Abstract: Secure workspaces can be supported in heterogenous environments. Snapshots of secure workspaces can be created when the secure workspaces are deployed on a user's primary user computing device. When a user desires to access secure workspaces on a secondary user computing device, information about and a trust for the secondary user computing device can be determined. Based on the information and the trust, it can then be determined how the snapshots of the secure workspaces will be used to make the secure workspaces available to the secondary user computing device. In some cases, a best-known configuration for a secure workspace can be determined and applied.

Abstract: Adaptive display association and placement for secure workspaces in a multi-display environment is provided. A secure workspace display manager can be configured to detect displays available on a user computing device and, in conjunction with a host agent, identify applications that are running inside secure workspaces deployed on the user computing device. The secure workspace display manager can use characteristics of the available displays and an application type of the applications running in the secure workspaces to create application-to-display mappings that will maximize the user experience in the multi-display environment. The secure workspace display manager can then move windows of the applications in accordance with the application-to-display mappings.

Abstract: Applications can be automatically grouped in a secure workspace environment. An application organizer service can be deployed on a user computing device to intelligently group applications within secure workspaces based on resource requirements, peripheral usage, threat level and/or data sharing characteristics of the applications. The application organizer service may determine these characteristics in a variety of ways including through the monitoring of the applications as they execute inside the secure workspaces.

Abstract: End-to-end distributed recovery of a user computing device on which secure workspaces are deployed is provided. An image of a user computing device and images of secure workspaces deployed on the user computing device can be created and stored. In response to a crash of the user computing device, a combined image can be created from the image of the user computing device and the images of the secure workspaces deployed on the user computing device. The combined image can then be deployed on the user computing device to recover the user computing device.

Abstract: Secure workspace servicing can be coordinated. A host agent on a user computing device can include a servicing manager plugin that is configured to interface with a workspace agent running in one or more secure workspaces deployed on the user computing device. The workspace agent can periodically report a status of the respective secure workspace to the servicing manager plugin. The servicing manager plugin can use the reported status to categorize each secure workspace in a critical workspace cluster or a non-critical workspace cluster. When the host agent received a servicing policy, the servicing manager plugin can coordinate the servicing of the secure workspaces using the critical and non-critical workspace clusters.

Abstract: Peripherals can be managed in a workspace environment. Peripherals can be associated with hoteling cubes to enable the inclusion of the peripherals in workspaces at the hoteling cubes to be managed. Users can be enabled to request the inclusion of additional peripherals in workspaces at the hoteling cubes. Users can also be enabled to include their own peripherals in workspaces at the hoteling cubes.

Abstract: Examples include an authenticated access to manageability hardware components in a computing device. Some examples enumerate manageability hardware components connected to an operative system kernel of the computing device, the manageability hardware components comprising a bus configuration space and the bus configuration space comprising memory map registers. Some examples include encoding an address stored in the memory map registers of each of the manageability hardware components to produce encoded address to control unauthorized accesses and locks the bus configuration space of each manageability hardware component by setting a read-only attribute to the bus configuration space. Some examples reprogram, in response to a request for access of an authenticated OS component to a manageability hardware component, the memory map register of the requested manageability hardware component with an accessible address to provide the authenticated OS component with access to the manageability hardware component.

Abstract: Examples include an authenticated access to manageability hardware components in a computing device. Some examples enumerate manageability hardware components connected to an operative system kernel of the computing device, the manageability hardware components comprising a bus configuration space and the bus configuration space comprising memory map registers. Some examples include encoding an address stored in the memory map registers of each of the manageability hardware components to produce encoded address to control unauthorized accesses and locks the bus configuration space of each manageability hardware component by setting a read-only attribute to the bus configuration space. Some examples reprogram, in response to a request for access of an authenticated OS component to a manageability hardware component, the memory map register of the requested manageability hardware component with an accessible address to provide the authenticated OS component with access to the manageability hardware component.