Workspace Control 2022.1 (10.8.0.1)

The Workspace Analysis tool is now enhanced with the option to refresh user event logs.

Open the Workspace Control Console and navigate to Diagnostics > Workspace Analysis or User Sessions. From the right-side pane, open the Workspace Analysis tool for a user from the list. In the Workspace Analysis window, navigate to Diagnostics > Event log.

To refresh the event log, use one of the following methods:

• Select an event log and press F5.

• In the main menu bar, select Action > Refresh.

• Right-click on an event log in the left-side navigation menu, or right-click on any log entry in the right-side pane, and then select Refresh from the context menu.

This feature request can be found on Ivanti Ideas.

To prevent end-users on Workspace Control Agents from editing Windows settings, select the Prohibit access to Control Panel & PC Settings option from within the Workspace Control Console, under Composition > Desktop > Lockdown and Behavior > Settings tab, in the Start Menu and Taskbar section.

Deselecting the option grants end-users access to the Windows Control Panel and PC Settings.

This option is applicable only for Microsoft Windows 10 or later operating systems.

This feature request can be found on Ivanti Ideas.

Authorized Owners increases the security of your Workspace Control environment by not allowing untrusted software to run. Untrusted software is software that is not installed by company authorized entities, such as administrators or automation accounts.

Authorized Owners is based on NTFS ownership and enables administrators to allow applications to be started only if the file owner of the executable matches the configured NTFS owner. Workspace Control checks executables to ensure that their ownership matches the configured authorized owners. If end-users launch an application and the NTFS file owner of the executable is not found in the list of authorized owners, then Workspace Control blocks the application from starting.

When enabling the Authorized Owners feature, the following authorized owners list is evaluated before Workspace Control allows an application to start:

• NT AUTHORITY\SYSTEM

• BUILTIN\Administrators

• .\Administrators

• NT Service\TrustedInstaller

To enable the Authorized Owners feature, open the Workspace Control Console and navigate to Security > Authorized Owners > Settings tab. Set the Authorized Owners option to Enabled and then select Save Settings from the main menu bar.

The Authorized Owners feature will be expanded with additional functionality in a future release, including adding and removing owners, adding and editing administrative notes, and configuring Workspace Containers.

This feature request can be found on Ivanti Ideas.

The log information found under the Log tab for the following Workspace Control nodes can now be exported as CSV files:

• Security > Applications > Managed Applications

• Security > Applications > User Installed Applications

• Security > Applications > Websites

• Security > Data > Removable Disks

• Security > Data > Files and Folders

• Security > Data > Read-Only Blanketing

• Security > Authorized Certificates

• Security > Network Connections

To export the information found under the Log tab as a CSV file, follow these steps:

1. Right-click on any entry and then select Export to file from the context-menu.

2. Select a location where to save the CSV file, enter an appropriate name for the file and then select Save.

Security logs can also be exported using the pwrtech command-line option:

pwrtech.exe /exportlog /type=<Workspace Control node> /output=<output filepath> [/outputtype=csv] [/start=<start date>] [/end=<end date>]

For example:
pwrtech.exe /exportlog /type=application /output=C:\export\managed_apps.csv /outputtype=csv /start=20161130 /end=20180523

/outputtype, /start and /end are optional parameters. If /outputtype is not specified, then the security logs are exported as XML files instead of CSV files.

For more details on pwrtech.exe /exportlog, see the Workspace Control Administration Guide.

This feature request can be found on Ivanti Ideas.

Event Logs can now be exported as CSV files. To export event logs, open the Workspace Control Console, navigate to Diagnostics > Workspace Analysis > Analysis tab and double-click on a user. This opens the Workspace Analysis for the selected user. In the Workspace Analysis window, navigate to Diagnostics > Event Log.

• To export all event logs:

  • Right-click on the Event Log node in the left-side navigation menu and then select Export to file from the context menu. Select the location where to save the CSV files and select OK.

  • Select the Event Log node in the left-side navigation menu and then in the main menu bar, select Action > Export to file. Select the location where to save the CSV files and select OK.

  Each individual event log is exported as a separate CSV file.

• To export specific event logs:

  • Right-click on a specific event log in the left-side navigation menu and then select Export to file from the context menu. Select the location where to save the CSV file and select OK.

  • Select a specific event log. Right-click on any log entry in the right-side pane and then select Export to file from the context menu. Select the location where to save the CSV file and select OK.

This feature request can be found on Ivanti Ideas.

Event Logs can now be searched to find specific events. To search event logs, open the Workspace Control Console, navigate to Diagnostics > Workspace Analysis > Analysis tab and double-click on a user. This opens the Workspace Analysis for the selected user. In the Workspace Analysis window, navigate to Diagnostics > Event Log.

To search event logs for a specific event, use one of the following methods:

• Select an event log or select any log entry in the right-side pane, and then press CTRL + F.

  Use F3 to continue the search and find the next occurrence of the searched criteria.

• Select an event log and then in the main menu bar, select Action > Search.

• Right-click on an event log in the left-side navigation menu, or right-click on any log entry in the right-side pane, and then select Search from the context menu.

This feature request can be found on Ivanti Ideas.

The Search option for the Application List now accepts more search options. The option is found in the Workspace Control Console, under User Context > Applications > Application List tab and accepts the following search criteria:

• Application ID — Workspace Control searches for application IDs that exactly match the entered criteria.

• Application Title — Workspace Control searches for application titles that contain the entered criteria.

• Administrative Note — Workspace Control searches for administrative notes that contain the entered criteria.

• Application GUID — Workspace Control searches for application GUIDs that contain the entered criteria.

  Enter at least six (6) consecutive characters that are part of the application GUID. When entering less than six characters, the search does not filter based on the application GUID. This prevents incorrect results when searching based on the application ID.

For more details and examples on how to use the Search option, see Workspace Control Administration Guide.

This feature request can be found on Ivanti Ideas.

In the Workspace Control Console, under the Security > Applications > Managed Applications > Application List tab, the number of displayed applications can now be limited to only the first 100 entries.

By default, the Show 100 entries only option is selected and the Workspace Control Console shows only the first 100 entries when opening the Managed Applications node. To view all the applications, deselect the checkbox next to the Show 100 entries only option.

• Selecting Show all application-level authorized executables disables the Show 100 entries only option. To re-enable the Show 100 entries only option, first deselect the Show all application-level authorized executables option.

• The Show 100 entries only option is always enabled when navigating to the Managed Applications node, except when the Show all application-level authorized executables is already configured.

This feature request can be found on Ivanti Ideas.

To configure Workspace Control to ignore a specific IP range or IP address when sending client IP addresses to the Datastore, create the following registry setting (string value):

For details on how to configure the registry setting, see the Ivanti Workspace Control Administration Guide.

Additional information is found in this KB article.

The security of the Ivanti Neurons for Edge Intelligence integration with Workspace Control has been improved.

When configuring Zones in the Workspace Control Console, under User Context > Locations and Devices, an IP address check is now implemented for Rules to prevent incorrect IP configurations that can result in undesired behavior, such as mapping the wrong network drives or printers. The check verifies if the entered IP address is composed of four digit groups, and that each digit group is between 0 and 255.

This applies to the following Zone Rules:

• Computer > IP address > IP address/IP address range

• Network > IP address > IP address/IP address range

• Remote Desktop > IP address > IP address/IP address range

Wildcards can still be used when entering an IP address.

The following fields found in IP address range Zone Rules have been renamed to better reflect their functionality:

• IP address starts at was renamed as IP address range start at

• IP address ends at was renamed as IP address range ends at

The Blacklisting and Whitelisting options in Workspace Control are now renamed to Deny and Allow respectively. This changes occurred in the Workspace Control Console for the following options:

• Security > Applications > User Installed Applications > Settings tab > Software installations.

• Security > Applications > Websites > Settings tab > Security method.

• Security > Authorized Certificates. Open a certificate and in the Authorize Certificate window > Mode.

• Security > Network Connections > Settings tab > Security method.

In Workspace Control sessions, Citrix published applications are started as separate full-screen sessions without a taskbar. When such applications are closed, Workspace Control also closes the session. To prevent the session from closing while sub-processes started by the application are still running, Workspace Control compares the processes running at session end against the processes running at session start. If Workspace Control finds additional running processes, the session remains opened.

When enabled, the option applies to all Workspace Control managed sessions.

To exclude processes from preventing Workspace Control to close the session, open the Workspace Control Console and then, from the main menu bar, select Setup > Advanced Setup. Select the Exclude processes from blocking the logoff sequence option. Configure the processes to be excluded and then select Save Settings from the main menu bar.

Process names must follow these rules:

• Be up to 255 characters in length.

• Contain only alphanumeric characters.

• End in .exe as the extension.

For example: crss.exe.

The session now ends even if the excluded processes are still running.

If the ExcludeProcesses registry setting is already configured in your Workspace Control environment, enabling the Exclude processes from blocking the logoff sequence option overrules the registry setting.

The Logon Performance node displays statistics regarding Workspace Control session logons. If the feature is enabled, Workspace Control Agents send logon information to the Datastore when a Workspace Control managed session is started.

To enable the feature, open the Workspace Control Console and navigate to Diagnostics > Logon Performance > Settings tab. Set the Logon Performance option to Enabled and then select Save Settings from the main menu bar.

Every time a Workspace Control managed session is started and the logon process starts, the following information is visible in the Workspace Control Console, under the Log tab:

• Boot time — the date and time when the machine was powered on.

• Windows logon time — the date and time when the user logged onto the Windows operating system and the Windows session started.

• Session start time — the date and time when the Workspace Control managed session started.

• Computer — the machine where the Workspace Control managed session started.

• User name — the user that started the Workspace Control managed session.

• Logon duration — the duration of the Workspace Control logon process.

• Desktop session — whether or not the Workspace Control managed session was started on as a desktop session or as a published application.

The capability of Workspace Control to detect proxy settings has been improved. The improvement applies to activating Workspace Control licenses through a proxy server.

Workspace Control can now be configured to replace the Start Menu of Microsoft Windows 11 with the Ivanti Start Menu.

To enable the Ivanti Start Menu on Workspace Control Agents, open the Workspace Control Console, navigate to Composition > Desktop > Lockdown and Behavior > Settings tab. Navigate to the Microsoft Windows Shell section, check the box next to Enable Ivanti Start Menu (Windows 8.1/11/2012 R2) and then select Save Settings from the main toolbar.

The Ivanti Start Menu for Windows 11 is compatible with all the configuration options found in Composition > Applications > Settings tab. For more details, see the Workspace Control Administration Guide.

The Authorized Owners feature has been enhanced with the following capabilities:

• Configured authorized owners are visible under the Authorized Owners tab.

• New authorized owners can be added.

• Existing authorized owners can be removed.

• Option to enable or disable specific authorized owners.

• Administrative notes can be added to authorized owners. They can also be edited.

• The Authorized Owners feature can be enabled or disabled for specific Workspace Containers.

The Authorized Owners feature is found in the Workspace Control Console, under Security > Authorized Owners. For more details on how to configure the feature and its new enhancements, see Workspace Control Administration Guide.

The following limitations apply:

• The current implementation of Authorized Owners ignores other Workspace Control application security features, such as managed applications security, found in the Workspace Control Console, under Security > Applications > Managed applications.

• Azure Active Directory accounts cannot currently be configured as authorized owners.

These limitations will be addressed in future Workspace Control 2022 versions.

The list of managed applications can now be exported as a CSV file. The applications are visible in the Workspace Control Console, under Composition > Applications > Application List tab.

Right-click in Application List pane and select Export to file from the context menu. In the Export to file window, select a location where to export the managed application list, enter a name for the CSV file in the File name field, and then select Save.

Use Search to filter the application list. Exporting the list after filtering only exports the search results, and not the entire list of applications.

By default, Workspace Control queries all configured Directory Services when retrieving user information for diagnostics purposes. For example, using Workspace Analysis to collect information about user sessions. Directory Services are configured in the Workspace Control Console, under User Context > Directory Services.

Create the following string value to disable the query of all configured Directory Services.

In the Workspace Control Console, under Security > Applications > Managed Applications, if the Show all application-level authorized executables option is selected, Workspace Control displays all managed applications every time the Managed Applications node is accessed. This behavior can take up to several minutes depending on the number of configured managed applications.

Create the following string value to deselect the Show all application-level authorized executables option every time the Managed Applications node is accessed, even if the option is already selected. This reduces load times by configuring Workspace Control not to display all managed applications.

The User Settings template used to capture the settings for Adobe Acrobat Professional DC is now enhanced with additional capture items:

• File — %APPDATA%\Adobe\AdobeUserInfo

• Folder tree — %APPDATA%\Adobe\OOBE

• Folder tree — %APPDATA%\Adobe\SLData

• Registry tree — HKEY_CURRENT_USER\Software\Adobe

The Adobe Acrobat Professional DC template is found in the Workspace Control Console, under Composition > User Settings > User Settings tab. Right-click in the right-side pane and from the context menu, select New > Templates > Other Applications > Adobe Acrobat Professional > DC.

Multiple configuration settings throughout the Workspace Control product have been renamed. Settings that contained Log on or Log off have been changed to Sign in and Sign out, respectively.

For example, the following are some of the settings that have been renamed in the Workspace Control Console, under Composition > Desktop > Lockdown and Behavior.

• Workspace Composer section:

  • Always hide "Log Off" in context menu was changed to Always hide "Sign out" in context menu.

• Workspace Control Shell section:

  • Do not show welcome message after log on was changed to Do not show welcome message after sign-in.