Troubleshooting ProfileDisk Setup and Configuration WorkFlow

How does ProfileDisk get configured on client machines? What does LwL.ProfileUnity.Client.Startup.exe do?

This article explains how ProfileUnity configures ProfileDisk on client machines — covering the clientsettings.xml file generated by the Management Console, how LwL.ProfileUnity.Client.Startup.exe consumes it, and the resulting update to LwlLogonNotifier.exe.config. It also covers the full logon-time workflow, prerequisites, common deployment scenarios, and a reference for the key clientsettings.xml fields.

How the Configuration Flow Works

ProfileDisk configuration follows a three-stage pipeline:

1. Management Console → clientsettings.xml. After you define a ProfileDisk group in the Console (Administration → ProfileDisk), the Console generates an encrypted clientsettings.xml file containing the broker connection, license server, FlexDisk service endpoint, disk mode, virtual disk path, size, and group-to-AD-group assignments.
2. clientsettings.xml → Deployment Share. You deploy this file to the NETLOGON share (or the custom path shown under Administration → ProfileUnity Tools → Deployment Path) so that machines can reach it at logon time or during image preparation.
3. LwL.ProfileUnity.Client.Startup.exe → LwlLogonNotifier.exe.config. The Startup executable reads clientsettings.xml, decrypts the relevant sections, and writes the ProfileDisk configuration into C:\Program Files\ProfileUnity\FlexApp\LwlLogonNotifier.exe.config. At user logon, the NP credential manager (mpnotify.exe) reads this config and launches LwlLogonNotifier.exe to mount the correct VHDX.

Prerequisites

• ProfileUnity Console and Client Tools must be on the same version. See the ProfileUnity Version Matrix for current build numbers.
• A dedicated file share for ProfileDisk VHDX files is recommended. Grant the Domain Computers group Create / Read / Modify permissions on the share and the folder that will contain the per-user VHDX files.
• Create an AD group to assign users to the ProfileDisk configuration group.
• Secondary Logon service: ProfileDisk mounts the VHDX using an impersonation token by default. If the Secondary Logon service is disabled, add the registry value pdusecomputerperms = 1 (DWORD) under HKLM\Software\Liquidware Labs\ProfileUnity on the master image or via GPO before running the Startup executable. See How to enable ProfileDisk with Secondary Logon Disabled.
• CAC / smart-card environments: Additional Kerberos delegation steps are required. See ProfileDisk not Mounting in Highly Secured Environments using CAC Authentication and the CAC Best Practices guide.
• Server OS used as a desktop: VHD/VHDX mounting on Server editions requires the Hyper-V role or VHD-mount capability. See ProfileDisk does not mount on Server Operating Systems used as a desktop.

Step 1 — Configure ProfileDisk in the Management Console

1. In the Management Console, navigate to Administration → ProfileDisk.
2. Click Add ProfileDisk Group and configure:
   • AD Group Assignment — the group whose members will receive this ProfileDisk.
   • Storage Type — VHD or VHDX (VHDX recommended for Windows 8.1/Server 2012 R2 and later).
   • Virtual Disk Path — UNC path with the %username% variable, e.g. \\server\ProfileDiskShare\ProfileDisk\%username%\%username%.vhdx.
   • Disk Size — initial size in GB (expandable disks grow as needed up to this limit).
   • Disk Format — Fixed or Expandable.
   • Multi-Session — enable if users may log on to multiple machines simultaneously (e.g. RDS/Citrix).
3. Click Save Assignments, then Update.
4. Verify that Communication Type to Broker Messages is set to VHDX ProfileDisk. Click Update if you change it.

Step 2 — Deploy clientsettings.xml to the Network Share

After saving the ProfileDisk group, the Console updates its internal clientsettings.xml. You must push this file to the deployment share so that clients can read it.

1. In the Management Console, go to Administration → ProfileUnity Tools.
2. Click Download or Deploy Client Settings. Confirm the Deployment Path shown (typically \\domain\NETLOGON\ProfileUnity or a custom share) is correct.
3. Check Overwrite existing files and click Deploy.
4. Verify that clientsettings.xml is present in the deployment share and has been updated (check the file's last-modified timestamp).

The deployed clientsettings.xml uses an encrypted format for connection strings. The plaintext structure contains these logical sections (see Field Reference below for details):

<?xml version="1.0" encoding="utf-8"?>
<ProfileDiskConfig xmlns:xsi="..." xmlns:xsd="..." version="3.0">
  <MqConnectionString>[encrypted]</MqConnectionString>
  <LicenseServerConnectionString>[encrypted]</LicenseServerConnectionString>
  <FlexDiskConnectionString>[encrypted]</FlexDiskConnectionString>
  <DiskMode>VHD</DiskMode>
  <ProfileDiskConfigGroups>
    <ProfileDiskConfigGroup>
      <Assignments>
        <Assignment name="domain\AD-Group" sid="S-1-5-..." />
      </Assignments>
      <MultiSession>True</MultiSession>
      <VirtualDiskCompression>False</VirtualDiskCompression>
      <VirtualDiskFormat>Expandable</VirtualDiskFormat>
      <VirtualDiskPath>\\server\share\%username%\%username%_.vhdx</VirtualDiskPath>
      <VirtualDiskSizeInGb>20</VirtualDiskSizeInGb>
    </ProfileDiskConfigGroup>
  </ProfileDiskConfigGroups>
  <LicenseMode>NamedUser</LicenseMode>
</ProfileDiskConfig>

Step 3 — Run LwL.ProfileUnity.Client.Startup.exe

LwL.ProfileUnity.Client.Startup.exe is the bootstrap executable that reads clientsettings.xml from the deployment share and updates the local client configuration. It must run in the SYSTEM context (or with local admin rights) so it can write to C:\Program Files\ProfileUnity\FlexApp\.

How it locates clientsettings.xml

By default the executable looks in the same directory from which it is launched. When launched via GPO Computer Startup Script (the recommended method), the path is the UNC share path of the script itself, e.g.:

\\domain\NETLOGON\GPO-Name\LwL.ProfileUnity.Client.Startup.exe

You can override the path to clientsettings.xml with the registry value ClientSettingsPath (REG_SZ) under HKLM\Software\Liquidware Labs\ProfileUnity.

GPO Computer Startup Script (recommended)

The most reliable delivery mechanism is a Computer Configuration → Windows Settings → Scripts → Startup GPO, targeting the machines that will use ProfileDisk:

Name:       \\domain\NETLOGON\GPO-Name\LwL.ProfileUnity.Client.Startup.exe
Parameters: (none required)

What the Startup executable does

1. Reads clientsettings.xml from the deployment share path.
2. Decrypts the connection strings (MQ broker, license server, FlexDisk service).
3. Evaluates the ProfileDiskConfigGroups assignments to determine which groups are configured.
4. Writes the resolved ProfileDisk configuration into C:\Program Files\ProfileUnity\FlexApp\LwlLogonNotifier.exe.config.
5. Verifies that the local client tools are current; if the version on the share is newer, it updates the local installation in-place (persistent desktops only — non-persistent images should be recomposed).

What Gets Written to LwlLogonNotifier.exe.config

After a successful run of the Startup executable, the ProfileDisk section of C:\Program Files\ProfileUnity\FlexApp\LwlLogonNotifier.exe.config is populated with the decrypted endpoint addresses and the disk configuration for each assigned group. To verify the update was applied:

1. Open C:\Program Files\ProfileUnity\FlexApp\LwlLogonNotifier.exe.config in a text editor.
2. Confirm that the ProfileDiskConfig section contains the correct VirtualDiskPath for your environment.
3. Confirm that the connection strings are present (they remain encrypted in this file).

Logon-Time Workflow

Once LwlLogonNotifier.exe.config is in place, the following sequence occurs automatically each time a member of the assigned AD group logs on interactively. All executables reside in C:\Program Files\ProfileUnity\FlexApp\.

Programmatic logons (station name SvcCtl) are silently skipped; only interactive logons (station name Winsta0, Authentication Type: MSV1_0:Interactive or KERBEROS:Interactive) trigger the workflow.

CAC / Smart-Card Mode Setup

In environments that require CAC (Common Access Card) or smart-card authentication, the standard ProfileDisk logon flow breaks at step 1 because mpnotify.exe cannot obtain a usable Kerberos token from the smart-card logon to impersonate the user when accessing the VHDX file share. Two resolution options are available; Option 1 (computer account) is recommended.

Option 1 — Computer account for VHDX access (recommended)

Uses the machine account (DOMAIN\ComputerName$) rather than the user's token to mount the VHDX, avoiding Kerberos delegation entirely.

1. Move ProfileDisk storage to a dedicated share. Update the VirtualDiskPath in the Management Console to point to the new share, then redeploy clientsettings.xml. The VHDX share must be separate from user home directories or roaming profiles.
2. Grant Domain Computers access to the VHDX share. Give the Domain Computers group Create / Read / Modify permissions on the share and the folder that will contain the VHDX files.
3. Enable ProfileDisk System Mount/Unmount via GPO ADMX. In the ProfileUnity Computer GPO, navigate to: Computer Configuration → Administrative Templates → Classic Administrative Templates → Liquidware Labs → ProfileUnity. Under both the 32-bit and 64-bit sections, set ProfileDisk System Mount Unmount to Enabled.
4. Set the SmartCardLogonNotify registry value as described in the callout above, then reboot.

Option 2 — AD service account for VHDX access

1. Create a dedicated service account in Active Directory with at least Read/Write permissions on the ProfileDisk VHDX share. If the account password expires, the credential file must be regenerated — consider maintaining two accounts for rotation.
2. Generate the credential file. In the Management Console, hover over your username (top right) → Administration → scroll to ProfileUnity Tools. Enter the service account credentials and click Download or Deploy Service Configuration. Place the resulting LwL.ProfileUnity.Client.Service.exe.creds file in the same NETLOGON folder as the ProfileUnity client tools.
3. Ensure Startup.exe runs on boot from that same path. For Horizon Instant Clones, re-run on the master image after any creds update.
4. Enable ProfileDisk VHD CAC support via GPO ADMX. Under both the 32-bit and 64-bit sections, set ProfileDisk VHD CAC to Enabled.
5. Set the SmartCardLogonNotify registry value as described in the callout above, then reboot.

Deployment Scenarios

Troubleshooting

Start every investigation by collecting the logs from C:\Windows\Temp\ProfileUnity\ on the affected endpoint. The lwl_cred_mgr_*.txt log is the primary diagnostic source — one file is created per logon event.

ProfileDisk does not mount at logon — no error visible

VHDX attach fails — error in LwlLogonNotifier.log or vhd.log

Startup executable runs but LwlLogonNotifier.exe.config is not updated

CAC / smart-card environments — ProfileDisk does not mount

clientsettings.xml Field Reference

The table below describes each element in clientsettings.xml. The connection string values are AES-encrypted by the Console and cannot be edited manually; all other values are plaintext and reflect what was configured in the Management Console.

Related Articles

• ProfileDisk Full User Profile Delivery (Product Docs)
• How to add VHD/x ProfileDisk to your current ProfileUnity setup
• How to enable ProfileDisk with Secondary Logon Disabled
• ProfileDisk not Mounting in Highly Secured Environments using CAC Authentication
• ProfileDisk does not mount on Server Operating Systems used as a desktop
• CAC Authentication Best Practices Guide (Product Docs)
• ProfileUnity Version Matrix
• ProfileUnity Hot Fix List