Customize your environment with PowerTags

PowerTags are a powerful feature for customizing virtualized application environments. PowerTags are metatags that can be assigned to various entities within a virtualized environment, including users, user groups, apps, servers, clusters, or the entire account (global). For example, you can use a PowerTag to define custom behavior for sessions or to inject environment variables directly into the Windows session.

Custom behavior with PowerTags

PowerTags offer granular control and can be applied at different levels:

• Individual users
• User groups
• Individual apps
• Sessions
• Specific servers
• Server clusters
• Company account

How to use a PowerTag

To use a PowerTag to customize a feature or a component, you locate the relevant option on the Cameyo Admin console and add a line to the PowerTags input field.

In general:

• PowerTags can be placed at application, server, cluster, user, usergroup or company-wide level.
• If there's no value set, the PowerTag is not used (not enabled).

For example: Prevent accidental tab closure

During Cameyo sessions, users can accidentally close the tab they are working in, resulting in unexpected closure of the Cameyo session. This could potentially lead to a loss of work and require the user to relaunch the application session. 

1. On the Cameyo Admin console, click Servers .
2. To open the Details page of your chosen server, click the hyperlinked server name.
3. Navigate to General > PowerTags.
4. On a new line, enter !CLOSECONFIRM=1 to set a server-wide setting.
5. At the bottom of the screen, click Save.
6. Restart your Cameyo server for the new PowerTag value to take effect for apps running on that server.

Once !CLOSECONFIRM is switched on, every time a user closes a tab, a message displays prompting them to click Leave to confirm that they want to close the tab, or Cancel to return to the app.

Supported PowerTags and their functions

These are the supported PowerTags that you can use to control various aspects of the virtualized environment and user sessions.

Open all   |   Close all

Users and Cameyo portal

PowerTag	Description
!AD_ADMIN_GROUPS	Allows specified Active Directory (AD) user groups to become Cameyo admins. When configured at the company level, users belonging to the specified AD groups are automatically granted Admin privileges in the Cameyo portal. For more details, see Cameyo user roles. Related tags include: !AD_SUBADMIN_GROUPS for SubAdmin mapping  !AD_POWERTAGS for AD group-based PowerTag assignment
!AUTHTTL=[minutes]	Company-level PowerTag for setting the authentication cache cookie duration after which the user is logged off and re-authentication is necessary (by default 10 days). Note: This takes effect after a sign-in (so if you're already signed in, sign out and sign in again after applying this PowerTag).
delete_days	delete_days is a parameter used within the company-level !INACTIVEUSERS PowerTag. It defines the number of inactivity days after which Cameyo automatically deletes users. Minimum number of days of inactivity allowed is 14. If set 0, users are never deleted.
!FAVICON	Changes browser icon from Cameyo icon to an online ICO file, for example, !FAVICON=https://someurl.com/favicon.ico, allowing customization of portal favicon.
!INACTIVEUSERS=[delete_days/report_days]	Delete or report inactive users (company-level PowerTag only). For example: !INACTIVEUSERS=60/45: Sends a report for users who have been inactive for 45 days, and automatically deletes users who have been inactive for 60 days.
!PWDEXPIRE=X	Cameyo logins only passwords expire after X number of days, after which they must be changed.
!PWDREGEX=regex	Cameyo logins only regular expression for password strength validation.
report_days	report_days is a parameter used within the company-level !INACTIVEUSERS PowerTag. It defines the number of days a user must remain inactive before the system generates and sends an inactivity report. Report is submitted by email, or 0 for never.
!UKRAINE=1	Ukraine-supportive theme and colors for the portal, to be applied at the company level.
!USERSETTINGS=0	Disables the ability for end users to access My Profile.

File dialogs and storage for user groups

PowerTag	Description
!FILEDIALOG_EXTRA !FILEDIALOG_MYFILES !STORAGEFILEDIALOG  !STORAGEFILEDIALOGPATHS	Controls the Cameyo File Dialog. Set to either !FILEDIALOG_EXTRA=1 (enable) or !FILEDIALOG_EXTRA=0 (disable). Adds extra folders or drive mappings to the Cameyo custom file dialog. Controls the Cameyo File Dialog and allows administrators to make additional local directories or drives visible to users within the custom Open and Save file dialog.
!EXPLORER	Controls access to built-in Windows Explorer alongside their Cameyo app. Set to either !EXPLORER=1 (enable) or !EXPLORER=0 (disable). When enabled, users can launch and interact with the Windows Explorer (explorer.exe) inside their virtual session, providing built-in file browsing and management capabilities alongside the virtualized application.
!PUBLIC_DRIVE=P	Virtual drive letter for the Public directory.
!UPCS_ENABLED=0/1	Configures fine-grained directory and file inclusion/exclusion rules for User Profile Cloud Sync (UPCS / Session Sync / Data Persistence). Allows administrators to define which files and folders are synchronized to cloud storage between sessions. Controls the data persistence include and exclude filters for user profile synchronization. Related tags: !UPCS_FILTERS !UPCS_INCLUDE !UPCS_EXCLUDE !UPCS_MINSPACE Controls data persistence and its include and exclude filters.
!UPCS_FILTERS	Controls data persistence and its include and exclude filters.
!UPCS_INCLUDE  !UPCS_EXCLUDE	Controls data persistence and its include and exclude filters.
!UPCS_MINSPACE	Defines the minimum hard-drive space when caching data persistence locally (C:\UserData). See Session Sync data persistence.
!USERPROFILE_DRIVE=X	Virtual drive letter for user profile.

Windows and app behavior

PowerTag	Description
!CLIENTNAME !COMPUTERNAME !USERNAME	Client, user, and machine name virtualization.
!CHROME=1	Sets Chrome as the default browser.
!EXECREDIR=[app-name={dir}\appname]	Substitutes the execution of an app from a specified directory path. For example, if you want to specify to run org.exe only from this directory path c:\new\new.exe. !EXECREDIR=org.exe=c:\new\new.exe
!FILEEXT=1	File handling using PWA's (File Association)
!SHELL_LOCKDOWN=1 or 0	Blocks hard-disk Windows Explorer navigation and basic system commands.
	Requires !USERPROFILE_DRIVE to be set (for example, !USERPROFILE_DRIVE=X).
	Has to be set at the server level (or cluster or company) but cannot be on a single app or user, as it's a server-global security feature and not per-session.
	Requires service restart to be applied, for the same reason.
!STARTINGDIR	Defines the starting directory for the session app's execution.
!STOPFILES	Block access to specific files and executables. For example:  !STOPFILES=file1.ext;file2.ext;fullpath\file.ext
!UPCS_SILO=%app_silo%	Using SILOs (Persistence)
!URLREDIR=1 or [url_prefix]	URLs launched by the session's app will be redirected directly as a new tab within the user's browser, outside the session itself. The url_prefix is in the form: https://example.com/example
!WEBFS=1	Controls whether Cameyo allows file system integration. Possible values: !WEBFS=1, this means file system integration is allowed. (Default) !WEBFS=0, this means file system integration is not allowed. For more details, see Integrate with a local file system.
!WEBFS_TOOLBTN	Adds a WebFS (Web File System) button to the Cameyo HTML5 WebPlay toolbar. When set to 1, a dedicated button appears in the toolbar allowing users to mount their local browser file system into the remote session via the File System Access API. This is a sub-feature of the main !WEBFS PowerTag, which must also be enabled for !WEBFS_TOOLBTN functionality to work.
!WEBUSB=1	USB redirection using WebUSB.

Session behavior and appearance

PowerTag	Description
!CLIPBOARD=1 or 0	Enables or disables clipboard support (from session to client - client to session is always permitted)
!CONNECT_RESOLUTION=800x600	Defines a fixed session width and height.
!CLOSECONFIRM=1 or 0	Controls accidental tab closure.
!CLOUDDRIVE=1 or 0	Controls user's cloud drives virtualization, if configured.
!DOWNLOAD	When !DOWNLOAD=0, this blocks the user downloading files from the session to the user's device, including using the Cameyo file dialog, drag and drop, or saving to an outbound directory.
!EXTRATOOLBTNS	Controls extra tool bar buttons.  Adds custom buttons to the Cameyo HTML5 WebPlay toolbar. For example: !EXTRATOOLBTNS=Name|Action|Icon To add multiple buttons, use a semicolon-separated list. Action can be a URL (opens in browser), a Cameyo app execution (#msg-app-AppID), or a keypress emulation (#msg-keybd-KeyCombo). Icon can be a URL to an image or a Material Design icon keyword.
!GRACEFULDISCOSEC !STARTUP_GRACEFULDISCO_PS1	See Graceful application closing.
!KEYLOCK=1	When in full screen mode, session will capture all system keyboard keys including the Windows key, Alt-Tab as well as certain reserved control keys.
!KBLAYOUT=en-us-qwerty	Setting Cameyo keyboard layout.
!STARTUP_AFTER_xxxx	Controls session scripting.
!STARTUP_BEFORE_BAT	Executes a Windows batch (.bat) script before the session's main application launches. The script runs asynchronously (does not block session startup). For example, if the session launches WordPad.exe, the script writes the current time to a log file in the user's profile directory just before the app starts. !STARTUP_BEFORE_BAT=@echo off^|echo %TIME% >> %USERPROFILE%\test.log Use inline scripting with ^| as newline delimiter. Maps to CAMEYO_STARTUP_BEFORE_BAT environment variable.
!STARTUP_BEFORE_SYNC_xxx	Controls session scripting.
!STARTUP_BEFORE_SYNC_BAT	If you need the session to wait for your .bat script to completely finish executing before the application is allowed to launch, you can use the synchronous version of the tag instead: !STARTUP_BEFORE_SYNC_BAT. Useful for setup tasks that must finish before the app starts For example, mapping network drives, or copying files. !STARTUP_BEFORE_SYNC_BAT= @echo off^|net use Z: \\server\SharedFolderName password /user:domain\Username Use ^| as newline delimiter in inline scripts.
!STARTUP_BEFORE_SYNC_CMD	Executes a custom Windows command (.cmd) script before the session's main application launches. Functionally similar to !STARTUP_BEFORE_SYNC_BAT. Use ^| as newline delimiter in inline scripts.
!STARTUP_SYSTEM_PS1	Executes an inline PowerShell (.ps1) script with elevated administrative privileges under the Windows SYSTEM account (NT AUTHORITY\SYSTEM). Functionally similar to !STARTUP_BEFORE_SYNC_BAT, but only recommended for cases where the script requires administrator privileges.  The script runs during session initialization.
!STARTUP_GLOBAL	Controls session scripting.
!TASKBARMODE	This PowerTag controls the display mode of the Cameyo taskbar in sessions. For more details, see Cameyo's taskbar. Possible values: 0 = Reserved mode (taskbar reserves OS desktop space, pushing app windows above it), 1 = Overlap mode (taskbar overlays application windows without resizing the desktop work area), 2 = Auto-hide mode (taskbar hides automatically and shows on hover/activity).
!TASKBAR_QUICKLAUNCH	Cameyo's taskbar allows quick launching and switching between applications. For more details, see Cameyo's taskbar.
!UPLOAD	When !UPLOAD=0, this blocks the user uploading files from the user's device to the Cameyo remote session, including using the Cameyo file dialog, drag and drop, or saving to an outbound directory.
!WNDGRACEFIRST	When all windows are closed within the session, this PowerTag defines the timeout in milliseconds after which a message will appear to the user saying Application was closed. Session will end in X seconds, where X is defined by !WNDGRACESECOND.
!WNDGRACESECOND	See also !WndGraceFirst. This tag defines the time in milliseconds remaining for the user to see the Application was closed message before the session is closed. The default value is 10000 milliseconds or 10 seconds.

Session connectivity and initiation

PowerTag	Description
!ADMINMAIL=1	Sends a notification email to the technical contacts every time an Admin session is initiated on a Cameyo server, for increased account security.
!ALLOW_COUNTRY=[2-letter country code]	This is an allow-list of countries (a comma separated list of 2-letter ISO country codes) from which sessions can be requested, at a company-wide, application, server, cluster, user, or usergroup level. For example, !ALLOW_COUNTRY=FR,PT will allow access to users connecting from France and Portugal. An error code will appear for a user attempting to connect from an unauthorized country.
!ALLOW_IP=[list of IP addresses, separated by semicolon]	This is an allow-list of IP addresses, separated by semicolon, from which sessions can be requested. This allow-list takes precedence over !ALLOW_COUNTRY values, so you can use the two PowerTags together to allow specific IP addresses from blocked countries.
!CLOUDTUNNEL=1 or 0	Switches Cloud Tunneling on or off.

Session token security

PowerTag	Description
!TOKENHIDE=1	Hides the session token out of the URL bar. In some cases, users like to hide the token ID, for example, when they project or share their screens. Note: When the session token is hidden, page refresh (F5) cannot reconnect to the session.
!TOKEN_MULTI_AUTH=0	Revokes a session's token a few seconds after session authentication.
!TOKEN_MULTI_IP=0	Prevents a session's token from being used from an IP different than the initial one. Notes: !TOKEN_MULTI_IP=0 neutralizes connection resiliency if the user's IP changes during session time. !TOKEN_MULTI_IP=0 prevents a session's token from being used from an IP different than the initial one when the Cameyo server uses direct connections, not cloud tunneling.
!TOKEN_TTL	Timeout in seconds after which a session's token can no longer be used. Note that this also neutralizes connection resiliency after the timeout expires.

Server properties

PowerTag	Description
!CLOUDINSTANCE	Specifies a custom machine type. You can define the CPU and RAM for the instance using the following syntax: !CLOUDINSTANCE=CPU:[cpu_count],RAM:[ram_gb]. For example, to create an instance with 2 CPUs and 12GB of RAM, you would use: !CLOUDINSTANCE=CPU:2,RAM:12.  Note: This PowerTag cannot be used in conjunction with !CLOUDCPUGEN. If both are present, !CLOUDINSTANCE will take precedence. For more information, see Google Cloud's General-purpose machine family for Compute Engine.
!CLOUDCPUGEN	Specifies the CPU generation for the instance, such as 'n2'. This will create a machine type of <GEN>-standard-<CPU>. For example, !CLOUDCPUGEN=n2 results in an n2-standard-8 machine type for a level 8 instance.
!CLOUDLABELS !CLOUDSUBNETS !CLOUDTAGS !CLOUDVPC	For Google Cloud Platform (GCP) only: Custom cloud tags and labels, VPC and subnets for created instances. For more details, see Set up BYO-GCP.
!CLOUDSECUREBOOT=1	(For GCP only) Forces Secure Boot to be enabled on newly-created instances. By default, this PowerTag has no value assigned, which means that Secure Boot is not enabled.
!CLOUDIP	(For GCP only) !CLOUDIP=0 prevents newly-created servers from obtaining a public IP. This applies to servers created after !CLOUDIP is defined at cluster level or at company level. New servers should be created without a public IP. To verify server settings, check your Google Cloud console.
!CLOUDREGION	(For GCP only) Allows you to pin Cameyo virtual machine groups to a specific Google Cloud Platform (GCP) zone, overriding the default zone assigned to that region. You must use a valid string for GCP zone. For more details, see Set up BYO-GCP. For example:  !CLOUDREGION=us-central1-a
!CLOUDSERIES	Specifies the CPU series type for the instance, such as highmem. This can be used with !CLOUDCPUGEN to create a machine type of <GEN>-<SERIES>-<CPU>. For example, !CLOUDSERIES=highmem combined with !CLOUDCPUGEN=n2 would result in an n2-highmem-8 machine type for a level 8 instance. C4D VMs are available as predefined configurations in standard, highcpu, and highmem sizes ranging from 2 vCPU to 384 vCPUs and up to 3,024 GB of memory.
!MAXDISCONNECT	Time, in seconds, to keep sessions alive in case of disconnection. Equivalent to Windows RDS MaxDisconnectionTime parameter. Cameyo's default is 120.
!MAXIDLETIME	Maximum idle time in minutes. Overrides the session policy settings. Requires service restart.
!RDS_SHADOW	!RDS_SHADOW=1 allows admins to shadow sessions with full control, after permission is granted by the user. Once enabled, to shadow a user session, navigate to the server's page and click the animated progress circle for the session you want to shadow. !RDS_SHADOW is defined at server or cluster level. Possible values include: 0: No remote control allowed (default). 1: Full control with user’s permission. 3: View session with user’s permission.
!RDSGRACE_RESET	The RDS (Remote Desktop Services) grace period is typically 120 days. Cameyo's RemoteAppPilot (RAP) service continuously monitors the remaining days on the server's RDS grace period, to prevent servers from expiring and locking users out. !RDSGRACE_RESET=0 disables the automatic reset behavior, preventing RAP from clearing the registry key or initiating a related reboot. !RDSGRACE_RESET is defined at server or cluster level.
!RDSGRACE_THRESHOLD_DAYS	When the grace period falls below the default 90 day threshold, RAP attempts to automatically reset the counter. Admins can adjust this threshold using the !RDSGRACE_THRESHOLD_DAYS  PowerTag.  !RDSGRACE_THRESHOLD_DAYS  is defined at server or cluster level.
!SUPPORT=0 or -1	Blocks server access to Cameyo's support team.  0 blocks admin access -1 blocks admin and regular app sessions.
!WARN_TMCNOTRUNNING	!WARN_TMCNOTRUNNING=0 allows admins to disable warnings, such as: Tomcat not running. When using self-hosted Cameyo servers with Cloud Tunneling, the Tomcat web server is not required. You can disable or uninstall Tomcat. In cases where Tomcat is not required, this PowerTag allows you to turn off alerts about Tomcat not running every time the Play server starts. For more details, see Cloud Tunneling on Cameyo.
!WARN_CANTCONNECT HTTPLOCALHOST	!WARN_CANTCONNECTHTTPLOCALHOST=0 allows admins to disable warnings, such as: CantConnectHttpLocalHost (Unable to connect to the remote server). When using self-hosted Cameyo servers with Cloud Tunneling, the Tomcat web server is not required. You can disable or uninstall Tomcat or run a different HTTP local server, for example, Microsoft's Internet Information Services (IIS). In cases where Tomcat is not required, this PowerTag allows you to turn off alerts about Tomcat not running every time the Play server starts. For more details, see Cloud Tunneling on Cameyo.

Configuration and order of precedence

PowerTags are dynamic, meaning they can vary from one session to another and take effect immediately, without requiring service nor server restart (except server-level PowerTags).

The order of precedence, from highest priority to least, is:

• User
• User group
• App
• Server
• Cluster
• Company (Account)

Example 1:

If a user has the tag 'MY_NAME=John' defined while the server has 'MY_NAME=Server' defined, a session run by this user on that server will have 'MY_NAME' defined as 'John'.

Example 2:

If the server has tag 'MY_NAME=SERVER' defined while the server's cluster has 'MY_NAME=CLUSTER' defined, sessions will run on this server with 'MY_NAME' defined as 'SERVER'.

Example 3:

If an application has tag 'MY_NAME=SomeApp' while the same global Cameyo account's PowerTag is defined as 'MY_NAME=CameyoAccount' then a session running this app will have 'MY_NAME' defined as 'SomeApp'.

Use multiple PowerTags

You can use multiple PowerTags at one time. When multiple PowerTags exist for a given session (for example, cluster + server + user + app), the session will be started with the combination of all relevant tags.

Multiple tags can be defined on each line, for example:

MY_VAR1=Some value
MY_VAR2=Some other value

Custom PowerTags

You use PowerTags to inject custom values into Cameyo sessions as environment variables. For more advanced control, sticky PowerTags can be used to create persistent, server-wide environment variables.

'+' sticky PowerTags: persistent server-wide environment variables (advanced): apply globally to an entire server, including system processes outside of a Cameyo session, and are defined by adding a + prefix.

• Function: To create global system variables. For example, +MY_GLOBAL_VAR=Some value creates a system variable named "MY_GLOBAL_VAR" with the value "Some value" on the affected servers.
• Scope: These tags can be set for servers, clusters, or entire accounts.
• Activation: A sticky PowerTag only takes effect after the server's Cameyo service (re)starts.
• Removal: To remove a sticky tag, you must set it to an empty value (for example, +MY_GLOBAL_VAR=). The removal takes effect after the Cameyo service restarts and the system is rebooted, which is a Windows requirement.