Hotfix Package 5 for Microsoft Application Virtualization 5.0 Service Pack 2

Summary

This article describes a hotfix package that contains the latest hotfixes for Microsoft Application Virtualization 5.0 (App-V 5.0) Service Pack 2 (SP2).

Note We recommend that you test hotfixes before you deploy them in a production environment. Because the builds are cumulative, each new hotfix release contains all the hotfixes and all the security fixes that were included with the previous update package. Therefore, this hotfix package also includes fixes released in hotfix 2934349 and hotfix 2956985. Because of the number and significance of the updates that were released in hotfix 2956985, we strongly recommend that you test extensively before you deploy this hotfix package into a production environment.  We recommend that you consider applying the most recent fix release that contains the most necessary hotfixes.

This hotfix package fixes the following issues.

Issue 1: Connection groups cannot support both user-published and global-published packages

App-V 5.0 SP2 does not let you create user-entitled connection groups that contain both user-published and global-published packages.

With this hotfix release, App-V 5.0 SP2 supports creating user-entitled connection groups that contain user-published and global-published packages by using Windows PowerShell.

To create a user-entitled connection group that contains user-published and global-published packages, follow these steps:

1. Add and publish packages by using the following commands:
    

   Add-AppvClientPackage Pacakage1_AppV_file_Path
   
   Add-AppvClientPackage Pacakage2_AppV_file_Path
   
   Publish-AppvClientPackage -PackageId Package1_ID -VersionId Package1_Version ID -Global
   
   Publish-AppvClientPackage -PackageId Package2_ID -VersionId Package2_ID

2. Create the connection group XML file. To learn about how to do this, see How to Use Connection Groups on a Standalone Computer Using PowerShell on the Microsoft TechNet website.

3. Add and publish the connection group by using the following commands:
    

   Add-AppvClientConnectionGroup Connection_Group_XML_file_Path
   
   Enable-AppvClientConnectionGroup  -GroupId CG_Group_ID -VersionId CG_Version_ID

Note Connection groups that contain user and global packages are currently not supported through the App-V server.

Issue 2: Enabling user-publishing in the Administrator context through Windows PowerShell

This hotfix release enables user-publishing to be done in the Administrator context through the following four Windows PowerShell cmdlets:

• Publish-AppVClientPackage

• Unpublish-AppVClientPackage

• Enable-AppVClientConnectionGroup

• Disable-AppVClientConnectionGroup

To do this, use the optional -UserSID parameter, and pass in the SID of the intended user. Administrator user rights are required to use this optional parameter. This cmdlet can be run in the user session or from the administration session. However, for the operation to succeed, the user has to be logged in. Or, the user's profile should exist on the computer.

Note There is no change to the Windows PowerShell cmdlets that are supported today, and these will continue to function as they currently do.

Issue 3: Deprecation of PackageStoreAccessControl support in App-V 5.0 SP2

Effective immediately, the PackageStoreAccessControl (PSAC) setting that was introduced in App-V 5.0 SP2 is being deprecated in both single-user and multiuser environments.

The PSAC setting has been unsupported in multiuser environments since the first hotfix package for App-V 5.0 SP2, but PSAC deployment in single-user environments was supported until now. If you deployed PSAC to single-user environments, remove the configuration option from any deployments.

The scope of application entitlement enforcement in App-V will be reviewed and addressed as appropriate in a future release.

To address App-V application entitlement concerns, you can use the following features that are available today in App-V 5.0 SP2:

• By default, the location in Windows where App-V stores applications, %ProgramData%, is a hidden folder that most users will not understand how to browse. You can use this hidden folder that has the "Pending Unpublish" feature in App-V 5.0 SP2 to reduce some entitlement concerns.

• To prevent your end-users from copying shortcuts and executables from the Program Data folder, consider the following:

  • User-copied shortcuts cannot be used to start an App-V application if the user does not have permissions to the package.

  • Copying executables from Program Data will not let users run the application outside an App-V environment, except for simple applications without any subsystems or integration.

Resolution

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

References

Learn about the terminology that Microsoft uses to describe software updates.