AppSense And Session Hosts: Managing Concurrent User Settings
Shared session hosts are a practical foundation for Australian organisations that need to support many users from a controlled Windows environment. They are common in virtual desktop infrastructure, published applications, contact centres, education, healthcare, and outsourced service desks. The efficiency is compelling, but a poorly designed user-settings model can create profile conflicts, slow logons, privacy risks, and confusing application behaviour. Learn more about Wai Guo Ren Guan Guang Kega Jin Zenowi Fini Jie Xusuru Jiniyokuaru Zhi Wen Ji.
AppSense, now commonly associated with Ivanti User Workspace Manager technologies, gives administrators tools to separate user experience from the operating system image. The important design question is how those settings behave when several people use the same session host, reconnect from different devices, or run applications concurrently. A reliable approach combines policy, profile management, application personalisation, and clear ownership of data.
| Area | Shared-host risk | Practical control |
|---|---|---|
| Application settings | One user’s preferences may appear in another session | Capture settings per user and application |
| Windows profile data | Roaming data increases logon and logoff time | Exclude caches and manage profile containers carefully |
| Concurrent sessions | CPU, memory, and storage contention affect everyone | Monitor host density and resource consumption |
| Temporary files | Sensitive information can remain on the host | Apply cleanup policies and verify deletion |
| Reconnection | Settings may be applied twice or become inconsistent | Test reconnect, disconnect, and forced logoff scenarios |
| Troubleshooting | Policy conflicts are difficult to isolate | Use logging, version control, and staged deployment |
Why Session Hosts Need A Different Settings Strategy
A dedicated desktop gives one person broad control over the operating system state. A session host is different: multiple users share the same server resources, application binaries, registry areas, and sometimes profile components. The user environment therefore needs strong separation without creating a heavy management burden.
The distinction between machine settings and user settings is central. A printer driver, security agent, or Windows service belongs to the host image or computer policy. A browser preference, application toolbar, mapped folder, or personal template belongs to the user. AppSense policies should reinforce that boundary rather than capture every change indiscriminately.
Concurrent use also changes the meaning of “last write wins”. If a user opens an application in two sessions, each session may update the same configuration file. The final saved version can overwrite changes made elsewhere. This is particularly noticeable when staff move between a desktop in Sydney, a laptop in Melbourne, and a remote session through a service provider.
Application personalisation should therefore be selective. Capture only settings that are valuable to the user and safe to roam. Exclude caches, temporary databases, crash dumps, machine-specific paths, and files that applications lock during normal use. A smaller, cleaner ruleset usually delivers a faster and more predictable result.
Separating User Experience From The Host Image
A durable session-host design begins with a standardised base image. The image should contain approved applications, security controls, operating-system updates, and monitoring agents, while AppSense manages the parts of the experience that legitimately vary by user. This reduces image sprawl and makes it easier to replace or patch hosts without losing personal settings.
Environment Manager-style policies can apply settings at logon, application launch, reconnect, and logoff. Each trigger should have a clear purpose. Logon is suitable for drive mappings and basic preferences; application launch is better for application-specific variables; reconnect may be needed for network-dependent resources. Avoid applying expensive actions every time a user reconnects unless the setting genuinely needs refreshing.
Profile data deserves particular attention. Redirecting large folders to a file server can create a poor experience over long-distance links, especially when users connect to infrastructure outside their state. Australian organisations with users in Brisbane, Perth, and Adelaide may see different latency patterns when the desktop platform is hosted in Sydney. Keeping profile data close to the session-host cluster, while applying sensible exclusions, can reduce delays.
A layered approach also helps with application compatibility. Group Policy, AppSense policies, profile containers, application virtualisation, and vendor configuration tools can all modify the same setting. Document which tool owns each area. For example, Group Policy might establish the security baseline, while AppSense handles personal preferences and application context. Ownership prevents an administrator from chasing a setting that another control is continually rewriting.
Controlling Concurrent Access And Resource Pressure
The number of sessions a host can support is not determined by a single CPU or memory figure. Workload matters. A user running a browser with many tabs, Microsoft Teams, a line-of-business application, and reporting tools consumes a different resource profile from a contact-centre operator using one lightweight application. Pilot tests should measure login duration, application launch time, CPU ready or equivalent scheduling pressure, memory use, storage latency, and peak concurrency.
AppSense configuration can reduce unnecessary activity, but it cannot compensate for an undersized host pool. Large logon actions, synchronous scripts, excessive registry processing, and repeated file copies can create a “logon storm” when staff begin work at 8:30 am. Staggering scheduled tasks, simplifying policy conditions, and removing obsolete actions are valuable operational controls.
Australia’s working patterns can make this especially visible. A national organisation may have early starts in Perth, standard office hours in Sydney, and support teams working across multiple time zones. School and university environments can produce sharp bursts of demand between classes, while retail and healthcare sites may generate evening peaks. Capacity planning should use real usage data rather than an average daily session count.
Resource controls should include storage and profile shares. A saturated file server can make an AppSense policy appear to be the cause of slow logons when the actual problem is I/O contention. Monitor profile share availability, file locks, network round-trip time, and antivirus scanning. Coordinate exclusions with the security team rather than disabling protection broadly.
Applying Privacy And Security Controls To User Settings
User settings may contain more information than administrators expect. Browser history, recently opened documents, application logs, cached usernames, email addresses, and locally stored tokens can expose personal or business data. In Australia, the Privacy Act 1988 and the Australian Privacy Principles make the handling of personal information an important design consideration, particularly for healthcare, education, finance, and government-related environments.
A policy should define what is captured, where it is stored, how long it is retained, and who can access it. Keep troubleshooting logs useful but proportionate. If a setting contains sensitive information, consider whether it needs to roam at all. Passwords, authentication tokens, and secrets should be handled by the application’s approved secure storage mechanism, not casually copied into a profile share.
The Essential Eight also provides a useful security lens for session-host management. Application control, patching, restricted administrative privileges, and regular backups all affect the safety of a shared desktop estate. Session isolation should be tested, especially where published applications expose file dialogs, clipboard functions, local drive access, or printing.
Password recovery deserves a defined process. Users should be directed to an approved workflow rather than asking administrators to reveal or reset credentials manually. A central password reset process can support consistent communication, reduce help-desk handling time, and lower the risk of identity checks being performed informally.
Local storage and printing need equal attention. Australian offices often combine managed corporate networks with home broadband, shared family devices, and public or semi-public workspaces. Policies should control clipboard redirection, USB access, local drive mapping, and printer discovery according to the sensitivity of the workload. A session host should not become a convenient path for data to leave the organisation.
Testing Rules Before They Reach Every User
Testing concurrent user settings requires more than signing in once and checking whether an application opens. Build test cases around real session behaviour: first logon, second logon, reconnect, disconnect, forced termination, concurrent sessions, profile reset, application upgrade, and host replacement. Include standard users, contractors, administrators, and users with unusually large profiles.
A test matrix should cover both positive and negative outcomes. Confirm that a user receives their own preferences, that another user cannot see those preferences, and that a machine-level setting remains consistent. Check what happens when a file is locked, a profile share is unavailable, or a policy action fails halfway through. Failure handling is as important as the normal path.
Community experience can shorten this process. The AppSense community forums provide a place to compare policy patterns, search for known behaviours, and review practical advice from people managing similar environments. Treat community guidance as a starting point, then validate it against the organisation’s AppSense version, Windows build, application set, and security standards.
Integration testing is especially important when the session platform is based on VMware Horizon or another virtual desktop broker. Broker actions, instant clones, roaming profiles, and application layering may influence timing and identity detection. The community’s Horizon integration tips can help administrators identify common interaction points before a production rollout.
Operational Checks For A Stable User Environment
A small set of repeatable checks can prevent a minor policy issue from becoming a business-wide incident. Record the AppSense configuration version, host image version, Windows build, profile technology, and relevant application versions for each test. When something changes, retain the previous configuration so that administrators can compare behaviour and roll back safely.
Use these checks during pilot deployment and after major changes:
- Verify that separate users receive separate settings and files
- Measure logon and application-launch times at peak periods
- Test reconnects after network interruption or host maintenance
- Confirm that temporary data and stale profiles are removed correctly
Operational ownership should be explicit. The EUC or desktop team may own AppSense policies, the infrastructure team may own session hosts, and the identity team may own authentication. A short runbook should show which logs to collect, which service status to verify, and when to escalate to the application vendor.
Review the environment at regular intervals rather than waiting for complaints. Look for policies that no longer apply, applications that have been retired, profile folders that have grown unexpectedly, and settings that are being captured by multiple tools. A quarterly review is often sufficient for a stable estate, with additional checks after a Windows feature update or major application release.
Use these indicators to judge whether the design is healthy:
- Median and peak logon duration by host pool
- Profile size, storage latency, and failed policy actions
- Session density compared with CPU and memory thresholds
- Help-desk incidents involving missing or duplicated settings
Documentation should be readable by the person who will support the platform at 6 am, not just by its original designer. Include screenshots where useful, policy dependencies, exclusion reasons, test evidence, and rollback steps. Configuration exports and version-controlled notes make it easier to reproduce a successful setup across Melbourne, Sydney, or regional sites.
A sound AppSense deployment treats personalisation as a controlled service rather than a collection of ad hoc fixes. Define which settings belong to the person, which belong to the host, and which should never persist. Test behaviour under simultaneous use, protect sensitive data, monitor the resources that policies depend on, and use community knowledge to refine the design. Teams that follow these principles can provide a consistent desktop experience across shared session hosts while keeping performance, privacy, and support effort under control. Begin with a small pilot, measure real user journeys, and promote only the policies that behave reliably under production conditions.