I’m back after several months with a new blog post, introducing a tool I developed in PowerShell over the past few weeks.
At an Enterprise customer, we needed to run an in-depth analysis of which applications users launch during their work sessions inside Desktops published through Citrix.
If we had been asked which seamless applications users were launching, it would have been easy to pull the information from Director; in this case, though, the customer needed the details of which applications installed in the VDIs and Hosted Shared Desktops were actually being used (so they could evaluate optimizations of the various Catalogs). This information is indeed visible when analyzing a single session in Director (running processes), but we needed to keep a history of it and be able to analyze medium/long-term data.
So I approached the request by searching online for the best way, in Windows, to capture the executables launched by users; the solution that turned out to be ideal was to read the section of the user registry where the operating system stores the executables launched by the user (and keeps track of them, potentially, forever).
The registry location is the following:
HKEY_USERS\$SID\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\StoreWhere $SID must be replaced with the SID of the user in Active Directory.
Alternatively, to read the same section of the registry (if not in a remote session), you can use this location:
HKEY_CURRENT_USERS\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\StoreThanks to this registry key, I was able to write a PowerShell script that gets the users currently connected to the Citrix Desktop, reads the key above (for each user) and writes its contents to a SQL Server database. After reading the key, I clear it, so that the next read only returns the most recently launched executables.
So I built a tool made up of three components:
- AULService: an agent running on the Citrix Worker machines, which captures the applications launched by users and writes the information to the database;
- AULMonitor: the central SQL Server database, which I write to and read from to generate the reports;
- AULReport: the reporting client, which pulls the information from the database, processes it and lets you export it to Excel;
The tool was developed with the goal of staying simple, lightweight and functional (so without too many “frills”).
Below are some sample screenshots of the reporting client (AULReport):
In this first screen of the application you can see the list of applications launched between the “From” date and the “To” date, along with the count of executions. Note that the count considers one launch per user, per application, per day; if a user launches Excel 100 times in a day (on the same VM), only one launch will be counted (we don’t care how many times the application is launched, but rather which applications are launched and in which time period).
Clicking an application in the list opens a second screen with more details about the executions of that application in the selected period:
We get a chart showing the usage trend of the application; the list of paths that have been mapped to that application, and the details of how many times the application was launched on the various Workers (with the related Machine Catalog and Delivery Group).
Still in the first screen of the application, right-clicking an app shows the list of users who launched it in the period:
Clicking the selected user opens the following details:
To make an executable’s path more meaningful, there is a dedicated screen where you can assign a name to each executable:
This way, each name can be mapped to multiple executables; this lets you aggregate the reports by application, consolidating different paths into a single report. For example, for the “Office 2016 – Excel” application, in our case we were able to group the 32-bit and 64-bit executables under the single name “Office 2016 – Excel”. If we had wanted to keep the 32-bit release separate from the 64-bit one, we could have assigned two different names to the executables of the different versions.
A dedicated table holds the Machine Catalog and Delivery Group references for each analyzed machine:
The last screen I implemented is based on a TreeView:
On the left you see the list of users with the details of the applications they ran in the period; clicking each application shows, on the right, the list of executions and their details (executable path, Citrix Worker and execution date).
Over the next few days I’ll add a few more details about the solution and, as soon as everything is ready, I’ll make it available to the community for free!
Stay tuned!