Delivering policy settings with virtualized applications

[0001] This application claims the benefit of U.S. Provisional Application No. 61/068,210, filed on Mar. 5, 2008. The entire teachings of the above application are incorporated herein by reference.

[0002] Group policy is a concept that enables various user and computer settings to be defined and managed centrally on a network. In the Microsoft Windows environment, “Group Policy” and “Active Directory” services infrastructure enable information technology (IT) administrators to automate one-to-many management of users and computers—simplifying administrative tasks and reducing management costs.

[0003] Group policy has many advantages including centralizing computer system settings for various computer systems at a domain, site and/or organizational unit (OU) level in order to enforce uniformity across the computer systems; allowing the application of different policies to different sites, domains and OUs in order to manage, e.g., different sets of users; enabling user desktop environments to be managed in order to reduce, e.g., time spent troubleshooting configuration problems; enabling the installation, update, repair and removal of software on various computer systems to be centrally managed; and enabling the creation and management of account policies, configuration policies, audit policies and other security features in order to manage the security of computers and users in, e.g., a domain.

[0004] Group policy objects (GPOs) are often employed to implement certain policies on a computer system. A GPO is a structure that contains a collection of computer settings associated with a group policy. For example, a GPO may contain settings that determine access rights and privileges for a particular user when the user logs into a computer system. GPOs may be configured to perform various management tasks on a computer system, such as distributing registry settings, distributing security settings and/or deploying software. Further, GPOs may be configured to implement other policy related functions, such as establishing roaming user profiles and redirecting file system folders to, e.g., a network share file system. In a typical arrangement, a system administrator creates a GPO and targets it to a particular site, domain and/or organizational unit. The GPO is delivered to the appropriate computer systems which are then configured according to the contents of the GPO.

[0005] GPOs are stored on the domain controllers or on the client machines; GPOs stored on client machines are called local GPOs or LGPOs. Policy settings are acquired from both the GPOs on the domain controller (DC) and from the local GPOs and applied to the system.

[0006] A GPO may be organized into various types of policies including, for example, administrative templates, folder redirection, security settings, and software installation. Each policy type may, in turn, be configured to support a number of policy settings. For example, a GPO may contain administrative template settings that both hide icons on a user's desktop and prevent the user from running certain applications.

[0007] Policy settings are applied to a computer system when the system is started, a user logs into the system, a user logs out of the system or when the system is shut down. Additionally the settings for the system and user may be refreshed at regular intervals. For DCs, the policy settings are typically refreshed every five minutes. For client computers, the policy settings are typically refreshed every ninety minutes plus a random offset of up to thirty minutes. In addition, certain policy settings, such as policy settings associated with software installation and folder redirection, may be applied only when the system starts up or when a user logs into the system, and are not refreshed periodically.

[0008] Policy settings have traditionally been defined with respect to an end user or a target computer system. As a result, any policies or security settings associated with a software application have been sent and applied to the user or to the computer that executes the particular software application. With the advent of application virtualization technology, which allows the delivery of a software application as a virtual streamed image to users/computers running within its own “virtual bubble” that is separate from the target computer's file and registry system, the application of corporate security policies such as Group Policy from Active Directory becomes a challenge.

[0009] Accordingly, embodiments of the present invention provide a method of “injecting” or inserting a virtualized group policy object into a virtualized application stream so that it is not only delivered to the virtualized application in the same manner that the application is streamed but also applies the policies inside the GPO to the virtualized application's file and registry system without affecting the target computer's file and registry.

[0010] A method includes receiving a GPO from an active directory, combining the GPO and logic for using the group policy object with a virtualized application to provide a virtualized group policy object and delivering the virtualized application and the virtualized group policy object to a targeted computer system.

[0011] A method includes receiving a virtualized application package including a virtualized application, a virtualized registry, a virtualized file system and a virtualized group policy object; executing the virtualized group policy object to deliver policy settings to the virtualized registry and virtualized file system; and executing the virtualized application subject to the policy settings in the virtualized registry and virtualized file system.

[0015] It should be noted that, illustrative embodiments of the present invention, described herein, are described as using the Microsoft Windows operating system. The Microsoft Windows operating system is available from Microsoft Corporation. It should be noted that other operating systems may be adapted to be used with the present invention including e.g., Unix, and Linux. In addition, the principles of the present approach can be applied to other application virtualization environments including those that operate in conjunction with such vendors as VMWare and Citrix.

[0016] Application virtualization aims to improve application compatibility and manageability by encapsulating applications from the underlying operating system on which they are executed. A virtualized application is not installed in the traditional sense. When a virtualized application is launched, a virtualization layer intercepts and transparently redirects any operations such as file I/O by that application. The virtualized application effectively believes it has direct access to the underlying operating system resources, although in effect it does not.

[0017] The present approach takes advantage of a capability provided in a software product called GPAnywhere® available from Full Armor Corporation. Generally, for policies to take effect on disconnected computers and mobile devices and laptops, such devices need to be connected to a network to access a policy store. This means that without an active connection to the network, policy generally cannot be applied.

[0018] With the standard GPAnywhere software product, the policies that need to be applied to the target machine or device are first exported to an executable. This “executable policy” contains code to process the policies and make changes to the configurations on the target device or computer. The executable can be transferred to the target device or computer using existing deployment methods of software distribution, a file copy over the network, emailed as an attachment, copied using removable media like floppy, USB drive, Compact discs (CD-R), etc. This does not require an active connection to the server or policy store. The executable policy is then executed, e.g., with command line options, to perform the policy update. This can be done using a script or batch file, or it can be scheduled using the scheduler on the target system, or interactively executed by the user. The configuration in the executable policy is applied to the target computer or device by the executable binary code.

[0019] FIG. 1 illustrates elements of an example process for delivering policy settings with a virtualized application to a targeted computer system or device.

[0020] A GPO is taken from an active directory 102 and combined in a virtualization process 104 to produce an independent packaged file (executable binary, e.g., Win32 executable) referred to herein as a virtualized GPO and denoted EGPO 108. Rather than containing code to make changes to the configurations on the target device or computer as in the standard GPAnywhere product, the virtualized GPO includes logic on how to apply those settings to the internal registry and file system of a virtualized application independent of target device or computer.

[0021] The new virtualized GPO is “injected” or inserted into the virtualized application stream 110 which includes virtualized application 114, virtual application control file 112 and the EGPO 108. For the Microsoft SoftGrid® environment, the execution of the virtualized GPO is added to the virtualized application's initialization file (referred to as an OSD file) which controls execution of add-on processes before the virtualized application is launched.

[0022] Optionally, the virtualized GPO is sequenced into the virtualized application package itself In the Microsoft SoftGrid environment, the virtualized GPO modifies the virtual application's packaging file (MSI) and injects the virtualized GPO into the streamed application package so that it can be delivered along with the virtualized application to the targeted computer system or device 120.

[0023] When the virtualized application is executed by the user at the targeted computer system 120, the virtualized GPO is present on the file system of the virtual application “bubble” and the virtual application's initialization file (OSD) executes the virtualized GPO independent of the registry 150 and file system 160 of the targeted computer system 120.

[0024] The virtualized GPO, when executed, injects the policy settings into the virtualized registry 130 and virtualized file system 140 and enforces the policy so that the virtualized application 114 runs with the newly applied policy settings delivered through the virtualized GPO 108.

[0025] In some embodiments the virtualized application package containing the virtualized application and the virtualized GPO is streamed to the targeted computer system from an application server in an application service provider configuration. In some other embodiments the virtual application package is streamed to the targeted computer system from an application server in an enterprise-based configuration.

[0026] Referring now to FIG. 2, another example process flow for delivering policy settings with a virtualized application to a targeted computer system or device is shown. This process flow is described in the context of Microsoft Application Virtualization (App-V), formerly known as SoftGrid.

[0027] In the process flow, an administrator selects a GPO 202 in the Microsoft Group Policy Management Console. The administrator selects functional sections of Group Policy settings (e.g., scripts, security, Internet Explorer, administrative templates) to include in the policy executable.

[0028] The GPAnywhere Console contacts the (Microsoft Windows) Active Directory domain controller. It locates data for the selected GPO in the Active Directory System Volume (“SYSVOL”) file-share 206. Lightweight Directory Access Protocol (LDAP) is the protocol used by the Active Directory directory service 204. Group Policy Object Editor uses LDAP to access the directory store on the domain controller. The client also uses LDAP to read the directory store on the domain controller.

[0029] The GPAnywhere Console prepares a Group Policy executable template file 208. This file is a Group Policy executable with no settings. It defines programming/logic used to apply settings both in a normal environment and in a virtual environment, and a framework for storing and accessing policy settings.

[0030] The GPAnywhere Console copies data from the Active Directory SYSVOL 206 into memory, and then writes that data directly into the prepared Group Policy executable template. The data is stored in an indexed binary table inside the Group Policy executable to provide a finished executable file 210.

[0031] The Group Policy executable 210 is next integrated with a virtual application. FIG. 2 shows the virtual application before integration 212 and after integration 222.

[0032] An application virtualization utility 220 is run to open three distinct types of files generated by an application virtualization sequencer, with different behavior for each file: an App-V sequencer project (SPRJ) file 214 which describes a set of virtual applications and is used to “install” the applications to App-V clients; an App-V open software description (OSD) file 216 which describes a virtual application and is used to “install” the application to App-V clients; and a Microsoft Installer Package (MSI) 218 for installing third-party programs which is run on App-V clients to install the virtual package it represents.

[0033] With respect to the App-V OSD file 216 which describes a virtual application, the utility 220 opens the OSD file 216 and locates a version string. If the version string does not match expected values, the utility displays an error and closes. Otherwise, the utility adds a section to the OSD file. This line is interpreted by the App-V client causing it to launch the Group Policy executable 230 each time the virtual application is launched. The utility saves the OSD file as modified OSD file 226 in the integrated virtualized application 222.

[0034] Regarding the MSI 218, the utility 220 opens the MSI and extracts all file resources from the package. The utility 220 modifies a Windows Installer internal manifest file to include the Group Policy executable. The utility 220 further modifies the OSD file 216 that it extracted from the MSI 218. The utility 220 recompiles all the MSI files, including the modified manifest, OSD, and the new Group Policy executable 230 to provide modified OSD file 226 and MSI 228 in the integrated virtual application 222.

[0035] With respect to the App-V SPRJ file which describes a set of virtual applications, the utility 220 opens the SPRJ file 214 and locates the OSD it describes for each virtual application. The utility 220 opens each OSD file in turn and proceeds as described above for each OSD file.

[0036] For any of the above scenarios, each time the App-V client launches a virtual application integrated with a Group Policy executable template, the template is run inside the virtual environment before the code representing the virtual application is executed. The Group Policy executable file may exist on a file-share. In that case, if the file is modified with new settings, the new settings will be applied inside the virtual environment.

[0037] When the Group Policy executable is run, an option configured in the OSD file instructs it to operate in virtualized mode. This causes it to only work inside the virtualized registry system, and not modify any non-virtualized operating system files or other data (as it would in normal operations).

[0038] The Group Policy executable extracts the Group Policy settings that were embedded in it and opens the Administrative Template registry data file. The Group Policy executable copies each Administrative Template setting into the virtual environment. The Group Policy executable closes, thus allowing the virtual application to finish launching. When the virtual application reads the virtual registry looking for a Group Policy setting, it finds the settings previously configured through execution of the Group Policy executable.

[0039] It should be understood that the application server and the targeted computer system may each include a processor and memory. The memory may be a computer readable medium organized as a random access memory (RAM) implemented using various RAM devices, such as dynamic random access memory (DRAM) devices. The memory may be configured to hold various computer executable instructions and data structures including computer executable instructions and data structures that implement aspects of the present approach. It should be noted that other computer readable mediums, such as disk units and flash memory, may be configured to hold computer readable instructions and data that implement aspects of the present approach.

[0040] While this invention has been particularly shown and described with references to example embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the scope of the invention encompassed by the appended claims.