Adding to the article written about the Citrix ShareFile Outlook Plugin here is how to configure whether to launch/login to ShareFile On-Demand Sync in a XenDesktop / XenApp environment.
First a little background. In 2012 Citrix announced ShareFile On-Demand Sync for “Customers who are providing hosted desktops or hosted apps for their users have traditionally not been able to seamlessly integrate file sharing products because they use too much local storage and/or IOPS to be effective in those environments. When you have 100 users all sharing a single server you don’t want them to each also have several GB of local data that is constantly being synchronized.”
In some cases our customers want to deploy this for every user that logs in to the XenApp or XenDesktop image, in other cases they only want certain users or groups to use the ShareFile On-Demand Sync client. This post is meant to help those looking to target the On-Demand Sync client only at certain users/groups in XenApp or XenDesktop environment that are using a common image with the ShareFile On-Demand Sync client installed.
Information about configuring Citrix ShareFile On-Demand Sync is posted here and should be read and thoroughly understood before reading further. Pay particular attention to the Computer and User policies that are part of the GPO. http://support.citrixonline.com/en_US/sharefile/help_files/SF020021?title=Implementing+ShareFile+On-Demand+Sync (Be sure to download the full PDF and read that too)
By default the Sync Service is set to Manual and is only run when Sync Session Agent starts and does some GPO checks. So the design is to always have Sync Session Agent run and do some checks at session logon. In the case of XenApp published applications, the only way to actually start that process is through the Winlogon\AppSetup registry key. This is because the Run keys (HKLM\Software\Microsoft\Windows\Run) are not invoked in a seamless application as the Explorer Shell is never run.
When the machine policy for the Sync Disk volume is enabled (ShareFile GPO), we always hide the Sync Monitor process. The only time a user should be prompted or get a valid ShareFile session is when the ShareFile user policies are in place. If the user logging in does not have any ShareFile user policies associated with them, the Sync Session Agent still runs, but will not invoke any type of authentication because nothing is configured for that user.
So to bypass users having ShareFile On-Demand Sync in a shared environment, they should be in a separate Organizational Unit or Security Group in Active Directory that does not have any ShareFile user policies applied.