AirWatch Hands-on Labs

Create the User Environment Manager Profile Archives Share

The profile archives share stores the personal settings for users as FlexEngine creates a subfolder for each user. The share contains User Environment Manager profile archives, which are ZIP files. FlexEngine reads personal user settings from the profile archives share when a user logs in to the environment or launches a DirectFlex-enabled application. FlexEngine writes the modified settings when the user logs out, or closes a DirectFlex-enabled application.

You should use a share that is dedicated to the profile archives. A dedicated share improves performance, simplifies configuring the User Environment Manager SyncTool, and makes it easier to configure permissions for the Helpdesk Support Tool.

Create a New Folder

Right-click the empty space in the Explorer window
Select New
Select Folder

Name the Folder

Name the folder UEMSite2Profiles

Edit NTFS Permissions on the New Folder

Setting the following NTFS security permissions on the profile archives share automatically creates a folder for each user on first login and limits the user to their own folder

For User Environment Manager administrators: Full control, applied to this folder, sub folders, and files
For End users: Create folders and append data, applied to this folder only
For Creator owner: Full control, applied to sub folders and files only

The minimum share permissions for all users should be Change and Read

Edit Folder Properties

Right-click UEMSite2Profiles
Select Properties

Edit Advanced Security Options

Select Security
Select Advanced

Disable Inheritance

Select Users (CORP\Users)
Select Disable inheritance

The Users (CORP\Users) group has inherited more permissions than are necessary. You need to disable inheritance to allow the removal of the unnecessary permissions.

Inherited Permissions

Select Convert inherited permissions into explicit permissions on this object

Remove Special Access Permission Entry

Be sure the Users entry with Special access permissions is highlighted
Select Remove
Select Apply

By removing the Special access permission entry, the Users group will only have Read & execute permissions

Add Permission

Select Add

Select a Principal

Select Select a principal

Search for Principal

Enter text creator owner
Select Check Names
Select OK

Applies To

Click the drop-down menu Applies to:
Select Subfolders and files only

Configure Permissions

Select the box next to Full control
Note - The remaining permissions will automatically be selected
Select OK

Edit Existing Permission for CORP\Users

Select the remaining Users (CORP\Users) permission entry

Advanced Permissions

Select This folder only from the Applies to: drop-down menu
Select Show advanced permissions

Configure Advanced Permissions

Select Clear all
Select only the Create folders / append data option
Select OK

Apply Changes

Select Apply

Review Configured NTFS Permissions

Review the configured permissions for each of the three principals
Select OK

The permissions should match the requirements listed in the beginning of this lesson:

For User Environment Manager administrators: Full control, applied to this folder, sub folders, and files
For End users: Create folders and append data, applied to this folder only
For Creator owner: Full control, applied to sub folders and files only

The NTFS permissions have been configured to allow end users and administrators the appropriate level of access to the content in the folder. Because you are relying on NTFS permissions, the share permissions do not need to be restrictive.

Select Sharing
Select Advanced Sharing

Select Share this folder
The share name should be automatically populated
Select Permissions

Select Everyone
Select Change and Read
Select OK

Share permissions will be processed first, granting end users the ability to read and change content on the share. The NTFS permissions you configured previously are more restrictive for the end users, and will therefore prevent end users from making changes to the configuration data.