Best Practices – Start Environments Strong with WEM or GPO

Starting a VDI environment on the right foot is always the best way to begin when deploying Citrix. Previously GPO was the easiest method to get this setup in a repeatable method, but with some of the new features in WEM you can go even further with your deployments. So what extra stuff can you see in the WEM templates vs traditional GPO templates?

• OneDrive External Task for launching OneDrive with your Published Application. Handy for organizations moving home folders to OneDrive.
• GPU vs Non-GPU and Persistent vs Non-Persistent configurations all in one single Template. Easy to flip between configurations as your environment changes.
• AppLocker Application Security Auditing enabled by default. As you review those audit logs it is quick and easy to move from Audit to Enforcing security in your environment.
• Basic Windows Optimizations enabled for CPU, Memory, Fast Logoffs, and Disconnected Session Optimization.

“Ok”, you say, “but why else would I want to use WEM, instead of the same GPO I have always used?”

Good question random internet citizen. There are far more features that are built-in to WEM that you can configure yourself. Such as:

1. UPM configuration. I am back to being a proponent for UPM over FSLogix. The new container mounting engine is amazing, and has replication of profiles built in. Get the best of both worlds. Container for OneDrive, and file based profiles for less empty space used than FSLogix, and if you use Windows 10 or Windows 11, use AppX Package attachment for all those store apps users want to use.
2. All the same post login configuration we have used in the past like; Printers and Drive Mapping, Environment Variables, launching of Applications in Desktops based on all types of filters and triggers.
3. Scripted Tasks. An overlooked gem. Restart services on your configuration set quickly. Kick off traces on all the machines. And more. Build your own PowerShell scripts, sign them, and automate your environment.
4. Application Updates and Delivery. Persistent machines in a Configuration Set? Update WEM from itself. Software you want deployed to your silo machine? Deploy it from WEM. No need to break out SCCM, Intune, etc. for your application control needs.
5. Moving away from Active Directory joined machines but want to continue to use all the Group Policy Templates and configurations? Migrate them to WEM and use them in non-domain joined or Azure Entra AD environments.

---

Here are the downloads and processes to get started. You will want to configure one method or the other. All the GPO settings are referenced in the WEM configuration. But there is a lot more available in the WEM configuration that aren’t in the GPO.

---

WEM Method

Setup the latest version of WEM following the Citrix Documentation.

Extract the contents of the JSONADMX.ZIP to that WEM Storage folder under \storage\gpo. These are the same ADMX and ADML files from March of 2025 used in the GPO Template Method.

Under the WEM Web Console click Configuration Sets -> Backup and restore -> Click the Upload button and upload the WEM_CVAD_TEMPLATE.json available inside the zip file available below.

Create an empty Configuration Set, and then restore this uploaded backup into that Configuration Set.

Modify the settings within this template to match your environment. Then create your own customized backup for future Configuration Set settings. Be sure and explore all the settings that are defined in the template. You may use more or less of those settings based on your environment. The following are a couple of examples under Group Policy Settings that you will need to make decisions on.

After you have created your organizations Template, and backed it up you now can create some Production Configuration Sets. My recommendation is to create configuration sets based on Delivery Groups. Each Delivery Group should be it’s own set with it’s own optimizations, configurations, and profile management for best practice and management. So these are the deployment steps.

1. Create a new Configuration Set for your Delivery group.
2. Restore YOUR organization backup settings to this Configuration Set.
3. Modify the Configuration Set for the specific settings for that Delivery Group.
4. Create an OU for your Delivery Group, and assign that to the Configuration Set. OU is my preferred deployment mechanism.
5. Move your Delivery Group machines into the new OU. Test machines first if you have them.
6. Install the WEM Agent onto the machines in the Delivery Group. I recommend installing it after the configuration is done, and the OU is bound, this prevents the agent from getting linked to the Unbound Agents and not switching over quickly to their final location.

---

Group Policy Template Method

Extract the ADMX and ADML files from the PolicyDefinitions.zip to \\Domain.Name\sysvol\Domain.Name\Policies\PolicyDefinitions. These are current as of March of 2025. They can directly replace any older versions of ADMX and ADML files installed currently.

Extract the Template GPOs to a folder on a machine with Group Policy Management Console.

Create the following 3 policies:

• CVAD Log Redirection
• CVAD System Config – GPU
• CVAD System Config -No GPU

Import the settings from the unzipped policies to the appropriate policy. Then modify them as necessary for your environment.