EntitleForge
EntitleForge inventories the Windows master image — applications, Start menu shortcuts, executables, signatures — and associates applications with Active Directory groups. From there it creates the shortcuts in Citrix WEM, the AppLocker rules that let only the right groups run them and, with session Tiers, what each kind of device may open. Every plan is approved before it is applied, and every change is in an audit log that cannot be altered.
A web portal for the whole team, built on the model of the Citrix Cloud console. Below, on sample data, a plan is being applied: follow its steps and the verification on the canary VDA, then try the session simulator on the Tier matrix of the «uffici» policy and add an application to a group in «Start menu by group».
The interface is the product's own, in its original language; the data are sample data and the simulation is not connected to any system.
In a shared master image every user finds every installed program. Removing a shortcut from the Start menu does not prevent anyone from starting the executable from Explorer, the command prompt or PowerShell.
Keeping WEM actions, assignments and AppLocker rules aligned by hand, image after image, is slow and error-prone: one missed rule blocks a department, one rule too many opens a program to everyone.
You write once who may use which application. EntitleForge turns it into WEM shortcuts for the right groups and AppLocker rules that allow execution only to them: whoever is not entitled is blocked even when starting the executable directly.
Every change goes through a plan with the differences, the approval of a second person, a backup of the configuration set, a verification on a canary VDA and a journal for the rollback.
A read-only collector, with a graphical interface or from the command line, records applications, Start menu shortcuts, executables with their signatures and hashes, and the posture of the image. The service imports the bundle after checking its integrity and schema.
A visual editor or YAML: which groups run which applications, how the Start menu is organized, which shortcut flags apply. The Start menu can be previewed for a group or for a user, with their nested groups read from Active Directory.
Publisher, hash and path rules built deterministically from the inventory, a baseline that is always present, and the analysis of launchers such as cmd.exe and PowerShell that could be used to get around them.
Corporate, managed or personal device: a matrix shows which applications and desktop features each Tier allows, a simulator tells which Tier a session gets, and the deviceTRUST policy is deployed through WEM.
Every change is a plan with its differences and steps; a second person approves it; the apply backs up the configuration set, checks the result on a canary VDA and only then assigns the shortcuts.
An append-only audit log chained by hash, verification and drift scan against WEM, rollback object by object from the journal, and a break-glass procedure for emergencies.
The collector runs on the image in read-only mode and produces a bundle.
The service validates the bundle; you confirm the associations the engine does not decide on its own.
Applications, AD groups, Start menu and, if you want them, session Tiers.
The plan lists every change to WEM; someone other than its author approves it.
Backup, writes to WEM, verification on the canary, assignment of the shortcuts, final verification.
No: whoever knows the path can start the executable from Explorer, CMD or PowerShell. EntitleForge creates AppLocker rules so that only the entitled groups can run it; the shortcut is only presentation.
Configuration sets, actions and assignment targets go through the public WEM API; AppLocker rules, Application Security settings and shortcut assignments through the API of the WEM console. If that is not available, a break-glass procedure produces the files and runbooks to apply by hand, and records it in the audit log.
Rules start in Audit mode and move to Enforce later. Every apply is checked on a canary VDA before the shortcuts are assigned, and every run can be rolled back from the journal, object by object.
Only for session Tiers. Without them, every entitled application is available in every session.
No. EntitleForge is developed by Corellix Software Engineering. Citrix, Citrix Workspace Environment Management and deviceTRUST are trademarks of Cloud Software Group, Inc. or its subsidiaries; Windows and AppLocker are trademarks of Microsoft Corporation.
What is planned next. If you need one of these sooner, say so in your request.
Tell us how many images, applications and groups you manage: we will show you EntitleForge on sample data and plan a pilot on your WEM configuration set with you.
Rather write to us? Contact page
EntitleForge is designed, built and supported by Corellix Software Engineering: the team behind the Corellix platform, which also builds custom software, infrastructure tools and data migrations.
About us All solutions