Process interception for unmanaged shortcuts

Workspace Control can intercept processes started through unmanaged shortcuts, and treat them as managed applications. Process interception for unmanaged shortcuts detects when a process starts and checks whether a managed application that uses the same process is available to the user. If such a match is found, then all the settings and configurations for the managed application are applied before the intercepted process is allowed to continue.

For example, in a session where Microsoft Word is available as a managed application, a user finds and double-clicks an unmanaged shortcut to Microsoft Word. This launches winword.exe and Workspace Control intercepts it. Workspace Control first checks that Microsoft Word is allowed to start, based on date and time restrictions, maximum number of instances, licensing etc. If so, Workspace Control applies the settings and actions configured for Microsoft Word, such as User Settings, Drive and Port Mappings and Environment Variables. As a result, Microsoft Word starts up with all its familiar Workspace Control configurations for the managed application Microsoft Word.

Configuration

Under Composition > Applications > Settings tab, the option Disable process interception for unmanaged shortcuts determines whether Workspace Control intercepts any processes at all. This option can be set for the global Workspace Model and for Workspace exceptions.

To start using process interception, clear the global option Disable process interception for unmanaged shortcuts, then configure individual managed applications to intercept their processes if started unmanaged. This is determined by the option If managed shortcut was not used, found under Properties > Shortcuts tab > Automatic shortcuts. From the drop-down menu, select one of the following settings:

  • Ignore
    The process starts without any configuration by Workspace Control.

  • Intercept new process and apply configuration
    Workspace Control intercepts the process and applies the configuration defined for the managed application.

If a process is intercepted that matches several available managed applications, Workspace Control applies the settings and configurations of the first managed application it finds. This occurs if there are multiple configurations of the same managed application.

If users start several processes that are intercepted, Workspace Control applies configurations on them one at a time.

Processes started from unmanaged shortcuts continue without any Workspace Control configurations in the following situations:

  • If there are no managed applications available in the user session for the same process.

  • If the managed applications are not configured to intercept unmanaged shortcuts.

  • If process interception for managed shortcuts is disabled.

Ivanti recommends to not enable process interception for system processes or background services. These applications are programs already available on the operating system, such as explorer.exe, svchost.exe or executables running for background services.

Process interception can be enabled for Citrix or Microsoft TS RemoteApp published applications:

To use process interception for Citrix published applications, under Administration > Agents, set the option Run Workspace Composer to Automatic for servers running Citrix XenApp. If unmanaged Citrix published applications are started on these servers, they are always launched by the Workspace Composer. Managed applications using the same processes are intercepted if they have the If managed shortcut was not used option set to Intercept new process and apply configuration.

To intercept Microsoft TS RemoteApp published applications on servers hosting these applications, follow these steps:

  1. Make sure that the Workspace Composer (pfwsmgr.exe) is started when users log on.
    For example, when users log on using the Microsoft Group Policy: Custom user interface.

  2. Configure the Workspace Control registry value XenDesktop7Intercept.

Managed applications using the same processes are intercepted if they have the If managed shortcut was not used option set to Intercept new process and apply configuration.
Using process interception, Workspace Control can be implemented into an existing environment without republishing previously created TS RemoteApp published applications.

  • If for managed applications, under Security > Authorized Files tab, the option Only Workspace Control is allowed to launch this application is checked, users are able to start the processes only using the managed application shortcuts.

  • Process interception for unmanaged application shortcuts is not supported for virtualized applications such as Microsoft App-V 4.x or VMware ThinApp.

  • When using process interception for unmanaged application shortcuts, application environment variables cannot be used in the Target field of the unmanaged shortcut to that application.