Implementing NWA and Data Persistence on Self-Hosted Cameyo

This guide outlines the architecture, configuration steps and security best practices required to migrate self-hosted Cameyo servers from default local RemoteUser accounts to Native Windows Accounts (NWAs).

While default RemoteUser configurations are sufficient for standard deployments, complex or legacy Windows applications frequently require NWA to maintain user profile consistency, access specific local system permissions, or interface with legacy database configurations.

1. Architectural Overview & Infrastructure Mapping

In a default Cameyo self-hosted environment, sessions run under standard, dynamically assigned local RemoteUser accounts. However, legacy enterprise applications often require dedicated local directory identities to properly execute tasks, write to designated registry paths, or persist custom application configurations.

Migrating to Native Windows Accounts (NWA) shifts the session runtime environment to utilize standard Windows local user accounts, which must be aligned with Cameyo's session delivery engine.

Step-by-Step Local Database Mapping:

1. Open the Local Directory Editor: Access the Windows Server hosting your self-hosted instance and open the Local Users and Groups manager (lusrmgr.msc).
2. User Creation & Database Alignment: Create local Windows user accounts that map structurally to your directory organization. Ensure that account usernames precisely align with the usernames designated for application access within the Cameyo platform.
3. Security Group Assignment: To authorize these local accounts to run virtualized browser-based sessions, they must have Remote Desktop permissions. Manually add each newly created native user account to the built-in local Remote Desktop Users group on the hosting server.

2. Environment Configuration & Session Optimization via PowerTags

Once Native Windows Accounts are active, managing dynamically changing session environment variables (such as client terminal names, virtual computer names, and regional settings) requires administrative customization.

Cameyo utilizes session engine parameters known as PowerTags to dynamically pass configurations to NWA environments during session runtime.

Essential PowerTags for NWA Environments:

• Client and Computer Name Mapping: Use PowerTags to ensure legacy applications that check local system registry keys can read custom terminal variables rather than generic server hostnames.
• Keyboard and Layout Customization: Configure session environment variables to automatically map non-US keyboard layouts and localized regional environments directly within the active NWA user profile.

To review the complete command list and verify configuration syntaxes, refer to the official documentation on how to Customize your environment with PowerTags.

3. Data Persistence & Security Architecture

Migrating to NWA requires careful planning around data storage. Standard windows profile deletions can erase local application files once a user disconnects, disrupting workflow continuity.

Designing User File Persistence

To prevent data loss between virtual application sessions, administrators must implement robust file sync systems that capture NWA directory writes. Enterprise deployments should utilize specialized cloud syncing or mapped directory paths to ensure data persists. For complete step-by-step setup parameters, consult the guide to Configure data persistence in virtual apps.
 

Port Shielding and Cloud Tunneling

Deploying NWA on self-hosted environments must not compromise edge security.

• RDP Port Shielding: Do not expose standard Remote Desktop Protocol (RDP) inbound ports (e.g., port 3389) directly to the public internet.
• Cloud Tunneling: Ensure all virtualized applications stream strictly over secure HTTPS (TCP port 443) utilizing Cameyo's secure cloud tunnel architecture. This eliminates open inbound perimeter ports while allowing local Windows account processes to securely initialize within the local runtime container.

4. Server Setup & Verification of the NWA Framework

Before executing a wide-scale production migration, the core server configuration must be validated to ensure the underlying hosting environment is fully stabilized.

To verify foundational requirements, administrative configurations, and initial prerequisites, refer to the documentation on how to Set up a self-hosted server.

Post-Migration Verification Steps:

1. Publish a Sandbox Utility: Deploy a simple, low-overhead application (such as Command Prompt or Notepad) under NWA permissions to test the session-launch handshake.
2. Verify Session Mapping: Launch the test application and execute whoami to verify that the active session is running under the intended local Native Windows Account rather than a temporary RemoteUser profile.
3. Validate Directory Write Permissions: Confirm the account can write successfully to the designated profile directories and that persistence mechanisms execute correctly upon logoff.

For specific steps on publishing and testing test apps within a newly configured self-hosted instance, view the resource to Install and publish a basic app.

Relevant Resources

• On-premises Active Directory Integration: Official guide on shifting to dedicated local directory identities and Native Windows Accounts.
• Personal information accessed by Cameyo: Details the underlying mechanics of local data persistence and profile storage.
• Customize your environment with PowerTags
• Install and publish a basic app
• Create a server