Abstract: Disclosed are various embodiments for replacing hard-coded certificate pinning with blockchain based certificate pinning. A signing device can obtain a public key from an endpoint device, produce a signature for the public key, and store the public key on a distributed data store, such as a blockchain. A client device can obtain and validate the public keys from the distributed data store and use the public keys to establish a secure connection between the client device and the endpoint device.

Abstract: Various examples are disclosed for predictive allocation of computing resources based on the predicted location of a user. A computing environment can generate a predictive usage model that predicts a location of a user and allocate computing resources, such as VDI sessions or VMs, to a host device that optimizes latency to the predicted location.

Abstract: Disclosed are various approaches for using drag-and-drop to open local files remotely. In one approach, a client device renders a user interface including a first indicium corresponding to a local file of the client device and a second indicium corresponding to a remotely executed application. A drag-and-drop action of the first indicium relative to the second indicium is detected. Responsive to the drag-and-drop action, the remotely executed application opens a copy of the local file.

Abstract: Information, such as information pertaining to a remote desktop, may be presented concurrently with an image of the remote desktop on an unused area of a display screen. The information may be presented with a selectable and adjustable transparency.

Abstract: Disclosed are various embodiments for delegating administrator tasks from a primary administrator to a secondary administrator. A secondary administrator can create a temporary user account and cause a temporary client device to be enrolled with a management service. The temporary user and/or temporary client device can be provided with access to certain enterprise resources to which the secondary administrator is empowered to grant access.

Abstract: Examples of enrollment of virtual devices for unprivileged users are described. In some examples, a virtual device includes an enrollment agent, encrypted enrollment credentials, and a user mode privilege elevation component that elevates privilege of the enrollment agent. A privilege elevated token is created to include an administrative privilege of a local security authority service, and a security context of an unprivileged user account logged in to the virtual device. The enrollment agent is launched using the privilege elevated token rather than a user token of a user that is logged in. The enrollment agent decrypts the encrypted enrollment credentials based on administrative privilege of the privilege elevated token, and enrolls the virtual device with a management service using decrypted enrollment credentials.

Abstract: Systems and methods are described for enrolling a user device in a Unified Endpoint Management (“UEM”) system over a closed network. After an initial boot or factory reset of a user device, a user can scan a Quick Response code, or other scannable code, that is embedded with enrollment configuration data that includes configuration settings for communicating with a UEM server in the UEM system. Using the enrollment configuration data, the user device can retrieve an installation file for a management application. The user device can install the management application and give the management application access to the enrollment configuration data. The management application can disable hardcoded open network endpoints on the user device and configure the user device for UEM communications on the closed network. The user device can connect to the UEM server over the closed network and request enrollment in the UEM system.

Abstract: Disclosed are various approaches for generating a management token corresponding to a client device. The management token can include one or more device policies that can be installed or enforce on a client device. This can allow a device that might not be enrolled as a managed device to be taken into a facility and comply with the security policies of the facility.

Abstract: A virtual computing services deployment network provides a consistent user experience from a variety of locations via a connection fabric for accessing a virtual desktop. The connection fabric identifies a user profile defining the virtualized desktop resources required for a particular user. The connection fabric includes distributed data and processing in nodes distributed throughout a public access network accessible from a user access device. Each of the fabric nodes is operable to provide an identifier (such as an IP address) of a computing resource adapted to provide the user specific desktop. A user access device accesses a local fabric node in the connection fabric, and the fabric node determines a computing resource matching a user profile of expected computing resources. The fabric node associates the user access device with the computing resource and sends the user access device an identifier for directly accessing the computing resource.

Abstract: A business method associates provisioning costs with a usage history indicative of user computing demand, and coalesces the cost data to identify an appropriate provisioning level balancing the provisioning cost and the usage demand cost. Conventional computing environments suffer from the shortcoming of being prone to overprovisioning or underprovisioning a user. Such misprovisioning is inefficient because it denotes underutilized computing resources or ineffective and/or disgruntled users. Costs increase either due to the excessive hardware bestowed on the overprovisioned user, or in support costs addressing the underprovisioned user. Configurations herein substantially overcome such shortcomings by defining a policy indicative of overprovisioning and underprovisioning indicators (misprovisioning flags), and defining rules to specify a triggering event indicating the need to reassess the provisioning of a user.

Abstract: Examples described herein include systems and methods for dynamically determining a server for enrollment with a management system. An example method can include receiving user input at an application executing on a user device, such as a portal application that provides access to and authentication for other applications through a catalogue of application icons. If the user input includes a first URL but that URL produces an error when used in conjunction with extensions associated with a management server, the application can automatically use extensions associated with an application-support server. The application can then retrieve a second URL from the application-support server and use it for performing enrollment steps at the management server. The enrollment steps can include authenticating the user at an identity service and determining the user's group ID for enrollment, for example.

Abstract: Remote desktop services are accessed by a remote desktop from a pool of remote desktops. When the remote desktop detects a user request to launch an application and determines that the application to be launched is from another remote desktop, the remote desktop establishes a connection with the other remote desktop to launch and display the application seamlessly. In addition, the remote desktop retrieves drive configuration data indicating drives or folders that are shared by each of the remote desktops in the pool and creates a mapping of the shared drives and folders based on the drive configuration data. In response to a user request to open a shared drive or folder of the second remote desktop, the remote desktop establishes a connection between the first remote desktop and the second remote desktop to acquire contents of the shared drive or folder.

Abstract: Systems and methods presented herein provide examples for distributing resources in a UEM system. In one example, the UEM system can receive a request to check out a user device enrolled in the UEM system. The request can include a profile identifier (“ID”) of a user profile making the request and attributes of the user device. The UEM system can create a hash of group IDs associated with the profile ID. The UEM system can create a device context that includes the device attributes and the hash. The UEM system can then determine if the device context matches to a resource context. Resource contexts can identify a set of UEM resources associated with a device context. Where a match is found, the UEM system can provide the corresponding resources to the user device.

Abstract: A scanner redirection method includes the steps of: receiving from an application running on a host server, a request for scanner properties; acquiring properties of the physical scanner; converting the properties of the physical scanner that are described according to a first scanning protocol to properties of the physical scanner that are described according to a second scanning protocol; transmitting the properties of the physical scanner that are described according to the second scanning protocol to the application; in response to detecting a user selection made on an image of a user interface, transmitting the user selection to the application; and in response to the user selection, receiving from the application, a request for a scanned image, and transmitting a request to an image capture core to acquire the scanned image from the physical scanner.

Abstract: Various examples are described for operating system update management. In some examples, an OS update schedule is generated. The OS update schedule specifies an OS update for a plurality of client devices. A command to deploy the OS update is transmitted to a subset of the client devices. Behavior data is received from the client devices that have applied the OS update. An update incompatibility identified using the behavior data. Instructions to fix the update incompatibility are transmitted to certain client devices.

Abstract: Disclosed are examples of embedding watermarks in a VDI session of a user. The watermark is based upon the user's identity and can be embedded into the VDI session to aid in the identification of data that is compromised from the VDI session. The watermark can be extracted from an image without needing the original image for extraction purposes.

Abstract: Examples of scheduled and on-demand volume encryption suspension are described. A management service can identify multi-volume encryption rules for local volumes of a client device including the operating system volume as well as non-operating-system volumes. The encryption rules can be transmitted to the client device. Volume encryption samples for the client device can be received, and a console user interface can be generated to indicate compliance status information for the multi-volume encryption rules for local volumes of a client device.

Abstract: Disclosed are various embodiments for generating a list of predicted contacts that can be provided to a client device. The predicted contacts can be generated based upon an analysis of user interaction data. The predicted contacts can be made available to a phone application or messaging application on a client device so that contact information can be displayed in response to an incoming call or a message.

Abstract: Examples herein include methods for dynamically protecting selective content during screen capture on a user device that is running an iOS operating system. The method includes extending a UI class that includes a protected field of an iOS class. The custom class can receive configuration data and determine which elements to protect. The protected elements can be placed within the protected field whereas the non-protected elements can be kept outside of the protected field. The operating system can hide the protected field and its contents during screen capture, while allowing additional content outside the protected field to remain displayed.

Abstract: Various systems facilitate encrypted file storage. A client device may generate an encrypted version of a file. The client device may obtain at least one reference to at least one storage location for the encrypted version of the file. The client device may cause the encrypted version of the file to be store at the at least one storage location using the at least one reference to the at least one storage location.