Features

App-V publishing free

The replacement for the Microsoft App-V Publishing Server, free with the Microsoft App-V client. The clients receive the new address via group policy; nothing else changes.

Two lines to set up: publishing https://<portal>:<port>/AppVPublishing, reporting https://<portal>:<port>/AppVReportReceiver — by group policy under System → App-V or with Add-AppvPublishingServer. The full path, including the shared content store recommendation, is in the administration handbook (German).

• Read packages from the share, publish, unpublish, update versions
• Connection groups with order, optional packages and versions
• Entitlement to AD groups, separately for machines and users
• Edit deployment and user configuration (DeploymentConfig, UserConfig) in the editor
• App-V reporting: receive and analyse usage data from the clients
• Migration scripts read packages, groups and entitlements from your existing App-V server
• Everything also via PowerShell; the cmdlets follow the App-V server cmdlets

MSIX and App Attach publishing Agent

The same mechanism as for App-V: packages live on the share, the portal manages catalogue and entitlements, the ZeroPortal agent fetches and delivers. Modern package formats for workstations, terminal servers and VDI.

• Vendor packages and your own alike: applications you repackaged yourself, for example with the MSIX Packaging Tool, are imported and delivered like any other MSIX package
• Import of .msix, .appx and bundles from the repository; dependencies and frameworks are detected and delivered along
• Import Store applications you fetched with winget download, licence file included, and deliver them to devices without the Store
• Entitlements to AD groups and accounts, portal groups, internal accounts, and enrolled devices and users
• App Attach images (CIM, VHDX) are built by the portal itself and stored next to the package
• Delivery format per policy: MSIX installation or App Attach, switching without losing application data
• Downgrades only with explicit approval, self-heal for removed packages, frameworks are retracted only when nobody needs them
• In-use protection: on terminal servers nothing is retracted while an application is running

Workplace policies (Digital Workplace) Agent

Policy sets bundle policies for a scenario such as terminal servers, VDI or notebooks. The scope decides where and for whom they apply.

• Scope filters: group, organisational unit, computer name, IP range, variable, operating system, terminal server, time window, registry, file
• 21 templates, among them delivery rules, package downgrade, agent configuration, desktop (theme, dark mode, icons, cleanup), drives, printers, shortcuts, environment variables, folders, copy and transform files, scripts, services, registry, scheduled tasks, internet and proxy, Microsoft Store
• Desktop info overlay as a BGInfo replacement, visual effects, drive visibility, RDS and VDI lockdown
• Import from Group Policy Preferences (GPP): drives, shortcuts, environment variables, printers, folders and registry; imported policies arrive disabled
• Scripts are hash-pinned; the agent verifies them before execution
• Revisions per policy; history and restore via PowerShell and the REST API, RSoP preview ("what applies to this device?") via the REST API
• Export and import of building blocks; custom .zppx templates are placed on the server

The ZeroPortal agent

A Windows service with tray icon on every device. It fetches entitlements and policies, installs, updates and cleans up.

• Sync in machine and user context, Kerberos authentication with the computer or user account
• No inbound port: the agent talks to the portal and the share, nowhere else
• High availability is built into the agent: it knows every portal node from group policy, picks one at random if you like, fails over on its own and blacklists a failed server for a configurable time. No load balancer, no shared name, no extra SPN
• Notifications with progress, timing per package, tray menu with package list and manual sync
• Controlled by group policy: the included ADMX template provides 25 settings: publishing servers and the three sync switches, HA failover, synchronisation (intervals, machine and user sync, policy refresh, package source), authentication (enrollment token) and diagnostics (log level, log path). The agent MSI is in the portal's download centre; the template is installed with the agent
• Agent settings are set by group policy or locally with Set-ZPAgentConfiguration; publishing servers and the enrollment token come from group policy or their own cmdlets
• Devices without a domain via enrollment token or API key

Identity and permissions

• Single sign-on (SSO): sign-in without a password prompt using the Windows account via Kerberos, permissions for AD groups
• Portal groups, internal accounts and a break-glass account for environments without a domain
• Permissions per area: App-V, reporting, MSIX, policies, downloads, configuration, high availability and node settings, each at level none, read or administrate. Permission administration itself stays with the full administrators
• API keys for automation and devices outside the domain, enrollment tokens for first contact
• Audit log for account changes, break-glass sign-ins and system notifications
• E-mail notifications, individually switchable, among them expiring certificates, licence issues, an unreachable database, failed nodes and stopped replication

High availability

• Primary and replica with MariaDB replication, set up through the replication wizard in the portal
• The replica serves the web interface and the agents; writes are forwarded to the primary transparently
• Agents fail over to the next node on their own. A load balancer, a shared DNS name or a dedicated SPN are not required; if you have them, you can use them
• Update node by node while the cluster keeps running, supported by per-node maintenance mode; status overview with heartbeat and replication lag

Operations and automation

• PowerShell module with 88 cmdlets for packages, connection groups, entitlements, policies, groups, permissions, licences and backup
• REST API behind nearly every function of the web interface
• Backup and restore of the configuration: packages, entitlements, policies, groups and permissions. Reporting data and node-local settings are excluded. Plus export as a script
• Installation by MSI with configuration wizard, .NET runtime included, MariaDB 11.8 or newer, the LTS series 11.8 and 12.3 recommended. ZeroPortal is maintained continuously: when MariaDB moves to a new LTS series or .NET to a new version, ZeroPortal follows
• Web interface in English and German, logs under ProgramData, audit and notifications

Licensing

• 30 free licences are included with every installation and never expire
• Counted are users or devices that reported within the last 90 days; the mode is your choice
• ZeroPortal counts, it does not block: when the count is exceeded, delivery continues and the portal notifies you by e-mail
• Licence files are signed and uploaded in the portal; several files add up
• The Pro licence from 5 € per user per year (net plus VAT, volume tiers starting at 8 €) includes the agent; product support from 20,000 users, below that support as a package or by time

See pricing