EUC-QUICLI key terms

A master virtual desktop or template, fully patched and configured, from which non-persistent desktops or published apps are cloned or provisioned. Changes made to the golden image propagate to new sessions after recomposition.

The process of rebuilding desktop pools from an updated golden image, replacing the OS disk while preserving user data and settings on a separate persistent disk. Typically scheduled during maintenance windows.

A virtual desktop whose OS state is discarded at logoff and reset to a clean baseline for the next user. User data must be redirected or stored separately to survive the reset.

A virtual desktop assigned to a specific user whose OS disk retains changes across sessions. It offers a familiar experience but consumes more storage and requires individual patching.

A Windows profile virtualization technology that stores the entire user profile in a VHD or VHDX file mounted at logon. It speeds logons and keeps settings consistent across pooled and non-persistent sessions.

A virtual disk containing a user's profile that is attached at logon to a pooled desktop. It differs from a full profile container in that only selected profile data is typically captured.

A Group Policy setting that moves user shell folders such as Documents and Desktop to a network share, so data persists independently of the local desktop or session host.

A technique that packages the OS, platform, and applications into separate layers combined at provisioning time. It lets one base image serve many app combinations without rebuilding images.

The process of capturing an application and its dependencies into a deployable format, such as MSIX, App-V, or an installer, so it can be delivered to virtual desktops or published to users.

Microsoft Application Virtualization, which streams and isolates applications so they run without traditional installation and can coexist even when they conflict. Sequencer tools convert installers into virtual packages.

Virtual Desktop Infrastructure, in which desktop operating systems run on centralized servers and users connect remotely. It centralizes management and data while shifting compute cost to the datacenter.

A server that runs multiple users' desktop sessions concurrently in a shared, session-based virtualization model. It is more cost-efficient than per-user VDI but offers less isolation.

The Windows Server role that hosts RemoteApp programs and shared desktop sessions. Users connect through a broker or gateway, and licensing requires RDS CALs.

A published application delivered through Remote Desktop Services that appears on the user's device as if installed locally, while actually running on a session host.

A desktop pool setting that permanently maps a specific user to a specific virtual machine, preserving personalization. Contrasts with floating assignment, where any user may receive any available desktop.

A pool configuration in which users are connected to whichever desktop is available at logon, maximizing utilization. It usually requires profile and data separation to preserve user state.

A collection of configuration settings linked to sites, domains, or organizational units and applied to users or computers. It is commonly used to enforce security baselines and map drives and printers.

A cloud-delivered policy in Microsoft Endpoint Manager that sets device or user settings such as Wi-Fi, certificates, and restrictions. It is the modern alternative to many Group Policy settings.

A set of rules, such as OS version, encryption, or firewall state, that a device must meet to be considered compliant. Conditional Access can then block or allow access based on that status.

An identity-driven policy engine that grants or blocks access based on signals such as user, device compliance, location, and risk. It enforces zero-trust decisions at the point of authentication.

An authentication method requiring two or more independent factors, such as a password plus an authenticator app code or hardware key. It reduces the impact of stolen credentials.

Sign-in without a password, using methods such as FIDO2 security keys, Windows Hello for Business, or passkeys. It removes a reusable secret that attackers can phish or replay.

Single Sign-On, a mechanism letting a user authenticate once and access multiple applications without re-entering credentials. It typically relies on federation protocols such as SAML or OpenID Connect.

A trust relationship between identity providers that allows users from one organization or domain to authenticate and access resources in another, often using SAML or WS-Federation tokens.

An authorization model that grants permissions to roles rather than individual users, and assigns users to those roles. It simplifies administration and supports least-privilege principles.

The principle of granting users and processes only the permissions necessary to perform their tasks, and no more. It limits the blast radius of compromised accounts and misconfiguration.

Controls that secure, monitor, and time-limit administrative accounts and sessions, often through vaulting, just-in-time elevation, and session recording. It targets the highest-risk credentials in an environment.

Windows full-disk encryption that protects data at rest on lost or stolen devices. Recovery keys must be escrowed, for example in Active Directory or Intune, to avoid permanent data loss.

A documented set of hardened configuration settings, often derived from vendor or government guidance, applied consistently to devices. Deviations are detected through monitoring and reporting.

A security tool that continuously records endpoint activity, detects suspicious behavior, and enables investigation and response. It complements antivirus by focusing on behavioral signals rather than known signatures.

A set of rules and controls that block common risky behaviors, such as Office macros spawning child processes or script execution from email. Rules reduce exploitable paths without removing user capability.

A cloud provisioning service that configures and enrolls new Windows devices with minimal IT interaction. Device profiles, enrollment status pages, and deployment profiles drive the out-of-box experience.

A setting that defines the out-of-box experience for Autopilot devices, including join type, naming template, and user-driven or pre-provisioned mode. It is assigned to device groups in Intune.

The process of registering a device with a mobile device management service so policies, apps, and certificates can be delivered. Enrollment establishes the management channel and device identity.

Bring Your Own Device, a model where employees use personal devices for work. It typically requires app-level protection and conditional access rather than full device management.

A cloud-based servicing approach that controls when Windows quality and feature updates install, using rings and deferral policies. It replaces some traditional WSUS patch-management workflows.

A feature that runs commands on remote computers over WinRM or SSH, enabling bulk administration and inventory. It requires appropriate firewall rules, authentication, and trust configuration.

A PowerShell management platform that declares the target configuration of a machine and enforces it. It detects drift and can remediate automatically, supporting idempotent configuration management.

A property of an operation that produces the same result whether run once or many times. Scripts and configuration tools should be idempotent so repeated runs do not cause unintended changes.

Windows Remote Management, the SOAP-based service that PowerShell Remoting and other tools use to execute commands and retrieve data from remote Windows hosts.

A Windows console for browsing logs from system, application, and security providers. Support engineers filter by event ID, level, and time to correlate symptoms with underlying errors.

A cloud service for querying and analyzing telemetry collected from devices and services. Queries use Kusto Query Language and can drive alerts, workbooks, and dashboards.

The query language used by Azure Monitor and Log Analytics to filter, aggregate, and visualize log data. Common operators include where, summarize, project, and join.

A Windows tool that samples counters such as CPU, memory, disk, and network to establish baselines and diagnose bottlenecks. It can log data for later analysis.

A structured sequence for resolving incidents: identify the problem, establish a theory, test it, act, verify, and document. Following it prevents random changes and preserves evidence.

The practice of tracing an incident to its underlying cause rather than its symptoms, often using techniques such as the five whys. Findings should feed back into prevention.

System Center Configuration Manager, an on-premises tool for deploying software, patches, and operating systems to large Windows estates. It can co-manage devices with Intune.