Behind the Scenes with VMware UEM Run Once Settings

I've recently had the opportunity to do a project with VMware UEM where we've made some use of the Run Once setting on a few config items (expect more on that later).  I was hesitant to build that setting into my design though, without having a thorough understanding of what it's doing behind the scenes (for example, what do I do if I need to make it run a second time for some reason?), so I did some research and experimenting.

Eventually, I came across a VMware KB Article describing the Run Once Special flag, which explained what was going on, although I still had to poke around a bit to find the file itself and fully understand the behavior.  That article described the Run Once process as creating flag files named .[L-computername.1] in the hidden FlexRepository user profile folder.  If those files are found for a given setting, it does not run the setting with that flag enabled. 

Let's look at an example Logon Task that has Run Once enabled, and how the system works.  When the user logs in, the system does the following:

1. Look in the hidden FlexRepository folder under the user's Archive folder for a corresponding *.[L-%ComputerName%.1] file for the task.  For example, if this Logon Task was named Robocopy Files, the system would look for \\server\share\%UserName%\archives\FlexRepository\Logon\Robocopy Files.xml.[1-%ComputerName%.1] file.
2. Since this is the first time this user has logged in, the file isn't there, and so the system performs the Logon Task as configured.
3. The user does their work, as normal.  When the user logs off, the system will create the \\server\share\%UserName%\archives\FlexRepository\Logon\Robocopy Files.xml.[1-%ComputerName%.1] file to record that the Logon Task was run.
4. On the next logon, the system will once again check for that files existence.  Since it's there now, the system will not run the Robocopy Files Logon Task.

There's a couple of things to note about that process.  Firstly, that flag file is created at logoff, not at task completion.  That means that a user session that ends abruptly (such as a desktop BSOD) will not create that file and so the Run Once task will be executed again.

Another thing to note is the name of the file: it has the computer name built into it.  As the KB article explains, Run Once means run once per user per computer, not run once globally per user.  If you need a task to be executed only once globally per user, follow the instructions in that KB article to modify the Task .xml file, replacing all instances of runOnce="1" with runOnce="1" runOnceSpecial="1".

One last thing to pay attention to is the folder structure and file names.  Note that, from the FlexRepository folder on down, the organization mirrors that of the of Config share's FlexRepository folder, including file names.  Just as my Robocopy Files logon task's configuration can be found in \\server\share\general\FlexRepository\Logon\Robocopy Profile.xml, the flag for its prior execution is in a ...\FlexRespository\Logon\Robocopy Profile.xml* file.  So, if I know where any given config's file is stored, I implicitly know where its Run Once flag files will be stored.