May 062016

If you have tried to use Windows 10 in XenDesktop with Citrix Profile Management you have probably run into two major issues.

The Issues
The first issue is the start menu… which is now a database located at %localappdata%\TileDataLayer\Database.  At logoff when profile manager tries to copy it off it can’t due to services locking the files.  This results in the user logging on and their start menu not working.

The second issue revolves around SMB2/3.  SMB1 would close files as soon as it was done with them, but 2/3 leave them open for a little longer in case they are requested again.  This means when a user logs off and their Pooled Random desktop shuts down file locks can remain in the profile store if the shutdown process happens too fast (which it does 99% of the time).  Basically, if a user was to logoff and then try to log back on in a short period of time their logon would be greatly delayed due to the “ghost” file locks.

The Workarounds
Start Menu – This one is a bit tricky.  When a user logs off we need to stop the Tile Data model server and State Repository Service (in that order) so that profile manager can copy the start menu database off to the user store.  Here is the rub… a normal user cannot stop these services, so you can’t use a logoff script!  Here is what you do… logon as a local administrator and…

  1. Create a powershell script on the root of C:\ – name it logoff.ps1
    1. Open powershell_ise.exe as administrator and write these 2 lines in the white space at the top (if no white space hit the new button to create a new script).
      stop-service tiledatamodelsvc -force
      stop-service staterepository -force
    2. Save it as C:\logoff.ps1 (or put it where ever you want – just remember where it is)
  2. Right click the start menu – hit run – type in taskschd.msc and hit ok
  3. Right click the Task Scheduler Library node and select Create Basic Task…
  4. Name it whatever you want – I named mine logoff – hit next
  5. Select “When a specific event is logged” on the next screen and hit next
  6. Under Log: start typing “Sec”  the Security log should show up
  7. Under Source type in “Microsoft Windows security auditing” (no quotes)
  8. Event ID will be 4647 – hit next
  9. leave Start a program selected – hit next
  10. in the program/script blank C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  11. in the add arguments blank “-executionpolicy unrestricted -file c:\logoff.ps1” (no quotes) – if you put the script somewhere else make sure you have the path correct.
  12. click next, and on the next screen check the box “Open the Properties dialog…” and hit Finish
  13. Click Change User or Group, type in “system” (no quotes) and hit ok
  14. Check “Run with highest privileges”, and hit ok

Now when a user initiates a logoff the system will stop the Tile Data model server and State Repository Service.  This will allow profile manager to copy off the start menu database.

Ghost File locks
This one is pretty easy – we just delay the shutdown with a shutdown script.  This allows the file locks to be released at shutdown.  Here is what you do… (you should still be logged on as a local administrator)

  1. Run powershell_ise.exe as administrator and type these 2 lines in the white space at the top… again if no white space hit the new button.
    stop-service brokeragent -force
    start-sleep -s 30
  2. Save it as C:\shutdown.ps1 (or where ever you want)
  3. Right click the start menu – hit run – type in gpedit.msc
  4. Under “Computer Configuration\Windows Settings\Scripts” double click on Shutdown
  5. Click the PowerShell Scripts tab
  6. Click Add – browse to the script you just created – hit ok
  7. Hit Ok again on the shutdown properties box, and close the local group policy editor

At shutdown this script will kill the brokeragent service (just in case delaying the shutdown would allow the desktop to appear “available” again), and delay the shutdown by 30 seconds.  This allows all file locks in the profile manager store to be released.

Bonus – UPM policy settings for Windows 10 (These are mine, so you may need to tweak for your environment – of course redirect all you can)

Exclusion list (registry) 
Software\Microsoft\Internet Explorer\Recovery

Exclusion list – directories
AppData\Local\Microsoft\Windows Live
AppData\Local\Microsoft\Windows Live Contacts
AppData\Local\Microsoft\Terminal Server Client
AppData\Local\Windows Live
AppData\Local\Google\Chrome\User Data\Default\Cache
AppData\Local\Microsoft\Windows\Temporary Internet Files
AppData\Roaming\Citrix\PNAgent\Icon Cache
AppData\Roaming\Macromedia\Flash Player\\support\flashplayer\sys
AppData\Roaming\Macromedia\Flash Player\#SharedObjects
AppData\Local\Microsoft\Internet Explorer\Recovery
AppData\Local\Microsoft\Windows Mail
AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
AppData\Local\Downloaded Installations
AppData\Local\Cisco\Unified Communications\Jabber\CSF\Voicemail
AppData\Local\Cisco\Unified Communications\Jabber\Voicemail
AppData\Local\ATT Connect
AppData\Local\Cisco\Unified Communications\Jabber\Crash Dump
AppData\Local\Cisco\Unified Communications\Jabber\CSF\Logs
AppData\Roaming\Microsoft\Internet Explorer\UserData
AppData\Local\Microsoft\Windows\Application Shortcuts
AppData\Local\Microsoft\Group Policy
AppData\Local\Microsoft\Media Player

Exclusion list – files

Files to synchronize

Directories to synchronize

Folders to mirror

Process Internet Cookie files on logoff  – Enabled

Process logons of local administrators – Enabled

Profile streaming – Enabled

Path to user store – \\server\share\%username%.%userdomain%\!CTX_PROFILEVER!!CTX_OSBITNESS!

Enable Profile management – Enabled

One more bonus!!
Based mostly on this Citrix blog – Windows 10 Optimization for XenDesktop – I wrote a powershell script to automatically optimize your Windows 10 gold PVS image… available HERE.

  29 Responses to “Windows 10 and UPM (AKA – Square Peg + Round Hole) & bonus items!”

  1. […] see David Ott’s list of UPM exclusions for Windows 10. This blog post also details how to roam the Windows 10 Start Menu and prevent file share locks.  […]

  2. Hi David

    As far as I am aware since the April 2016 updates for Windows 10 the Start Menu database should no longer “lock” at logoff time. However there are still issues around the Start Menu tiles – namely that they don’t all appear.

    I’ve been playing with using Import-StartLayout at logon time to essentially “spoof” a new menu creation. However I will give this a try on my XenDesktops and see how it goes.



  3. Hi David

    This doesn’t seem to work in my lab. The database copies OK – but at next logon I get a blank Start Tiles area, and the entire Start Menu has most of its applications missing. Are you on Windows 10 version 10586.420?



    • My OS version is 10.0.10240, so that may have something to do with it. I’ll see if updating changes anything (last update was early June, so definitely have the April updates). Have you verified the .edb file is saved in the profile after logoff (AppData\Local\TileDataLayer\Database\vedatamodel.edb) as well as the .chk/.log/.jrs files? You still need the regular start menu path to be saved or redirected as it is still used (AppData\Roaming\Microsoft\Windows\Start Menu)… it is read and populates the start menu database. If you are excluding that… I bet that is your problem.

      • Hi David

        Thanks for providing all these details.

        I am getting the database files, but that’s news to me about the “regular” Start Menu…very interesting. Thinking about it now I should have guessed that – I was well aware it contributes to the database 🙂

        10240 is the RTM version as far as I remember – do you have the 1511 update installed?

        I’m actively working on this now – I will see if I can get it working any better. My email is if you want to contact me directly (I still can’t get on that CTA Slack channel!)

    • Here is a video of how it works. Things of note:
      You will see a liquidware folder in the profile store – that is from a previous test and is not being used.
      27ish seconds in the first session is launched where it is booting from the vdisk which does not have the workarounds implemented.
      38ish seconds in you will see the initial profile being created in the profile store
      During the session I customize the start menu a bit, show the redirected start menu location, the database file(s), file locks on the storage server
      2:27ish is the first logoff
      3:09 you will see file locks after the desktop has been shutdown
      3:33 second launch occurs, note the time is 1:46pm
      4:12 second logon still going… I show not all the files made it to the TileDataLayer\Database location in the profile store
      4:38 logon is complete – I paused the recording and restarted it after logon finally completed… finished at 1:50pm (4 min logon)
      You’ll notice task bar items are not present, and clicking on the start menu does nothing.
      5:28 you see the database file doesn’t get re-created
      5:42 second signout
      after which I force close connections to the profile store used by my test user
      I then place the desktops I’m testing with in maintenance mode and shut them down (ddc restarted one and it was missed by my script – shutdown manually)
      7:39 I switch the vdisk version to the version with the workarounds and take the desktops out of maintenance mode (allowing the ddc to start them)
      9:04 I rename the test user profile in the profile store – user will get a new profile at the next logon
      9:14 logon to the “fixed” desktop image
      9:52 customize the start menu/task bar
      10:29 logoff
      then I check for file locks on the profile store a couple of times, and they go away
      11:03 I drill down into the profile store to show the TileDataLayer\Database folder – you’ll all the files are there
      11:15 Log back on to check the start menu
      12:16 I logon to the console of one of the Windows 10 machines to show the scheduled task/logoff scripts

      • Hi David

        I think I understand the difference in what we are seeing now. You are using the LTSB version of Windows 10, are you not (I think I can tell because your right-click Start Menu is white – the latest version is black)? That would explain why your version is still 10240 as well.

        I am doing all my testing on CBB, not LTSB, which is why my version is 10586. For what it’s worth, I spun up an LTSB instance and it works perfectly with the technique you describe above. Unfortunately, it doesn’t seem to work on CBB in my lab…

        • I don’t see a listing for CBB in our Microsoft licensing portal… only normal and LTSB (honestly I never even noticed that before). I am fairly certain the one i downloaded was the one simply labeled “Windows 10 Enterprise” not LTSB.

          • If you’re still on 10240 fully patched it must be LTSB. The Current Branch version of Enterprise was 10586 from November 2015 onwards.

            Easy way to tell – do you have Edge in your image? LTSB doesn’t have Edge…

          • Yes Edge is there.

          • I see… the one I have is option 1… not CCB or LTSB…
            There are two downloads available for this Edition:

            1. Windows 10 Enterprise (Released Jul ’15)
            2. Windows 10 Enterprise, Version 1511 (Updated Apr ’16)

            Windows 10 Enterprise, Version 1511 (Updated Apr ’16) is the Current Branch for Business version of Windows 10 Enterprise, Version 1511. It includes all updates released for Windows 10 since Version 1511 (Released Nov ’15) including security and non-security updates.

  4. That’s amazing then, I can’t understand how you are still on build 10240 and are not on LTSB….all my machines picked up the 10586 update back in December 2015.

    Probably explains the difference in behaviour though. I’m going to see if I can get UPM working on 10586 and the 14532 builds. Cheers!

  5. Ah, so you’re using the RTM version. I wonder why it hasn’t picked up the update? Maybe if you’re using SCCM you have to manually allow it maybe…

    Have you tried using version number 2 – that’s the Current Branch or Current Branch for Business version.

    • I’ll give it a shot after the holidays 🙂

      • Hi David

        What I’ve also noticed is that when setting up the Scheduled Task there are two “sources” in the drop-down box under Security, one called “Microsoft Windows security auditing” and one called “Microsoft Windows security auditing.” (note the period at the end). When you use the second one, the Scheduled Task source actually populates as “Microsoft-Windows-Security-Auditing” which seems to be the way it should look when I actually get the Scheduled Task to run successfully.

        I will continue trying to fathom this out on 10586 for the moment – enjoy your holiday weekend 🙂

  6. James, its working for me in 10586.494

    I did have to enable the logoff/logon auditing as it was disabled by default so wasnt actually running the task



  7. I haven’t successfully got this working. I am running with 10586.494 – vesion 1511

    Using your solution I can successfully copy the start tile files using UPM and the script,
    however when I log into a ‘new’ desktop (non-persistant pool) the ‘changed’ settings I did in the start tiles have not come across, these are some other things:

    ** Start Tiles/Menu is never blank or broken
    ** Start Tile changes do not save.

    Does this solution resolve the ‘start tiles’ so they can be changed and roam between other desktops?

    • Watch the video I posted in the comments. Make sure you see the same files getting saved (vedatamodel.edb is the main one).

  8. We are running into an issue on Windows 10 when we enable the App-V 5 service. We are on PVS 7.9 with UPM and when we enable the service user profiles reset with each logon. Has anyone else ran into profile corruption like this? If we turn the service off no more profile issues. Note: we are using full Infrastructure for App-V not the integrated option within Studio.

    • Yes we have the same issue, Windows 10 LSTB 2016. Profile doesn’t reset, however most setting dont save after the first login. Disabling the App-V service corrects the issue, however we need this.

  9. We are have the same issue with Window Server 2016 as Remote Desktop Session Host. From my point of view, the Workaround with stopping the services:

    stop-service tiledatamodelsvc -force
    stop-service staterepository -force

    Is not an option for a Terminalserver environment, because if I stop the services, the other users can´t use their startmenu.

    Any Ideas?!

  10. Hi and thanks for this, it was helpful.

    Does anyone have any idea how to setup chrome and firefox in UPM to reduce the bloat?

    I’m looking for exclusions, synchronizations and what to mirror if any.

    Thanks in advance.

  11. Can I use it for linux platform

  12. […] with Windows 10, UPM really struggled, necessitating some hacks to unhook the Tile Data Model Server service so the Start Menu database could be copied. However, […]

  13. Hi David,

    Using all your settings to configure UPM using GPO works fine. When UPM is configured using WEM, each time i check and added Files and Folders to Sync and Folders to Mirror, UPM profiles are not saved.

    Outlook and windows act like a user is logging on for the first time each time. When i remove those settings it works fine – *weird*

    Without Files and Folders to Sync and Folders to Mirror, Everything works fine. Start Menu icons, Pinned taskbar ETC.

    Any ideas why would be appreciated

    NB: I am Using Citrix App Layering Technology for this Env. So User Layers is active.


 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code class="" title="" data-url=""> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> <pre class="" title="" data-url=""> <span class="" title="" data-url="">



This site uses Akismet to reduce spam. Learn how your comment data is processed.