Choosing the Best Tool for User Management in ControlUp – Comparing Group Policy and WEM

A discussion takes place on the ControlUp Slack channel about the best way to add registry entries using the User logon trigger. Some users suggest using Group Policy or PowerShell commands, while others mention that Citrix WEM could also be an option. Different considerations, such as login times and scalability are mentioned when comparing WEM to Group Policy. Some users mention past issues with WEM, but also acknowledge that it may be a suitable tool for certain environments.

Read the entire ‘Choosing the Best Tool for User Management in ControlUp – Comparing Group Policy and WEM’ thread below:

Good morning everyone. We would like to use the User logon trigger to add a few registry entries to the HKEY Local User section of the registry. Since we are still new to ControlUP I had a few questions:

1. Is the user logon the best way to do that
2. Whats the best way to script that? Just with the reg key add command?
3. Is their a way to have it check if the keys already exist?

Thank you.

1. The issue I would see with using ControlUp for this is getting the right user key for the user ~as the script won’t run in the user context~ looks like there actually might be ways to make it run in the user context that I didn’t see before. ~There are ways to do it, but~ a straight Group Policy logon script or Group Policy Preference is really easier for something like this. (edit: I still think GPP is the best method for this)
2. Personally, I would PowerShell script it and use the PowerShell commands.
3. Using PowerShell commands for sure could check if keys already exist.

Dennis, Thank you very much for the info. I will take a look at GPP.

what is ur environment, is it Citrix, Physical endpoints. Group policy is the stone age way to add config to a users profile

Hi Luke. For this particular case it would be for users logging in to our Citrix DaaS.

Do you not use Wem

As for me that would be the way to go with this

We do use WEM, but we have never used it for GPO/GPP settings. Currently we are using it only for the CPU/Memory settings.

Same here. What’s the benefit of WEM vs. GPP? (Not all of our servers have WEM due to issues it caused in the past, but everything has GPP)

Login Times:

• WEM significantly reduces login times compared to traditional Group Policy processing. By efficiently managing and applying user settings and policies in the background, WEM ensures that users can start working with minimal delays.

• Group Policy can sometimes introduce longer login times, especially when a large number of policies are being applied or when network performance issues occur.

Environment Management:

• WEM provides extensive environment management capabilities, including application masking, dynamic resource allocation, and environment personalization. This allows for a highly customizable user experience that can be tailored to individual needs and preferences.

• Group Policy offers a wide range of settings and controls for environment management but lacks the dynamic resource allocation and personalization capabilities of WEM.

Scalability and Flexibility:

• Citrix WEM is highly scalable, designed to manage tens of thousands of users across multiple sites efficiently. Its architecture minimizes the impact on network resources, making it suitable for large-scale deployments.

• Group Policy can scale but may require more careful planning and infrastructure considerations, especially in large, dispersed environments.

User Experience and Productivity:

• By optimizing system resources and reducing login times, WEM directly contributes to an improved user experience and productivity. Users can access their applications and environments quickly, with less waiting time and better overall performance.

• While Group Policy is essential for maintaining security and compliance, its direct impact on user experience and productivity is more limited.

I used other tools similar to WEM to to replave Group policy by about 95%

@member May I ask what issues you had in the past?

there are better tools than wem that do the profile and config across phisical and virtual

but me i avide Group policy were i can

Yeah, for my environment and architecture, WEM may reduce login times, but the rest of that doesn’t apply. It can apply to other environments, not trying to discount it any in that regard.

My concern with WEM doing the application of settings is, what if they don’t hit in time for the application that needs them. I have never heard of this being an issue though, it’s just a concern I have had with it and an issue I have trying to use ControlUp for a thing that isn’t a registry setting. For me at the moment, if it isn’t broke at the moment, I’m not going to break it with some new/different technology.

As for issues in the past, I’m talking very early on after Citrix first acquired WEM and we tried to do something things with it on our multi-user servers and the user agent was not stable. I have not tried anything in more recent builds except for trying to get the per application Elevation Agent to work, which I have never had any success with, even after working with Citrix on the issue multiple times. It’s probably something I’m doing incorrectly, but Citrix wasn’t able to tell me what that something is.

I have a love/hate relationship with WEM. It does manage CPU/Memory ok most of the time, and recent builds haven’t been leaking memory and crashing my servers, so I’m starting to get to the point of considering it for more things. Also, if it were just me managing things, and not having to train others and making sure they get it right, it may be a different story as well. Having one standard way of doing things is nice….going back through hundreds of policies to migrate them over isn’t really appealing to anybody. Where is the time to do it over?

I will also say that WEM probably makes more sense in a single user VDI compared to multi-user persistent server environment we have currently. We are not looking to change from our architecture any time soon as well.

Thank you for the info. We’ve only had Citrix for a few years and WEM can do a lot of things. But for us it is overwhelming and since we don’t have someone dedicated to it, we haven’t used it much except for the CPU/Memory settings.

Continue reading and comment on the thread ‘Choosing the Best Tool for User Management in ControlUp – Comparing Group Policy and WEM’.  Not a member? Join Here!