Guided Walkthrough: Publish Notepad

This walkthrough takes one concrete example from start to finish. You will create a test user and group, publish notepad.exe, deliver it two ways — as a single-app App Collection and as a full Virtual Desktop, both on the built-in lowtrust policy — then clone that policy to test_lowtrust and apply it to the Notepad workspace. Every value below is deliberately simple so you can follow along on a fresh server.

Before you start

Complete Phase 1 — Quick Validation first so you know the platform streams. You should be signed in to the admin panel at http://localhost:9008/admin/ with a valid licence.

Do the steps in order

The order matters. A workspace can only assign an application that already exists, and can only grant access to a group that already exists — the Add dialogs are empty otherwise. So you create the user (1), the group (2), and the application (3) before the workspaces (4–5). Nothing is auto-selected for you: after creating a workspace you must add the application and grant the group on separate tabs.

1. Create the test user

  1. Open Users in the left navigation and click Add User.
  2. Username: enter test-username.
  3. Fill in the display name, email, and password fields as required by your auth mode.
  4. Leave the account enabled and click Create.

Full details: Create a User.

2. Create the test group and add the user

  1. Open Groups and click Add Group.
  2. Name the group test-group and click Create.
  3. Open the test-group you just created and switch to its Members tab.
  4. Click Add Member, select test-username, and confirm.
Membership is required

Granting a workspace to test-group only reaches users who are members of that group. If you skip adding test-username to the group, the user will see nothing at login even though the workspace is granted. The built-in everyone group already contains all users, so you could grant to everyone instead — but this walkthrough uses test-group to keep the test isolated.

See Groups.

3. Publish Notepad as an application

  1. Open Applications and click Add Application.
  2. Click the Notepad preset chip under Quick Setup Presets. This fills in the name, description, and executable path C:\Windows\notepad.exe for you.
  3. Leave Status set to Active.
  4. Turn ON the Published (visible to users) toggle. It is off by default.
  5. Click Create.
Publish the application

An application that is Active but not Published cannot be added to a workspace and launched by users. Make sure the Published toggle is on before saving.

The application form: pick the Notepad preset, keep Status = Active, turn on Published, then Create.

See Publish an Application.

4. Publish the single app as an App Collection

Creating a workspace is a two-part process: you fill in the create form, and then — on the workspace's own detail page — you add the application and grant a group on two separate tabs.

4a. Create the workspace

  1. Open Workspaces and click Add Workspace.
  2. Name: enter Notepad (App).
  3. Type: select App Collection.
  4. Policy Set: open the dropdown (it defaults to None (use organization default)) and select lowtrust.
  5. Turn ON the Published (visible to users) toggle. It is off by default.
  6. Click Create. You are taken straight to the workspace's detail page, which has two tabs: Applications and Access Rights. Both are empty — you fill them in next.

4b. Add the Notepad application (Applications tab)

  1. On the Applications tab, click Add Application.
  2. In the dialog, open the Select Application dropdown and choose Notepad.
  3. Click Add. Notepad now appears in the workspace's application list.

4c. Grant the group (Access Rights tab)

  1. Switch to the Access Rights tab.
  2. Click Grant Access.
  3. In the dialog, open the Select Group dropdown and choose test-group (or everyone).
  4. Click Grant Access. The group now appears in the access list.
Nothing is auto-assigned

The application and the group are not selected automatically when you create the workspace. If you stop after clicking Create, the workspace has no apps and no access, and no user can launch it. You must complete steps 4b and 4c.

See App Collection.

5. Publish a Virtual Desktop

5a. Create the workspace

  1. Open Workspaces and click Add Workspace again.
  2. Name: enter Desktop (Test).
  3. Type: select Virtual Desktop.
  4. Policy Set: select lowtrust.
  5. Auto Launch App (optional): for a Virtual Desktop you may pick Notepad here so it opens automatically. Choosing an app here does add it to the workspace for you — the one place an app is auto-added.
  6. Turn ON the Published (visible to users) toggle and click Create.

5b. Grant the group (Access Rights tab)

  1. On the workspace detail page, switch to the Access Rights tab.
  2. Click Grant Access, choose test-group, and click Grant Access.

A Virtual Desktop still needs a group granted on the Access Rights tab — the Auto Launch choice only adds the app, not the access. Both workspaces now run on the same built-in lowtrust baseline. See Virtual Desktop.

6. Clone the policy to test_lowtrust

  1. Open Policies and select the built-in lowtrust set.
  2. Clone it. Name the copy test_lowtrust and Save.
Naming rule

Policy names must match ^[a-z][a-z0-9_]*$ — lowercase letters, digits and underscores only. A name like test-lowTrust is automatically normalized to test_lowtrust. See Policy Sets & the Editor.

7. Apply test_lowtrust to the Notepad app

  1. Open the Notepad (App) workspace from Workspaces and click Edit Workspace.
  2. Change the Policy Set dropdown from lowtrust to test_lowtrust.
  3. Click Update.

The application assignment and group access you set in step 4 are unchanged — only the policy changes. The App Collection now runs under your own copy of the policy, which you can tighten independently of the built-in template and of the Virtual Desktop workspace.

8. Verify

  1. Open Entitlements, select test-username, and confirm both workspaces, the Notepad application, and the expected policies (test_lowtrust for the App Collection, lowtrust for the desktop) appear.
  2. If a workspace is missing, re-check that it is Published, that the application is added on the Applications tab, and that test-group is granted on the Access Rights tab and contains test-username.
  3. Sign in as test-username at https://<your-server-address>/ and launch each workspace.
Access flows from the user, through test-group, to the two workspaces, the Notepad app, and their policies.
Where to go next

You now have the same app delivered two ways on a policy you control. To turn this into a repeatable delivery method — prove an app runs, dial in isolation, then project just its window — continue to Best Practices: SaaSification.