Session Isolation
The session.sessionIsolation node controls whether a user's environment settings persist between sessions (user affinity) or are fully reset each time (disposable). It governs profile cleanup, registry baseline restore, and how registry and filesystem preferences are journaled and replayed.
session.sessionIsolationProfile isolation
| Property | Type | Default | Notes |
|---|---|---|---|
profileCleanup | boolean | true | Purge profile directories (Temp, Downloads, Desktop, caches) at session start. |
registryRestore | boolean | true | Restore NTUSER.DAT from a clean baseline at session start. |
Registry preferences
Under sessionIsolation.registryPreferences — controls how user HKCU keys are saved and restored.
| Property | Type | Default | Notes |
|---|---|---|---|
mode | enum | detect | disabled: no persistence (clean slate). static: export/import an explicit key list. detect: a Detours DLL auto-journals all HKCU writes. |
preservedKeys | string[] | — | static mode: explicit HKCU key paths to export/import (e.g. Printers\Connections). |
detectIncludes | string[] | — | detect mode: path-prefix include filters (e.g. Software\, Printers\). |
detectExcludes | string[] | — | detect mode: path-prefix exclude filters to suppress noisy Explorer keys. |
Filesystem preferences
Under sessionIsolation.filesystemPreferences — controls how profile file paths are saved and restored.
| Property | Type | Default | Min | Notes |
|---|---|---|---|---|
mode | enum | disabled | — | disabled: no file persistence. static: explicit path list. detect: auto-journal writes under include filters. |
maxSizePerSessionMB | integer | — | 1 | Hard cap on total filesystem-hive size per session (MB). |
maxFileSizeMB | integer | — | 1 | Hard cap per individual file in the hive (MB). |
preservedPaths | string[] | — | — | static mode: relative profile paths to export/import (e.g. AppData\Roaming\Vendor\App). |
detectIncludes | string[] | — | — | detect mode: include filters relative to the profile root. |
detectExcludes | string[] | — | — | detect mode: exclude filters to skip caches and temp files. |
Sample
"sessionIsolation": {
"profileCleanup": true,
"registryRestore": true,
"registryPreferences": {
"mode": "detect",
"preservedKeys": ["Printers\\Connections"],
"detectIncludes": ["Software\\", "Printers\\"],
"detectExcludes": ["Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs"]
},
"filesystemPreferences": {
"mode": "disabled"
}
}
When the file-system trust level is disposable, the editor locks this whole section and the runtime forces both registry and filesystem preference modes to disabled — a disposable session never persists state.
This node uses per-key override with fallback: the runtime starts from the app.config.xml <profileCleanup> defaults (cleanup, registry restore, registry hive, filesystem hive) and applies the policy values for any key the policy sets. Keys the policy omits keep the global default.