality, to cause the selected Modern Standby configurations to be applied to the Modern Standby capable applications while the system is in Modern Standby. In this way, even though the operating system may implement Modern Connected Standby for all Modern Standby capable applications, dynamically selected Modern Standby configurations can be applied to mimic Modern Disconnected Standby or suspension for at least some of the Modern Standby capable applications.

Abstract: Shared hoteling workspaces and computer equipment are preconfigured based on location. A location associated with a mobile device is monitored. As the mobile device moves toward a workspace, computer equipment associated with the workspace are automatically preconfigured for use. Different configuration events and operational states may be implemented, based on a locational proximity of the mobile device to the workspace. When the mobile device arrives at the workspace, the mobile device has been automatically paired/registered with the computer equipment at the workspace. Moreover, when the location of the mobile device no longer matches the workspace, the network pairings/registrations may be automatically torn down and deleted, thus making the workspace available for a next occupant.

Abstract: An information handling system may determine a pre-boot security posture, and update an advanced configuration and power interface mitigation table with the pre-boot security posture. The system may also update a security mitigation table based on a security mitigation policy, and determine a security mitigation based on a protection flag in the advanced configuration and power interface mitigation table and the security mitigation table.

Abstract: Shared hoteling workspaces and computer equipment are preconfigured based on location. A location associated with a mobile device is monitored. As the mobile device moves toward a workspace, computer peripheral equipment assigned to the workspace are identified and a best known configuration is retrieved. As the mobile device continues moving toward the workspace, the mobile device installs the best known configuration. Location-based policies and configuration events are defined and executed to ensure the best known configuration is timely installed. When the mobile device arrives at the workspace, the mobile device has been automatically configured to the computer peripheral equipment at the workspace. The mobile device is thus preconfigured, perhaps just in time, for immediate productivity and optimum user experience. Moreover, when the location of the mobile device no longer matches the workspace, the best known configuration may be automatically deleted to conserve memory.

Abstract: Systems and methods for generating workspace distribution and/or configuration recommendations are described. In an embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: receive data related to a plurality of workspaces; generate, based upon the data, a recommendation to modify at least one of the plurality of workspaces; and modify the at least one of the plurality of workspaces.

Abstract: When a transport is added, degraded, upgraded or lost between a computing device and a dock, peripherals can be moved or have their configurations modified to thereby seamlessly handoff and efficiently share the peripherals' traffic between the available transport(s). A service can be employed on the computing device to determine when a transport is added, degraded, updated or lost and to identify and implement one or more applicable rules to accomplish the handoff and sharing of the peripherals' traffic.

Abstract: According to one embodiment, an Information Handling System (IHS) includes executable instructions for receiving a request to execute an application that has been deployed in the workspace by a workspace that has been instantiated on the IHS. In response, the instructions communicate with the IHS to obtain a license entity associated with the application, and execute the application in the workspace according to the obtained license entity associated with the application.

Abstract: Embodiments of systems and methods for managing an Information Handling System (IHS) using a workspace orchestration system are described. In an illustrative, non-limiting embodiment, an IHS may include computer-executable instructions to, upon a request to instantiate a workspace on the IHS, receive a user identity of a user of the workspace. Using the user identity of the user, the instructions may further cause the IHS to obtain, from a database, one or more policies associated with the user, and instantiate the workspace using the obtained policies. The policies identify one or more applications to be implemented in the workspace, application settings to be applied to each of the applications, or workspace settings to be applied to the workspace.