How does ProfileDisk get configured on client machines? What does LwL.ProfileUnity.Client.Startup.exe do?

ProfileDisk Setup and Client Configuration

This article explains how ProfileUnity configures ProfileDisk on client machines — covering the clientsettings.xml file generated by the Management Console, how LwL.ProfileUnity.Client.Startup.exe consumes it, and the resulting update to LwlLogonNotifier.exe.config. It also covers the full logon-time workflow, prerequisites, common deployment scenarios (non-persistent VDI, persistent desktop, secure/CAC environments), and a reference for the key clientsettings.xml fields.

How the Configuration Flow Works

ProfileDisk configuration follows a three-stage pipeline:

1. Management Console → clientsettings.xml. After you define a ProfileDisk group in the Console (Administration → ProfileDisk), the Console generates an encrypted clientsettings.xml file containing the broker connection, license server, FlexDisk service endpoint, disk mode, virtual disk path, size, and group-to-AD-group assignments.
2. clientsettings.xml → Deployment Share. You deploy this file to the NETLOGON share (or the custom path shown under Administration → ProfileUnity Tools → Deployment Path) so that machines can reach it at logon time or during image preparation.
3. LwL.ProfileUnity.Client.Startup.exe → LwlLogonNotifier.exe.config. The Startup executable reads clientsettings.xml, decrypts the relevant sections, and writes the ProfileDisk configuration into C:\Program Files\ProfileUnity\FlexApp\LwlLogonNotifier.exe.config. At user logon, the NP credential manager (mpnotify.exe) reads this config and launches LwlLogonNotifier.exe to mount the correct VHDX.

Prerequisites

• ProfileUnity Console and Client Tools must be on the same version. See the ProfileUnity Version Matrix for current build numbers.
• A dedicated file share for ProfileDisk VHDX files is recommended. Grant the Domain Computers group Create / Read / Modify permissions on the share and the folder that will contain the per-user VHDX files.
• Create an AD group to assign users to the ProfileDisk configuration group.
• Secondary Logon service: ProfileDisk mounts the VHDX using an impersonation token by default. If the Secondary Logon service is disabled in your environment, add the registry value pdusecomputerperms = 1 (DWORD) under HKLM\Software\Liquidware Labs\ProfileUnity on the master image or via GPO before running the Startup executable. See How to enable ProfileDisk with Secondary Logon Disabled.
• CAC / smart-card environments: Additional Kerberos delegation steps are required. See ProfileDisk not Mounting in Highly Secured Environments using CAC Authentication and the CAC Best Practices guide.
• Server OS used as a desktop: VHD/VHDX mounting on Server editions requires the Hyper-V role or VHD-mount capability. See ProfileDisk does not mount on Server Operating Systems used as a desktop.

Step 1 — Configure ProfileDisk in the Management Console

1. In the Management Console, navigate to Administration → ProfileDisk.
2. Click Add ProfileDisk Group and configure:
   • AD Group Assignment — the group whose members will receive this ProfileDisk.
   • Storage Type — VHD or VHDX (VHDX recommended for Windows 8.1/Server 2012 R2 and later).
   • Virtual Disk Path — UNC path with the %username% variable, e.g. \\server\ProfileDiskShare\ProfileDisk\%username%\%username%.vhdx.
   • Disk Size — initial size in GB (expandable disks grow as needed up to this limit).
   • Disk Format — Fixed or Expandable.
   • Multi-Session — enable if users may log on to multiple machines simultaneously (e.g. RDS/Citrix).
3. Click Save Assignments, then Update.
4. Verify that Communication Type to Broker Messages is set to VHDX ProfileDisk. Click Update if you change it.

Step 2 — Deploy clientsettings.xml to the Network Share

After saving the ProfileDisk group, the Console updates its internal clientsettings.xml. You must push this file to the deployment share so that clients can read it.

1. In the Management Console, go to Administration → ProfileUnity Tools.
2. Click Download or Deploy Client Settings. Confirm that the Deployment Path shown (typically \\domain\NETLOGON\ProfileUnity or a custom share) is correct.
3. Check Overwrite existing files and click Deploy.
4. Verify that clientsettings.xml is present in the deployment share and has been updated (check the file's last-modified timestamp).

The deployed clientsettings.xml uses an encrypted format for connection strings. The plaintext structure contains these logical sections (see Field Reference below for details):

<?xml version="1.0" encoding="utf-8"?>
<ProfileDiskConfig xmlns:xsi="..." xmlns:xsd="..." version="3.0">
  <MqConnectionString>[encrypted]</MqConnectionString>
  <LicenseServerConnectionString>[encrypted]</LicenseServerConnectionString>
  <FlexDiskConnectionString>[encrypted]</FlexDiskConnectionString>
  <DiskMode>VHD</DiskMode>
  <ProfileDiskConfigGroups>
    <ProfileDiskConfigGroup>
      <Assignments>
        <Assignment name="domain\AD-Group" sid="S-1-5-..." />
      </Assignments>
      <MultiSession>True</MultiSession>
      <VirtualDiskCompression>False</VirtualDiskCompression>
      <VirtualDiskFormat>Expandable</VirtualDiskFormat>
      <VirtualDiskPath>\\server\share\%username%\%username%_.vhdx</VirtualDiskPath>
      <VirtualDiskSizeInGb>20</VirtualDiskSizeInGb>
    </ProfileDiskConfigGroup>
  </ProfileDiskConfigGroups>
  <LicenseMode>NamedUser</LicenseMode>
</ProfileDiskConfig>

Step 3 — Run LwL.ProfileUnity.Client.Startup.exe

LwL.ProfileUnity.Client.Startup.exe is the bootstrap executable that reads clientsettings.xml from the deployment share and updates the local client configuration. It must run in the SYSTEM context (or with local admin rights) so it can write to C:\Program Files\ProfileUnity\FlexApp\.

How it locates clientsettings.xml

By default the executable looks in the same directory from which it is launched. When launched via GPO Computer Startup Script (the recommended method), the path is the UNC share path of the script itself, e.g.:

\\domain\NETLOGON\GPO-Name\LwL.ProfileUnity.Client.Startup.exe

You can override the path to clientsettings.xml with the registry value ClientSettingsPath (REG_SZ) under HKLM\Software\Liquidware Labs\ProfileUnity.

GPO Computer Startup Script (recommended)

The most reliable delivery mechanism is a Computer Configuration → Windows Settings → Scripts → Startup GPO, targeting the machines that will use ProfileDisk. The image in this article shows an example GPO with the script configured as:

Name:       \\domain\NETLOGON\GPO-Name\LwL.ProfileUnity.Client.Startup.exe
Parameters: (none required)

What the Startup executable does

1. Reads clientsettings.xml from the deployment share path.
2. Decrypts the connection strings (MQ broker, license server, FlexDisk service).
3. Evaluates the ProfileDiskConfigGroups assignments to determine which groups are configured.
4. Writes the resolved ProfileDisk configuration into C:\Program Files\ProfileUnity\FlexApp\LwlLogonNotifier.exe.config.
5. Verifies that the local client tools are current; if the version on the share is newer, it updates the local installation in-place (persistent desktops only — non-persistent images should be recomposed).

What Gets Written to LwlLogonNotifier.exe.config

After a successful run of the Startup executable, the ProfileDisk section of C:\Program Files\ProfileUnity\FlexApp\LwlLogonNotifier.exe.config is populated with the decrypted endpoint addresses and the disk configuration for each assigned group. To verify the update was applied:

1. Open C:\Program Files\ProfileUnity\FlexApp\LwlLogonNotifier.exe.config in a text editor.
2. Confirm that the ProfileDiskConfig section contains the correct VirtualDiskPath for your environment.
3. Confirm that the connection strings are present (they remain encrypted in this file).

Logon-Time Workflow

Once LwlLogonNotifier.exe.config is in place, the following sequence occurs automatically each time a member of the assigned AD group logs on interactively. All executables below reside in C:\Program Files\ProfileUnity\FlexApp\.

1. mpnotify.exe — NP notification and group membership check. (logged in lwl_cred_mgr_*.txt) Windows calls the ProfileUnity Network Provider via mpnotify.exe immediately after the user authenticates. It confirms the logon is interactive (station name Winsta0, Authentication Type: MSV1_0:Interactive or KERBEROS:Interactive) — programmatic logons detected via station name SvcCtl are silently skipped. It then:
   • Reads LwlLogonNotifier.exe.config and loads all configured AD group assignments.
   • Obtains the user's token, resolves the user's SID and group list (up to 14+ groups checked), and confirms the user is a member of the assigned AD group.
   • Resolves the configured VHD path (%username% substitution) and constructs the LwlLogonNotifier.exe command line:

     "LwlLogonNotifier.exe" -u <username> -s <SID> -v <VHDPath> -q <size> -c <compression> -f <format>

   • Launches LwlLogonNotifier.exe in the user's security context and waits for it to exit.
2. LwlLogonNotifier.exe — VHDX attach. Resolves %username% in the virtual disk path, checks whether the VHDX exists on the share, and calls vhd.exe to attach it:

   "vhd.exe" /p \\server\share\<username>\ProfileDisk\<username>.vhdx /attachonly /log C:\Windows\Temp\ProfileUnity

   On success, records the resolved VHDX path and attach time (ms) in the registry at HKLM\Software\Liquidware Labs\ProfileDisk\<UserSID> (ProfileVhdPath, ProfileAttachTimeMs), then exits with code 0. The LwlLogonNotifier.log file is written to C:\Windows\Temp\ProfileUnity\.
3. vhd.exe — low-level VHD attach. Opens the VHDX file with read/write access and attaches it as a loopback disk (\\?\PhysicalDriveN). Logs to C:\Windows\Temp\ProfileUnity\ as vhd.log.
4. mpnotify.exe — disk location, cap import, mount point, and reparse. (logged in lwl_cred_mgr_*.txt) After LwlLogonNotifier.exe exits (code 0), mpnotify resumes and:
   1. Locates the attached disk by volume label (e.g. <username>-pd) via \\?\PhysicalDriveN / \\?\Volume{guid}\.
   2. Creates the mount point at C:\ProfileDiskMounts\<username> and grants the user full control to the volume.
   3. Imports userprofile.cap from the VHDX (C:\ProfileDiskMounts\<username>\<username>\userprofile.cap), restoring all 12 ProfileList registry values including ProfileImagePath = C:\Users\<username>.
   4. Sends the reparse point operations to the Container Service (local Kestrel HTTP endpoint); each returns HTTP 200 on success:
      • C:\Users\<username> → C:\ProfileDiskMounts\<username>\<username>
      • C:\Users\ProfileDisk\<username> → C:\ProfileDiskMounts\<username>\<username> (legacy path compatibility)
   5. Builds the lwl_profile_mgr.exe command line and writes it to the registry as ExportCommand under HKLM\SOFTWARE\Liquidware Labs\ProfileDisk\<UserSID>:

      "lwl_profile_mgr.exe" /profilepath C:\ProfileDiskMounts\<username>\<username>

   Windows then follows the reparse point and loads the user profile from the VHDX, transparently treating it as C:\Users\<username>.
5. lwl_profile_mgr.exe — profile path setup and registry export. Called by mpnotify.exe at logon using the ExportCommand written in the previous step. It performs two roles:
   • App and path fixup. Applies Chrome and Edge user data directory policy keys pointing into the mounted VHDX (C:\ProfileDiskMounts\<username>\<username>\AppData\Local\...) and creates the AppV target path on the disk.
   • Registry export. Exports the current ProfileList registry key (all 12 values including ProfileImagePath) to C:\ProfileDiskMounts\<username>\<username>\userprofile.cap on the VHDX. This cap file is what mpnotify imports at the start of the next logon (step 4c above) to restore the correct profile registry state before Windows loads the profile. Finally, it restores the default profile path registry value to %SystemDrive%\Users.

CAC / Smart-Card Mode Setup

In environments that require CAC (Common Access Card) or smart-card authentication, the standard ProfileDisk logon flow breaks at step 1 because mpnotify.exe cannot obtain a usable Kerberos token from the smart-card logon to impersonate the user when accessing the VHDX file share. Two resolution options are available; Option 1 (computer account) is recommended.

Option 1 — Computer account for VHDX access (recommended)

This option uses the machine account (DOMAIN\ComputerName$) rather than the user's token to mount the VHDX, avoiding Kerberos delegation entirely.

1. Move ProfileDisk storage outside the user profile share. The VHDX path must reside in a dedicated share separate from user home directories. Update the VirtualDiskPath in the Management Console to point to the new share, then redeploy clientsettings.xml.
   
   Before (avoid): \\server\share\%username%\ProfileDisk\%username%.vhdx
   After (CAC): \\server\ProfileDiskShare\ProfileDisk\%username%\%username%.vhdx
   
   The VHDX share must be separate from the share used for user home directories or roaming profiles — the computer account needs access to it independently of the user's credentials.
2. Grant Domain Computers access to the VHDX share. Give the Domain Computers group Create / Read / Modify permissions on the share and the folder that will contain the VHDX files.
3. Enable ProfileDisk System Mount/Unmount via GPO ADMX. In the ProfileUnity Computer GPO, navigate to:
   Computer Configuration → Administrative Templates → Classic Administrative Templates → Liquidware Labs → ProfileUnity
   Under both the 32-bit and 64-bit sections, set ProfileDisk System Mount Unmount to Enabled.
4. Set the SmartCardLogonNotify registry value as described in the callout above, then reboot.

Option 2 — AD service account for VHDX access

1. Create a dedicated service account in Active Directory with at least Read/Write permissions on the ProfileDisk VHDX share. Consider a share that contains only ProfileDisks (same guidance as Option 1). If the account password expires, the credential file must be regenerated — consider maintaining two accounts for rotation.
2. Generate the credential file. In the Management Console, hover over your username (top right) → Administration → scroll to ProfileUnity Tools. Enter the service account credentials and click Download or Deploy Service Configuration. Place the resulting LwL.ProfileUnity.Client.Service.exe.creds file in the same share/NETLOGON folder as the ProfileUnity client tools.
3. Ensure Startup.exe runs on boot from that same path. The creds file must be present alongside it. For Horizon Instant Clones, re-run on the master image after any creds update.
4. Enable ProfileDisk VHD CAC support via GPO ADMX. In the ProfileUnity Computer GPO, navigate to:
   Computer Configuration → Administrative Templates → Classic Administrative Templates → Liquidware Labs → ProfileUnity
   Under both the 32-bit and 64-bit sections, set ProfileDisk VHD CAC to Enabled.
5. Set the SmartCardLogonNotify registry value as described in the callout above, then reboot.

For full details see the CAC Authentication Best Practices guide and KB: ProfileDisk not mounting in highly secured environments using CAC authentication.

Deployment Scenarios

clientsettings.xml Field Reference

The table below describes each element in clientsettings.xml. The connection string values are AES-encrypted by the Console and cannot be edited manually; all other values are plaintext and reflect what was configured in the Management Console.

Related Articles

• ProfileDisk Full User Profile Delivery (Product Docs)
• How to add VHD/x ProfileDisk to your current ProfileUnity setup
• How to enable ProfileDisk with Secondary Logon Disabled
• ProfileDisk not Mounting in Highly Secured Environments using CAC Authentication
• ProfileDisk does not mount on Server Operating Systems used as a desktop
• CAC Authentication Best Practices Guide (Product Docs)
• ProfileUnity Version Matrix
• ProfileUnity Hot Fix List