Abstract: A single user can be provided multiple user profiles. When a user logs in to a computing device, the user can be given the option of selecting one of the multiple user profiles and/or the option to create a new user profile. The user can therefore select a user profile that is most appropriate for a particular situation. By employing a layering system, these multiple user profiles can be provided in various types of virtualization environments and independently of the operating system version.

Abstract: Access to a redirected smart card can be provided to applications executing within a remote session. To enable this access, a smart card stub can be executed within the remote session and can function to intercept an application's API calls to access a smart card. A corresponding smart card proxy can also be executed within session 0 and can function to receive the intercepted API calls from the smart card stub. The smart card proxy can then execute the API calls. Because the smart card proxy is executing in session 0, the smart card resource manager service will not block access.

Abstract: A directory that resides on a layered volume can be renamed. A hooking module can be employed to intercept rename requests. The hooking module can query a layering file system filter driver to determine the volume of the source and target of the rename request. If the source and target are on different volumes, thereby indicating that the source is a directory of a layered volume, the hooking module can append a signature to the target which identifies the actual volume of the source. The modified rename request can then be passed to the operating system which will perform its normal operations including verifying that the source and target are on the same volume. During this verification, the layering file system filter driver can detect the appended signature in the target and can inform the operating system that the target is on the volume identified in the signature.

Abstract: Mass storage devices of any interface can be redirected to a server. When a mass storage device is connected to a client terminal, a client-side proxy can obtain information about the device including the interface by which the device connects to the client terminal. The proxy can relay this information to a server-side agent which can instruct a VMiniport enumerator to enumerate the mass storage device using the interface specified in the information. When the VMiniport driver is loaded, the agent can also use the information to cause the VMiniport driver and the storport driver to be initialized in accordance with the specified interface. The VMiniport driver and storport driver will therefore be configured to communicate IO requests targeting the mass storage device in a format appropriate for the interface.

Abstract: Multiple clipboard items are supported in a VDI environment. A client clipboard service can monitor the system clipboard to detect when a clipboard item is added to the system clipboard. The client clipboard service can copy any item added to the system clipboard to a client clipboard buffer. The client clipboard service can also interface with a client virtual channel endpoint to send items in the client clipboard buffer to a server virtual channel endpoint. A server clipboard service can then copy the received items to a server clipboard buffer to thereby synchronize the client and server clipboard buffers. The server clipboard service can function in a similar manner to copy items added to the server's system clipboard to the server clipboard buffer and then interface with the server virtual channel endpoint to cause such items to be synchronized back to the client clipboard buffer.

Abstract: A generic client engine can associate a transcoder process with a requested server-side application so that the transcoder process can act as an intermediary between the browser-based application and the server-side application. The transcoder process can be configured to communicate with the browser-based application using a browser-supported protocol. The transcoder process can be further configured to transcode between the browser-supported protocol and a protocol employed by the server-side application. In cases where a gateway service provides access to the server-side application, the transcoder process can also act as an intermediary between the browser-based application and the gateway service to transcode between the browser-supported protocol and a gateway protocol. In some cases, the transcoder process, and possibly the gateway service, can alternatively be located on the client device that hosts the browser-based application.

Abstract: Cloud based Wake-on-LAN (WoL) for thin clients can be performed to allow a cloud based management server to wake up a thin client prior to an update command (or other communication) being transmitted to the thin client to ensure that the thin client will receive the update command. Cloud based WoL can therefore facilitate the deployment of updates to thin clients by providing a way for the administrator to wake up the thin clients from the cloud.

Abstract: Examples of methods, systems, apparatus, and machine-readable storage media are provided to facilitate access and control of a remote desktop of a remote machine by a windows web browser of a client device through a web server without installing proprietary plug-ins or protocols on the client device. A web server may translate user input requests from a web browser into input calls compatible with a remote desktop display protocol. The web server may receive remote desktop drawing commands from the remote machine and translate the remote desktop drawing commands into web browser drawing updates compatible with the windows web browser. A web server may communicate with the windows web browser via HTTP and communicate with the remote machine via a remote desktop display protocol.

Abstract: Examples of methods, systems, apparatus, and machine-readable storage media are provided to facilitate access and control of a remote desktop of a remote machine by a web browser of a client device through a web server without installing proprietary plug-ins or protocols on the client device. A web server may translate user input requests from a web browser into input calls compatible with a remote desktop display protocol. The web server may receive remote desktop drawing commands from the remote machine and translate the remote desktop drawing commands into web browser drawing updates compatible with the web browser. A web server may communicate with the web browser and the remote machine via HTTP and a remote desk top display protocol, respectively.

Abstract: Application configurations can be merged to enhance multi-layer performance. When a layering system is employed, a layering registry filter driver can create a merged registry hive that includes the contents of each operating system registry hive as well as the contents of each registry hive of a mounted layer. The merged registry hive will therefore form a single location that the layering registry filter driver can access to complete a registry operation.

Abstract: A smart card stub and a smart card proxy can be employed to enable a redirected smart card reader to be accessed within a remote session. To isolate a redirected smart card to a remote session, the smart card stub can be configured to process a response to an application's request to enumerate smart card readers. This processing can include obtaining a session identifier for each enumerated smart card reader and removing any smart card reader from the response if the session identifier of the smart card reader does not match the session identifier of the requesting application. The smart card stub can communicate with a filter driver to obtain the session identifiers employed in this process.

Abstract: Examples of methods, systems, apparatus, and machine-readable storage media are provided to facilitate access and control of a remote desktop of a remote machine by a web browser at a client device through a transcoding server without installing proprietary plug-ins or protocols on the client device. A transcoding server may translate user input requests from a web browser into input calls compatible with a remote desktop display protocol. The transcoding server may receive remote desktop drawing commands from the remote machine and translate the remote desktop drawing commands into web browser drawing updates compatible with the web browser. A transcoding server may communicate with a web browser via HTTP and communicate with a remote machine via a remote desktop display protocol. A web browser may be an HTML5 browser. A transcoding server may send drawing coordinates to the web browser via an HTTP header and may use long polling.

Abstract: Analytics driven update notifications can be provided. An agent on a managed device can monitor which applications are being used on the managed device and can provide a report of these application usage details along with other details of components on the managed device to a management server. The management server can evaluate reports received from a number of agents to generate rankings of applications and components that are based at least partially on usage. The management server can then identify available updates and present recommendations for deploying the updates based on the rankings.

Abstract: Peer assisted updates can be provided in a device management environment. When it is desired to deploy an update to a group of managed devices, an update command can be sent to a first set of managed devices in the group instructing these managed devices to download the update. Once these managed devices have downloaded and installed the update, they will notify the management server. In response, the management server can instruct these managed devices to remain awake so that they may each function as a master device or repository for deploying the update to other managed devices in the group. The management server can then send update commands to the other managed devices instructing them to download the update from one of the managed devices that is now acting as a master device. This process can be repeated until all managed devices in the group have been updated.

Abstract: A security solution can be implemented using a layering system. By using a layering system, any changes that are made to a computing system can be isolated within a separate write layer. Due to this isolation, the changes, which may even be malicious, can be evaluated without fear that the resources in other layers will be negatively affected. In this way, even security threats that are still unknown to antivirus solutions (so-called zero-day attacks) can be prevented from harming the system.

Abstract: Live imaging of a device can be performed. A client device can include at least two drives that are alternately employed to store the active OS partition. An imaging solution that executes on the active OS partition on a first drive can perform a live imaging process in which a second drive is fully imaged while the user continues to use the client device. Then, once the imaging of the second drive has been completed, the client device can be rebooted to cause the client device to boot from the second drive. In this way, the only downtime that a user may experience due to the imaging process is during the reboot. In a similar manner, when a client device includes only a single available drive, the drive can be divided into two or more sets of one or more partitions that are alternately employed as the active OS partition(s).

Abstract: Session reliability for a redirected mass storage device can be improved by delaying a device removal process when a redirected mass storage device is disconnected. Whenever a session employed to redirect a mass storage device is disconnected, the agent on the server can send a device removal notification to a virtual disk enumerator. Rather than immediately initiating the device removal process, the virtual disk enumerator can pause I/O requests pertaining to the mass storage device and wait a specified amount of time to allow the mass storage device to be reconnected. If the mass storage device is reconnected during the specified amount of time, the paused I/O requests can be resumed. Otherwise, the device removal process can be commenced after the specified amount of time has elapsed.

Abstract: A secure access client can be employed to enforce limitations on a user's access to a file while also allowing the user to access the file using an application of choice. To provide this functionality, the secure access client can implement an RDP client that is configured to create an RDP session with an RDP service executing on the same computing device. The RDP service can allow the secure access client to display the user interface of an application employed to open a file. The secure access client can be configured to selectively apply access limitations on a per file basis. This selective enforcement can be accomplished by only implementing a virtual channel extension to provide a particular type of access to the file when the file's access limitations would allow such access.

Abstract: When a USB device that supports multiple streams is redirected, a multi-channel environment can be established in which each USB stream is associated with a separate network connection. As a result, each USB stream will be transferred over the network in its own connection and therefore the data transfer can be carried out in an out-of-order fashion and with speeds that better approximate those provided by the USB SuperSpeed feature. To handle the routing of URBs to the appropriate network connection, the virtual desktop infrastructure can implement a lookup table to associate a stream's handle with a particular network connection.

Abstract: Session reliability can be improved when a USB device is redirected over a remote session. If a remote session is disconnected while a USB device is redirected over the remote session, a server-side agent and a client-side proxy will both receive a session disconnection notification. In response to this session disconnection notification, the agent and the proxy can each queue any I/O requests pertaining to a USB device that was being redirected over the now-disconnected remote session and commence waiting for a specified period of time. If the disconnected remote session is restored within the specified period of time, the agent and the proxy can send the queued I/O requests over the remote session. Otherwise, the agent and proxy can cause the queued I/O requests to be completed with the proper error status or discarded and can take appropriate steps to remove the device from the server and connect the device to the client.