Ebook The Ultimate Guide to Managing Apps in Citrix XenDesktop VDI Some IT organizations assume that Citrix XenApp is the only way to virtualize and manage applications for Citrix XenDesktop VDI. But there are actually 5 different ways to manage application lifecycles for virtual desktops. This ultimate guide lists the pros, cons, and ideal use cases for each method so you can make an informed decision. Ebook 1
Executive Summary The decision between shared hosted desktops and published apps with Citrix XenApp or full virtual machines for every user with Citrix XenDesktop used to be pretty clear. However, new application layering innovations that deliver unique apps and personalization in real-time to every XenApp user has blurred the line between traditional server-based computing (XenApp) and VDI (XenDesktop). A new Citrix XenApp vs XenDesktop decision tree now gives Citrix customers more options and flexibility than ever before. Those that choose XenDesktop to give virtual desktops to every user have another major decision to make: how to virtualize and manage their apps. Some automatically assume that XenApp is the only answer. Citrix's naming scheme certainly encourages this thinking. But does it really make sense to build and manage two hosted Windows workspace solutions one to deliver desktops and another to deliver apps? Also, should users really be forced to make a double hop network connection to first access hosted desktops, then again to access hosted applications? This Ebook examines the 5 ways to manage apps in XenDesktop VDI, lists the pros, cons, and ideal use cases for each method, and provides a summary table at the end to help you compare all 5 options. Ebook 1
#1: Streaming Apps with Citrix XenApp For organizations that are already using Citrix XenApp for shared hosted desktops or published applications, continuing to use XenApp for managing and delivering apps in XenDesktop VDI is a viable option. For organizations that have no existing XenApp infrastructure, skillsets, or experience, it is much harder to make a case for implementing two separate hosted Windows workspace solutions one to deliver desktops (XenDesktop) and another to deliver apps (XenApp). Pros Apps can be published or streamed to physical PCs and other endpoint devices without needing virtual desktops. Apps can be centrally managed, patched, and updated once, instead of having to install them locally on each desktop. Apps can be managed and delivered the same way for both physical and virtual workspaces. Cons Apps must be compatible with the Windows Server operating system, which is used by XenApp to deliver both shared hosted desktops and published applications. Additional server and storage infrastructure will be needed to support two hosted Windows workspace solutions XenApp for apps and XenDesktop for desktops increasing up-front capital costs. Advanced IT expertise will be needed to build and manage two hosted Windows workspace solutions XenApp for apps and XenDesktop for desktops increasing ongoing operational costs. Even though both solutions are built on the Citrix Flexcast Management Architecture (FMA) and use Citrix Studio for management, it is well known that the XenApp and XenDesktop environments are very different, requiring extensive training and deep skillsets. A double-hop network connection will be required for XenDesktop users to, first, access their hosted virtual desktops and, second, to access their hosted XenApp Ebook 2
applications. Extra network hops add latency that impacts application performance. Delivering one-off and departmental apps that are used by small numbers of users with XenApp will be expensive and difficult unless application layering technology is used. The same advanced IT skillsets and lengthy setup times that are needed to publish apps used by all users will also be required for the one-off apps. New XenApp server silos will have to be built to avoid licensing one-off apps to every user, increasing infrastructure cost and complexity. Image management overhead will increase. IT will now have to patch and update the Windows Server operating systems on every XenApp server as well as the Windows desktop operating systems on every XenDesktop virtual desktop. Apps delivered natively through XenApp cannot be easily migrated to the cloud. Ideal Use Case Using XenApp to stream applications to XenDesktop VDI may be appropriate if: You already have XenApp deployed. You have XenApp skillsets on staff and your IT project backlog is small enough that you can use senior IT administrators for application and image management. Your users all use the same small number of apps, and don t require one-off or departmental apps on a per user or per group basis. You have physical desktops that will be used for local computing (not just for VDI access) for the foreseeable future. Your network is fast enough to support the double hop connections required to access remote Windows applications from remote Windows desktops with satisfactory performance. You have no near-term plans to migrate your desktop applications to the cloud. Ebook 3
#2: Installing Apps with PC Management Tools Many IT organizations already use agent-based software distribution solutions to simplify application management for their physical PCs. Microsoft System Center Configuration Manager (SCCM), LANdesk, Symantec Altiris, IBM Big Fix, and Shavlik Patch are some of the most common ones. These legacy tools are sometimes pulled into Citrix XenDesktop VDI environments, usually when deadlines are tight and the fastest way to deploy virtual desktops is to simply provision full-sized VMs for every user. However, this first-generation VDI approach of treating virtual desktops like physical PCs inevitably becomes problematic at scale. Pros The same application packaging skillsets can be used for XenDesktop VDI and physical PCs. Apps can be managed and updated the same way for both the physical PC environment and the XenDesktop VDI environment. Cons Deploying full-sized virtual machines for every XenDesktop user is often prohibitively expensive due to the amount of costly datacenter storage required. The 40-80 GBs of disk space that costs less than US $1/GB on a stand-alone physical PC typically costs US $5-12/GB in shared SAN storage. For 2,000 desktops, that can amount to $1 million in additional storage costs alone. Advanced IT expertise will still be needed to package applications, build MSIs, and write scripts, increasing ongoing operational costs. The impact of agent-based tools on virtual machines and shared storage is severe. The agent-based software distribution model was designed for standalone PCs, and presumes full access to all resources. When an application is pushed and installed by an agent, it may use 20% of CPU and average 150 IOPS for 10 minutes. Imagine this in a XenDesktop VDI environment with 100 VMs per host. If all receive the software update at the same time, the server CPU, the shared storage, and the connection to the shared storage may be swamped, causing VMs to fail or blue-screen. At the very least, users will be negatively impacted, or capacity will have to be over-provisioned to avoid Ebook 4
impacting users. Delivering one-off and departmental apps that are used by small numbers of users with agent-based software distribution will be expensive. The same advanced IT skillsets and lengthy packaging times that are needed to create MSIs and test changes for broadly distributed apps will also be required for the one-off apps. Software update failure rates and service escalations will be perpetuated. Agent-based software updates are known to fail 1-5% of the time due to change in PC configurations, DLL conflicts, and user personalization. Every major software update typically results in service tickets that require manual diagnosis and break/fix by Tier 2 and 3 IT staff. Gartner estimates that each service ticket costs $250-400 to resolve. Using the same agent-based tools in XenDesktop VDI will continue this cycle. There is no easy way to rollback bad patches or updates. Even when IT does a comprehensive job testing new software releases, unforeseen issues will occasionally crop up when the software is deployed. With agent-based software installations, new uninstall packages or batch files will have to be created to back out changes. Or, Tier 2 and 3 IT staff will have to spend time manually editing the registry or uninstalling programs. Either way, the user downtime that results will negatively impact productivity and revenue. Apps installed using PC management tools cannot be easily migrated to the cloud. Ideal Use Case Using PC management tools to install applications for XenDesktop VDI may be appropriate if: You already have a PC management tool in use. You have MSI and packaging skillsets on staff and your IT project backlog is small enough that you can use senior IT administrators for application and image management. You have a large enough IT budget to absorb the high storage costs of full-sized images and 1:1 persistent desktops. You have physical desktops that will be used for local computing (not just for VDI access) for the foreseeable future. You have enough service desk staff and IT administrators to respond quickly to the patch failures that result from using agent-based installation tools. Ebook 5
Your desktop apps aren t critical to your business and you can afford occasional user downtime. You have no near-term plans to move your desktop applications to the cloud. Ebook 6
#3: Virtualizing Apps with Process Isolation Traditional application virtualization was originally thought to be the answer to all application management issues in VDI. By using tools such as Microsoft App-V and VMware ThinApp to isolate applications in their own protective process bubbles, effectively hiding them from the Windows OS and each other, the need for resource-sapping agent-based installations could be eliminated and software updates would always work. The market now realizes this is not the case. First-generation application virtualization tools are excellent at enabling two versions of the same application to run on the same machine at the same time (e.g. multiple versions of Java or a web browser). However, they were never designed to be mass software distribution tools that could deliver and update every application. Pros Repetitive software installations can be eliminated, creating an install-free XenDesktop VDI environment. The same package can be delivered to 1, 100, or 10,000 machines without the failures or resource impact of agent-based software distribution. Conflicts with other applications and the Windows OS can be avoided, enabling multiple versions of the same app to run on the same machine. Cons Many apps are not compatible with the process isolation approach of traditional application virtualization tools. The last 30% of apps must be delivered in other ways. Typically this means baking them into the gold image, which results in gold image sprawl and increased Windows patching costs. Advanced IT expertise is needed to virtualize apps. Machine staging, app sequencing, pre-scans, post-scans, scripting workarounds, and Windows registry changes to work around process isolation can take several hours for even basic apps. Complex apps can take a week or more to package, driving up operational costs. Delivering one-off and departmental apps that are used by small numbers of users will be expensive and difficult. The same advanced IT skillsets and lengthy setup times that are needed to virtualize apps used by all users will also be required for the one-off apps. The result will be manual installations on individual machines or extra gold Ebook 7
images to bake in these one-off apps, which will increase image management costs. Isolating apps may be good for avoiding conflict, but it is bad for the majority of apps that do not need to be isolated, and that need to share data, link to each other, and cross-communicate. If apps that require interoperability are sequenced in the same package, the result will be very large packages that need to be re-sequenced every time one of the apps in the package changes. If IT pokes holes in the isolation bubbles so that the apps can see each other, it will add even more packaging time to an already lengthy and time-consuming packaging process. It also ups the expertise requirements and operational costs, as packagers will need line of business knowledge to know which apps need interoperability. Apps virtualized using process isolation technologies cannot be easily migrated to the cloud. Ideal Use Case Using process isolation technology to virtualize apps for XenDesktop VDI may be appropriate if: You have many applications that require different versions to be running on the same virtual desktop at the same time. Your applications do not cross-communicate or depend on each other (e.g. no requirements for plug-ins, object linking and embedding, copy/paste, etc.). Your users all use the same small number of apps, and don t require one-off or departmental apps on a per user or per group basis. You have virtualization skillsets on staff and your IT project backlog is small enough that you can use senior IT administrators for application and image management. You have no near-term plans to migrate your desktop applications to the cloud. Ebook 8
#4: Bundling Apps Into Multiple Gold Images Many XenDesktop VDI projects start with bundling apps into the gold image. This is the easiest method of app delivery, and is often used during VDI proofs of concept to gauge end user reactions to hosted virtual desktops. However, as soon as different users need different apps, this approach doesn t scale. Pros Easy and fast. IT administrators simply install the apps with Windows and push the image out. All apps can be delivered in this manner, with none of the limitations of application virtualization. There is little resource impact, since every user gets the same image without agentbased installations. Cons There is no personalization. Every user gets the same apps. Real world XenDesktop VDI deployments almost always require different apps for different users. Licensing costs skyrocket. If every user gets the same app, every user has to be licensed, even if they are not going to use the app. Image sprawl occurs. To avoid licensing every app to every user, multiple gold images are built, each with different app combinations. Instead of patching Windows and apps once each month, patches must be applied many times, greatly increasing operational costs. Patches and updates become difficult, time-consuming, and costly. Any time a single app must be updated, the entire image must be unpacked, updated, and re-packed. There is no easy way to rollback individual software patches or updates. The entire image will have to be reverted back to the previous version, undoing all changes. Ebook 9
Ideal Use Case Bundling apps as part of multiple Windows gold images may be appropriate for delivering apps in XenDesktop VDI if: Your users all use the same small number of apps, and don t require one-off or departmental apps on a per user or per group basis. You have a large enough IT budget to absorb the high storage costs of full-sized images and 1:1 persistent desktops. Ebook 10
#5: Layering Apps as Virtual Disk Containers The newest way to manage applications in XenDesktop VDI is with application layering technology. Unidesk is the market leader and the original inventor of this approach, which enables applications to be packaged independent of the Windows OS as virtual disk containers, with just an ordinary installation. A single application or a set of applications packaged in a layer can be managed once and assigned to many different virtual machines. The Windows Server operating system can also be packaged as a layer, as well as user settings and applications. Not all layering solutions are created equal, however. The following information applies specifically to Unidesk. Pros Easy and fast app delivery. Tier 1 or help desk administrators simply install apps as they would normally on a physical PC, without the need for advanced packaging expertise. All changes get captured in a read-only virtual disk. Repetitive software installations can be eliminated, creating an install-free XenDesktop VDI environment. The same layer can be delivered to 1, 100, or 10,000 machines without the failures or resource impact of agent-based software distribution. 99%+ app compatibility. All apps can be delivered with Unidesk, including system services, boot-time drivers, and custom-built apps. Unidesk app layering has none of the limitations of traditional application virtualization. Full interoperability. Unlike traditional app virtualization, which hides apps from Windows and each other and prevents interoperability, Unidesk layered apps appear locally installed. They show up as expected in Add/Remove Programs and the Windows registry. Unidesk Cross-Layer Merge technology ensures that apps and plug-ins packaged in separate layers work together seamlessly as if hand-installed on the same machine. No line of business knowledge is required to anticipate which apps need to be packaged together. No extra images to manage. Unidesk app layers can be used to provide exactly the applications required for specific departments or functional groups within an enterprise, aligning apps with precise business needs, and eliminating the overhead of Ebook 11
image management. The same Window OS layer can be used for all desktops for patchonce efficiency. Minimal resource impact. Layering creates an install-free environment in which the virtual disk layers are attached either before a virtual desktop boots, or in real-time when a user logs on. The resource overhead and over-provisioning of agent-based silent installations are eliminated. No installation failures and costly break/fix escalations. Unlike agent-based tools whose repeated installations are failure-prone, layering is consistent and reliable. If a virtual disk attachment works for one virtual machine, it will work for all of them. Instant patch rollback. Every layer is versioned, with previous virtual disk containers being stored based on policy. If a patch proves to be problematic, the help desk can simply assign the previous OS or app layer version to undo any updates. Apps and desktops are restored to working order with a simple logout/login or desktop reboot. Lengthy outages and costly downtime are avoided. Accelerates the migration to the cloud. The same application layers can be delivered across hypervisors, end user computing platforms, and clouds for maximum workload flexibility and business agility. Today, Unidesk s strategic partnership with Microsoft makes Unidesk the only solution that can be purchased from the Azure Marketplace, be hosted in Azure, and manage apps in Azure. Going forward, other cloud platforms will also be supported. Cons There is no isolation of apps. However, Unidesk is compatible with App-V and ThinApp for the small number of applications that may require isolation. Layered apps cannot be delivered to physical PCs today. While physical PC support is planned, environments that will have a mix of physical and virtual desktops for the foreseeable future will require separate management tools. Ideal Use Case Using application layering technology to manage and deliver apps for XenDesktop VDI may be appropriate if: You have many applications, with different users requiring access to different apps. You have applications that require cross-communication and that have inter- Ebook 12
dependencies (e.g. plug-ins, object linking and embedding, copy/paste, etc.). You do not have advanced packaging and virtualization skillsets on staff. Your IT project backlog is large and you need to free up senior IT administrators from spending time on application and image management. You do not have the capital budget to pay extra for storage to support full-sized disk images. You want to only have 1 Windows OS instance and 1 application instance to patch and manage to avoid image sprawl. Your desktop apps are critical to your business and you need a quick process to undo problematic updates to avoid user downtime. You plan to leverage the cloud to eliminate on-premises infrastructure for delivering desktops apps, or to implement more cost-effective disaster recovery, and you want to be able to deliver your apps to the cloud without re-packaging. Ebook 13
Summary There are five main ways to deliver apps in XenDesktop VDI environments. Each has its technical pros and cons, as well as operational and capital cost ramifications. 4 Best 0 Worst Application compatibility Application interoperability Citrix XenApp PC Management Application Virtualization Gold Image Unidesk App Layering 3 4 2 4 4 3 4 1 4 4 Application portability across hypervisors 2 4 2 2 4 Conflict avoidance (app isolation) Minimal IT staffing requirements Minimal IT skill requirements (Tier 1) Install-free reliability & resource efficiency Image reduction (1 gold OS and apps) Deployment speed (new apps & updates) Departmental & one-off apps Storage efficiency License optimization 0 0 4 0 0 1 1 1 4 4 1 1 1 3 4 2 0 4 4 4 1 0 2 0 4 1 2 2 1 4 0 1 1 0 4 2 0 2 0 4 2 4 3 0 4 Easy rollback of updates & patches 2 0 3 1 4 Integration with Citrix PVS for image delivery Extend XenApp to minimize need for VDI 4 0 0 4 4 0 0 0 0 4 Cloud support 0 0 0 4 4 Ebook 14
As the table above shows, for organizations that have diverse application requirements as well as different departments and users to satisfy, Unidesk application layering offers many clear advantages: Lowest operational cost by enabling helpdesk and Tier 1 IT staff to take on application lifecycle management. Lowest capital cost by minimizing storage, CPU, and software licensing requirements. Lowest impact on user productivity by enabling problematic software updates to be quickly rolled back with little downtime. Greatest flexibility and agility, with app layers that can be moved between hypervisors, end user computing platforms, and the cloud. This is why Gartner rated application layering to be the best way to deliver applications in VDI environments and why the Unidesk application layering platform won the Best of Citrix Synergy 2016 Award for New Technology for its ability to manage applications in both Citrix XenApp and XenDesktop environments. About Unidesk Unidesk is the leader in application packaging and lifecycle management software for the digital workspace. With Unidesk layering technology, IT organizations manage Windows desktop applications once across published desktops, published applications, and virtual desktops with unparalleled packaging simplicity and 99% application compatibility. Unidesk s hybrid management solution supports all virtualization platforms including Microsoft Hyper-V and VMware vsphere; leading cloud platforms such as Azure; and leading end user computing solutions including Citrix XenApp/XenDesktop, Microsoft VDI/RDSH and VMware Horizon. Unidesk is a privately held company headquartered in Marlborough, Mass., with 1,400 customers and solution partners around the world. Visit www.unidesk.com to learn more. Unidesk Corporation, 313 Boston Post Road West, Marlborough, MA 01752 USA Tel 508-573-7800 Fax 508-573-7801 Copyright 2016 Unidesk Corp. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. Unidesk is a registered trademark of Unidesk Corp. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. Item No: UNI-EB-ULTIMATE-GUIDE- XENDESKTOP-APP-DELIVERY -06-16 Ebook 15