Client: Using a ProfileDisk While Also Requiring CAC Authentication

You have two options when using a ProfileDisk while also requiring CAC authentication. Each is explained below, with the first one being the recommended method.

Option 1: Use the local computer account for ProfileDisk file access operations (Recommended)

This option involves the following tasks:

  1. Change the path for ProfileDisks to a common location
    1. Modify the ProfileDisk path under Administration and make sure to update and download ClientSettings.xml using the following as guidance:
      • From example:
      • Copy
        \\server\share\%username%\VHDX-ProfileDisk\%username%.vhdx
      • To example:
      • Copy
        \\server\ProfileDiskShare\%username%_ProfileDisk\%username%.vhdx

      • Note: The path should reside outside of the folder containing all the user profiles.

    2. Open your Computer Group Policy for ProfileUnity.
    3. Navigate to Computer Configuration > Administrative Templates > Classic Administrative Templates > Liquidware Labs > ProfileUnity.
    4. Under BOTH 32-bit and 64-bit sections, set ProfileDisk System Mount Unmount setting to Enabled.
    5. Set the "Domain Computers" group to have access to create/read/modify on the share and folder that contains the ProfileDisk VHDX files. Similar to following this knowledge base article "What are necessary NTFS Permissions on user's home directory? (Storage Path)."
  2. Enable Logon Notification Events for SmartCard-based logons
  3. On the master image or pushed to persistent machines via a GPO AND rebooted, we need to verify or create the following registry value if it does not exist:

    4. Key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

    Type: DWORD

    Value: SmartCardLogonNotify

    Data: 1

Option 2: Use an Active Directory service account for ProfileDisk file access operations

Note: This service account option cannot be used if the Secondary Logon service is disabled. If that is the case, use Option 1 above.

Another method is to use an Active Directory service account for ProfileDisk file access operations.

  1. Create a Service Account to use for ProfileDisk file access
    1. In Active Directory, create an account or don’t and instead use an existing account.
    2. Make sure the service account has at least Read/Write permissions on the share where the ProfileDisks are to be stored. Consider a location that contains only ProfileDisks, as outlined in Option 1, above.
    3. In the ProfileUnity Management console, hover over your username in the top right corner of the screen.
    4. In the drop-down menu that appears, click Administration.
    5. The Administration screen opens with the Settings tab displayed.
    6. Scroll down to ProfileUnity Tools section.
    7. Add relevant service account info and click the Download or Deploy Service Configuration button. Choose where to place the LwL.ProfileUnity.Client.Service.exe.creds file to the share or netlogon folder where the ProfileUnity client tools (ini path) reside.

      Note: If the password for this account expires or changes you will need to repeat this process. Consider acquiring two service accounts that can be rotated when password changes are required.

    8. Ensure that startup.exe in that same path of the creds file gets executed by the pool/machines on boot as a startup script in the ProfileUnity Computer GPO. It does not need to be re-run on the master image unless you are using Instant Clones in Horizon.
  2. Enable CAC authentication
    1. Open your Computer Group Policy for ProfileUnity.
    2. Navigate to Computer Configuration > Administrative Templates > Classic Administrative Templates > Liquidware Labs > ProfileUnity.
    3. Under BOTH 32-bit and 64-bit sections, set ProfileDisk VHD CAC support to Enabled. As with CAC logins, Kerberos pass-through also requires a setting so we know to impersonate the ProfileUnity as a Service user when connecting to the file share.
  3. Enable Logon Notification Events for SmartCard-based logons
  4. On the master image or pushed to persistent machines via a GPO AND rebooted, we need to verify or create the following registry value if it does not exist:
  5. Key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
  6. Type: DWORD
  7. Value: SmartCardLogonNotify
  8. Data: 1