Application Resilience policies for VMware Workspace ONE

Application Resilience policies for VMware Workspace ONE are supported on devices running:

• a supported version of the Windows operating system

• PowerShell version 5.1 or higher

  Due to PowerShell restrictions imposed by Microsoft, Application Resilience isn't supported for this application on devices running Windows 11 SE.

• one of the following versions of VMware Workspace ONE:

  • 19.x or higher

    Significant software changes in higher versions may cause health checks to become invalid.

In addition to checking the version, the following table describes the health checks performed:

If you select Report higher versions as Compliant, higher versions report Compliant without running health checks.

Component	Test performed
Services	Installed	Running	Signed by
AirwatchService (TaskScheduler.exe)	P	P	One of the signers entered in the policy configuration By default, Signers contains "VMware, Inc.".

You can configure an Application Resilience policy for VMware Workspace ONE to enable the Application Resilience (RAR) component A lightweight software component of the Secure Endpoint Agent that detects the status of third party applications installed on a device. The component may also attempt to repair the third party application if it is non-compliant. The RAR component is deployed on a device only when the device is associated with a customized policy group and that policy group's Application Resilience policy is activated. to attempt to repair the VMware Workspace ONE agent if it's not functioning, or reinstall it if it's missing or can't be repaired.

Depending on the Absolute product licenses associated with your account, the Report and repair option, and the Report, repair, and reinstall option may not be available.

The RAR component of the Secure Endpoint Agent can respond to the following issues:

Issue	Resolution
Repair
The AirwatchService (TaskScheduler.exe) isn't running	The RAR component restarts the service.
The AirwatchService (TaskScheduler.exe) isn't installed and the service's executable can be detected on the device	The RAR component reinstalls the missing service.
Reinstall
Downgrades are not supported. If the version installed on a device is higher than the expected version, no action is taken.
The AirwatchService (TaskScheduler.exe) isn't installed and the service's executable cannot be detected on the device	If the application is installed, the RAR component uninstalls it. After the application is uninstalled, or if the application wasn't installed, the RAR component downloads and installs the configured version of the application.
VMware Workspace ONE failed to be repaired, or the expected version isn't installed

The installer:

• must be an MSI file

• can have any file name

Before you activate an Application Resilience policy you need to configure the policy. You need to configure the application version in addition to the settings in Configuring Application Resilience policies.

To configure the application version:

1. Under Application version, select 19.* or higher from the drop-down menu.

2. Under VMware Workspace ONE version, enter the version of VMware Workspace ONE you expect to be running on your devices.

   • The target version must be a sequence of digits separated by a period.

   • You can use wildcard "*" characters after the major version, for example, 19.*, 21.0.*, or 23.0.1.*.

   Make sure the version you are entering is consistent with version 19.x or higher.

If you selected the Report, repair, and reinstall option, you also need to configure these settings in addition to the settings in Configuring Application Resilience policies.

To configure the VMware Workspace ONE specific settings:

1. Under Device Services server URL, enter the URL of the Device Services server.
2. Under Organization group ID, enter the ID number of the organization group to which the devices belong in VMware Workspace ONE.

3. Under User or staging user, enter the Username and Password of the user who is being enrolled or the user who is staging the device on behalf of the user who is being enrolled.

   To verify that you've entered the password correctly, select the Show Password check box.

4. Under Enrolling user, enter the username of the user who is enrolling the device.

   Enrolling user is referred to as STAGEUSERNAME in the VMware Workspace ONE documentation.

5. Under Assign to logged in user?, choose whether to assign the device to the logged in domain user. To assign the device to the user who is logged in at the time, enter Y. Otherwise, enter N.
6. Under User being enrolled, do the following:

   1. [Optional] Enter the Email username of the user who is being enrolled.

      Email username is referred to as STAGEEMAILUSRNAME in the VMware Workspace ONE documentation.

   2. Enter the Password of the user who is being enrolled.

      Password is referred to as STAGEPASSWORD in the VMware Workspace ONE documentation.

   3. To verify that you've entered the password correctly, select the Show Password check box.
   4. [Optional] Enter the Email address of the user who is being enrolled.