> ## Knowledge Base Index > Fetch the complete knowledge base index at: https://help.trugrid.com/sitemap.xml > Use this file to discover available pages before exploring further. > Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash). # TruGrid RDSM Enterprise - Admin / End User Guide | This edition covers TruGrid RDS Manager Enterprise releases up to and including 2026.05.176. If your build number is higher, most of this guide still applies; check the release notes for anything that changed. This guide is written for administrators. Everywhere it says "you", it means the person administering the fleet. --- ### About this guide ### Who this is for This guide is for the administrator who installs, configures and runs TruGrid RDS Manager Enterprise. There is no non-administrator user of this product: the people who open the Enterprise Client are your IT staff, so "end user" and "administrator" mean the same thing here. It assumes you are comfortable with Windows Server, Active Directory and Remote Desktop Services. It does not assume you know anything about this product. ### How this guide is versioned Two version numbers appear on the cover and they mean different things: | Number | What it means | | ---- | | Guide revision (Rev 3), dated 2026-07-27 | The edition of this document. It goes up when the document changes, even if the product did not. The date is part of the file name, so you can always tell two editions apart. | | Releases covered (up to and including 2026.05.176) | The product releases this edition was written and checked against. If your build number is higher than the last release covered, most of this guide still applies, but check the release notes for anything that changed. | You can see your own build number in three places: the bottom right corner of the Data Collector Configuration app, the bottom right corner of the Enterprise Client, and the About dialog in the Enterprise Client. ### Revision history | Revision | Date | Releases covered | What changed | | ---- | | Rev 3 | 2026-07-27 | Up to and including 2026.05.176 | Third Edition. Covers installation, Data Collector setup, Access Control, AGENT deployment, all Enterprise Client pages, VM Pools end to end, upgrades, certificates and troubleshooting. Checked against releases up to and including 2026.05.176. | ### Related documents These are published on the TruGrid help site. Where they disagree with this guide, this guide is newer. | Document | Use it for | | ---- | | Installation and Setup Guide | The short version of Part 2 of this guide. | | Data Collector Service - Network Access Requirements | Firewall detail, port by port, for your network team. | | Image Management / VM Pools | The short version of Part 4 of this guide. | | Enterprise Design Guide | Sizing the Data Collector server and choosing a topology before you install. | ### How to read the instructions * File paths and service names are written out in full, like C:\ProgramData\TruGrid RDS Manager Enterprise. * Anything you are meant to type is on its own indented line, in a fixed-width font. * Button and field names are written exactly as they appear on screen, such as the Save Settings button. * Numbered lists are procedures. Do the steps in order. * "Important" boxes are things that will cost you time or data if you skip them. "Note" and "Tip" boxes are worth reading but will not hurt you. --- # In this article * [Part 1 - Understanding what you have installed](#3-part-1-understanding-what-you-have-installed) * [1.1 What this product does](#3-11-what-this-product-does) * [1.2 The four pieces](#3-12-the-four-pieces) * [1.3 How the pieces talk to each other](#3-13-how-the-pieces-talk-to-each-other) * [1.4 What the Session Host AGENT adds](#3-14-what-the-session-host-agent-adds) * [Part 2 - Installing and setting up](#3-part-2-installing-and-setting-up) * [2.1 Before you start](#3-21-before-you-start) * [2.2 Firewall and Group Policy prerequisites](#3-22-firewall-and-group-policy-prerequisites) * [2.3 Install the Data Collector](#3-23-install-the-data-collector) * [2.4 Set the service account](#3-24-set-the-service-account) * [2.5 Tell it which computers to watch](#3-25-tell-it-which-computers-to-watch) * [2.6 Decide who can sign in, and what they can do](#3-26-decide-who-can-sign-in-and-what-they-can-do) * [2.7 Review the settings](#3-27-review-the-settings) * [2.8 Optional: turn on HTTPS](#3-28-optional-turn-on-https) * [2.9 Connect with the Enterprise Client](#3-29-connect-with-the-enterprise-client) * [2.10 Deploy the Session Host AGENT](#3-210-deploy-the-session-host-agent) * [2.11 Turn on the two audit policies the AGENT needs](#3-211-turn-on-the-two-audit-policies-the-agent-needs) * [2.12 Check your work](#3-212-check-your-work) * [Part 3 - Day-to-day administration](#3-part-3-day-to-day-administration) * [3.1 Finding your way around](#3-31-finding-your-way-around) * [3.2 Dashboard](#3-32-dashboard) * [3.3 Computers](#3-33-computers) * [3.4 Users and Sessions](#3-34-users-and-sessions) * [3.5 Logon Performance](#3-35-logon-performance) * [3.6 Analytics](#3-36-analytics) * [3.7 Alerts](#3-37-alerts) * [3.8 Audit Log](#3-38-audit-log) * [3.9 How to do the common jobs](#3-39-how-to-do-the-common-jobs) * [Part 4 - VM Pools](#3-part-4-vm-pools) * [4.1 What VM Pools does](#3-41-what-vm-pools-does) * [4.2 The two kinds of pool](#3-42-the-two-kinds-of-pool) * [4.3 What you need before your first pool](#3-43-what-you-need-before-your-first-pool) * [4.4 The one-time Group Policy step](#3-44-the-one-time-group-policy-step) * [4.5 Create a pool](#3-45-create-a-pool) * [4.6 Watching a pool build](#3-46-watching-a-pool-build) * [4.7 Everyday pool jobs](#3-47-everyday-pool-jobs) * [4.8 Updating the image](#3-48-updating-the-image) * [4.9 Going back to an earlier image](#3-49-going-back-to-an-earlier-image) * [4.10 The VM Pool Library](#3-410-the-vm-pool-library) * [4.11 When virtual machines fail to build](#3-411-when-virtual-machines-fail-to-build) * [Part 5 - Keeping it running](#3-part-5-keeping-it-running) * [5.1 Upgrading to a new build](#3-51-upgrading-to-a-new-build) * [5.2 Certificates and AGENTs](#3-52-certificates-and-agents) * [5.3 Database size, history and backup](#3-53-database-size-history-and-backup) * [5.4 Troubleshooting](#3-54-troubleshooting) * [Appendix A - Ports and firewall rules](#3-appendix-a-ports-and-firewall-rules) * [Appendix B - Where the files live](#3-appendix-b-where-the-files-live) * [Appendix C - What each role can do](#3-appendix-c-what-each-role-can-do) * [Appendix D - Settings reference](#3-appendix-d-settings-reference) * [Appendix E - What is collected, and from where](#3-appendix-e-what-is-collected-and-from-where) --- ### Part 1 - Understanding what you have installed ### 1.1 What this product does TruGrid RDS Manager Enterprise gives you one window onto a Remote Desktop Services or VDI fleet. It answers four questions that are otherwise hard to answer: * What is every session host doing right now - processor, memory, disk, how many people are signed in? * Who is signed in where, and what can I do about it - message them, sign them out, shadow them, look at their processes? * Why are logons slow - and which part of the logon is slow, on which host? * Optionally, with VMware: build and rebuild pools of virtual desktops from a master image, without touching vCenter by hand. Everything it shows you is recorded, so you also get history, trends and a full audit log of what your administrators did. ### 1.2 The four pieces There are four programs. You will install two or three of them. | Piece | What it is | Where it runs | Do you need it? | | ---- | | Data Collector | A Windows service. The engine. It polls your session hosts, stores the history, and serves data to the Enterprise Client. | One dedicated Windows Server. | Yes. Everything depends on it. | | Data Collector Configuration | A setup program with tabs. You use it to install the service, choose which computers to watch, and decide who is allowed in. | The same server as the Data Collector. | Yes, for setup and for changes later. | | Enterprise Client | The day-to-day console your administrators use. | Any admin workstation or server in the same domain. | Yes. This is where the work happens. | | Session Host AGENT | A small service on each monitored computer. It reports detail the Data Collector cannot get from across the network. | Each session host or virtual desktop. | Strongly recommended. See 1.4. | || **Note:** The Data Collector Configuration app has both the Data Collector service and the Session Host AGENT built into it. You do not download them separately. ### 1.3 How the pieces talk to each other | From | To | How | Direction | | ---- | | Enterprise Client | Data Collector | TCP 5743 (plain) or 5744 (encrypted). Signs in as your Windows account. | Client starts the connection | | Session Host AGENT | Data Collector | TCP 5743 or 5744. Signs in as the computer's own account. | AGENT starts the connection | | Data Collector | Session hosts with no AGENT | TCP 135 plus dynamic RPC ports, for WMI and session queries. Only used for computers with no AGENT, or whose AGENT is not reporting. | Data Collector starts the connection | | Data Collector | Domain controllers | LDAP, Kerberos and DNS, to read the groups you asked it to watch. | Data Collector starts the connection | | Data Collector | vCenter | TCP 443. Only if you use VM Pools. | Data Collector starts the connection | Two things follow from this that are worth knowing early: * AGENTs and clients always dial out to the Data Collector. You never have to open a port inbound on a session host for the AGENT to work. * The Data Collector dials out to session hosts only when it has to. Once a host has a healthy AGENT, the Data Collector stops polling that host across the network entirely, which is why the AGENT makes firewall problems disappear. ### 1.4 What the Session Host AGENT adds The Data Collector can monitor a computer with no AGENT installed. It pings it, asks it for processor and memory figures over WMI, and lists sessions using the built-in quser command. That gets you the basics. The AGENT gets you everything else. None of the following is available without it: | What you get with an AGENT | Where you see it | | ---- | | Logon timing broken into phases: authentication, profile, Group Policy, shell, and the remainder | Logon Performance page | | Processor and memory per application, per session | Analytics, Prism top apps | | Round-trip time and bandwidth for each RDP session | Users and Sessions, Analytics | | Which applications people launched, and when | Analytics, App Launches | | Clipboard and printer redirection state | Analytics, Timeline | | Reconnect events, and how long recovery took | Analytics, Prism | | Session changes appearing within about five seconds instead of at the next poll | Everywhere | | Process lists and process termination without needing remote WMI to work | Users and Sessions, process panel | | **Tip:** If your session hosts are Windows 11 based, install the AGENT. Windows 11 ships with the WMI firewall rules switched off, so AGENT-less polling of those hosts usually returns blank processor and memory columns until you deploy a Group Policy. An AGENT sidesteps that completely. --- ### Part 2 - Installing and setting up Work through this part in order. The first installation on a prepared server takes about 1 hour, plus however long it takes you to deploy AGENTs. ### 2.1 Before you start The Data Collector server Give the Data Collector its own Windows Server. It must be domain joined. Size it by how many computers you are going to watch: | Fleet size | Processors | Memory | Disk | | ---- | | Up to about 1,000 computers | 4 vCPU | 16 GB | 100 GB SSD or equivalent performant disk | | About 1,000 to 10,000 computers | 8 vCPU | 32 GB | 200 GB or more, on a separate volume for the database | | More than 10,000 computers | Contact TruGrid support | | A design with one Data Collector per site is usually better | Aim to keep steady-state processor and memory use under 70 percent. The database lives on local disk and must stay on local disk: it uses a journal mode that is not safe on a network share. The admin workstations Anyone running the Enterprise Client needs Windows 11 or Windows Server, in the same Active Directory domain as the Data Collector. There is nothing to install. Just run the single program file. Some organizations may choose to publish the Enterprise Client as a RemoteApp application via TruGrid. Accounts you will need | Account | What it is for | Rights it needs | | ---- | | Data Collector service account | The account the Windows service runs as. It reaches out to your session hosts with no AGENT and to Active Directory. | Read access to Active Directory. On each monitored computer, either local administrator, or membership of the local Remote Management Users and Performance Monitor Users groups. | | Your own admin account | Signing in to the Enterprise Client and the Configuration app. | Listed on the Access Control tab, as described in 2.6. | | VM Pools Active Directory account | Only if you use VM Pools. Creates and deletes computer accounts for pool virtual machines. | See 4.3. | | vCenter account | Only if you use VM Pools. Builds and manages the virtual machines. | See 4.3. | ||| **Important:** The installer registers the service to run as LocalSystem, because it cannot know your service account password. LocalSystem authenticates on the network as the server's own computer account, which usually has no rights on your session hosts. Setting the service account in step [2.4](#3-24-set-the-service-account) is not optional if you want data. ### 2.2 Firewall and Group Policy prerequisites Get these in place before you install, or your first look at the Computers page will be disappointing. On the Data Collector server * Allow inbound TCP 5743. Add 5744 as well if you plan to turn on HTTPS. * Allow outbound TCP 135 and the dynamic RPC range 49152 to 65535, to your session hosts. * Allow the usual domain traffic outbound: DNS 53, Kerberos 88, LDAP 389, LDAPS 636 if you use it, and global catalog 3268 if you use it. * If you will use VM Pools, allow outbound TCP 443 to vCenter. On the monitored session hosts These rules are only needed for computers you monitor without an AGENT. Deploy them by Group Policy to the organizational unit that holds your session hosts: 1. Enable the inbound rule group Windows Management Instrumentation (WMI), all three rules in the group. 1. Enable the inbound rule Remote Procedure Call (RPC) on TCP 135. 3. Enable the inbound rule for RPC dynamic ports, TCP 49152 to 65535. ||| **Important:** Windows 11 ships with the WMI firewall rule group disabled. If you monitor Windows 11 virtual desktops without an AGENT, you must deploy the policy above or their processor, memory and process data will stay blank. Installing the AGENT is the easier fix. || **Note:** You do not need WinRM (5985 and 5986), SMB (445), SSH or SNMP for monitoring. If your network team asks, the product does not use them. ### 2.3 Install the Data Collector You need one file: TruGrid-RDSM-DC-Config.exe. It contains the service and the AGENT. ![The Overview tab after a successful install. Service Status reads Running and Quick Stats begin to fill in once polling starts.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/dcconfig-01-overview_1y4xipz.png "=1000xauto") 1. Copy TruGrid-RDSM-DC-Config.exe to the Data Collector server. There is no installer and nothing is written to Program Files. 1. Right-click it and choose Run as administrator. It will refuse to start without elevation. * On first run it unpacks the Data Collector service and the AGENT into C:\ProgramData\TruGrid RDS Manager Enterprise; and creates the database. 1. Go to the Windows Service tab. 1. Click Install Service. A message tells you to set the Log On account and then start the service. Read the next section before you click Start Service. * Service name: TruGrid-RDSM-DC * Display name: TruGrid RDS Manager Data Collector * It starts automatically, and restarts itself if it crashes. The status pill in the top right corner shows the service state and refreshes every few seconds. Watch that pill rather than waiting for dialog boxes: if a service action fails, the pill is often the only sign. ### 2.4 Set the service account The service is registered as LocalSystem. Change it to your domain service account now. ![The Windows Service tab. Install, start and stop the service here, and turn polling on and off.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/dcconfig-02-windows-service_11qz5l9.png "=1000xauto") 1. Open services.msc on the Data Collector server. 1. Find TruGrid RDS Manager Data Collector. 1. Open its properties, go to the Log On tab, choose This account, and enter your domain service account and password. 1. Return to the Configuration app, Windows Service tab, and click Start Service. Then confirm the account has what it needs on a monitored computer. The quickest test is the Computers page in the Enterprise Client: if the processor and memory columns have numbers in them, remote WMI is working under that account. ### 2.5 Tell it which computers to watch The Data Collector does not scan your network. It watches the member computers of Active Directory security groups that you nominate. ![Computer Groups. Each row shows what the group is for. The chip on the second group marks where new VM Pool security groups are created.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/dcconfig-03-computer-groups_wmek2.png "=1000xauto") 1. Go to the Computer Groups tab. 1. Click Add. 1. In the Browse AD Groups window, type part of the group name and click Search. * Only Active Directory groups can be added. There is no organizational unit picker. * The search returns at most 50 results, so type enough of the name to narrow it down. 1. Select the group and click Select. The group is added immediately, with no second confirmation step. ||| **Important:** After adding or removing a group here, restart the Data Collector service, or stop and start polling on the Windows Service tab. The running service reads its group list at startup. The same applies when you add a computer to a group that is already being watched: the new computer will not appear until the service reloads that list. Group membership does two jobs, not one. It decides which computers are monitored, and it is also how an AGENT proves it is allowed to report in. A session host whose computer account is not in one of these groups will install its AGENT successfully and then be refused by the Data Collector. The VM Pool Groups box Lower on the same tab is a box titled VM POOL GROUPS with the option "Automatically add new VM Pool groups to:". If you tick it and choose a group, every new VM Pool you create has its own security group placed inside that group. The effect is that pool virtual machines are monitored from the moment they are built, without you coming back here. Existing pools are not changed. This saves immediately, with no Save button. ### 2.6 Decide who can sign in, and what they can do Nobody can use the Enterprise Client until they are listed on the Access Control tab, either directly or through a security group. ![Access Control. Pick a person or group on the left, then choose one of the four roles on the right.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/dcconfig-04-access-control_l5a1wr.png "=1000xauto") ||| **Important:** If the Access Control list is empty, every connection from the Enterprise Client is refused. This is deliberate, so that a fresh install is not open to the whole domain. The Configuration app on the server itself stays usable, so you cannot lock yourself out completely. 1. Go to the Access Control tab. 1. Click Browse AD, search for a user or a security group, and click Add Selected. 1. Select the new entry on the left, then choose one of the four roles on the right. The first entry you ever add is set to Admin automatically. Every entry after that starts as Help Desk and you raise it deliberately. Role changes save the moment you click them and take effect immediately. | Role | Give it to | What they can do | | ---- | | Admin | Your platform owners | Everything. Configuration, Access Control, VM Pools, images, and every session action. | | Image Operator | The team that maintains gold images | Everything in VM Pools, including creating, growing, updating and deleting pools. Can view computers and sessions. Cannot open the Configuration app or change settings. | | Help Desk | First-line support | Day-to-day session support: message, sign out, shadow, restart and shut down computers. No VM Pools. Cannot open the Configuration app. | | Read-Only Administrator | Auditors, managers, new starters | Sees every page in the Enterprise Client and changes nothing. No session actions, no restarts, no pool changes. | || **Note:** You cannot demote or remove the last Admin. The product blocks it and tells you to add another Admin first. Full detail of what each role can and cannot reach is in Appendix C. ### 2.7 Review the settings Go to the Settings tab. There are four things worth a decision on a new install. ![Settings. Ports, refresh interval, the HTTPS certificate, and where the database and service program live.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/dcconfig-06-settings_san8qz.png "=1000xauto") | Setting | Default | Guidance | | ---- | | HTTP Port | 5743 | Leave it unless it clashes with something. Both other programs use it to reach the service. | | Enable HTTPS, and HTTPS port | Off, 5744 | See 2.8. Plain HTTP stays available even when HTTPS is on. | | Refresh Interval | 60 seconds | How often the Data Collector polls computers that have no AGENT. The minimum is 10 seconds. Read the warning below before you lower it. | | Start polling automatically when the service starts | On | Leave it on. With it off, the service runs but collects nothing until someone clicks Start Polling. | Click Save Settings. Port and interval changes need a service restart, and the app tells you so. ||| **Important:** If you monitor any computers without an AGENT, keep the refresh interval at 30 seconds or more. RDP bandwidth figures for polled computers are only collected at 30 seconds or above, so a shorter interval silently empties their bandwidth columns and charts, with no warning on screen. Computers with an AGENT report their own bandwidth and are not affected by this setting. The File Locations section at the bottom lets you move the database and the service program to another drive, which is worth doing for better performance or if your system drive is small. Follow the on-screen procedure exactly: it requires stopping and uninstalling the service, moving the files, then reinstalling. Note that the configuration file and the HTTPS certificate always stay in C:\ProgramData\TruGrid RDS Manager Enterprise, even after you relocate everything else. ### 2.8 Optional: turn on HTTPS Out of the box, traffic between the Enterprise Client and the Data Collector is plain HTTP on port 5743. Turning on HTTPS encrypts it, using a self-signed certificate that the product generates for itself. 1. On the Settings tab, tick Enable HTTPS, confirm the port, and click Save Settings. 1. Restart the Data Collector service. The certificate is generated on startup. 1. Come back to the Settings tab. The thumbprint now appears under HTTPS Certificate. 1. Click Install to Trust and Update Connected AGENTs. That adds the certificate to the server's trusted store and tells every connected AGENT about it, in one step. ||| **Important:** Never delete or regenerate the certificate file by hand. AGENTs remember the certificate they were given. If it changes without the AGENTs being told, they can neither connect nor update themselves, and the only fix is to visit each host. Always use the Install to Trust and Update Connected AGENTs button. Read 5.2 before you touch certificates. || **Note:** Plain HTTP on 5743 stays open even with HTTPS enabled. If you need it closed, close it with a firewall rule. ### 2.9 Connect with the Enterprise Client 1. Copy TruGrid-RDSM-Enterprise.exe to an admin workstation and run it. No elevation needed. 1. In the Connect to Data Collector window, type the address of your Data Collector. * A bare name or address is fine. If you do not type a scheme, http is assumed. * Examples: http://dc-server:5743 or http://10.1.2.3:5743 * For HTTPS you must type it in full: https://dc-server:5744 1. Click Connect. If the account you are signed in with is not on the Access Control list, you are told your account is not authorised. Add it as described in [2.6](#3-26-decide-who-can-sign-in-and-what-they-can-do). The certificate prompt, and what it means With HTTPS and a self-signed certificate, the client quietly remembers the certificate the first time it connects to a given address. It only prompts later, if the certificate changes. The prompt is titled Security Alert, says the certificate has changed, and shows you both thumbprints. Accept it only if you know a certificate change was expected, for example because you have just rotated it. Otherwise treat it as worth investigating: the same prompt appears whether the cause is a legitimate rotation or something pretending to be your Data Collector. ### 2.10 Deploy the Session Host AGENT There are three ways to install the AGENT. All three end up in the same place: a service named TruGrid-RDSM-Agent, running automatically, with its settings in C:\ProgramData\TruGrid RDS Manager Enterprise\Agent. ![The Agents tab after clicking Refresh. One host is behind, so the amber banner offers Update all out-of-date.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/dcconfig-05-agents_rcyzgt.png "=1000xauto") Before you start, make sure the computer accounts of the hosts you are deploying to are in one of the groups from [2.5](#3-25-tell-it-which-computers-to-watch). Without that, the AGENT installs and is then refused. Option 1: push from the server with PsExec, best for a handful of hosts 1. Download PsExec (part of SysInternals) from Microsoft and put it on the Data Collector server, for example in C:\Tools. 1. Go to the AGENTs tab and click Push with PsExec. Choose PsExec64.exe or PsExec.exe. It is recommended to use PsExec64.exe on 64bit operating systems 1. Type the host names, one per line. 1. Confirm the PsExec path, then click Deploy and watch the log. This copies the AGENT to the target's C$ share and runs the installer remotely, so administrative file sharing has to work on the targets. Failures are logged per host and the run carries on. Option 2: the installer ZIP, best for a hands-off or scripted rollout (SCCM / Intune) 1. On the AGENTs tab, click Download ZIP and save the file. 1. Copy the ZIP to each session host and extract all three files into a folder. 1. From an elevated command prompt in that folder, run install.cmd. The ZIP is built for your Data Collector specifically: its address and, if you use HTTPS, the certificate thumbprint are already inside. That is why you download it from your own server rather than from TruGrid. Option 3: the PowerShell script, best for existing deployment tooling Install-Agent.ps1 ships in the deploy\agent folder. Run it elevated, with the AGENT program and your Data Collector address. If your Data Collector uses HTTPS you must also pass the certificate thumbprint, and the script stops if you do not. Confirming it worked Go to the AGENTs tab and click Refresh. The grid does not fill in by itself, so click Refresh each time you open the app. | What you see | What it means | | ---- | | Online, green | Reported in within the last 90 seconds. Healthy. | | Stale, amber | Nothing heard for between 90 and 300 seconds. Usually a brief network problem or a restart in progress. | | Offline, red | Nothing heard for more than 300 seconds. Investigate. | | No row at all | The AGENT never enrolled. Almost always because the computer account is not in a watched group. Check 2.5, and note that group membership is cached for five minutes. | ### 2.11 Turn on the two audit policies the AGENT needs Two Windows audit settings are what make the logon and application pages work. The AGENT reports whether each one is enabled, and the AGENTs tab shows it in the AUDIT column. | Audit setting | Needed for | Required? | | ---- | | Logon, success (event 4624) | The whole Logon Performance page | Yes. Without it that page is permanently empty. | | Process Creation, success (event 4688) | The App Launches views | Optional, but those views stay empty without it. | Set them by Group Policy on your session host organizational unit. To test one host quickly, run these in an elevated PowerShell window on that host: ``` auditpol /set /subcategory:"Logon" /success:enable ``` ``` auditpol /set /subcategory:"Process Creation" /success:enable ``` If you forget, the product tells you. The Logon Performance page and the App Launches view both show an amber banner naming the affected hosts and giving you the exact command above. ### 2.12 Check your work Run through this list before you call the install done. | Check | Where | What good looks like | | ---- | | Service is running | Configuration app, status pill | Running, in green | | Polling is active | Configuration app, Overview | Polling: ACTIVE, and a recent Last poll time | | Computers are being found | Configuration app, Overview | The COMPUTERS card shows a sensible total, with most of them online | | Remote data is working | Enterprise Client, Computers page | Processor and memory columns have numbers, not blanks | | Sessions are visible | Enterprise Client, Users and Sessions | Your own test session appears, with the right state | | AGENTs are reporting | Configuration app, AGENTs tab, after clicking Refresh | Your AGENT hosts are Online, and their versions match the bundled version | | Audit policy is on | Configuration app, AGENTs tab, AUDIT column | On | | Logon timing is flowing | Enterprise Client, Logon Performance | Sign in to a monitored host, wait a minute, refresh, and a row appears | | Access Control is right | Configuration app, Access Control | At least one Admin, and everyone else at the lowest role that suits them | --- ### Part 3 - Day-to-day administration This part covers the Enterprise Client, which is where you will spend your time. VM Pools has its own part. ### 3.1 Finding your way around The sidebar Down the left, from the top: * A DATA COLLECTOR card showing which server you are connected to and how many groups it watches. * An ONLINE ADMINS card, which only appears when another administrator is connected at the same time. * A group filter. Choose one of your Active Directory groups here and every page narrows to it. It starts on (All Groups). * The page buttons: Dashboard, Computers, Users and Sessions, Logon Performance, Analytics, VM Pools, Alerts, Audit Log. VM Pools is hidden for the Help Desk role. * Switch Data Collector at the bottom, if you run more than one. The header and the status bar | What you see | Where | What it means | | ---- | | Live, in green | Top right | Connected and receiving data. | | Disconnected, in red | Top right | Not connected. Data on screen is whatever arrived last. | | Connecting... | Bottom left | No data has arrived yet since you opened the program. | | 4/5 online \| 23 sessions \| Refreshed 14:22:07 | Bottom left | The normal state. The time is when the last update arrived. | | Dark Mode or Light Mode button | Top right | Switches theme immediately and remembers your choice. | How the data refreshes, and what stale looks like You do not need to refresh anything by hand. The Data Collector pushes updates to you: a full picture after each poll cycle, a lighter status update every few seconds, and session changes within about five seconds when the host has an AGENT. When a page has a Refresh button, it asks the Data Collector to run an extra poll right now rather than waiting for the next cycle. That takes a few seconds. ||| **Important:** If the connection goes quiet for 90 seconds, the Computers page dims and a small italic note appears in its toolbar reading "Data as of" with a time. That is the product telling you the numbers are old. There is no pop-up and no red banner. The header can still read Live in some network failures, so treat the dimmed grid and the "Data as of" note as your real freshness signal. ### 3.2 Dashboard A read-only summary. Nothing on this page changes anything. ![The Dashboard. Fleet totals across the top, then per-computer health and a session breakdown.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/client-01-dashboard_mx3ize.png "=1000xauto") The top row counts computers and sessions: TOTAL COMPUTERS, COMPUTERS ONLINE, COMPUTERS OFFLINE, ALL SESSIONS, ADMINS ONLINE. The second row shows FLEET UX SCORE plus ACTIVE, IDLE and DISCONNECTED session counts. The Fleet UX Score One number out of 100 for how the fleet feels to its users, recalculated every five minutes over the previous 24 hours. It is a weighted blend of logon times, responsiveness, resilience and availability, with responsiveness and logon time carrying the most weight. | Score | Word shown | What to do | | ---- | | 71 to 100 | excellent | Nothing. Keep an eye on the trend. | | 41 to 70 | fair | Look at Logon Performance and the Prism tab for the weak spot. | | 1 to 40 | poor | Something is wrong. Start with Prism, which names the worst host. | | A dash | no data yet | Not enough has been collected yet, usually because AGENTs are new or absent. | Lower down, COMPUTER HEALTH gives one card per computer with processor and memory bars that turn amber then red as they climb, and COLLECTOR INFO plus SESSION BREAKDOWN summarise the connection and the session mix. ### 3.3 Computers One row per monitored computer. This is where you act on whole machines rather than individual sessions. ![The Computers page. Select a row, then use the buttons along the top to act on that computer.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/client-02-computers_p82rs3.png "=1000xauto") The buttons | Button | What it does | Asks first? | | ---- | | Refresh | Polls the selected computers now, or all of them if none are selected. | No | | Enable Logon | Lets people sign in to the selected computers again. | No | | Disable Logon | Blocks new sign-ins and reconnections. | No | | Drain | Blocks new sign-ins but allows reconnections. Existing sessions carry on. This is what you want before patching. | No | | Message | Sends a pop-up to every session on the selected computers. | No | | Restart | Restarts the computer, forcing applications closed. | Yes, per computer | | Shutdown | Shuts the computer down, forcing applications closed. | Yes, per computer | | Logoff All | Signs out every session on the selected computers. | Yes, per computer | | Export CSV, Export PDF | Saves the list as it is currently filtered. | No | ||| **Important:** Every button except Refresh acts on the rows you have selected and does nothing at all if you have not selected any. There is no warning that nothing happened. Refresh is the exception: with nothing selected it refreshes everything. || **Note:** Enable Logon, Disable Logon, Drain and Message act the moment you click them, with no confirmation. Only Restart, Shutdown and Logoff All ask, and with several computers selected they ask once for each. The columns | Column | What it tells you | | ---- | | Status | Online or Offline. Offline means it did not answer a ping. | | CPU, Memory | Current use, with a small bar. Amber then red as they climb. | | Sessions, Active, Idle, Disc | Total sessions and the split by state. | | AGENT | YES or NO. This says whether an AGENT is installed, not whether it is talking to you right now. A host can read YES while its AGENT is offline, which is how you tell "no AGENT" apart from "AGENT in trouble". | | Logon | Enabled or Disabled, matching the Enable and Disable Logon buttons. | | Drain | Draining or Normal. | | Disk Read, Disk Write | Current throughput, scaled automatically. | | Uptime | How long since the last restart. | | OS | Operating system version. | The search box filters on computer name only. Right-clicking a row gives you the same actions plus View Analytics, which jumps to the Analytics page already filtered to that computer. The two errors you are most likely to see from these actions are "Access denied. Admin rights required on target." and "Registry key not found on target." Both point at the rights of your Data Collector service account on that host, not at the product. ### 3.4 Users and Sessions One row per session. This is the help desk page. ![Users and Sessions. Filter by computer, state or type, then select a session to message, disconnect, shadow or sign out.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/client-03-users-sessions_jp6169.png "=1000xauto") Narrowing the list Four filters combine: Computer, State (Active, Idle, Disconnected), Type (RDS, VDI, AVD, App) and a search box that matches either the user name or the computer name. The sidebar group filter applies on top of all of them. The buttons | Button | What it does | Asks first? | | ---- | | Refresh | Polls all sessions now. | No | | Disconnect | Disconnects the session. It stays on the server and the applications keep running, so the user can reconnect where they left off. | No | | Reset | Terminates the session. Unsaved work is lost. Reset and sign-out are the same thing at the Windows level. | Yes | | Shadow | Opens a shadow view of the session using the built-in Remote Desktop client, with control. | No | | Message | Sends a pop-up. It stays on screen for 60 seconds. | No | | Logoff | Signs the user out. | No | | Processes | Opens a panel listing that session's processes, where you can end them. | No | | App Launches | Opens a panel listing what that user recently started. | No | | Export CSV, Export PDF | Saves the list as filtered. | No | ||| **Important:** Logoff, Disconnect, Shadow and Message happen the instant you click them. Only Reset asks you to confirm. This surprises new administrators more than anything else in the product, so be deliberate about which row is selected before you click. || **Note:** Disconnect, Reset, Logoff and Message act on every row you have selected. Shadow, Processes and App Launches only ever use the single focused row. || **Note:** Message is delivered to every session on that computer, not only the user you picked. If you need to reach one person privately, contact them another way. The columns worth explaining | Column | What it tells you | | ---- | | State | Active, Idle or Disconnected. Idle means no keyboard or mouse input for at least a minute. | | Type | RDS, VDI, AVD or App. Blank when it cannot be determined. | | Idle | How long since real input. Blank for disconnected sessions. | | Active For, Disc For | How long in the current state. Only one of them is ever filled in. | | CPU%, Mem (MB) | That session's use, from the AGENT. | | RDP Up, RDP Dn | Bandwidth from the user's point of view: Up is what the user is sending. Needs an AGENT, and needs the refresh interval at 30 seconds or more. | | Client, IP | The name and address of the device the person is connecting from. | The Processes panel Select a session and click Processes. You get process name, process ID, processor and memory. Select one or more and click Terminate, which does confirm first. Critical system processes are refused by the AGENT, so you cannot accidentally kill the host. What happens after you act * Logoff and Reset: the row vanishes straight away, and the product suppresses it for 30 seconds so a slow update cannot make it flicker back. * Disconnect: the row stays and changes to Disconnected. That is correct, not a failure. * Restart and Shutdown: no confirmation message appears. The computer simply drops to Offline at the next poll. * If the user signed themselves out at the same moment, the product treats that as success rather than showing you an error. ### 3.5 Logon Performance This page answers "why is signing in slow, and which part is slow". It needs the AGENT, and it needs Logon auditing turned on as described in [2.11](#3-211-turn-on-the-two-audit-policies-the-agent-needs). ![Logon Performance. Total logon time is broken into Auth, Profile, GPO, Shell and Other, so you can see which part is slow.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/client-04-logon-performance_tuhxgd.png "=1000xauto") Choose a window with the Show last box. It opens on Last 1 Day. The five tiles across the top are LOGONS, AVG TOTAL, P95 TOTAL, AVG PROFILE and AVG GPO. | **Tip:** Read LOGONS first. It is your sample size. An average built on four logons tells you nothing. P95 TOTAL is the number your users actually complain about: it is the experience of the slowest one in twenty sign-ins. The five phases | Phase | What it covers | A large number here usually means | | ---- | | Auth | From the moment credentials are accepted until Windows starts building the session. | Domain controller, Kerberos or network delay before Windows even starts. | | Profile | Loading the user's profile. | A roaming or FSLogix profile problem: slow file server, oversized profile, or a virtual disk that will not attach cleanly. | | GPO | Processing Group Policy for the user. | Heavy user policies, logon scripts, drive and printer mappings, or slow SYSVOL. | | Shell | Starting the desktop itself. | Shell extensions, startup applications, or logon notification packages. | | Other | Everything left over from the total. | Usually the tail after the desktop appears while the taskbar and Start menu warm up. | Click any row and the detail pane shows a bar split into those five phases, sized in proportion, so the expensive phase is obvious at a glance. Underneath, CORRELATED EVENTS lists what Windows logged on that host around that logon, which usually names the cause outright. The "Filter to this user" tick box starts on, and turning it off widens the list to everything happening on the host at the time. || **Note:** An empty correlated-events list is a finding, not a fault. It means nothing was flagged underneath that logon. ### 3.6 Analytics ||| **Important:** Analytics does not load by itself. Choose your filters and click Refresh. Until you do, the status line reads "Select a time range and click Refresh." When you change a filter, the line reminds you to click Refresh to apply it, and the charts keep showing the old data until you do. The toolbar at the top applies to every tab: a Computer filter, a User filter, a Period running from Last 1 Hour to Last 90 Days, Refresh, and Export PDF. | Tab | What it is for | | ---- | | Overview | Processor, memory and session counts for one computer, side by side. | | Timeline | Six lanes stacked on one shared clock, so you can see whether a logon spike lines up with a processor spike or a network problem. | | Prism | The executive view. Start here. Described below. | | Session Trends | How many people were signed in over time. | | CPU Trends, Memory Trends | One line per host, or a filled line for one host. | | Peak Hours | Which hours of the day are busiest, averaged over the period. | | RDP Bandwidth | Maximum and average bandwidth in both directions. | | Top Users | Who consumes the most processor and memory. | | Top Computers | Which hosts carry the most concurrent sessions. | | App Launches | What people are running, across the fleet. | ||| **Important:** The Overview tab is deliberately blank while the Computer filter is on All Computers. Pick a specific computer to populate it. || **Note:** Export PDF exports the data table, not the picture, and only works on the chart tabs. On Timeline, Prism and App Launches it produces an empty document without telling you. Prism, the executive view Prism answers four questions in four tiles, each with a pill in the corner reading OK, WATCH or ALERT. | Tile | What it tells you | Where it sends you | | ---- | | Are we improving? | Fleet UX score with a small trend line and the change against 24 hours ago. | Nowhere. It is context. | | Where's the pain? | The single worst host, and how far off the fleet median it is. | Logon Performance | | What needs attention? | How many users had a logon over 30 seconds today, against your normal baseline. | Logon Performance for the last 24 hours | | Do we have headroom? | Spare processor and memory across the fleet, with today's peaks. | CPU Trends for the last 24 hours | || **Note:** The four Prism tiles always show the last 24 hours, whatever Period you chose in the toolbar. The panels below them do follow the toolbar. Below the tiles, a STATUS strip collapses to a green pill when there is nothing to report, and TOP APPS ranks the busiest applications by memory or processor. ### 3.7 Alerts A read-only history of what the product noticed. There are no buttons here beyond Refresh, and no way to acknowledge or close an alert by hand: alerts resolve themselves when the condition clears. The tick box "Open alerts only" starts unticked, so you see history as well as current problems. The three tiles always count the whole window even when the grid is filtered. | Alert | Raised when | Resolves when | | ---- | | Slow logon | Any logon in the last five minutes took longer than 45 seconds. | No slow logon on that host for an hour. | | Sustained host CPU | Every sample over the last ten minutes was above 85 percent. | Any sample comes in below the threshold. | | Sustained host memory | Every sample over the last ten minutes was above 90 percent. | Any sample comes in below the threshold. | | AGENT offline | An AGENT has not reported for 30 minutes. | The AGENT reports in again. | | Profile load failure | Windows logged a User Profile Service failure in the last five minutes. | No further failure in the window. | ||| **Important:** Alerts appear inside the Enterprise Client only. The product does not send email, and there is no webhook or Teams integration. Nobody is notified unless somebody has the Enterprise Client open. Plan your monitoring accordingly. || **Note:** The thresholds above are fixed in the product. There is no screen for tuning them. ### 3.8 Audit Log Everything your administrators did, plus session events the product noticed itself. Search matches the administrator, the action or the target. The window opens on Last 7 Days, and Export PDF exports whatever you have filtered. Columns are Time, Admin, Action, Target, Details and a Result pill reading OK or Failed. Click a row for the full detail, including the error text when something failed. | What lands here | Examples | | ---- | | Session actions by administrators | Sending a message, disconnecting, resetting, signing out, ending a process | | Configuration changes | Groups added or removed, Access Control changes, certificate updates, hypervisor connection changes | | Connections | Each time an administrator connects to or disconnects from the Data Collector | | Session events the product saw | Sign-ins, sign-outs and disconnects, recorded as System | | Everything VM Pools did | Recorded as System (VM Pools) when the product acted on its own | | **Tip:** The Details column ends with via:direct or via:AGENT. That tells you whether the command ran from the administrator's own workstation or was relayed through the AGENT, which is the fastest way to work out why one help desk operator can act on a host and another cannot. || **Note:** The Admin name is resolved by the Data Collector from the Windows sign-in, not supplied by the client, so it cannot be forged from a workstation. Audit entries are also written locally first and retried, so they survive a Data Collector outage. ### 3.9 How to do the common jobs Take a host out of service for patching 1. Computers page, select the host. 1. Click Drain. Existing users carry on working and can still reconnect, but nobody new lands there. 1. Wait for the Sessions count to fall to zero, or use Logoff All if you cannot wait. 1. Patch and restart. 1. Click Enable Logon when it is back. This does not happen by itself. ||| **Important:** Draining is not automatically undone by a restart. If you forget to click Enable Logon, the host will sit there healthy and empty while users pile onto the others. For hosts managed by VM Pools, use the RECYCLE policies to automate this function. Help someone whose session is stuck 1. Users and Sessions, find them with the search box. 1. Click Shadow to see what they see. This starts immediately. 1. If an application is hung, click Processes, select it and click Terminate. 1. If the session itself is beyond help, click Disconnect first: it keeps their applications running so they can reconnect. Use Reset only when you accept losing unsaved work. Investigate a complaint about slow sign-in 1. Logon Performance, set Show last to cover the complaint. 1. Search for the user or the host. 1. Check LOGONS to be sure you have enough samples to trust. 1. Click the slowest row and read which phase owns the bar. 1. Read CORRELATED EVENTS underneath for the cause. 1. If several hosts are affected, look at Analytics, Timeline to see whether it lines up with a processor, memory or network problem. Tell everyone on a host that it is going down 1. Computers page, select the host. 1. Click Message and type it. 1. Remember it reaches every session on that host and stays on screen for 60 seconds. Find out who changed something 1. Audit Log, set the window wide enough. 1. Search for the administrator, the action or the computer. 1. Click the row for the full detail. --- ### Part 4 - VM Pools VM Pools is optional. It only applies if you run VMware vSphere and want the product to build and rebuild virtual desktops for you. If you only monitor existing session hosts, skip this part. ### 4.1 What VM Pools does You prepare one master image. VM Pools clones it into as many virtual machines as you ask for, names them to your pattern, joins each one to your domain, and puts them all in an Active Directory security group so they are monitored automatically. Later, when you update the master image, it rebuilds the pool onto the new image without you touching vCenter. || **Note:** A pool is an Active Directory security group. The group name is the pool name: there is no separate label. Two pools can never share a name, because they would have to share one group. ### 4.2 The two kinds of pool You choose this on the first screen of the wizard and you cannot change it afterwards. | | Persistent | Non-persistent | | ---- | | Also called | Personal-desktop pool | Hot-desk or shared pool | | Who uses each machine | One person keeps the same machine | Anyone takes any free machine | | User data between sessions | Kept | Discarded when the machine returns to its clean baseline. See below for exactly when that happens. | | How it is built | A full clone. Every machine is a complete independent copy. | A linked clone. All machines share one read-only copy of the master and each writes only its own differences. | | Disk used | Full size per machine | Much less. Only the differences are stored. | | Valid image sources | Template, powered-off virtual machine, or snapshot | Powered-off virtual machine or snapshot. Templates cannot be used. | | Can you update the image later? | No. Rebuilding would erase each user's data. | Yes. This is the main reason to choose non-persistent. | | Can you reset one machine? | No | Yes, at any time, from the pool page | Exactly when a non-persistent machine is wiped A non-persistent machine is wiped by being reset back to its clean baseline. Everything written since it was built is discarded. A reset happens in these four cases: | Trigger | Optional? | Notes | | ---- | | The machine is powered off or fully restarted | Always on, cannot be turned off | This is the main one. A restart is what resets a machine. | | The machine drains to zero sessions | Optional, off by default | Turn this on if you want a machine cleaned as soon as the last person leaves it. | | A schedule you set | Optional, off by default | Daily or weekly, up to eight entries. Typically overnight. | | You click Reset on that machine | Manual | Always available on the pool page. | The wipe is complete, but it is the reset that causes it rather than the sign-out on its own. If you want each machine cleaned as soon as its last user leaves, turn on the drain-to-zero option: that is what turns the final sign-out into a reset. Otherwise a machine is cleaned at its next restart, on its schedule, or when you reset it by hand. ### 4.3 What you need before your first pool A vCenter connection ![Hypervisor Connections, in the Data Collector Configuration app. VM Pools cannot build anything until a vCenter is set up here.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/dcconfig-07-hypervisor_1vaiy9t.png "=1000xauto") Set this up in the DC CONFIG app, on the Hypervisor Connections tab. Click Add and fill in a friendly name, the vCenter address, and an account. Tick Trust self-signed certificate only for a laboratory: in production, install your issuing certificate authority into the Data Collector server's trusted root store instead. Click Test Connection before you save, then use the Test button on the saved connection to run the full permission checklist. The dialog splits results into privileges it could verify now by reading, and write privileges it can only confirm when you actually build a pool. The vCenter account needs these privileges: | Privilege | Where it applies | | ---- | | System.View and System.Read | Datacenter | | Datastore.Browse and Datastore.AllocateSpace | The datastores you will use | | VirtualMachine.Provisioning.Clone | The source templates and virtual machines, and the target folder | | VirtualMachine.Provisioning.Customize | The target folder | | VirtualMachine.State.CreateSnapshot and RemoveSnapshot | The master image | | VirtualMachine.Inventory.Create and Delete | The target folder | | VirtualMachine.Config.AddNewDisk and RemoveDisk | The target datastores | | Network.Assign | The target port groups | | Resource.AssignVMToPool | The target resource pool | | VirtualMachine.Interact.PowerOn, PowerOff and Reset | The target folder | An Active Directory account for VM Pools On the same tab there is a card called VM Pools AD Account. This is the account that creates and deletes computer accounts as machines come and go. Enter it as a user principal name or in domain\user form, give it a test organizational unit, and click Test. The test binds to the directory, creates a throwaway computer object in that organizational unit, reads it back and deletes it, then shows you each step. | Right | Where it applies | Why | | ---- | | Read all properties | The organizational units you use | To find groups and units | | Create Computer objects | The computer accounts organizational unit | Every new machine needs an account | | Delete Computer objects | The computer accounts organizational unit | Removing machines cleans up after itself | | Write Members | The pool security groups | To add each machine to its pool group | | Create Group objects | The group organizational unit | Only if you want the product to create the pool group for you rather than pre-creating it | | Reset Password | Computer objects | Optional. Used when a machine is rebuilt. | || **Note:** Both accounts are stored encrypted on the Data Collector server itself and are never sent to the Enterprise Client. Because the encryption is tied to that server, moving the database to a different machine means re-entering both passwords. A master image that is ready to be cloned ||| **Important:** This is where first pools usually go wrong. The source must be generalized. Every clone is renamed and joined to the domain, so cloning a live in-use server, such as a running session host or a domain controller, produces machines that keep that server's identity and fail. * Generalize the image with sysprep before you use it. * Remove or handle any Windows Store applications that block generalization. They are a common cause of failure. * Make sure the image can reach a domain controller and resolve DNS. * Do not leave Windows Update mid-installation in the image. * Check how many times the image has been generalized. Windows limits it. || **Note:** You do not have to prepare the image's networking to match the pool. The network adapter and port group for the pool's machines are chosen in the wizard, on the Pool config step, and are not inherited from the master image. See 4.5. ### 4.4 The one-time Group Policy step Non-persistent pools need one manual step, once, before the first person signs in. Without it, machines fall off the domain a few weeks later and users cannot sign in. | Item | Value | | ---- | | Policy | Domain member: Disable machine account password changes = Enabled | | Where to find it | Computer Configuration, Policies, Windows Settings, Security Settings, Local Policies, Security Options | | Link it to | The organizational unit that holds the pool's computer accounts | | When | Once, any time before the first user signs in | The reason is straightforward. Windows changes each computer's own account password roughly every 30 days. The clean baseline your machines revert to was captured at one moment in time, and it contains the password as it was then. If Windows has rotated the password since, a machine that reverts comes back with the old one, the domain no longer recognises it, and you get a trust relationship failure. Stopping the rotation keeps the captured password valid. ||| **Important:** The wizard shows this reminder on its Review screen and offers a Copy GPO details button. If you chose to put computer accounts in a different organizational unit from the group, the reminder names the group's unit. Link the policy where the computer accounts actually are. ### 4.5 Create a pool In the Enterprise Client, go to VM Pools and click Create Pool. There are four steps. ![Step 3 of the Create VM Pool wizard. Identity and sizing on the left, vSphere placement on the right, and the note that starts this pool's change journal.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/client-06-create-pool-wizard_1y8ocw7.png "=1000xauto") Step 1: Persistence Choose Persistent or Non-persistent, using 4.2. It starts on Persistent. You cannot change this after the pool is built. Step 2: Source Pick the vCenter connection and click Discover sources. You get a tree of templates, powered-off virtual machines and snapshots, with chips to filter by type and a search box. * Snapshots appear underneath the machine they belong to. * Running machines are shown for context but cannot be selected. You can select a snapshot underneath one. * For non-persistent pools, templates are not listed at all, because a linked clone needs a snapshot to hang off. || **Note:** If you pick a powered-off machine for a non-persistent pool, the product takes its own base snapshot first. You do not have to prepare one. Large vCenters can take a while to enumerate. If discovery times out, raise the Discover timeout on the connection: the default is 60 seconds and very large environments sometimes need 180 to 300. Step 3: Pool config | Field | What to put in it | | ---- | | VM Pool Name (AD Security Group) | The pool name, which is also its security group. Type an existing group, or a new name and the product creates the group in the unit below. Names must be unique. | | AD OU for security group | Where the group lives, or should be created. | | AD OU for computer accounts | Where the machines' computer accounts go. Leave Same as group OU ticked unless you separate them. If you untick it, remember the Group Policy note in 4.4. | | Number of VMs | How many to build. Starts at 12. | | VM naming convention | A pattern with hash marks for the number, such as RDSM-##. The number of hashes sets the zero padding, so RDSM-## gives RDSM-01 through RDSM-12. A live sample is shown as you type. | | Recycle policy (non-persistent only) | Power-off is always on and cannot be unticked. Optionally add drain-to-zero and a schedule. | | Compute resource | The cluster or host. Selecting it filters everything below to what it can actually reach. | | Resource pool | Defaults to the cluster root. | | vCenter folder | Where the machines are placed. Only folders that accept virtual machines are listed. | | Datastore | Where the disks go. | | Network | The network adapter and port group every machine in this pool connects to. This is set here, not inherited from the master image. The list is filtered to what the compute resource you chose can actually reach. | | Reason / notes | Optional. Becomes the first entry in this pool's history journal, so write why you built it. | Step 4: Review Check the summary. For non-persistent pools there is a one-line reminder about the Group Policy from [4.4](#3-44-the-one-time-group-policy-step), with Show details and Copy GPO details. Then click the green Provision button. ### 4.6 Watching a pool build The pool page refreshes itself every few seconds. Each machine moves through Queued, Cloning, Customizing, Joining AD and then Ready. ![A pool part way through its first build. Each virtual machine shows its own step: Cloning, Customizing, Joining AD, then Ready.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/client-05-vmpools_r00dk5.png "=1000xauto") | Pool state | What it means | | ---- | | Pending | Saved and waiting for the engine to pick it up. Up to about ten seconds. | | Provisioning | Building. Ten machines are built at a time by default. | | Healthy | Every machine is Ready. | | Partial | Some machines are Ready and some failed. Use Retry Failed. | | Error | Everything failed. Read the message: it usually names a missing permission or a renamed folder or datastore. | | Updating | An image update is in progress. | | Finalizing update | The rebuild is done and the machines are taking their new clean baseline snapshots. Update Image, Revert and Resize unlock again when this finishes, usually a few minutes. | Expect a full build to take a while. Each machine has to clone, boot, run generalization, join the domain and report its own name back. The product waits up to 30 minutes for a clone and 10 minutes for a domain-join before it gives up on a machine. || **Note:** The product does not trust the domain alone to tell it a machine is ready. It also waits for the machine to report its own host name. That is deliberate: it stops a half-built machine being handed to a user. ### 4.7 Everyday pool jobs | Job | Where | Safe or destructive | | ---- | | Reset one machine | Reset on the machine's row | Discards everything written on that machine since it was built. Any active session is dropped. The machine itself survives. | | Retry a failed machine | Retry on the row, or Retry Failed in the header | Safe. | | Stop a build | Abort in the header | Safe. Clones already running finish, queued machines stay queued, finished machines are kept. | | Grow a pool | Resize | Safe. New machines are built and numbering gaps are reused. | | Shrink a pool | Resize | Destructive. The highest-numbered machines are powered off and permanently deleted from vCenter. The dialog names them first. | | Delete one machine | Delete on the row | Destructive. Deletes the machine from the hypervisor and its computer account in AD, and permanently lowers the pool's target size. The VM is not replaced or rebuilt. | | Delete a pool | Delete in the header | Destructive. Removes every machine from vCenter and Active Directory and clears the pool's history. The name stays reserved until the teardown finishes. | || **Note:** There are no power on, power off or restart buttons for pool machines. Power operations happen according to the RECYCLE policies. Powering a non-persistent machine off from vCenter will trigger its reset, because On power-off / full restart is an always-on recycle policy. Use the RESET button when you want a reset deliberately. ### 4.8 Updating the image Non-persistent pools only. Update the master image, then point the pool at the new version. ||| **Important:** Understand what a rebuild does before you run one. Each machine is deleted and cloned again from the new image. Its name and its Active Directory account are kept. Everything on its disk is gone. Nothing is preserved, and there is no layering. 1. Prepare and generalize the new image, and make sure it is powered off or has a snapshot. 1. Open the pool and click Update Image. 1. Choose the new source. The same rules from [4.3](#3-43-what-you-need-before-your-first-pool) apply: it must be sysprep-ready. 1. Write a reason. It is saved into the pool's history. 1. Choose when, and how fast, using the table below. 1. Click the button, which reads Start Update, Schedule Update or Apply on Recycle depending on your choice. | When | What happens | Use it when | | ---- | | Now | The rebuild starts immediately. | Out of hours, or for a pool nobody is using. | | At a scheduled time | The rebuild starts at the date and time you pick. | You want it overnight without being there. | | As each machine recycles | Nothing happens immediately. Each machine moves to the new image the next time it would have reset anyway. | Forgiving images where a temporary mix of versions is acceptable. | | Rollout | What happens | Trade-off | | ---- | | All at once | Every machine rebuilds together. | A short full outage for the pool, but everybody ends up on the same version at the same moment. This is what you want for version-locked applications such as clinical or finance systems. | | Rolling, a few at a time | A batch rebuilds, then the next after a wait you choose. | The pool stays partly available, but for a while you have two versions running side by side. | ||| **Important:** Do not use the rolling or as-each-machine-recycles options for applications that check their own version against a server or a database schema. A pool running two versions at once will break them for some users and not others, which is a hard fault to diagnose. You can also warn signed-in users before their machine rebuilds, with a lead time and a message. The default message includes the time, substituted automatically. While an update is running the header shows Cancel Update. Cancelling stops further rebuilds. Machines already moved keep the new image, so you may be left with a mixed pool deliberately. ### 4.9 Going back to an earlier image Open the VM Pool Library tab, find the entry you want, and click Revert. It rebuilds the pool from exactly the image content recorded at that point, not from whatever that source looks like today. || **Note:** Revert needs an entry that recorded a snapshot. Entries that recorded only a source machine cannot be reverted, because that machine's disk has changed since. Very old entries can have this limitation, and the product tells you plainly when they do. || **Note:** If you open Revert and then click Change to pick something else, it stops being a revert and becomes an ordinary image update. ### 4.10 The VM Pool Library The second tab on the VM Pools page is the change journal for every pool: what it was built from, every image update and revert since, the reason somebody typed, and the exact vCenter snapshot behind each one. ![The VM Pool Library. Entries are grouped under the snapshot they share, so a snapshot used twice is obvious.](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/client-07-vmpool-library_4nnfzo.png "=1000xauto") | What you see on an entry | What it means | | ---- | | A green CURRENT badge | This is what the pool is running now. | | A blue SCHEDULED or amber PENDING badge | An update is queued for this entry. | | A Revert button | This entry can be returned to. Non-persistent pools only. | | "not in use - safe to clean up in vCenter" | That snapshot is no longer needed by any pool. You can tidy it up in vCenter. | | "deleted from vCenter" in red, and the card dimmed | Somebody removed the snapshot outside the product. You cannot revert to it any more. | | **Tip:** Snapshot names are learned the first time you open the Library for that pool, not when the pool is built. If a name is missing, open the Library once and it fills in. ### 4.11 When virtual machines fail to build The commonest failure by far is generalization. The pool page shows a Troubleshooting card listing six causes when a pool is Partial or Error, and each failed machine shows its own error underneath its name. | What you see | What it usually is | What to do | | ---- | | Guest customization (sysprep) failed | The image was not generalized properly, or a Windows Store application blocked it. | Check C:\Windows\System32\Sysprep\Panther\setuperr.log on the clone. Fix the image and use Retry Failed. | | Domain join did not complete within 10 minutes | The clone cannot reach a domain controller or resolve DNS, VMware Tools is not running, or the VM Pools account cannot join computers. | Check the clone's network and DNS, then the account rights in 4.3. | | Missing, in red | The machine no longer exists in vCenter. Somebody deleted it outside the product. | Use Delete to remove it from the pool. | | Delete failed | vCenter refused the deletion. | Look in vCenter for a lock or a task in progress, then try again. | | Reset failed | The revert to baseline did not complete. | Try again. The machine stays usable in the meantime. | | Could not resolve placement | The folder or datastore was renamed or removed in vCenter. | Put the name back, or rebuild the pool against the new one. | | A VM named ... already exists and could not be removed | A leftover machine with the same name is in the target folder. | Remove it in vCenter. The product clears these automatically when it can. | || **Note:** A machine can be Ready and usable but still have failed to take its clean baseline snapshot. That is not fatal. It simply has no reset point until one is taken, which happens on the next successful reset or rebuild. --- ### Part 5 - Keeping it running ### 5.1 Upgrading to a new build Upgrades are manual and deliberate. Nothing updates itself without being told to, and the product never installs an update behind your back. You will find out that an update exists from a blue banner across the top of the Configuration app and the Enterprise Client, naming the new build. Dismissing the banner hides it only for that build. Upgrade in this order. 1. Upgrade the Data Collector. * Download the new TruGrid-RDSM-DC-Config.exe and replace the old copy on the server. * Run it as administrator. Go to the Overview tab and look at the Data Collector Software box: Installed is what the service is running, Included is what this new file carries. * Click Upgrade. It stops the service, replaces it and starts it again. Connected administrators drop for a few seconds. 1. Upgrade the AGENTs. * Go to the AGENTs tab and click Refresh. * For non-persistent VMs created via VM Pools, update the AGENT on source image and UPDATE the pool * For all others, an amber banner reports how many are behind. Click Update all out-of-date. * Each AGENT downloads the new version from your own Data Collector and restarts itself. * Only AGENTs that are connected can be updated in this manner. Repeat later for hosts that were switched off, or the amber banner will keep reminding you. 1. Upgrade the Enterprise Client on each admin workstation, by replacing the program file. The banner in the client links to the download. || **Note:** The AGENT keeps its own settings through an upgrade. Its address and its certificate are not disturbed. | **Tip:** Check the AGENTs tab a day after an upgrade. Anything still behind is a host that was off, or one that cannot reach the Data Collector, and the second case is worth investigating. ### 5.2 Certificates and AGENTs This section only matters if you turned on HTTPS. It is short, and worth reading before you have a problem rather than after. When an AGENT is installed against an HTTPS Data Collector, it is told which certificate to expect and it remembers it. From then on it will only talk to a Data Collector presenting that certificate. That is what stops something else impersonating your server. ||| **Important:** The consequence is the part people get caught by. If the Data Collector's certificate changes and the AGENTs were not told first, they cannot connect. They also cannot download an update, because that download uses the same certificate. The service on the host keeps running and looks perfectly healthy while sending nothing at all. Hosts can sit like this for weeks. Doing it safely * Change the certificate only from the Configuration app, using Install to Trust and Update Connected AGENTs on the Settings tab. That tells every connected AGENT in the same action. * Do it while your hosts are on, not overnight. Only connected AGENTs can be told. * Afterwards, check the AGENTs tab. The certificate column should be clear for every row. * Back up the certificate file with the database, as described in [5.3](#3-53-database-size-history-and-backup). Restoring a Data Collector without its original certificate has the same effect as changing it. Reading the AGENTs tab | What you see | What it means | What to do | | ---- | | No red mark | The AGENT expects the certificate you are serving. | Nothing. | | Certificate out of date, red | The AGENT expects a different certificate, or none, or it is too old to take part. | If it is still connected, use Install to Trust and Update Connected AGENTs. If it is not, see below. | | Online, but nothing arriving | The likely case is a certificate the AGENT no longer recognises. | Fix it by hand, below. | Fixing a host that can no longer connect This has to be done on the host, or over the network to its disk, because there is no working connection to fix it over. 1. Get the current thumbprint from the Configuration app, Settings tab, HTTPS Certificate. 1. Open the AGENT's settings file on the affected host. Over the network that is: \\HOSTNAME\C$\ProgramData\TruGrid RDS Manager Enterprise\Agent\appsettings.json 1. Set the CertificateThumbprint value to the current thumbprint. Take a copy of the file first. 1. Restart the TruGrid-RDSM-Agent service on that host. ``` Restart-Service TruGrid-RDSM-Agent ``` The host normally reappears within about a minute. Once it is back, it can be updated normally again. || **Note:** The folder is hidden by default in Explorer. Type the path rather than browsing to it. ### 5.3 Database size, history and backup What is kept, and for how long Detailed history is kept for 45 days by default. Older detail is summarised into hourly figures rather than being thrown away, so long-range charts still work while the database stays a sensible size. Tidying runs once a day in the background. | Data | Retention | | ---- | | Detailed session and performance history | 45 days by default, minimum 7 | | Hourly summaries used by long-range charts | Kept | | Audit log | Never deleted by the product | | Alert history | Never deleted by the product | | VM Pools records | Never deleted by the product, except when you delete a pool or a specific update history in the VM Pool Library | || **Note:** Retention is not on any screen. If you need it changed, contact TruGrid support rather than editing the database. Setting it to zero switches retention off completely and the database will grow without limit. How big to expect For a few hundred computers the database typically runs to a few gigabytes. If your system drive is small, move it to another volume using the File Locations section in [2.7](#3-27-review-the-settings) before it becomes a problem. It must stay on local disk: a network share is not safe for it. Backing up Everything that matters lives in one folder: C:\ProgramData\TruGrid RDS Manager Enterprise. Back up the whole folder. 1. Stop the TruGrid-RDSM-DC service. This flushes the database cleanly. 1. Copy the folder, including the database file, the configuration file and the certificate file. 3. Start the service again. ||| **Important:** Include the certificate file in the backup. If you rebuild the server without it, the Data Collector generates a new identity and every AGENT that remembers the old one stops reporting, exactly as described in [5.2](#3-52-certificates-and-agents). ### 5.4 Troubleshooting Nothing is appearing at all | Check | How | | ---- | | Is the service running? | Configuration app, status pill top right. | | Is polling on? | Configuration app, Overview. It should read Polling: ACTIVE. If not, Windows Service tab, Start Polling. | | Are any groups configured? | Computer Groups tab. With no groups, nothing is monitored and no AGENT can connect. | | Is your account allowed in? | Access Control tab. An empty list refuses everybody. | | Did you restart after changing groups? | See the warning in 2.5. | A page or column is blank | What is blank | Almost always | | ---- | | Processor and memory for some computers | Remote WMI is blocked or the service account has no rights there. On Windows 11 hosts, the WMI firewall rules are off by default. Install the AGENT, or deploy the policy in 2.2. | | The whole Logon Performance page | No AGENT on those hosts, or Logon auditing is off. The amber banner on the page names the hosts and gives the command. | | App Launches, everywhere | Process Creation auditing is off. Same banner treatment. | | Bandwidth columns and charts, on computers without an AGENT | The refresh interval is below 30 seconds. See the warning in 2.7. AGENT hosts are not affected. | | The Analytics Overview tab | The Computer filter is on All Computers. Pick one computer. | | Any Analytics tab | You have not clicked Refresh. Analytics never loads by itself. | | Round-trip time or per-application figures | Those need an AGENT. Give a new AGENT a few minutes to start reporting. | An AGENT is not reporting 1. On the host, check the service is running: sc.exe query TruGrid-RDSM-Agent 1. Check the host's computer account is in one of your watched groups. Allow five minutes for a membership change to be noticed. 1. Look for a crash log at C:\ProgramData\TruGrid RDS Manager Enterprise\Agent\agent-crash.log 1. Check the host can reach the Data Collector on 5743 or 5744. 1. If the service is running and nothing is arriving, suspect the certificate. See 5.2. An action failed | Message | Meaning | | ---- | | Access denied. Admin rights required on target. | Your Data Collector service account has no rights on that host. This is not a product fault. | | Registry key not found on target. | The host does not have the Remote Desktop drain-mode setting where expected. Usually not an RDS host. | | Failed to start shadow session | Remote Desktop shadowing is not permitted on that host. It is a Windows policy, set by Group Policy. | | Nothing happened when I clicked a button | On the Computers page, no row was selected. See the warning in 3.3. | | A refresh seemed to do nothing | Slow refreshes are deliberately not reported as errors. Wait, then refresh again. | | **Tip:** The Audit Log records failures as well as successes, with the error text. When somebody reports that something did not work, look there first: it tells you what was attempted, by whom, against what, and why it failed. --- ### Appendix A - Ports and firewall rules | From | To | Port | Needed for | | ---- | | Enterprise Client | Data Collector | TCP 5743 | Everything, unless you use HTTPS | | Enterprise Client | Data Collector | TCP 5744 | Everything, when HTTPS is on | | Session Host AGENT | Data Collector | TCP 5743 or 5744 | AGENT reporting | | Data Collector | Session hosts | TCP 135 | WMI, for hosts without an AGENT | | Data Collector | Session hosts | TCP 49152-65535 | WMI dynamic ports | | Data Collector | Domain controllers | TCP and UDP 389 | Reading groups | | Data Collector | Domain controllers | TCP 636 | Reading groups over LDAPS, if used | | Data Collector | Domain controllers | TCP and UDP 88 | Kerberos | | Data Collector | Domain controllers | TCP 3268 | Global catalog, if used | | Data Collector | DNS servers | TCP and UDP 53 | Name resolution | | Data Collector | vCenter | TCP 443 | VM Pools only | Not used by TruGrid RDSM Enterprise Manager: WinRM on 5985 and 5986, SMB on 445 for monitoring, SSH, and SNMP. --- ### Appendix B - Where the files live | What | Where | | ---- | | Data Collector settings, database and certificate | C:\ProgramData\TruGrid RDS Manager Enterprise | | Data Collector service program | C:\ProgramData\TruGrid RDS Manager Enterprise\TruGrid-RDSM-DC.exe, unless you moved it | | AGENT program | C:\Program Files\TruGrid\RDSM Agent | | AGENT settings | C:\ProgramData\TruGrid RDS Manager Enterprise\Agent\appsettings.json (hidden folder) | | AGENT crash log | C:\ProgramData\TruGrid RDS Manager Enterprise\Agent\agent-crash.log | | Enterprise Client settings, per administrator | %LOCALAPPDATA%\TruGrid RDS Manager Enterprise\client.cfg | | Service crash log | C:\ProgramData\TruGrid RDS Manager Enterprise\service-crash.log | | Windows service | Name | Display name | | ---- | | Data Collector | TruGrid-RDSM-DC | TruGrid RDS Manager Data Collector | | Session Host AGENT | TruGrid-RDSM-Agent | TruGrid RDSM Session Host Agent | --- ### Appendix C - What each role can do | | Admin | Image Operator | Help Desk | Read-Only | | ---- | | Open the Configuration app | Yes | No | No | No | | Change settings and Access Control | Yes | No | No | No | | View computers and sessions | Yes | Yes | Yes | Yes | | View analytics and logon performance | Yes | Yes | Yes | Yes | | View the audit log | Yes | Yes | Yes | Yes | | Message, sign out, disconnect, shadow | Yes | No | Yes | No | | Restart and shut down computers | Yes | No | Yes | No | | See the VM Pools page | Yes | Yes | No | Yes | | Create, grow, update and delete pools | Yes | Yes | No | No | || **Note:** A Read-Only Administrator sees buttons greyed out with a tooltip explaining why, rather than the buttons disappearing. Help Desk does not see the VM Pools page at all. --- ### Appendix D - Settings reference Set in the Configuration app, Settings tab | Setting | Default | Effect | | ---- | | HTTP Port | 5743 | The port the service listens on. Always listening, even with HTTPS on. | | Enable HTTPS | Off | Adds an encrypted listener using a self-signed certificate. | | HTTPS port | 5744 | The encrypted port. | | Refresh Interval | 60 seconds | How often computers without an AGENT are polled. Minimum 10. Keep at 30 or above so their bandwidth figures keep being collected. It does not affect computers with an AGENT, which are not polled at all. | | Start polling automatically | On | Whether collection begins when the service starts. | | Database File | In ProgramData | Move the database to another volume. | | Service Executable | In ProgramData | Move the service program. | Port and interval changes need a service restart. The dark or light theme and the two path settings save separately from the main Save Settings button. Set elsewhere in the Configuration app | Setting | Where | Effect | | ---- | | Watched computer groups | Computer Groups tab | Which computers are monitored, and which AGENTs may connect. | | Automatically add new VM Pool groups to | Computer Groups tab | Nests each new pool group inside one parent group, so pool machines are monitored immediately. | | Access Control list and roles | Access Control tab | Who may connect, and what they may do. | | vCenter connections | Hypervisor Connections tab | VM Pools targets. | | Allow parallel VM Pool operations | Hypervisor Connections tab, per connection | Off by default. Lets one vCenter build or update several pools at once, at the cost of more load on vCenter and storage. | | Discover timeout | Hypervisor Connections tab, per connection | 60 seconds by default, up to 600. Raise it for very large vCenters. | | VM Pools AD Account | Hypervisor Connections tab | The account that creates and deletes pool computer accounts. | Not on any screen These exist but have no user interface. Contact TruGrid support if you think you need one changed. | Setting | Default | Effect | | ---- | | History retention | 45 days | How long detailed history is kept. | | Provisioning concurrency | 10 | How many pool machines are built at once. | | Maintenance concurrency | 10 | How many resets, deletions or rebuilds run at once. | | Domain join timeout | 10 minutes | How long a new machine has to join the domain. | --- ### Appendix E - What is collected, and from where | Information | Without an AGENT | With an AGENT | How often | | ---- | | Online or offline | Yes, by ping | Yes | Each poll cycle | | Processor, memory, disk | Yes, by WMI | Yes, reported by the AGENT | 30 seconds | | Who is signed in, and their state | Yes, using quser | Yes | About 5 seconds with an AGENT | | Client name and address | Yes | Yes | Each poll cycle | | Sign-in and sign-out events | Yes | Yes | As they happen | | Logon phase breakdown | No | Yes | One record per sign-in | | Processor and memory per application | No | Yes | 30 seconds | | RDP round-trip time and bandwidth | No | Yes | 30 seconds | | Application launches | No | Yes, with auditing on | As they happen | | Clipboard and printer redirection | No | Yes | 30 seconds | | Reconnects and recovery time | No | Yes | As they happen | | Process list for a session | Yes, by WMI | Yes, faster and more reliable | On demand | || **Note:** Once a host has an AGENT that is reporting, the Data Collector stops polling that host across the network altogether and uses the AGENT's stream instead. End of guide \| TruGrid RDS Manager Enterprise \| Rev 3, 2026-07-27 \| Covers releases up to and including 2026.05.176