EUC-QUICLI cheat sheet

EUC layers: physical endpoint, OS image, management agent, user profile, delivered apps, and data services; a fault in any layer can mimic a fault in another, so isolate layer by layer.

Roaming profiles copy the whole profile at logon and logoff; FSLogix and similar container solutions mount a virtual disk at logon, which reduces logon time and profile bloat.

Folder redirection moves known folders (Desktop, Documents, Downloads) to a network share while leaving the profile local; it does not redirect AppData unless explicitly configured.

A golden image is a versioned base; changes must be captured through a build pipeline, otherwise drift makes deployments non-reproducible.

User Environment Manager-style settings apply at logon, and policy precedence generally runs from computer policy to user policy, with more specific scopes overriding broader ones.

Non-persistent desktops discard OS changes at reboot; persistent desktops retain them. Choose persistence only when the app or user workflow requires local state.

Per-user costs of a virtual desktop include profile storage, app licensing, and session compute; concurrency ratio (active users per host) drives sizing more than total headcount.

Group Policy refresh intervals: background refresh every 90 minutes with a random offset up to 30 minutes; domain controllers refresh every 5 minutes.

Session-based virtualization shares one OS kernel across users; VDI gives each user a dedicated OS instance. Session hosts scale denser but have weaker isolation.

Published apps (RemoteApp-style) stream a single window from a session host; published desktops deliver a full desktop session. App publishing reduces per-user compute.

For app layering, sequence the package on a clean reference image matching the target OS build; mismatched sequencing hosts cause registration and runtime failures.

Protocol choices trade bandwidth against quality: adaptive codecs tune to available bandwidth, while lossless or high-fidelity modes demand stable low-latency links.

Profile containers must be excluded from antivirus real-time scanning of the VHD(X) file to avoid corruption and lock contention.

A host pool groups session hosts behind a broker; a workspace is the user-facing collection of app groups. Users see workspaces, not host pools.

Load balancing can be breadth-first (spread sessions evenly) or depth-first (fill hosts before using the next), which supports power management of idle hosts.

FSLogix profile containers require the supporting service and drivers on the host; missing drivers cause temporary profiles at logon.

Enrollment methods: manual, bulk/autopilot-style provisioning, group-based auto-enrollment, and co-management. Each yields a different trust and compliance baseline.

Configuration profiles set desired state (settings); compliance policies evaluate state and report. Compliance results can gate conditional access.

Push vs pull: MDM commands are queued and delivered on check-in, so a device that is offline shows pending status until the next sync.

Ring deployment: pilot ring, broad ring, then all devices. Rollback requires a prior known-good assignment, not just a new policy.

Windows Update for Business deferral days apply per quality or feature update; deadline settings force installation after the deferral window.

Device wipe vs retire: wipe removes data and returns the device to factory state; retire removes management and corporate data but leaves personal data.

BitLocker recovery keys should be escrowed to the directory during enrollment; without escrow, a TPM or boot change can strand the device.

Endpoint analytics metrics such as boot time and app crash rate are derived from telemetry, so sampling gaps can skew scores.

Authentication proves identity; authorization grants access. MFA strengthens authentication; conditional access enforces authorization context.

OIDC/SAML flows: authorization code with PKCE for public clients; client credentials for service-to-service with no user context.

Token lifetimes: access tokens are short-lived and validated by resource servers; refresh tokens are long-lived and must be rotated and revocable.

Conditional access evaluates signals (user, device compliance, location, risk) and then allows, blocks, or requires MFA or a compliant device.

Role-based access control assigns permissions to roles, then roles to principals; least privilege means scoping role assignments to the narrowest resource.

Passwordless methods: FIDO2 security keys, platform biometrics, and certificate-based auth. Each maps to a distinct authentication strength.

Federation trust requires matching identifiers (issuer, signing certificate, claim mapping). A certificate rollover without metadata refresh breaks SSO.

Privileged access: just-in-time elevation and approval workflows reduce standing admin rights; audit logs must capture activation and use.

Data classification drives protection: label, then apply encryption, retention, and DLP rules based on the label rather than ad hoc policy.

DLP policies match sensitive information types; false positives are tuned with confidence levels and policy tips, not by disabling the rule.

Retention vs deletion: retention keeps content for a period; a deletion policy removes it. A retention hold overrides user deletion until the hold expires.

Encryption at rest protects stored data; encryption in transit (TLS) protects the wire. Both are required for regulated workloads.

Compliance score reflects improvement actions against a control framework; it is not a certification and does not guarantee audit pass.

Audit log retention varies by license tier; export logs to a SIEM if you need retention beyond the built-in window.

Zero Trust pillars: verify explicitly, use least privilege access, and assume breach. Each control should map to one of these principles.

Risk detections (impossible travel, leaked credentials) feed identity protection policies; remediation can require password reset or risk-based MFA.

Troubleshooting order: reproduce, scope (one user vs many, one host vs all), check recent changes, then isolate the failing layer.

Log locations: OS event logs, application logs, agent logs, and broker/connection logs. Correlate timestamps across sources before concluding.

Performance counters for session hosts: CPU ready time, memory pressure, disk latency, and per-session input latency. High ready time indicates host contention.

Latency budget: user input to screen update. WAN round-trip plus protocol overhead plus host processing; measure each segment separately.

Black screen or disconnected session often traces to display driver, GPU policy, or profile mount failure; check the session host event log first.

SLA math: availability = uptime / total time. A 99.9% monthly target allows about 43 minutes of downtime per 30-day month.

Escalation requires evidence: collected logs, timestamps, affected scope, and reproduction steps. Missing evidence is the most common cause of bounce-back.

Synthetic monitoring (probe logons) detects broker or gateway failures before users report them; pair it with real-user telemetry.

Idempotency: a script should produce the same end state when run repeatedly. Use test-then-set logic rather than blind appends.

PowerShell parameter binding: use [CmdletBinding()] and typed parameters; -WhatIf and -Confirm come from SupportsShouldProcess.

Error handling: set $ErrorActionPreference = 'Stop' for terminating behavior in automation, and wrap in try/catch; check $LASTEXITCODE for native tools.

Secrets never belong in scripts. Use a vault or managed identity; rotate credentials and scope them to the minimum required API permissions.

Scheduled tasks and runbooks need a service identity with logged-on-as or managed identity context; interactive-user context fails when no one is signed in.

Desired State Configuration or declarative templates compare current state to target state and remediate drift; imperative scripts do not self-heal.

Logging: emit structured output (JSON) with timestamps and correlation IDs so automated runs can be audited and replayed.

Testing: Pester-style unit tests for functions, plus a dry-run against a pilot group before broad rollout; version scripts in source control.

Definition of EUC scope and lifecycle from procurement to retirement.

User profile types and their effect on logon performance.

Golden image versioning and drift control.

Policy precedence across computer and user scopes.

Session vs VDI isolation and density trade-offs.

App sequencing prerequisites and host matching.

Profile container exclusions for antivirus.

Host pool, app group, and workspace relationships.

Breadth-first vs depth-first load balancing.

Enrollment methods and trust baselines.

Configuration vs compliance policy roles.

Ring-based rollout and rollback requirements.

Wipe vs retire data outcomes.

BitLocker key escrow during enrollment.

Authentication vs authorization distinction.

OIDC authorization code with PKCE for public clients.

Access vs refresh token lifetimes and rotation.

Conditional access signal evaluation.

Least privilege via scoped role assignments.

Federation certificate rollover and metadata refresh.

Label-driven protection for encryption, retention, and DLP.

DLP false-positive tuning with confidence levels.

Retention hold overriding user deletion.

Encryption at rest and in transit both required.

Compliance score is not a certification.

Zero Trust pillars and control mapping.

Audit log retention limits by license tier.

Reproduce, scope, check changes, isolate layer.

Correlate timestamps across log sources.

Key session host performance counters.

End-to-end latency budget segmentation.

SLA availability math and monthly downtime allowance.

Escalation evidence requirements.

Synthetic probe logons for early detection.

Idempotent test-then-set logic.

PowerShell CmdletBinding and ShouldProcess.

Terminating errors with try/catch and LASTEXITCODE checks.

Secrets in vaults, not scripts.

Managed identity for unattended runbooks.

Declarative state and drift remediation.

Structured JSON logging with correlation IDs.

Pester tests and pilot dry runs.