ThinApp Notes
I was reading a blog today which was promoting vmware ThinApp and it’s “agent-less” installation. So as curious as I am, I decided to read the VMware View 4 & VMware ThinApp Integration Guide (http://vmware.com/files/pdf/VMware-IG-ViewThinApp-EN.pdf). Here are some of the notes I made from the document.
Application Registration – integration of virtualized apps into the desktop OS occurs through this process which creates shortcuts on the desktop, creates file-type associations, and entries in Add/Remove Programs. It appears that registry modifications occur on the client.
ThinReg for Application Registration has two options:
- Login Script based – incorporates the ThinReg executable in an existing login script
- Local Script using Registry Run Key or Logon Script –
- the run key of the registry can call the Thinreg.exe
- GPO can use run from Logon. With this method it is recommended that Thinreg.exe be placed in the clients “Windows” directory.
App Packaging and Updates
- The setup capture process allows admins to use AD groups to assign permission to an app. These security assignments are embedded into the package.
My Conclusions
After reading through the document, I find it curious that VMware is making registry entries for its applications, uses login scripts, registry run keys, or GPO Logon Scripts to execute ‘Thinreg.exe’ and recommends that Thinreg.exe be placed in the clients “Windows” directory (a directory that requires admin access to browse and in best practice should not be modified).
So much for the “agent-less” install claim, and so much for the purpose of Virtualizing Applications in the first place, to keep them from modifying the underlying client OS.
The other item I took note of was the limitations an administrator has to assign an App to a user. This must be done during the packaging of the App. Therefore, you are going to have to create a new “Security Group” for every application you want to deploy with ThinApp and then add users to that security group created for the application.
Maybe it’s just me, but before buying into the “agent-less” installation pitch from VMware, I would look at other App Virtualization products.
March 31st, 2010 at 11:41 am
Thanks for taking the time to read the document but I think you’ve drawn some conclusions that miss the value on the guide and the product. Just a couple of comments to throw out for everyones understanding.
1. ThinApp is Agentless, a user can launch an exe from a local drive, usb, or network share and run the app without any activex, java, anything installed and without admin rights.
2. By registering the applications we are making filetype associations and shortcuts which are optional and just barely qualify as modifying the OS.
3. Registering the apps can be done with ThinReg.exe run from the netlogon directory from a logon script without any user logon scripts on the local device. The benefits of that method are completely cntralized and controlled mgt. The downside is modifying the logon script and putting the thinreg.exe on netlogon. In the guide I recommend thinreg in the windows directory and GPO based logon script for manageability via GPO rather than needing to be a logon script jockey. You can do either way, whatever is best for you and your environment.
4. Assigning Apps to new users doesn’t require modifying the package. You simply add the user to the AD group you specified during the setup capture process. Thats why I recommend creating an AD group called “THinApp MS Office” so you just add a user to an AD group and then they get access. This is the recommended method for any app delivery technology – I did the same thing as a Citrix admin so that I wouldn’t have to re-edit the properties of my published app every time I wanted a user to ‘get’ access to that app.
5. You will find when looking at other AppVirt products that we are the only successful product that doesn’t require an ‘installation’ , so you are defnly focused on the right word for your comparison.
April 4th, 2010 at 6:58 pm
Thanks for the review of the post Aaron.
I suppose it is a bit unclear to me then how ThinApp is agentless if it reguires ThinReg to register the application to the OS. and if its optional – guess that would mean that you would get file type associations or shortcuts on the end users desktops. So they would have to find the executable on their own to launch the application then? In simple terms that just seems like an agent of sorts.
I also understand there are other Application Virtualization products too, that use an agent in order to push/pull the centralized management server for new applications and user/group assigments and but actually don’t use the agent to execute the package. This allows packages to be pushed to users within a couple of minutes rather than requiring a logoff/logon or a refresh of the AD GPOs. These can also deliver applications on USB, network, CD-ROM in a single agentless package if desired.
As far as having the ability to use use a GPO to deploy ThinReg, that is a great option. But if you are going to use a GPO to deliver the ThinReg.exe to the ‘Windows’ directtory and register applications, you could also deploy a 1-2 MB agent using GPO deployment, or a configuration management product to deploy the agent to physical and virtual machines. I don’t really see a bing difference here in deploying an agent or the ThinReg.exe file.
I do realize that best practice dictates that you creat a new Group for a virtual app and add users to the group. It doesn’t happen often, but when consulting in the past, I have hired to redesign AD Sites, OUs, Groups, and GPOs. It’s nice to have the flexibility to easily add new groups such as role based groups directly to a network share and application rather than having to nest groups. It’s not a huge deal having to create application groups and add users/groups to that application group, but I do like flexibility in that area.
The last point, I guess it’s a matter of opinion on how you define installation. Maybe your marketing department defines ThinApp as not requiring and installation, but technically registering apps with ThinReg and deploying ThinReg to the ‘windows’ directory (optional of course) is an installation. If is was not an installation or an agent, it would not be required at all. There are other Virtualized Application technologies other than vmware that are quite popular that are agentless as well. They have been in business or years, so I’m sure they would consider themselves successful.
Anyway, thanks for the feedback.
April 21st, 2010 at 1:51 pm
Disclosure: I am the Director of Marketing at InstallFree…
InstallFree took a different approach to App Virtualization which enables us to fully integrate virtual applications into the host OS without modifying the OS in any way. We can also manage application assignments to users, computers, or any other AD object without modifying the packages.
While we do require a client agent to reside on each managed machine, the agent itself is a virtual application that runs completely in user mode, does not create any system services and does not require admin level privileges. This way, we can provide full manageability while still allowing end users to run virtual applications practically from anywhere.
More information at our web site.