Digital Employee Experience Management

Digital Employee Experience Management (DEEM) helps organizations gain insights into the employee experiences with their digital workspace. DEEM provides insights about apps, operating system stability, and performance. It also displays analytics for key performance indicators that impact employee experiences such as start time, shutdown time, logon, and logout events.

What is DEEM?

DEEM harvests telemetry from desktop devices and provides insights to take predictive actions. The Workspace ONE Intelligent Hub gets the data from devices and sends it to Workspace ONE Intelligence for display and interaction on the Devices and Apps dashboards. To harvest data, the Workspace ONE Intelligent Hub for Windows and macOS activate the collection of advanced desktop telemetry.

Note: Find DEEM data definitions in the Workspace ONE Intelligence Product Data Definitions section, DEEM Data Definitions.

What are the requirements to use DEEM?

• General requirements
  • Use Workspace ONE UEM console v2010 or later.
  • Use the Workspace ONE Intelligence service.
  • Use Windows or macOS devices that are managed in Workspace ONE UEM.
  • Use corporate-owned and corporate-shared devices.
• Windows
  • Use the Workspace ONE Intelligent Hub for Windows Desktop v20.10 or later.
• macOS
  • Use the Workspace One Intelligent Hub for macOS v21.07 or later.
  • Use the Workspace One Digital Experience for macOS on macOS devices.

What can you do with DEEM telemetry?

You can view and manipulate the data in modules. Focus your analysis to predict issues and to mitigate and fix problems. In the Desktop Device Dashboard module, find three tabs; Overview, Performance, and Errors.

• Overview - This tab has general data for enrolled devices that are active and inactive. The Total OS Crashes analytic reports failures specifically for Windows Desktop devices fed from the Workspace ONE Intelligent Hub.
• Performance - This tab displays statistics for Boot Time and Shutdown Time variables for your Windows Desktop devices. It uses bubble charts to visualize Critical and Warning thresholds for these variables. Select a bubble to get specific metadata. With this information, you can instantly see the devices that might need replacing or that need attention due to aged form factors and software. Configure the Performance tab to display data that aligns with your organization's definition of the Critical and Warning thresholds. To edit the thresholds, select the ellipses (…) in the bottom right of the Performance tab.
• Errors - This tab displays statistics for Crashes and Crash Rate of your Windows Desktop devices. It uses line graphs to visualize the events. Select a point on the line graph to focus your troubleshooting. With this information, you can quickly find problem devices, get the error codes for the failures, and fix the issue. In any module, you can use the Edit Columns setting to customize the data displayed on dashboards. View the data that is most helpful for your situation.

Where can you access DEEM telemetry data?

Access your DEEM telemetry data in Dashboards and in Solutions.

Dashboards

You can view and interact with DEEM telemetry data through dashboards in Workspace ONE Intelligence.

• Devices dashboard - Go to the Desktop Device Dashboard module using the View Dashboard setting to get performance and error data fed from devices through the Workspace ONE Intelligent Hub.
• Apps dashboard - Use several modules on this dashboard to view DEEM telemetry.
  • MAU for Top 10 Windows Apps - This module displays your most popular apps by the number of monthly active users. Perhaps an app you thought was helpful is not in this module? Then, there might be a problem with the app like it is hard to use, it does not install correctly, or users do not find it helpful with their work.
  • Windows Apps Errors - This module displays data for native, Windows apps except web apps. You can look at Crashes or Hangs data for these apps to identify apps that are not working or are constantly having problems.

Solutions

You can also interact with DEEM telemetry data using Solutions. This area of the console consolidates all Workspace ONE Intelligence components into a single space. For details, access DEEM Solution.

How do you activate DEEM using the Integrations section?

You can activate DEEM using the Integrations section of Workspace ONE Intelligence at Integrations > Desktop Advanced Telemetry > Set Up. Select Enable to start collecting telemetry data for your Windows Desktop or macOS devices managed in Workspace ONE UEM.

Note: You do not need to activate DEEM in the Integrations section if you already configured the feature in Solutions.

What category identifies DEEM data?

When working in Dashboard widgets in Workspace ONE Intelligence, look for the Employee Experience category.

What data does DEEM provide?

The DEEM system provides various telemetry.

• Organization Experience Score
• User Experience Score
• Desktop Apps Experience Score
• Mobile Apps Experience Score (For Intelligence SDK apps)
• Device Health
• Application Performance and Stability
• OS Crashes
• Login, and Logout
• Boot and Shutdown events and duration
• Windows Services Status
• Windows Performance Monitor Data

What is the DEEM footprint on your devices?

The footprint is comparatively small. The tested configurations for DEEM suggest a periodic impact of up to 5% CPU usage for a typical 4 core CPU. Tested configurations also suggest 10 to 40 Mb of memory usage on each Windows or macOS device. The Workspace ONE Intelligent Hub itself sends between 4K to 10K of data on randomized 10 minute intervals.

How do you find all the data attributes DEEM uses for Experience Scores?

For the latest list of attributes, which can change often, use Workspace ONE Intelligence. Viewing the attributes in the console ensures you see the most current list of attributes.

1. Go to Solutions > Digital Employee Experience Management > View Dashboard > Settings (gear icon) and select the Experience Scores tab.
2. Select any of the scores to see the contributing attribute. For example, select Device Health Experience Score and view the attributes for OS Crashes, which are frequency and date range.

Activate additional logon event reporting for DEEM (optional for Windows)

To feed additional DEEM metrics around the Windows logon/logoff experience into the User Experience Score, activate the listed advanced audit policies on the applicable Windows devices.

• Audit Logoff
• Audit Logon
• Audit Other Logon/Logoff Events
• Audit Special Logon

On the machine

You can activate these policies on the Windows machine using the listed process.

1. Open the Group Policy Editor (Gpedit.msc).
2. Go to Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies – Local Group Policy Object > Logon/Logoff.
3. Activate and configure each of the above policies for Success and Failure reporting.

With a CMD file

If you want to use a CMD file (batch file) to activate advanced audit policies, the listed code updates the applicable GPOs.

@echo off
echo "Machine Name,Policy Target,Subcategory,Subcategory GUID,Inclusion Setting,Exclusion Setting,Setting Value" >audit_policy.csv
echo ",System,Audit Logoff,{0cce9216-69ae-11d9-bed3-505054503030},Success and Failure,,3" >>audit_policy.csv
echo ",System,Audit Logon,{0cce9215-69ae-11d9-bed3-505054503030},Success and Failure,,3" >>audit_policy.csv
echo ",System,Audit Other Logon/Logoff Events,{0cce921c-69ae-11d9-bed3-505054503030},Success and Failure,,3" >>audit_policy.csv

auditpol.exe /restore /file:audit_policy.csv
del /f audit_policy.csv

With Baselines

Another way to activate the advanced audit policies is using Baselines. Baselines are curated settings grouped together to streamline Windows configurations. The listed process outlines the general steps to activate the advanced audit policies. For details about Baselines, access Using Baselines.

1. In Workspace ONE UEM, select the organization group.
2. Create a Baseline using a template in the console at Resources > Profiles & Baselines > Baselines.
3. Use the Windows Security Baseline template.
4. On the Customize tab, find the policies in Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies – Local Group Policy Object > Logon/Logoff.
5. Activate the settings for Success and Failure.
6. Save and assign the Baseline to applicable smart groups.
7. Restart devices to deploy Baselines.

Installation and Troubleshooting DEEM

If your devices are not sending telemetry data to Workspace ONE Intelligence for DEEM, you can troubleshoot the system by checking the status of the Workspace ONE Intelligent Hub and reviewing the log files.

Windows

These troubleshooting tips are specific to Windows.

Do you need to install a separate DEEM agent for Windows devices?

You do not need to install a DEEM agent on Windows devices. The DEEM Telemetry Agent for Windows is installed with the Workspace ONE Intelligent Hub for Windows. Find the agent in C:\Program Files (x86)\Airwatch\AgentUI\Telemetry.

How do you check that the Workspace ONE Intelligent Hub is running?

One way to troubleshoot issues with sending data to Workspace ONE Intelligence is to ensure the Workspace ONE Intelligent Hub or the DEEM Telemetry Agent for Windows is running on the Windows device. Start the Command Prompt app as an administrator and run sc query vmwosqext. This command displays the status of the DEEM Telemetry Agent service as VMWOSQEXT. You can also look for the service displayed as VMware Digital Experience Telemetry with the service name VMWOSQEXT.

What are the registry settings DEEM uses?

DEEM creates registry entries under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMWOSQEXT on the Windows device. This registry works for both the Workspace ONE Intelligent Hub and the DEEM Telemetry Agent for Windows.

Utility tool (tlmTool) for troubleshooting

To make troubleshooting easier, the DEEM Telemetry Agent v22.6.0 and later comes with a new utility tool called the tlmTool. Use the tlmTool to set log levels, collect log files, and package log files.

The tlmTool is installed on the device in the same directory as the DEEM Telemetry Agent for Windows at C:\Program Files (x86)\Airwatch\AgentUI\Telemetry. The installation path can be retrieved with a registry key at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMWOSQEXT\ImagePath.

How do you run the utility tool?

Run tlmTool as an administrator and use an execution policy with a PowerShell script. The PowerShell command is Set-ExecutionPolicy.

1. Run the Command Prompt app as an administrator.
2. Go to the installation path C:\Program Files (x86)\Airwatch\AgentUI\Telemetry.
3. Run tlmTool <options> [arguments].
   An example of what to enter in Command Prompt is tlmTool -setLogLevel Trace.
4. To view supported command options in the tlmTool, enter tlmTool -help in Command Prompt.

Command line options for the utility tool

Option	Usage	Description
-help	-help	Displays the help information for the tool.
-setLogLevel	-setLogLevel <Error\Info\Trace>	Sets the log level to <Error\Info\Trace>.
-resetLogLevel	-resetLogLevel	Resets the log level to default settings.
-setLogConfiguration	-setLogConfiguration maxLogSize <1..50>	Sets the maximum size of a log file in MB, and the range is 1-50.
	-setLogConfiguration maxTraceLogSize <1..50>	Sets the maximum size of a trace log file in MB, and the range is 1-50.
	-setLogConfiguration maxLogFiles <1..30>	Sets the maximum number of historical log files kept, and the range is 1-30.
-resetLogConfiguration	-resetLogConfiguration maxLogSize	Resets the maximum size of the log file to the default 1MB.
	-resetLogConfiguration maxTraceLogSize	Resets the maximum size of the trace log file to the default 10MB.
	-resetLogConfiguration maxLogFiles	Resets the maximum number of historical log files kept to the default 10.
-resetAllLogSettings	-resetAllLogSettings	Resets all the log settings to default, including log level and configurations.
-collectLog	-collectLog	Collects and packages the log files, and stores them in C:\Windows\Temp\Diagnostic by default.

How do you activate logging for the DEEM Telemetry Agent on the device?

• For the DEEM Telemetry Agent v22.6.0 and later, activate logging for DEEM by running the tlmTool command tlmTool -setLogLevel Trace without restarting the service.
• For older DEEM Telemetry Agents, activate logging for DEEM by updating the listed registry entry. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMWOSQEXT\ImagePath = “"C:\Program Files (x86)\Airwatch\AgentUI\Telemetry\vmwosqext.exe" --service --osq_named_pipe=vmwosqext.em --logger_min_status=0 --vmw_windows_log_verbose”
  After the registry changes, restart the service. The logs are then written to the folder C:\ProgramData\VMWOSQEXT.

macOS

These installation and troubleshooting tips are specific to macOS.

How do you install the Digital Experience for macOS app?

For macOS devices, you must have both the Workspace ONE Intelligent Hub for macOS and the Digital Experience for macOS installed. Get the Digital Experience for macOS from the My Workspace ONE site. You can install the Digital Experience for macOS package manually or by command line.

• On the macOS device, extract the package and follow the prompts.
• Deploy the package with any software delivery tool using the command sudo installer -pkg /tmp/VMware.Deem-macos-installer-x64.21.12.191.pkg -target /'.
• Use Workspace ONE UEM and the Workspace ONE Admin Assistant for macOS to browse the Digital Experience for macOS package and select the included PLIST file. For details about the Workspace ONE Admin Assistant, see Introduction to the Workspace ONE Admin Assistant for macOS.

How do you verify the macOS Digital Experience package is installed?

Verify that the package is installed and visible on the device at Library/Application Support/VMware/VMware.Deem folder.{{ }}.

How do you check that the Workspace ONE Intelligent Hub is running?

Verify the agent is running by looking in the Activity Monitor, viewing all processes, and validating that the deemd process is visible and running.

How do you work with DEEM logs?

View the deemd logs on the macOS device in Log Reports.

Reload the deemd daemon using the following commands.

• sudo launchctl unload /Library/LaunchDaemons/com.vmware.deemd.plist
• sudo launchctl load /Library/LaunchDaemons/com.vmware.deemd.plist