Back to all
With Ivanti Workspace Control (IWC) officially reaching End of Life on December 31, 2026, IT leaders face a hard deadline. For many enterprises, Workspace Control has been a quiet staple of the environment – running reliably in the background for over a decade...
But since the announcement, many Citrix admins are revisiting their EUC and reassessing decisions originally made in a very different time. That’s where we come in. As Citrix Preferred Services Partners, we’re already helping customers plan their final 8 weeks of supported IWC and migrations/next steps with WEM. Now, with the deadline drawing closer, we’re ready to help even more teams with practical advice.
The strategic view is this – rather than simply lifting and shifting ten years of accumulated tech debt into a new tool, why not use this deadline to audit, streamline, and modernize? Sounds like a no-brainer. But to truly benefit from the process, and avoid last-minute reactive panics, you’ll want to get started soon.
To help navigate this transition, Kris Haynes, Head of Technology at Axess Systems, answers 9 critical questions on evaluating legacy rules, avoiding costly migration mistakes, and leveraging tools you likely already own.
Understanding the Workspace landscape
Before diving into the strategy, it helps to understand some of the core platforms at the centre of this transition:
Ivanti Workspace Control (IWC)
Originally known as RES Workspace Manager before its acquisition by Ivanti, IWC is a legacy user environment management (UEM) tool. Historically, it was deployed to give IT granular control over digital workspaces – managing application security, drive mappings, printer connections, and context-aware policies in complex corporate setups.
Citrix Workspace Environment Management (WEM)
Included with many Citrix entitlements – such as Citrix Universal Hybrid Multi-Cloud – WEM is a modern user environment management and optimization platform. Beyond managing user settings and application access, WEM dynamically optimizes system resources (RAM, CPU, and I/O) to boost server scalability and end-user performance, while featuring modern security capabilities like Process Hierarchy Control and privilege elevation.
Other alternative Workspace providers
As a Citrix Preferred Services Provider, we’ve written this blog primarily for Citrix admins considering reconsolidating the Workspace functions provided by Ivanti back within their Citrix UHMC. However, many of the points below remain just as relevant for non-Citrix companies too.
Modernisation requires both strategy and execution, and we have expertise in both camps. So, whatever your existing obligations, we recommend taking a step back to ask yourself what you truly want to achieve in January 2027.
At Axess Systems, we have deep expertise and accreditations across multiple technologies from:
So if you’re looking to find an alternative Workspace solution, why not get in touch to request a more personalised recommendation based on your current setup?
9 Frequently Asked Questions on preparing for Ivanti Workspace Control End of Life
Without further ado, here are our most frequently received questions and Kris’ answers for your consideration.
1. What advice do you have for IT leaders preparing for hard deadlines on legacy tech?
My first piece of advice would be, don’t start by looking for a replacement product.
Start by understanding what the existing product actually does. That probably sounds obvious, but Workspace Control is exactly the sort of technology that can sit in an environment for ten years or more. Over that time, admins change, apps change, infrastructure changes and hundreds of rules, policies and scripts accumulate. What you have today, is unlikely to be what you set out to achieve 10 years ago.
Eventually, nobody wants to touch it because nobody is completely sure what will break. With Ivanti Workspace Control reaching End of Life on 31 December 2026, customers now have a hard deadline to address that. But I actually believe there’s an opportunity here.
Before deciding what replaces IWC, document what it’s doing today. Which capabilities are still required? Which are duplicated elsewhere? Which exist because of an application you retired five years ago? And which could now be delivered by technology you’re already paying for?
The worst outcome in my opinion, would be spending a significant amount of time and money faithfully recreating ten years of legacy configuration, in another product.
2. Historically, third-party workspace management tools were assumed to be superior. Does that argument still hold weight today?
Honestly, not to the extent it once did.
RES Workspace Manager, which eventually became Ivanti Workspace Control, was a very capable product and solved genuine problems that the native platforms of the time didn’t solve particularly well. It’s been an interesting ride though, watching the surrounding technology move on significantly over such a small timeframe.
For example, Citrix Workspace Environment Management has become a much broader platform. We now have environment management, contextual assignments, application security, privilege elevation, process controls, profile integration and resource optimisation within WEM.
Microsoft has moved on as well. Intune, Group Policy, AppLocker, Windows Defender Application Control and other native capabilities can potentially take responsibility for parts of the environment. Plus, their acquisition of FSLogix, which made huge waves when they decided to simply embed it for free in their portfolio.
That’s largely why I’d challenge the assumption that IWC must be replaced with another equivalent third-party product.
If you’re already a Citrix customer and already entitled to Workspace Environment Management, the first question I’d ask is:
“How much of what we’re using Ivanti for today, could we move into technology we’re already paying for?“
That doesn’t mean WEM is automatically a complete replacement for every IWC deployment. It isn’t. But for a Citrix customer, I’d absolutely assess WEM before recommending they introduce another workspace management platform.
3. How do you work with customers to overcome risk when managing migrations?
One of the biggest mistakes I see people make, is treating existing configuration as a requirement. Take for example, something simple: Workspace Control contains a rule that maps a drive for members of a particular AD group.
The requirement isn’t “we need this Ivanti rule” – it is instead, “these users need access to this drive”.
Then once you think about it that way, you have options.
WEM might deliver it. Group Policy might already deliver it somewhere else. Perhaps the application no longer needs the drive at all. And that’s how I’d approach the wider migration.
Catalogue the existing configuration, understand the outcome each component provides and classify it. I’d broadly put everything into four categories:
| Keep | Replace | Design | Retire |
- The retire column is important.
I’ve seen enough mature customer environments to know that if you migrate everything simply because it exists, you’re almost certainly migrating things nobody needs. The objective should be a cleaner environment at the end of the project, not exactly the same environment with a different management console.
4. How do features like App Access Control and Process Hierarchy Control in WEM give security teams confidence to make the switch?
Application security is an area where WEM has developed considerably. App Access Control allows administrators to control access to applications and apply redirections to files, folders and registry locations.
You’ve then got application security controls, privilege elevation and Process Hierarchy Control. The latter is particularly interesting in published application environments.
It’s not always enough to say that an executable itself is trusted. You also need to consider what that application can subsequently launch.
Consider this, if I’ve published an application to a user and there’s absolutely no reason that application should ever launch PowerShell or CMD, why should I allow it to?
Process Hierarchy Control gives admins another layer of control around those aspects.
But I’d still approach this as a security mapping exercise, if IWC currently provides an application security control, don’t assume that a similarly named WEM feature behaves identically. Document the security requirement, map the equivalent control and test it.
5. How do WEM’s latest updates, specifically around policy migrations and web console management, help remove migration friction?
The move towards web-based management makes WEM a much easier proposition than it was historically. Citrix has steadily expanded what can be configured through the WEM web console, which makes it much easier to manage alongside the wider Citrix platform.
The Group Policy Migration Tool is interesting as well, particularly if you’re using the IWC project as an opportunity to clean up the wider user environment. It’s important to be clear about what that feature does, though. It isn’t an “import my Ivanti environment” button.
It can analyse supported Group Policy settings and preferences and convert those into WEM configuration. For me, that’s actually a more interesting use case. If we’re already opening the bonnet on the user environment because IWC is going EoL, let’s look at the old GPOs and logon scripts at the same time (how often do we get that opportunity?)
6. How do end-user performance and logon metrics in Citrix WEM compare to third-party equivalents?
I wouldn’t claim WEM is automatically better than every third-party monitoring product. That’s not really the point.
Its advantage is that it’s sitting directly alongside the Citrix environment we’re trying to manage and optimise. WEM gives us controls around CPU, memory, processes and I/O, but it also gives administrators detailed Windows logon analysis.
Instead of simply knowing that somebody’s logon took 40 seconds, we can start breaking that down. How much time did Group Policy take? How long did the profile take? Was FSLogix involved? What processes were running during logon? Where did we actually spend those 40 seconds?
That’s the information admins care about. A dashboard telling me something is slow isn’t particularly useful if it doesn’t help me work out why it’s slow.
As an all in one tool, so to speak – we can then use WEM to make targeted changes and measure the result.
7. What is your first practical tip for auditing before a migration?
Don’t migrate anything yet. Inventory it.
This is your chance to check – “I want to know what the rule does, who gets it, why they get it, what depends on it and what happens if I remove it.”
Then ask yourself the dangerous question – “Does anybody actually still need this?”
I’d rather spend additional time during discovery and migrate 300 configurations that we understand than automatically migrate 600 because that’s how many happen to exist.
Also look for duplications, sometimes you can spend more time fixing something that doesn’t make sense quite simply because the orchestration in place has conflicting criteria.
I’d be mindful that you’re not just auditing Ivanti. You’re taking the opportunity to audit the user environment.
8. What is your second practical tip to keep day-two performance reliable?
Baseline everything before you touch it.
If the current average logon takes 35 seconds, write that down.
Capture CPU utilisation, memory pressure, profile timings, Group Policy processing and the behaviour of the important applications. Then you’ve got something objective to compare against from day 1.
Without that baseline, six weeks later somebody will inevitably say: “I’m sure this used to be faster.”
And there’s no exercise which can prove anything, either way.
I’d also resist the temptation to turn every WEM feature on, right from the start.
If CPU optimisation solves a problem, use it. If memory management solves a problem, use it. If a particular process control improves the environment, configure it.
But don’t enable features simply because there’s a checkbox available. Build the baseline, make a change, measure it, then document it.
That approach also makes day-two support considerably easier because the team understands why the configuration exists.
9. Anything else Citrix admins should consider?
I’d use the IWC End of Life as an excuse to ask a bigger question:
“If we were designing this environment today, would we build it this way?“
That’s the bit I’d try and help customers think about. You’re being forced to change something anyway. So, rather than asking how to reproduce IWC exactly, look at Citrix WEM, Profile Management, FSLogix, Group Policy, Intune and the other technologies already present in the organisation.
Work out which platform should own each part of the user environment and remove the duplication. There will absolutely be customers where WEM doesn’t replace every capability they’re using in Workspace Control. If that’s the case, identify the gap and solve it properly. Don’t force a requirement into WEM simply because that’s the product you want to use.
But equally, don’t spend money introducing another complete management platform until you’ve established what your existing Citrix investment can already do.
For me, that’s the real opportunity created by the IWC End of Life. Not simply replacing Ivanti. Simplifying the environment while you’ve got a reason to change it.
Not using Citrix? Consider your Ivanti replacement technology options
For Citrix admins considering the Ivanti EoL, our recommendation to consolidate within the UHMC makes a lot of sense financially. However, many of the points about audit and strategic planning remain just as relevant for non-Citrix companies too.
All Ivanti Admins would benefit from the Keep, Replace, Design, Retire framework, for example. But the biggest difference for you is that the Replace decision may involve investing in an additional vendor.
If this is the case, we may still be able to help – as we have links and accreditations across the whole Workspace ecosystem, including Microsoft, Veeam, VMware, ControlUp, IGEL, LG, and more. Or perhaps you’d like to use on of our stand alone services such as Microsoft AVD Health Check or Workspace Advisory Service?
We provide expert guidance to help you build a Workspace that meets your goals on user segmentation, context-aware authentication, ZTNA, and the latest cybersecurity measures, all while ensuring your strategy aligns with your organisation’s objectives today and in the future.
Turning EoL into an Opportunity
It sounds a bit cheesy but it’s true! The approaching Ivanti Workspace Control End-of-Life deadline doesn’t need to be a crisis – it’s an ideal catalyst for positive change. By auditing existing configurations rather than blindly recreating them, IT teams can shed years of outdated scripts, eliminate redundant tools, and maximize existing investments like Citrix WEM and native Microsoft capabilities.
Before rushing into vendor demos or buying new replacement licenses, step back and evaluate what your current tech stack can already deliver. Take the time to inventory, baseline performance, and categorize every rule under Keep, Replace, Design, or Retire.
The ultimate goal isn’t just surviving the 2026 deadline – it’s leaving your organisation with a leaner, faster, and far more manageable workspace environment.
Are you deciding on your next steps for Ivanti Workspace Control End of Life?
Or are you delaying action, as you don’t know what the full scope of the move would be yet?
Whatever stage you’re at, contact our team now – we have the knowledge and experience to support you.
Previous