Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Configuring isolation modes for the file system and registry in ThinApp (1017265)

Last Updated: 5/16/2023Categories: How toTotal Views: 35422Language:
Chinese (Simplified)JapaneseEnglish

5 like this article

Subscribe to get an email
newsletter with new updates

5 people found this helpful Please provide article feedback:

Symptoms

A virtual application fails to run properly on a computer with the same application running natively.

One person's use of a virtual application in a multiuser environment affects other people's use of the same application.

A virtual application cannot access a necessary file on the physical computer.

A virtual application does not run correctly in a locked-down kiosk environment.

Purpose

This article provides in-depth information about ThinApp isolation modes.

Resolution

https://www.youtube.com/watch?v=MZBucvIohog

Subtopics of this article:

Three isolation mode choices

Directory and registry isolation modes

The Setup Capture wizard choices for isolation mode

Package.ini parameters for isolation mode

Summary of differences between isolation modes in the Setup Capture wizard and in Package.ini

Exceptions to the default isolation modes

Isolation mode for other drives

If isolation mode is set incorrectly for your application environment, the virtual application may interact with registry keys and files on the physical computer either too closely or not closely enough. Carefully consider what you want to achieve and set isolation mode accordingly.

Isolation modes allow you to control the degree to which a virtualized application can read from and write to the local, physical PC where the virtual application resides. ThinApp automatically configures isolation modes for directories in the file system and for registry subtrees in a ThinApp project. You can change the default isolation modes.

The Sandbox directory works in conjunction with isolation mode by providing a place to write user application data if the isolation mode forbids writing to the physical system.

For more information on the Sandbox, see the ThinApp User’s Guide: https://docs.vmware.com/en/VMware-ThinApp/index.html .

For example, with the proper selection of isolation mode, you can:

Disallow the integration of a user's application documents with the rest of the documents on the physical computer by storing the user's documents in the Sandbox. These documents are available whenever the user launches the virtual application.

Allow everyone using a computer to access each other's application documents by storing those documents on the physical computer.

Three isolation mode choices

ThinApp provides three isolation modes:

Full

Merged

WriteCopy

Full isolation of the virtual application means that the user cannot read from or write to the physical system. With Full isolation of the virtual application, users read from and write to the virtual "bubble." ThinApp records user registry and file system changes in a directory called the Sandbox.

For more information on the Sandbox, see the ThinApp User's Guide: https://docs.vmware.com/en/VMware-ThinApp/index.html.

Merged isolation of the virtual application means that the user can read from and write to the physical system.

WriteCopy isolation mode means that the user can read from the physical system, but cannot write to the physical system. Instead, the user writes to a copy of the physical system in the Sandbox.

For more information about the rules of precedence when both virtual and physical versions of the same element exist, see http://kb.vmware.com/kb/1006991 .

Directory and registry isolation modes

You can set default isolation modes for:

the file system

registry keys

You also can configure exceptions to these overall defaults. (For more information, see Exceptions.)

The Setup Capture wizard choices for isolation mode

The Setup Capture wizard allows you to configure only the default file system isolation mode.

The wizard provides a choice between two isolation modes:

Full write access to non-system directories (Modified Merged isolation mode)

Restricted write access (Modified WriteCopy isolation mode)

The Setup Capture wizard modifies the pure Merged and WriteCopy isolation modes by building in common exceptions.

Modified Merged isolation mode

The default file system isolation mode in the Setup Capture wizard is Full write access, or modified Merged.

The modified Merged isolation mode in the Setup Capture wizard allows users to write to any directory except for specified system directories. This is recommended for applications that you trust.

Almost every directory is writable, except for:

%AppData%

%Local AppData%

%Common AppData%

%SystemRoot%

%SystemSystem% (*see note below)

%ProgramFilesDir%

%Program Files Common%

* %SystemSystem%\spool remains as writable, so Setup Capture creates an exception file to preserve Merged mode in this subdirectory of %SystemSystem%.

Writes to these directories go to the Sandbox instead.

Modified WriteCopy isolation mode

The Restricted write access, or modified WriteCopy, isolation mode in the Setup Capture wizard prevents users from writing to any directory on the physical system except for a few specified user directories. Modified WriteCopy is recommended for applications you do not trust, or for legacy applications that you will deploy to more recent operating system versions. It is also recommended for virtual applications running in locked-down PC environments.

The only directories that are writable on the physical system with modified WriteCopy isolation mode are:

%Desktop%

%Personal% (My Documents)

%SystemSystem%\spool

All other writes go to the Sandbox.

Package.ini parameters for isolation mode

ThinApp writes the configurations that you selected in the Setup Capture wizard into a project configuration file called Package.ini. You can manually configure the Package.ini parameters with a text editor.

For more information on editing the Package.ini file, see the ThinApp User's Guide: https://docs.vmware.com/en/VMware-ThinApp/index.html .

The Setup Capture wizard provides a GUI only for the file system isolation mode, but not for registry isolation mode.

The configuration parameter in Package.ini for the default file system isolation mode is DirectoryIsolationMode.

The configuration parameter in Package.ini for the default registry key isolation mode is RegistryIsolationMode.

Both the DirectoryIsolationMode and the RegistryIsolationMode require the [Isolation] heading before them in the Package.ini file. For example:

[Isolation]

DirectoryIsolationMode=Merged

RegistryIsolationMode=Merged

DirectoryIsolationMode

The default DirectoryIsolationMode in Package.ini is Merged if you capture the application outside of Setup Capture with the snapshot.exe utility. This default directory isolation mode in Package.ini is the same as the default in the Setup Capture wizard.

If you capture the virtual application outside of Setup Capture, ThinApp also builds in the same exceptions to the isolation mode as in Setup Capture.

For more information about configuring exceptions, see Exceptions.

For more information about the snapshot.exe command-line utility, see the ThinApp User's Guide: https://docs.vmware.com/en/VMware-ThinApp/index.html

RegistryIsolationMode

The default RegistryIsolationMode in Package.ini is WriteCopy.

Note:

The Setup Capture wizard does not provide a GUI to change the registry isolation mode from its default value of WriteCopy. If you wish to change the default registry isolation mode, you must manually configure Package.ini. You can do this by briefly exiting the Setup Capture wizard to edit the project.

Summary of differences between isolation modes in the Setup Capture wizard and in Package.ini

Full isolation mode is not available as a choice in the Setup Capture wizard. You may use Full isolation mode in a manual configuration of isolation mode in Package.ini, but it is not recommended. Full isolation mode is best used only in exception files. (For example, if you use Full directory isolation mode as a default, ThinApp cannot use system DLLs.)

Configuration of the registry isolation mode is not available in the GUI of the Setup Capture wizard.

Exceptions to the default isolation modes

You can set up exceptions to the default isolation mode for specified directories or registry subtrees.

Both the Setup Capture wizard and snapshot.exe build in common exceptions to the pure Merged or WriteCopy isolation mode choices so that your virtual application behaves in the expected manner. These exceptions allow or disallow writing to specific directories. You can add to or change these exceptions.

Configuring an exception to the default DirectoryIsolationMode

The default file system isolation mode that you set applies to all directories. You may configure exceptions to the default directory isolation mode. An exception applies to the directory for which you set the exception and to all subdirectories.

To configure an exception to the default directory isolation mode, create and place a ##Attributes.ini file in the directory within the application project.

The application project is located by default in:

C:\Program Files\VMware\VMware ThinApp\Captures\

Here is an example of the contents of a ##Attributes.ini file:

Here is an example of the placement of the ##Attributes.ini file in the \%ProgramFilesDir%\Opera\defaults directory in the virtual application project:

Configuring an exception to the default RegistryIsolationMode

The default registry isolation mode that you set applies to all registry keys. You may configure exceptions to the default registry isolation mode. An exception applies to the registry key for which you set the exception and to all subkeys.

To configure an exception to the default registry isolation mode, create and place an HKEY_.txt file within the application project.

The application project is located by default in:

C:\Program Files\VMware\VMware ThinApp\Captures\

Here is an excerpt from an HKEY_LOCAL_MACHINE.txt registry key exception file:

Here is an example of the placement of this registry key exception file in the Opera 10.10 application project:

Isolation mode for other drives

Your setting for the default directory isolation mode applies not only to the local physical drive, but also to:

Virtual drives

For information about configuring a ##Attributes.ini exception file for virtual drives, see the documentation on the VirtualDrives Package.ini parameter in the ThinApp User's Guide: https://docs.vmware.com/en/VMware-ThinApp/index.html.

Your setting for the default directory isolation mode does not apply to:

Network drives

Removable disks and drives

By default, users can write to network drives and removable disks.

For information about how to turn off the ability to write to network drives and removable disks or drives, see the documentation on the SandboxNetworkDrives and SandboxRemovableDisk Package.ini parameters in the ThinApp User's Guide: https://docs.vmware.com/en/VMware-ThinApp/index.html .

Related Information

For information about making sure that users can write to the virtual application's working directory, see the documentation on the WorkingDirectory Package.ini parameter in the ThinApp User's Guide: https://docs.vmware.com/en/VMware-ThinApp/index.html .

For more information about isolation of shared memory objects and isolation of synchronization objects, see the IsolatedMemoryObjects and IsolatedSynchronizationObjects Package.ini parameters in the ThinApp User's Guide: https://docs.vmware.com/en/VMware-ThinApp/index.html.

For information about how isolation mode interacts with Application Link (AppLink), see Affecting Isolation Modes with Application Link in the ThinApp User's Guide:https://docs.vmware.com/en/VMware-ThinApp/index.html

For more information about troubleshooting isolation mode, see http://kb.vmware.com/kb/1006991.

The SandboxRemovableDisk Parameter in Package.ini in ThinApp
ThinApp でのファイル システムおよびレジストリの分離モードの構成
在 ThinApp 中为文件系统和注册表配置隔离模式

Page last reviewed: May 2023
Next review due: November 2023

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware ThinApp

Related Versions:

VMware ThinApp 5.x

VMware ThinApp 4.x

Take Our Survey

Support Assistant