EUC Weekly Digest – August 11, 2018

Last Modified: Nov 7, 2020 @ 6:34 am

Interesting EUC items from last week:

WEM/Profile Management

Receiver/Workspace app

NetScaler ADC

NetScaler MAS

NetScaler SD-WAN

Citrix Cloud

VMware

For more immediate updates, follow me at http://twitter.com/cstalhood.

For a list of updates at carlstalhood.com, see the Detailed Change Log.

EUC Weekly Digest – August 4, 2018

Last Modified: Nov 7, 2020 @ 6:34 am

Interesting EUC items from last week:

XenApp/XenDesktop

VDA

App Layering

StoreFront

XenMobile

Citrix Cloud

VMware

Other

For more immediate updates, follow me at http://twitter.com/cstalhood.

For a list of updates at carlstalhood.com, see the Detailed Change Log.

EUC Weekly Digest – July 21, 2018

Last Modified: Nov 7, 2020 @ 6:34 am

Interesting EUC items from last week:

App Layering

WEM/Profile Management

NetScaler

NetScaler Gateway

  • Citrix SSO Client User Guide – next gen iOS VPN client for NetScaler Gateway built using Apple’s Network Extension framework – replaces the legacy Citrix VPN client – Citrix Docs

XenMobile

VMware

Microsoft

For more immediate updates, follow me at http://twitter.com/cstalhood.

For a list of updates at carlstalhood.com, see the Detailed Change Log.

EUC Weekly Digest – July 14, 2018

Last Modified: Nov 7, 2020 @ 6:34 am

Interesting EUC items from last week:

VDA

WEM/Profile Management

StoreFront

NetScaler

NetScaler MAS

NetScaler SD-WAN

XenMobile

ShareFile

VMware

For more immediate updates, follow me at http://twitter.com/cstalhood.

For a list of updates at carlstalhood.com, see the Detailed Change Log.

EUC Weekly Digest – July 7, 2018

Last Modified: Nov 7, 2020 @ 6:34 am

Interesting EUC items from last week:

XenApp/XenDesktop

VDA

Receiver / Workspace App

NetScaler

NetScaler MAS

XenMobile

ShareFile

VMware

Microsoft

Other

For more immediate updates, follow me at http://twitter.com/cstalhood.

For a list of updates at carlstalhood.com, see the Detailed Change Log.

EUC Weekend Reading – June 23, 2018

Last Modified: Nov 7, 2020 @ 6:34 am

Interesting EUC items from last week:

WEM/Profile Management

StoreFront

Receiver

NetScaler MAS

NetScaler Gateway

XenMobile

For more immediate updates, follow me at http://twitter.com/cstalhood.

For a list of updates at carlstalhood.com, see the Detailed Change Log.

EUC Weekly Digest – June 16, 2018

Last Modified: Nov 7, 2020 @ 6:34 am

Interesting EUC items from last week:

XenApp/XenDesktop

App Layering (Unidesk)

StoreFront

NetScaler

NetScaler MAS

ShareFile

VMware

For more immediate updates, follow me at http://twitter.com/cstalhood.

For a list of updates at carlstalhood.com, see the Detailed Change Log.

Citrix Application Delivery Management (ADM) 12.1

Last Modified: Jun 17, 2020 @ 10:15 am

Navigation

The older 12.0 version of NetScaler MAS is detailed in a different post.

💡 = Recently Updated

Change Log

Planning

Why ADM?

Citrix Application Delivery Management (ADM), formerly known as NetScaler Management and Analytics System (MAS), enables every Citrix ADC (formerly known as NetScaler) administrator to achieve the following:

  • Alert notifications – Receive email alerts whenever something goes down. For example, if a Load Balancing service goes down, you can receive an email alert.
    • ADM can email you for any Major SNMP trap produced by any ADC appliance.
  • Automatically backup all Citrix ADC instances.
    • ADM can even transfer the backups to an external system, which is then backed up by a normal backup tool.
  • SSL Certificate Expiration – Alert you when SSL certificates are about to expire.
    • Show you all SSL certificates across all ADC appliances.
  • Configuration Record and Play – Use the Configuration Recorder to configure one ADC appliance, and then push out the same configuration changes to additional appliances. This is the easiest method of managing ADC appliances in multiple datacenters.
  • AppFlow Reporting – Receive ICA AppFlow traffic from ADC and show it in graphs.
    • Integrate ADM with Citrix Director so Help Desk can see the AppFlow data.

Everything listed above is completely free, so there’s no reason not to deploy ADM.

ADM Overview

For an overview of ADM, see Citrix’s YouTube video Citrix NetScaler MAS: Application visibility and control in the cloud.

Cloud vs on-prem

ADM is available both on-premises, and as a Cloud Service. For the Cloud Service, you import a ADM Agent appliance to an on-prem hypervisor, or deploy a ADM Agent to AWS or Azure. The ADM Agent is the broker between the Cloud Service and the on-prem (or cloud hosted) Citrix ADC appliances. For more info on the ADM Cloud Service, see the following:

The rest of this article focuses on the on-premises version, but much of it also applies to the Cloud Service.

On-premises ADM Licensing:

  • Instance management is free (unlimited). This includes Configuration Jobs, Instance Backups, Network Functions/Reporting. Basically everything in the Networks node is free.
  • Analytics and Application monitoring are free for up to 30 Virtual Servers (Load Balancing, Citrix Gateway, Content Switching, etc.).

ADM version – The version/build of Citrix ADM must be the same or newer than the version/build of the Citrix ADC appliances being monitored. ADM 12.1 can monitor 12.0 and older ADC appliances.

HDX Insight

See CTX239748 for a list of HDX Insight Quality Improvements in Citrix Gateway 12.1. These include:

  • NSAP protocol for reduced performance impact on ADC
  • EDT support

HDX Insight Requirements (aka AppFlow Analytics for Citrix ICA traffic):

  • Your ADC appliance must be running Enterprise Edition or Platinum Edition.
  • ADC must be 10.1 or newer.
  • HDX Insight works with the following Receivers:
    • Receiver for Windows must be 3.4 or newer. Or upgrade to Workspace app.
    • Receiver for Mac must be 11.8 or newer. Or upgrade to Workspace app.
    • Receiver for Linux must be 13 or newer. Or upgrade to Workspace app.
    • Notice no mobile Receivers. See the Citrix Receiver Feature Matrix for the latest details.
  • For ICA Session Reliability with AppFlow: NetScaler 10.5 build 54 and newer.
    • For ICA Session Reliability, AppFlow, and ADC High Availability: NetScaler 11.1 build 49 and newer.
  • For EDT (UDT-based ICA), Citrix ADC must be 12.1 build 49 or newer.
  • AppFlow statistics are only generated when ICA traffic flows through a Citrix Gateway. Internally, when a user clicks an icon from StoreFront, an ICA connection is established directly from Receiver to the VDA, thus bypassing the internal ADC. Here are some methods of getting ICA traffic to flow through an internal ADC:
  • A new Receiver / Workspace app Virtual Channel named NetScaler App Experience or NSAP can dramatically reduce the CPU needed on the ADC to process AppFlow. Details at Citrix Blog Post HDX Insight 2.0. NSAP requires the following:
    • VDA 7.17 or newer, including VDA 1903. VDA 7.15 (LTSR) does not include the NSAP functionality.
    • Workspace app or Receiver 4.10 and newer.
    • ADC 12.0 build 57.24 or newer, including ADC 12.1.
  • For ICA round trip time calculations, in a Citrix Policy, enable the following settings:
    • ICA > End User Monitoring > ICA Round Trip Calculation
    • ICA > End User Monitoring > ICA Round Trip Calculation Interval
    • ICA > End User Monitoring > ICA Round Trip Calculation for Idle Connections
  • Citrix CTX215130 HDX Insight Diagnostics and Troubleshooting Guide contains the following contents:
    • Introduction
    • Prerequisites for Configuring HDX Insight
    • Troubleshooting
      • Issues Related to ICA parsing
      • Error Counter details
    • Checklist before Contacting Citrix Technical Support
    • Information to collect before Contacting Citrix Technical support
    • Known Issues

Citrix CTX204274 How ICA RTT is calculated on NetScaler Insight: ICA RTT constitutes the actual application delay. ICA_RTT = 1 + 2 + 3 + 4 +5 +6:

  1. Client OS introduced delay
  2. Client to NS introduced network delay (Wan Latency)
  3. NS introduced delay in processing client to NS traffic (Client Side Device Latency)
  4. NS introduced delay in processing NS to Server (XA/XD) traffic (Server Side Device Latency)
  5. NS to Server network delay (DC Latency)
  6. Server (XA/XD) OS introduced delay (Host Delay)

Multi-Datacenter Deployment Architecture

In a main datacenter, import two Citrix ADM appliances into the same subnet and configure them as an HA pair with a Floating IP address.

In a DR datacenter, import a Citrix ADM appliance, and configure it to replicate with the main datacenter.

For Citrix ADC appliances in additional datacenters, import two ADM Agent appliances into each datacenter, and configure them as remote agents to the main datacenter. Two ADM Agents per datacenter enables HA. The virtual appliance for ADM Agent is different than the normal ADM appliance.

Import ADM Appliance

If you are upgrading an existing MAS, skip to the Upgrade section.

To import a ADM Appliance into vSphere, do the following. The same process is used for DR ADM appliance. The ADM Agent appliance is different from the normal ADM appliances that are detailed in this section.

  1. Go to the ADM 12.1 download page. Expand NetScaler MAS Release 12.1. Expand Product Software. Click the latest release of 12.1.
  2. Download the Citrix ADM image for ESX.
  3. Then extract the .zip file.
  4. In vSphere Web Client, right-click a cluster, and click Deploy OVF Template.
  5. In the Select an OVF Template page, select Local file, and browse to the Citrix ADM .ovf files. If vCenter 6.5+, select all three files. Click Next.

  6. In the Select name and folder page, enter a name for the virtual machine, and select an inventory folder. Then click Next.
  7. In the Select a resource page, select a cluster or resource pool, and click Next.
  8. In the Review details page, click Next.
  9. In the Select storage page, select a datastore. Due to high IOPS requirement, SSD or Flash is recommended.
  10. Change the virtual disk format to Thin Provision. Click Next.
  11. In the Select networks page, choose a valid port group, and click Finish.
  12. In the Ready to Complete page, click Finish.
  13. Before powering on the appliance, you can review its specs. Right-click the virtual machine, and click Edit Settings.
  14. Review the specs. Citrix Docs VMware ESXi Hardware Requirements has recommended specs.
  15. The OVF defaults to 8 vCPU and 32 GB of RAM.
  16. You can add a second hard disk at this time.
  17. Citrix Docs Attach an additional disk to Citrix ADM says that an additional disk must be added before initial deployment.
    • Use the ADM storage calculator to determine the recommended size of the disk. Ask your Citrix Partner for the tool.
    • The new disk must be larger than 120 GB.
    • In ADM 12.1, the new disk can be larger than 2 TB.
    • In ADM 12.1, the new disk can be grown later, and /mps/DiskPartitionTool.py can resize the partition, but only up to 2 TB. If you need more than 2 TB, the initial disk should be larger than 2 TB.
  18. Power on the Virtual Machine.

Appliance IP Address Configuration

  1. Open the console of the virtual machine.
  2. Configure IP address information.
  3. Enter 7 when done.

Second Disk

  1. SSH to the appliance and login as nsrecover/nsroot.
  2. Enter /mps/DiskPartitionTool.py

  3. Enter info to see that there are no existing partitions on the second disk.
  4. Enter create to create partitions on the second disk. A reboot is required.
  5. During the reboot, the database is moved to the second disk.
  6. After the reboot, the Disk Partition Tool info command shows the partition on the second disk.
  7. If you need to increase the size of the disk, reboot the ADM appliance so it detects the larger size. Then use the Disk Partition Tool resize command.

Deployment Modes

HA Pair in the Main Datacenter

First Node:

  1. SSH to the first node and login as nsrecover/nsroot.
  2. Enter deployment_type.py.
  3. Enter 1 for Citrix ADM Server.
  4. Enter no when prompted for Citrix ADM Standalone deployment.
  5. For the First Server Node prompt, enter yes.
  6. Enter yes to Restart the system.

Second Node:

  1. Import another ADM appliance to the same subnet, and configure an IP address.
    • Latency to the HA node must not exceed 10 ms.
    • The HA nodes must be on the same subnet.
  2. If you added a second disk to the first ADM appliance, then you must add the same size second disk to the second ADM appliance.
  3. Configure the new nodes’ IP address.
  4. SSH to the second appliance, login as nsrecover/nsroot, and run the Disk Partition tool.
  5. SSH to the second appliance, login as nsrecover/nsroot, and run deployment_type.py.
  6. Enter 1 for Citrix ADM Server.
  7. Enter no when prompted for Citrix ADM Standalone deployment.
  8. Enter no when prompted is this is First Server Node.
  9. Enter the IP address of the first MAS node.
  10. Enter the nsroot password of the first node. The default password is nsroot.
  11. Enter a new Floating IP address.
  12. Enter yes to restart the system.

Deploy HA Configuration:

  1. Point your browser to the first appliance’s IP address, and login as nsroot/nsroot.
  2. If you see Customer User Experience Improvement Program, click Enable, or click Skip.
  3. The System > Deployment page is displayed. In the top right, click Deploy.
  4. Click Yes to reboot.
  5. After deployment, you can now use the Floating IP to manage the appliance.
  6. After the reboot, login again. You’ll see a Wizard to add instances.

After the add instance wizard is complete, you can manage High Availability.

  1. System > Deployment lets you see the HA nodes.
  2. You can Force Failover from here. Note: HA failover only occurs after three minutes of no heartbeats.
  3. On the top right is a HA Settings button that lets you change the Floating IP.

DR Node

Requirements for the DR node:

  • The main datacenter must have an HA pair of ADM appliances. Standalone in the main datacenter is not supported.
  • Latency from the main datacenter HA pair to the DR node must not exceed 200 ms.

To configure a DR node:

  1. Import another ADM appliance into a remote datacenter, and configure an IP address.
  2. If you added a second disk to the main datacenter ADM appliances, then you must add the same size second disk to the DR ADM  appliance.
  3. After configuring the new nodes’ IP address, SSH to the DR appliance and login as nsrecover/nsroot.
  4. Enter deployment_type.py.
  5. Enter 2 for Remote Disaster Recovery Node.
  6. Enter the Floating IP address of the HA pair in the main datacenter.
  7. Enter the nsroot password, which is nsroot by default.
  8. The DR node registers with the MAS HA Pair.
  9. Point your browser to the Floating IP Address and login.
  10. Go to System > System Administration.
  11. On the right, in the right column, click Disaster Recovery Settings.
  12. The Registered Recovery Node should already be filled in.
  13. Check the box next to Enable Disaster Recovery, and click Apply Settings.
  14. Click Yes to enable DR.
  15. A System Backup is performed and replicated to the DR appliance.
  16. Disaster Recovery is not automatic. See the manual DR procedure at at Citrix Docs.
    • /mps/scripts/pgsql/pgsql_restore_remote_backup.sh

ADM Agents

The virtual appliance for ADM Agent is different than the normal ADM appliance.

  1. Download the ADM Agent from the main ADM download page. Scroll down the page to find the ADM Agent images. Note: The ADM Agent has a newer build number than the ADM image due to a security vulnerability.
  2. Extract the downloaded .zip file.
  3. Import the .ovf to vSphere.

  4. Edit the settings of the virtual machine to see the allocated CPU and Memory.
  5. Power on the ADM Agent virtual machine.
  6. At the virtual machine’s console, configure an IP address.
  7. Login as nsrecover/nsroot.
  8. Run /mps/register_agent_onprem.py
  9. Enter the floating IP address of the main ADM HA Pair. Enter nsroot credentials.
  10. The Agent will be registered and services restarted.
  11. Login to the ADM Floating IP.
  12. Go to Networks > Agents.
  13. On the right, select the ADM Agent, and then click Attach Site.
  14. In the Site drop-down, if you don’t see your site, then you can click the Add button to create a new site.
  15. Enter a name, enter a search location, and click Get Location to get the coordinates. Click Create when done.
  16. Click Save to attach the site.
  17. For HA, import two ADM Agents into the same Site.

ADM Appliance Maintenance

Add Instances

Citrix ADM must discover Citrix ADC instances before they can be managed. Citrix Docs How Citix ADM discovers instances.

  1. Once you’ve built all of the nodes, point your browser to the Citrix ADM Floating IP address, and login as nsroot/nsroot.
  2. Deployment should already be done, so click Next.
  3. On the Add New Instances page, click Add Instance near the top right.
  4. Enter the NSIP address of a Citrix ADC appliance.
    • CItrix ADM supports up to 400 ms latency to the instances.
  5. Click Edit next to ns_nsroot_profile.
  6. Check the box next to Change Password.
  7. Type in the nsroot password, and then scroll down.
  8. The Citrix ADC Profile defaults to using https for instance communication. You can change it by unchecking Use global settings for Citrix ADC communication.
  9. Click OK.
  10. Select the Site for the instance. You can click Add to create a Site.
  11. For remote sites, you can optionally choose a ADM Agent.
  12. Then click OK to add the instance.
  13. A progress window will appear. Click Close when complete.
  14. You can add more instances, or just click Next.
  15. In the Customer Identity page, make your choice, then click Next or Skip.
  16. In the Done page, click Finish.

To add more instances later:

  1. Click the top left hamburger icon.
  2. Go to Networks > Instances > Citrix ADC.
  3. On the right, select a tab (e.g. MPX), and then click Add.
  4. To edit, or create new Admin Profiles, go to Networks > Instances > Citrix ADC, and on the right is a Profiles button.

  5. ADM 12.1 build 49 and newer lets you assign Tags to instances. See How to create tags and assign to instances at Citrix Docs.

  6. You can then search instances based on the Tags.

Citrix ADC SDX

  1. At Networks > Instances > Citrix ADC, on the SDX tab, you can click Add to discover a SDX appliance, and all VPXs on that SDX appliance. You don’t have to discover the VPXs separately.
  2. In the Add Citrix ADC SDX page, click the Edit button next to the Profile Name drop-down to edit nssdx_default_profile. Or you can click the Add button to create a new SDX Profile. Note: SDX profiles are different than VPX profiles.
  3. Enter the credentials for the SDX SVM Management Service.
  4. For Citrix ADC Profile, select an admin profile that has nsroot credentials for the VPX instances. After the VPXs are discovered, ADM uses the ADC Profile to login to each VPX. If you don’t have a VPX Admin Profile in your drop-down list, click the Add button. Note: You can only select one ADC Profile. If each VPX instance has different nsroot credentials, you can fix it after SDX discovery has been performed. The ADC Profile is different than the SDX Profile.

    1. In the Create Citrix ADC Profile page, enter the nsroot credentials for the VPX instances, and then scroll down.
    2. Enter a new SNMP Security Name or Community String.
    3. Then click Create.
  5. Back in the Configure ADC SDX Profile page, enter a new Community string for the SDX SVM. This appears to be SNMP v2 only.
  6. You can uncheck the box for Use global settings for SDX communication, and change the protocol.
  7. Click OK when done.
  8. Back in the Add Citrix ADC SDX page, select a Site, and optionally an Agent.
  9. Click OK to start discovery.
  10. After discovery is complete, switch to the VPX tab. You should automatically see the VPX instances.
  11. To specify the nsroot credentials for a VPX, right-click the VPX, and click Edit.

    1. In the Modify Citrix ADC VPX page, either select an existing Profile Name, or click the Add button to create a new one. Click OK when done. It should start rediscovery automatically.
  12. After fixing the nsroot credentials, right-click the VPX instance, and click Configure SNMP. ADM will configure the VPX to send SNMP Traps to ADM.

Instance management

  • REST API proxy – Citrix ADM can function as a REST API proxy server for its managed instances. Instead of sending API requests directly to the managed instances, REST API clients can send the API requests to Citrix ADM. See Citrix CTX228449 NetScaler MAS as an API Proxy Server
  • Citrix ADC VPX Check-In/Check-Out Licensing – You can allocate VPX licenses to Citrix ADC instances on demand from Citrix ADM. The Licenses are stored and managed by Citrix ADM, which has a licensing framework that provides scalable and automated license provisioning. A Citrix ADC VPX instance can check out the license from the Citrix ADM when a Citrix ADC VPX instance is provisioned, or check back in its license to Citrix ADM when an instance is removed or destroyed. See Citrix CTX228451 NetScaler VPX Check-In/Check-Out Licensing with NMAS

Licenses

Virtual Server License Packs

Without licenses, you can enable analytics features on only 30 Virtual Servers. You can install additional licenses in 100 Virtual Server packs. More info at Licensing at Citrix Docs.

  1. On the left, go to Networks > Licenses.
  2. On the right, notice the Host ID.
  3. At mycitrix.com, allocate your Citrix ADM licenses to this Host ID.
  4. Then use the Browse button to upload the allocated license file.
  5. Click Finish after uploading the license file to apply it.
  6. The License Expiry Information section shows you the number of installed licenses and when they expire.
  7. You can use the Notification Settings section to email you when licenses are almost fully consumed or about to expire.
  8. If you don’t have an Email server setup yet, click the Add button to create one.

Allocate licenses to Virtual Servers

You can manually unassign an automatically-allocated ADM Virtual Server license and reassign it to a different Virtual Server.

  1. Go to Networks> Licenses > System Licenses to see the number of currently installed licenses, and the number of managed virtual servers.
  2. By default, Auto-select Virtual Servers is enabled. If you disable this setting, then the Click to select button appears.
  3. Click the Click to select button.
  4. The top right shows you the number of licensed Virtual Servers.
  5. In the left, select the type of Virtual Server you want to unlicense or license.
  6. On the right, the License Type column indicates if the Virtual Server is licensed or not.
  7. Select a Virtual Server you want to license, and then click the Apply Basic License button. Note: you might have to unlicense a different Virtual Server first.
  8. Click Close when done.

Enable AppFlow / Insight / Analytics

  1. Go to Networks > Instances > Citrix ADC.
  2. On the right, switch to one of the instance type tabs (e.g. VPX).
  3. Select an instance, open the Select Action menu, and click Configure Analytics.
  4. At the top of the page are boxes you can check.
  5. Down the page, in the Application List section, with Load Balancing selected in the View list, select your StoreFront load balancer, and then click Enable AppFlow. If you don’t see your Virtual Server in this list, then you first need to assign a Virtual Server License.
  6. In the Enable AppFlow window, do the following:
    1. In the larger Expression box, type in true.
    2. For newer ADC appliances, change the Transport Mode selection to Logstream instead of IPFIX. Notice the firewall requirement for TCP port 5557.
    3. Select Web Insight.
    4. If App Firewall is enabled on the vServer, then also select Security Insight.
    5. Client Side Measurement injects JavaScript in HTTP responses to measure page load times and can sometimes cause problems in Receiver / Workspace app.
  7. Click OK.
  8. Use the View drop-down to select Citrix Gateway.
  9. Right-click a Citrix Gateway Virtual Server, and click Enable AppFlow.
  10. In the Enable AppFlow window, do the following:
    1. In the Select Expression drop-down, select true.
    2. For newer ADC appliances, change the Transport Mode to Logstream. Notice the firewall warning.
    3. Select both ICA and HTTP. The HTTP option is for Gateway Insight.
    4. The TCP option is for the second appliance in double-hop ICA. If you need double-hop, then you’ll also need to run set appflow param -connectionChaining ENABLED on both appliances. See Enabling Data Collection for NetScaler Gateway Appliances Deployed in Double-Hop Mode at Citrix Docs for more information.
    5. The AppFlow processing impact on the ADC is much reduced if you run VDA 7.16 or newer (including VDA 1903), Workspace app or Receiver 4.10 and newer, and ADC 12.0 build 57.24 or newer (including NetScaler 12.1). VDA 7.15 (LTSR) does not include the new AppFlow NSAP functionality. Details at Citrix Blog Post HDX Insight 2.0.
  11. Click OK.
  12. Login to the Citrix ADC (not ADM), and go to System > Settings.
  13. On the right, click Configure Modes.
  14. If you are using LogStream, then make sure ULFD is checked. Click OK.

    enable mode ulfd
  15. On the right, click Change Global System Settings.
  16. Scroll down to ICA port(s) and enter 1494 and 2598. Click OK. (Source = Citrix Discussions)

    set ns param -icaPort 1494 2598
  17. On the right, click Change HTTP Parameters.
  18. At the top, add 80 and 443 to the Http Ports list. Click OK. (Source = Citrix Discussions)

    set ns param -httpPort 80 443
  19. By default, with AppFlow enabled, if a ADC High Availability pair fails over, all Citrix connections will drop, and users must reconnect manually. NetScaler 11.1 build 49 and newer have a feature to replicate Session Reliability state between both HA nodes.
    1. From Session Reliability on NetScaler High Availability Pair at Citrix Docs: Enabling this feature will result in increased bandwidth consumption, which is due to ICA compression being turned off by the feature, and the extra traffic between the primary and secondary nodes to keep them in sync.
    2. On a NetScaler 11.1 build 49 and newer ADC appliance, go to System > Settings.
    3. On the right, in the Settings section, click Change ICA Parameters.
    4. Check the box next to Session Reliability on HA Failover, and click OK.
  20. In a NetScaler 12 or newer instance, at System > AppFlow > Collectors, you can see if the Collector (ADM) is up or not. However, ADC uses SNIP to verify connectivity, but AppFlow is sent using NSIP, so being DOWN doesn’t necessarily mean that AppFlow isn’t working. Citrix CTX227438 After NetScaler Upgrade to Release 12.0 State of AppFlow Collector Shows as DOWN.

  21. On the ADM appliance, AppFlow for ICA (HDX Insight) information can be viewed MAS under the Analytics > HDX Insight node.

Citrix Blog Post – NetScaler Insight Center – Tips, Troubleshooting and Upgrade

Enable Syslog on Instance

ADM can configure ADC instances to send Syslog to ADM. Note: this will increase disk space consumption on the ADM appliances.

  1. Go to Networks > Instances > Citrix ADC. On the right, select a tab..
  2. On the right, select an instance, open the Select Action drop-down, and click Configure Syslog.
  3. Uncheck All and check the other boxes. You probably don’t want Debug or None. Click OK.

ADM nsroot Password

Changing the nsroot password also changes the nsrecover password.

  1. In ADM , go to System > User Administration > Users.
  2. On the right, select the nsroot account, and click Edit.
  3. Check the box next to Change Password and enter a new password.
  4. You can also specify a session timeout by checking the box next to Configure Session Timeout.
  5. Click OK.

Management Certificate

The certificate to upload must already be in PEM format. If you have a .pfx, you must first convert it to PEM (separate certificate and key files). You can use a ADC to convert the .pfx, and then download the converted certificate from the appliance.

  1. Go to System > System Administration.
  2. On the right, in the Set Up Citrix ADM section, click Install SSL Certificate.
  3. Click Choose File to browse to the PEM format certificate and key files. If the keyfile is encrypted, enter the password. Click OK.
  4. Click Yes to reboot the system.

System Configuration

  1. Go to System > System Administration.
  2. On the right, modify settings (e.g. Change System Time Zone) as desired.

  3. Click Change System Settings.

    1. Check the box next to Enable Session Timeout, and specify a value.
    2. By default, at NetworksInstances > Citrix ADC , if you click a blue IP address link, it opens the instance in a new web page, and logs in automatically using the nsroot credentials. If you want to force ADM users to login using non-nsroot credentials, in Modify System Settings, check the bottom box for Prompt Credentials for Instance Login.

    3. Click OK when done.
  4. Configure SSL Settings lets you disable TLS 1 and TLS 1.1.

    1. Click the Protocol Settings section in the Edit Settings section on the right side of the screen.
    2. On the left, uncheck TLSv1 and TLSv1.1. Then click OK and Close.
    3. A restart is required.

Message of the Day

In ADM 12.1 build 50 and newer, you can configure a Message of the day.

  1. In ADM, on the left, go to System > System Administration.
  2. On the right, in the System Settings section, click Configure message of the day.
  3. Enter a message and click OK.
  4. When you login to ADM, you’ll be shown the message.

Prune Settings

  1. At System > System Administration, on the left are Prune Settings.
  2. System Prune Settings …

    1. …defaults to deleting System Events, Audit Logs, and Task Logs after 15 days. System events are generated by the MAS appliance, which is different than Instance events (SNMP traps) that are generated by ADC appliances.
    2. MAS can initiate a purge automatically as the database starts to get full.
    3. If you click the pencil next to the purge threshold value, you can configure an alarm for when the database gets full.

  3. To see the current database disk usage, go to System > Statistics.
  4. Instance Events prune Settings controls when instance SNMP traps are pruned, which defaults to 40 days.

  5. If you are sending Syslog from instances to MAS, Instance Syslog Purge Settings controls when the log entries are purged.

Backup Settings

  1. In the right column, under Backup Settings, are additional settings.
  2. System Backup Settings defines how many MAS backups you want to keep.

  3. Instance Backup Settings lets you configure how often the instances are backed up.

    1. You probably want to increase the number of instance backups, or decrease the backup interval.
    2. There is an option to perform a backup whenever the ADC configuration is saved.
    3. The Enable External Transfer checkbox lets you transfer the backups to an external system so it can be backed up by your backup tool.

Analytics Settings

  1. There are more settings at Analytics > Settings.
  2. ICA Session Timeout can be configured by clicking the link.

    • If ADM doesn’t receive AppFlow records for a session, it will consider that session has got terminated in ADC and stops monitoring that session further. The time for which ADM needs to wait before considering a session terminated is ICA session timeout. This is configurable in ADM, by default it is set to 15 minutes. (source = Citrix Discussions)
  3. You can configure how the App Score (Application Dashboard) is calculated.

  4. Analytics > Settings > Data Persistence lets you configure how long Analytics data is retained. Adjusting these values could dramatically increase disk space consumption. See CTX224238 How Do I Increase Granularity of Data Points Stored on NetScaler MAS Analytics?.

    • To see the current database disk usage, go to System > Statistics.

NTP Servers

  1. On the left, click System > NTP Servers.
  2. On the right, click Add.
  3. Enter an NTP server, and click Create.

  4. After adding NTP servers, click the NTP Synchronization button.
  5. Check the box next to Enable NTP Synchronization, and click OK.
  6. Click Yes to restart.

Syslog

This is for log entries generated by ADM, and not for log entries generated by instances.

  1. Go to System > Auditing > Syslog Servers.
  2. On the right, click Add.
  3. Enter the syslog server IP address, and select Log Levels. Click Create.
  4. You can click Syslog Parameters to change the timezone and date format.

Email Notification Server

  1. Go to System > Notifications > Email.
  2. On the right, on the Email Servers tab, click Add.
  3. Enter the SMTP server address, and click Create.
  4. On the right, switch to the Email Distribution List tab, and click Add.
  5. Enter an address for a destination distribution list, and click Create.
  6. In ADM 12.1 build 49 and newer, you can highlight a Distribution List and click the Test button.


  7. On the left, click System > Notifications.
  8. On the right, click Change Notification Settings.
  9. Move notification categories (e.g. UserLogin) to the right.
  10. Check the box next to Send Email. Select a notification distribution list. Then click OK.

Authentication

  1. Go to System > Authentication > LDAP.
  2. On the right, click Add.
  3. This is configured identically to ADC.
    1. Enter a Load Balancing VIP for LDAP.
    2. Change the Security Type to SSL, and Port to 636. Scroll down.
    3. Enter the Base DN in LDAP format.
    4. Enter the bind account credentials.
    5. Check the box for Enable Change Password.
    6. Click Retrieve Attributes, and scroll down.
    7. For Server Logon Attribute, select sAMAccountName.
    8. For Group Attribute, select memberOf.
    9. For Sub Attribute Name, select cn.
    10. To prevent unauthorized users from logging in, configure a Search Filter. Scroll down.
    11. If desired, configure Nested Group Extraction.
  4. Click Create.
  5. On the left, go to System > User Administration > Groups.
  6. On the right, click Add.

    1. Enter the case sensitive name of your Citrix ADC Admins AD group.
    2. Move the admin Permission to the right.
    3. The Configure User Session Timeout checkbox lets you configure a session timeout.
    4. Click Next.
    5. On the Authorization Settings page, if you are delegating limited permissions, you can uncheck these boxes and delegate specific entities.
      • All DNS Domain Names (GSLB) is an option for Stylebooks in ADM 12.1 build 49 and newer.
    6. Click Create Group.
    7. In the Assign Users page, click Finish. Group membership comes from LDAP, so there’s no need to add local users.
  7. On the left, go to System > User Administration.
  8. On the right, click User Lockout Configuration.
  9. If desired, check the box next to Enable User Lockout, and configure the maximum logon attempts. Click OK.
  10. On the left, go to System > Authentication.
  11. On the right, click Authentication Configuration.
  12. Change the Server Type to EXTERNAL, and click Insert.
  13. Select the LDAP server you created, and click OK.
  14. Make sure Enable fallback local authentication is checked, and click OK.

Analytics Thresholds

  1. Go to Analytics > Settings > Thresholds.
  2. On the right, click Add.
  3. Enter a name.
  4. Use the Traffic Type drop-down to select HDXWEBSECURITY, or APPANALYTICS.
  5. Use the Entity drop-down to select a category of alerts. What you choose here determines what’s available as Metrics when you click Add Rule.
    1. With HDX as the Traffic Type, to add multiple rules for multiple Entity types, simply change the Entity drop-down before adding a new rule.
    2. If the Traffic Type is HDX, and the Entity drop-down is set to Users, on the bottom in the Configure Geo Details section, you can restrict the rule so it only fires for users for a specific geographical location.

  6. In the Notification Settings section, check the box to Enable Treshold.
  7. Check the box to Notify through Email, and select an existing Email Distribution List.
  8. Click Create.

Private IP Blocks

You can define Geo locations for internal subnets.

  1. Go to Analytics > Settings > IP Blocks.
  2. On the right, click Add.
  3. In the Create IP Blocks page:
    1. Enter a name for the subnet.
    2. Enter the starting and ending IP address.
    3. Select a Geo Location (Country, Region, City). As you change the fields, the coordinates are automatically filled in.
  4. Click Create.

Instance Email Alerts (SNMP Traps)

You can receive email alerts whenever a ADC appliance sends a critical SNMP trap.

  1. On the left, go to Networks > Events > Rules.
  2. On the right, click Add.
  3. Give the rule a name.
  4. Move Severity filters (e.g. Major, Critical) to the right by clicking the plus icon next to each Severity.
  5. While scrolling down, you can configure additional alert filters. Leaving them blank will alert you for all categories, objects, and instances.
  6. On the bottom of the page, in the Event Rule Actions section, click Add Action.
  7. In the Add Event Action page:
    1. Select an Action Type (e.g. Send e-mail Action).
    2. Select the recipients (or click the Add button to add recipients).
    3. Optionally, enter a Subject and/or Message.
    4. In ADM 12.1 build 49 and newer, if you enter a Subject, you can check Prefix severity, category, and failure object information to the custom email subject.
    5. Emails can be repeated by selecting Repeat Email Notification until the event is cleared.
  8. Click OK.
  9. Then click Create.
  10. See the Event Management section at All how to articles at Citrix Docs.

Events Digest

ADM can email you a daily digest (PDF format) of system and instance events

To enable the daily digest:

  1. Go to System > Notifications.
  2. On the right, click Configure Event Digest Settings.
  3. Uncheck the box next to Disable Event Digest.
  4. Configure the other settings as desired, and click OK.

Director Integration

Integrating Citrix ADM with Director adds Network tabs to Director’s Trends and Session Details views. Citrix Blog Post Configure Director with Netscaler Management & Analytics System (MAS)

Requirements:

  • Citrix Virtual Apps and Desktops (CVAD) must be licensed for Platinum Edition. This is only required for the Director integration. Without Platinum, you can still access the HDX Insight data by going visiting the Citrix ADM website.
  • Director must be 7.11 or newer for Citrix ADM support.

To link Citrix Director with Citrix ADM:

  1. On the Director server, run C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /confignetscaler.
  2. Enter the Citrix ADM nsroot credentials.
  3. If HTTPS Connection (recommended), the Citrix ADM certificate must be valid and trusted by both the Director Server and the Director user’s browser.
  4. Enter 1 for Citrix ADM (aka MAS).
  5. Do this on both Director servers.

Use Citrix ADM

Networks

Everything under the Networks node is free.

At Networks > Instances, select an instance, and view its Dashboard.

ADM 12.1 adds a series of tabs to the Instance Dashboard.

Backups are available by selecting an instance, and clicking Backup/Restore.

Infrastructure Analytics. The ADM Cloud Service has an Infrastructure Analytics node under the Networks node. For details, see Infrastructure Analytics at Citrix Docs.

  • On the right, if you click the gear icon above the table, then the right panel changes to the Settings Panel instead of the Summary Panel. In the right panel, you can then switch to the tab named Score Thresholds to adjust how Infrastructure Analytics scores instance CPU, Memory, Disk, etc.
  • You can click the Circle Pack button to change to the Circle Pack view.

Networks > Network Reporting lets you create Dashboards where you can view Instance performance data.

Networks > Network Reporting > Thresholds lets you create thresholds when counters cross a threshold. For example, you might want a notification when Throughput gets close to the licensed limit.

Configuration Record and Play

Use ADM to record a configuration change on one instance, and push to other instances.

  1. Go to Networks > Configuration Jobs.
  2. On the right, click Create Job.
  3. Change the Configuration Source drop-down to Record and Play.
  4. Change the Source Instance drop-down to the instance you want to record.
  5. Click Record.
  6. ADM opens the instance GUI. Make changes as desired.
  7. When done, go back to ADC, and click Stop.
  8. ADC retrieves the changed config.
  9. On the left, you’ll see the changed commands. Drag them to the right.
  10. On the right, you can change instance-specific values to variables by simply highlighting the values. This allows you to change the values for each instance you push this config to.
  11. Proceed through the rest of the Configuration Job wizard like normal. You’ll select instances, specify variable values for each instance, and schedule the job.

Dave Brett Automating Your Netscaler 11.1 Vserver Config Using Netscaler Management and Analytics System uses a Configuration Job to deploy StoreFront load balancing configuration to an instance.

Analytics and Applications

This functionality requires Virtual Server licenses, which can come from your built-in 30 free licenses.

The AppFlow Analysis tools (e.g. HDX Insight) are located under the Analytics node. See Viewing HDX Insight Reports and Metrics at Citrix Docs.

Applications > Dashboard automatically includes all licensed Virtual Servers in the Others section. On the top middle, click Define Custom App to group Virtual Servers together into an application. The grouped Virtual Servers are removed from the Others list.

Applications > Configurations > Stylebooks lets you use Stylebooks to create new ADC configurations.

There are built-in Stylebooks for Exchange, SharePoint, Oracle, ADFS, etc. Or you can create your own Stylebook and use it to create ADC configurations. For details, see Stylebooks at Citrix Docs.

The Applications Node has quite a bit of functionality. See Application Analytics and Management at Citrix Docs for details.

Link:

HDX Insight

HDX Insight Dashboard displays ICA session details including the following:

  • WAN Latency
  • DC Latency
  • RTT (round trip time)
  • Retransmits
  • Application Launch Duration
  • Client Type/Version
  • Bandwidth
  • Licenses in use

Citrix CTX215130 HDX Insight Diagnostics and Troubleshooting Guide contains the following contents:

  • Introduction
  • Prerequisites for Configuring HDX Insight
  • Troubleshooting
    • Issues Related to ICA parsing
    • Error Counter details
  • Checklist before Contacting Citrix Technical Support
  • Information to collect before Contacting Citrix Technical support
  • Known Issues

Gateway Insight

In the Analytics node is Gateway Insight.

This feature displays the following details:

  • Gateway connection failures due to failed EPA scans, failed authentication, failed SSON, or failed application launches.
  • Bandwidth and Bytes Consumed for ICA and other applications accessed through Gateway.
  • # of users
  • Session Modes (clientless, VPN, ICA)
  • Client Operating Systems
  • Client Browsers

More details at Gateway Insight at Citrix Docs.

Security Insight

The Security Insight dashboard uses data from Application Firewall to display Threat Index (criticality of attack), Safety Index (how securely ADC is configured), and Actionable Information. More info at Security Insight at Citrix Docs.

Troubleshooting

Citrix CTX215130 HDX Insight Diagnostics and Troubleshooting Guide: Syslog messages; Error counters; Troubleshooting checklist, Logs

Citrix CTX224502 NetScaler MAS Troubleshooting Guide

Upgrade Citrix ADM

  1. For MAS 12.0 build 56 and older, you must upgrade to MAS 12.0 build 57.24 before you can upgrade to ADM 12.1. (Source = Before you upgrade at Citrix Docs)
  2. Download the latest Citrix Application Delivery Management (NetScaler MAS) Upgrade Package. You want the ADM Upgrade Package, not a ADM image. It’s around halfway down the page.
  3. Login to Citrix ADM Floating IP or Active Node. Upgrading the Active Node automatically upgrades the Passive Node.
  4. Go to System > Deployment and make sure both nodes are online and replicating.
  5. Go to System > System Administration.
  6. On the right, in the right pane, click Upgrade Citrix ADM.
  7. Browse to the build-mas-12.1…tgz Upgrade Package, and click OK. The file name starts with build-mas-12.1.
  8. Click Yes to reboot the appliance.



  9. After it reboots, login.
  10. If you upgraded from a version older than 12.1 build 50 to a version 12.1 build 50 or newer, you might be prompted to Configure Customer Identity. Make your choice.

    • You can return to the Configure Customer Identity screen by clicking the cloud icon next to your username at the top right of the page.
  11. The new firmware version will be displayed by clicking your username in the top right corner.

Upgrade Disaster Recovery Node

After you upgrade the HA pair in the primary datacenter, you can upgrade the DR node.

  1. Use WinSCP or similar to connect to the DR node using the nsrecover credentials.
  2. On the ADM DR node, navigate to /var/mps/mps_images.
  3. Create a new Directory with the same name as the 12.1 build number. Then double-click the new directory to open it.

  4. Upload the file named build-mas-12.1-##.##.tgz to the version-specific directory. This is the regular ADM upgrade file with a name starting with build-mas-12.1. It’s not the Agent upgrade file.
  5. SSH (Putty) to the DR node and login as nsrecover.
  6. Enter the following. Replace the # with the version number.
    cd /var/mps/mps_images/12.1.##.##
    tar xvzf build-mas-12.1-##.##.tgz

  7. Then enter the following. The appliance will reboot automatically.
    ./installmas

  8. After the reboot, the file /var/mps/log/install_state
  9. …shows you the installed version.

Upgrade ADM Agents

After you upgrade the ADM HA pair in the primary datacenter, and after you upgrade the DR node, you can then upgrade the ADM Agents.

  1. From the ADM 12.1 download page, at the bottom of the page, download the ADM Agent Upgrade Package. This Agent Upgrade file is different than the regular ADM upgrade file. And it is different than the files to deploy a new Agent. Find it at the bottom of the downloads page. Note that Citrix updated the ADM Agent firmware to build 50.33 or higher to resolve a security vulnerability.
  2. Use WinSCP or similar to connect to the ADM Agent using the nsrecover credentials.
  3. On the ADM Agent, navigate to /var/mps/mps_images.
  4. Create a new Directory with the same name as the 12.1 build number. Then double-click the new directory to open it.

  5. Upload the file named build-masagent-12.1-##.##.tgz to the version-specific directory. This is the ADM Agent upgrade file, and not the regular ADM upgrade file.
  6. SSH (Putty) to the ADM Agent and login as nsrecover.
  7. Enter the following. Replace the # with the version number.
    cd /var/mps/mps_images/12.1.##.##
    tar xvzf build-masagent-12.1-##.##.tgz

  8. Then enter the following. The appliance will reboot automatically.
    ./installmasagent

  9. After the reboot, the file /var/mps/log/install_state
  10. …shows you the installed version.
  11. Repeat for any additional ADM Agents.
  12. If you login to ADM and go to Networks > Agents, you should see the new Version. It will take several minutes for the version number to update.

EUC Weekly Digest – June 9, 2018

Last Modified: Nov 7, 2020 @ 6:34 am

Interesting EUC items from last week:

XenApp/XenDesktop

VDA

App Layering (Unidesk)

HDX

Director/Monitoring

WEM/Profile Management

Provisioning Services

Receiver

NetScaler

NetScaler MAS

NetScaler Gateway

XenMobile

Citrix Cloud

  • Citrix SaaS Gateway Service – enables partners to offer managed SD-WAN services for business critical SaaS applications to their end customers – Citrix Docs

VMware

Microsoft

For more immediate updates, follow me at http://twitter.com/cstalhood.

For a list of updates at carlstalhood.com, see the Detailed Change Log.

Director 7.18

Last Modified: Nov 7, 2020 @ 6:34 am

Navigation

💡 = Recently Updated

Change Log

Director Licensing – Platinum Edition

See the XenApp and XenDesktop Feature Matrix. Scroll down to Director Platinum Edition for the list of Director features that require Platinum Edition licensing.

  • Up to a year’s worth of performance data that provides a comprehensive view of capacity trends
  • Proactive notification and alerting including SNMP integration
  • SCOM alerts
  • Desktop and server OS usage reporting
  • Create customized reports
  • Reboot warnings
  • NetScaler MAS integration – HDX Insight
  • Override control over roaming sessions

See Citrix Docs Feature compatibility matrix for a list of which Director feature came with each version, and the licensing Edition needed for each feature.


Install/Upgrade Director 7.18 on Standalone Server

Current Release vs LTSR – Director 7.18 is a Current Release, which is only supported for 6 months from the release date, and you are expected to upgrade it every 3-6 months. If you prefer a release with a longer support cycle, see Director 7.15 LTSR.

Install on Delivery Controller? – The XenDesktop Delivery Controller metainstaller has an option to install Director on the Delivery Controller machine. Or you can install Director on separate, dedicated machines.

  • If Director will connect to multiple sites/farms, then install Director on its own servers.
  • For small environments, it might be OK to install Director on the Delivery Controller machines. Otherwise, Director is usually installed on separate machines.

Director and Delivery Controller versions – There’s no point in upgrading to Director 7.18 if your Delivery Controllers are not also 7.18. Director will inform you if your Delivery Controllers are not the same version as Director.

Installation guidance – For Director installation guidance, see the following:

Scripted install – To install and configure Director using a script, see Dennis Span Citrix Director unattended installation with PowerShell.

Manual installation – To install Director manually:

  1. Start with running AutoSelect.exe from the XenApp/XenDesktop 7.18 ISO.
  2. In the Extend Deployment section, on the bottom left, click Citrix Director.
  3. In the Licensing Agreement page, select I have read, understand, and accept the terms, and click Next.
  4. In the Core Components page, click Next.
  5. In the Delivery Controller page, it will ask you for the location of one Controller in the farm. Only enter one Controller per farm. If you have multiple Director servers, each Director server can point to a different Controller in the farm. From Citrix Docs: Director automatically discovers all other Controllers in the same Site and falls back to those other Controllers if the Controller you specified fails. Click Test Connection, and then click Add.
  6. You can optionally force SSL/TLS for the Monitoring service by following the instructions at Data Access Security at Citrix Developer Documentation. Also see CTX224433 Error: “Cannot Retrieve Data” on Citrix Director Dashboard After Securing OData Interface Through TLS.  💡
  7. In the Features page, click Next.
  8. In the Firewall page, click Next.
  9. In the Summary page, click Install.
  10. A machine restart will probably be needed.
  11. After the restart, login.
    1. If you see a Locate ‘XenDesktop’ installation media window, don’t click anything.
    2. Mount the XenApp_and_XenDesktop_718.iso.
    3. Go back to the Locate media window. On the left, expand This PC and click DVD Drive. Then click Select Folder.
    4. Installation will resume.
  12. In the Finish page, click Finish.
  13. In IIS Manager, go to Default Web Site > Director > Application Settings, find Service.AutoDiscoveryAddresses, and make sure it points to one Controller in the farm, and not to localhost. From Citrix Docs: Director automatically discovers all other Controllers in the same Site and falls back to those other Controllers if the Controller you specified fails.
  14. If you built multiple Director servers, use NetScaler to load balance them.
  15. If you are upgrading Director, run C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /upgrade to complete the upgrade process.
  16. For info on the new monitoring features in Director 7.18 and older, see Use Director below.

Director Default Webpage

From CTX223907 How to Make Director the Default Page within IIS: If Director is installed on a standalone server, do the following to set /Director as the default path.

  1. Open Notepad elevated (as administrator) and paste the following text:
    <script type="text/javascript">
    <!--
    window.location="https://director.corp.com/Director";
    // -->
    </script>
  2. Adjust the window.location line to match your FQDN.
  3. Select File > Save As and browse to the IIS folder, by default C:\inetpub\wwwroot is the IIS folder.
  4. Select the Save as type to All types.
  5. Type a file name with an html extension, and select Save.
  6. Open IIS Manager.
  7. Select the SERVERNAME node (top-level), and double-click Default Document, as shown in the following screen shot:
  8. On the right, click Add…,
  9. Enter the file name of the .html file provided in Step 5.
  10. Ensure the .html file is located at the top of the list, as shown in the following screen shot:

Director Spinning Circle

If after login to Director the spinning circle doesn’t go away…

Do the following to fix it:

  1. Edit the file C:\inetpub\wwwroot\Director\web.config using an elevated text editor.
  2. Search for <serviceHostingEnvironment (line 273).
  3. Add the following attribute:
    multipleSiteBindingsEnabled="true"

Also see CTX202564 Citrix Director Becomes Unresponsive after Submitting the Credentials when IIS X-Frame-Options is enabled

Director Domain Field

On the Director servers, locate and edit the ‘LogOn.aspx’ file. By default you can find it at C:\inetpub\wwwroot\Director\Logon.aspx

In line 450 you will have the following. To find the line, search for ID=”Domain”.

<asp:TextBox ID="Domain" runat="server" CssClass="text-box" onfocus="showIndicator(this);" onblur="hideIndicator(this);"></asp:TextBox>

In the ID=”Domain” element, insert a Text attribute and set it to your domain name. Don’t change or add any other attributes. Save the file.

<asp:TextBox ID="Domain" runat="server" Text="Corp" CssClass="text-box" onfocus="showIndicator(this);" onblur="hideIndicator(this);"></asp:TextBox>

This will prepopulate the domain field text box with your domain name and still allow the user to change it, if that should be required. Note: this only seems to work if Single Sign-on is disabled.

Citrix CTX227936 How to hide the domain from Director Logon Page:  💡

  1. Edit the file C:\inetpub\wwwroot\Director\LogOn.aspx using an elevated text editor.
  2. Locate the tag which starts with: <asp:Label ID="DomainLabel"
  3. Immediately prior to that label, locate the tag: <div class='label eight'>
  4. Add the following before <div class=’label eight’>: <div style='display:none'>
  5. In between “</asp:Textbox> <br />” add the following: </div>

Director Tweaks

Session timeout

By default the idle time session limit of the Director is 245 min. If you wish to change the timeout, here is how to do it.

  1. Log on to the Director Server as an administrator
  2. Open the ‘IIS Manager’
  3. Browse to ‘SitesDefault Web SiteDirector’ in the left hand pane.
  4. Open ‘Session State’ in the right hand pane
  5. Change the ‘Time-out (in minutes)’ value under ‘Cookie Settings’
  6. Click ‘Apply’ in the Actions list

SSL Check

If you are not securing Director with an SSL certificate you will get this error at the logon screen.

To stop this:

  1. Log on to the Director Server as an administrator
  2. Open the ‘IIS Manager’
  3. Browse to ‘SitesDefault Web SiteDirector’ in the left hand pane.
  4. Open ‘Application Settings’ in the right hand pane
  5. Set UI.EnableSslCheck to false.

Disable Activity Manager

From Disable the visibility of running applications in the Activity Manager in Advanced Configuration at Citrix Docs: By default, the Activity Manager in Director displays a list of all the running applications and the Windows description in the title bars of any open applications for the user’s session. This information can be viewed by all administrators that have access to the Activity Manager feature in Director. For Delegated Administrator roles, this includes Full administrator, Delivery Group administrator, and Help Desk Administrator.

To protect the privacy of users and the applications they are running, you can disable the Applications tab from listing running applications.

  • On the VDA, modify the registry key located at HKLM\Software\Citrix\Director\TaskManagerDataDisplayed. By default, the key is set to 1. Change the value to 0, which means the information will not be displayed in the Activity Manager.
  • On the server with Director installed, modify the setting that controls the visibility of running applications. By default, the value is true, which allows visibility of running applications in the Applications Change the value to false, which disables visibility. This option affects only the Activity Manager in Director, not the VDA. Modify the value of the following setting:
    UI.TaskManager.EnableApplications = false

Large Active Directory / Multiple Forests

From CTX133013 Desktop Director User Account Search Process is Slow or Fails: By default, all the Global Catalogs for the Active Directory Forest are searched using Lightweight Directory Access Protocol (LDAP). In a large Active Directory environment, this query can take some time or even time out.

If multiple forests, see Citrix Blog Post Using Citrix Director in a MultiForest Environment.

  1. In Information Server (IIS) Management, under the Desktop Director site, select Application Settings and add a new value called Connector.ActiveDirectory.ForestSearch. Set it to False. This disables searching any domain except the user’s domain and the server’s domain.
  2. To search more domains, add the searchable domain or domains in the Connector.ActiveDirectory.Domains field.

Site Groups

From Citrix Blog Post Citrix Director 7.6 Deep-Dive Part 4: Troubleshooting Machines:

If there are a large number of machines, the Director administrator can now configure site groups to perform machine search so that they can narrow down searching for the machine inside a site group. The site groups can be created on the Director server by running the configuration tool via command line by running the command:

C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /createsitegroups

Then provide a site group name and IP address of the delivery controller of the site to create the site group.

Director Configuration Script

Johan Greefkes at Script for configuring Director at Citrix Discussions was kind enough to provide a script that does the following:

  • Sets the XenDesktop Controllers that Director communicates with
  • Disables SSL Check
  • Sets Logon.aspx file to default to a domain name
  • Adds a footer that displays the name of the Director server

Director – Saved Filters

From Scott Osborne and Jarian Gibson at Citrix Discussions: In Director, you can create a filter and save it.

The saved filter is then accessible from the Filters menu structure.

The saved filters are stored on each Director server at C:\Inetpub\wwwroot\Director\UserData. Each user has their own saved filters. The saved filters are not replicated across Director servers.

You can instead configure multiple Director servers to store the filters on a shared UNC path: (h/t CTP Jarian Gibson)

  1. Create and share a folder (e.g. DirectorData).
  2. The Director server computer accounts need Modify permission to the share.
  3. On each Director server, run IIS Manager.
  4. Go to Sites > Default Web Site > Director. In the middle, double-click Application Settings.
  5. Change the Service.UserSettingsPath setting to the UNC path of the new share.
  6. Repeat this on other load balanced Director servers.

Director and HDX Insight

You can connect Director to NetScaler Management & Analytics System (NetScaler MAS) or Citrix Insight Center to add Network tabs to Director’s Trends and Machine Details views. Citrix Blog Post Configure Director with NetScaler Management & Analytics System (MAS).

Director and Self-Service Password Reset (SSPR)

If you have XenApp/XenDesktop Platinum Edition, it’s possible to install SSPR on the Director server. See George Spiers Citrix Self-Service Password Reset for a detailed implementation guide.

However this might break Director, and all you will see is a spinning circle.

To fix it, in IIS Manager (inetmgr), edit the bindings of the Default Web Site, and Remove the HTTP 8080 binding. Or implement the multisitebinding fix.

More info at Citrix Discussions Installing SSPR 1.0 appears to have broken Director 7.11 on same server.

Director Grooming

If XenDesktop is not Platinum Edition, then all historical Director data is groomed at 30 days.

For XenDesktop/XenApp Platinum Edition, by default, most of the historical Director data is groomed at 90 days. This can be adjusted up to 367 days by running a PowerShell cmdlet.

  1. On a XenDesktop Delivery Controller, run PowerShell and run asnp Citrix.*

  2. Run Get-MonitorConfiguration to see the current grooming settings.
  3. Run Set-MonitorConfiguration to change the grooming settings.

More details on Monitor Service data aggregation and retention can be found at Data granularity and retention at Citrix Docs.  💡

Director Single Sign-on

You can configure Director to support Integrated Windows Authentication (Single Sign-on). Note: there seem to be issues when not connecting from the local machine or when connecting through a load balancer.

  1. Run IIS Manager. You can launch it from Server Manager (Tools menu), or from the Start Menu, or by running inetmgr.
  2. On the left, expand Sites, expand Default Web Site, and click Director.
  3. In the middle, double-click Authentication in the IIS section.
  4. Right-click Windows Authentication, and Enable it.
  5. Right-click Anonymous Authentication, and Disable it.
  6. Pass-through auth won’t work from another computer until you set the http SPN for the Director server. See Director 7.7 Windows Authentication not working with NS LB at Citrix Discussions.
  7. If Director is not installed on a Controller, then you’ll need to configure Kerberos delegation.
  8. If you are load balancing Director then additional config is required. See Director 7.7 Windows Authentication not working with NS LB at Citrix Discussions for more info.
    1. The FQDN for Director load balancing should be different than the FQDN for StoreFront load balancing.
    2. Create an AD service account that will be used as the Director’s ApplicationPoolIdentity.
    3. Create SPN and link it to the service account.
      setspn -S http/loadbalanced_URL domain\user
    4. Trust the user account for delegation to any service (Kerberos only) (trust the Director servers for delegation is not necessary in this case). You have to create the SPN before you can do this step.
    5. In IIS manager, on the Application Pools (Director), specify the Identity as user we have created in step 1.
    6. In IIS manager, expand Default Web Site, select Director, and open the Configuration Editor (bottom of the middle pane).
    7. Use the drop-down to navigate to the following section: system.webServer/security/authentication/windowsAuthentication
    8. Set useAppPoolCredentials = True, and useKernelMode = False. Click Apply on the top right.

  9. When you connect to Director you will be automatically logged in. You can change the login account by first logging off.
  10. Then change the drop-down to User credentials.

Director – Multiple XenDesktop Sites

  1. Run IIS Manager. You can launch it from Server Manager (Tools menu) or from the Start Menu, or by running inetmgr.
  2. On the left, expand Sites, expand Default Web Site, and click Director.
  3. In the middle pane, double-click Application Settings.
  4. Find the entry for Service.AutoDiscoveryAddresses, and double-click it.
  5. If Director is installed on a Controller, localhost should already be entered.
  6. Add a comma, and the NetBIOS name of one of the controllers in the 2nd XenDesktop Site (farm). Only enter one Controller name. If you have multiple Director servers, you can point each Director server to a different Controller in the 2nd XenDesktop Site (farm). From Citrix Docs: Director automatically discovers all other Controllers in the same Site and falls back to those other Controllers if the Controller you specified fails.

Director Process Monitoring

Director 7.11 and newer have Process Monitoring, which is detailed in Citrix Blog Post Citrix Director: CPU, Memory Usage and Process Information.

Process Monitoring is disabled by default. To enable it, configure the Enable process monitoring setting in a Citrix Policy. For Citrix Policies in a GPO, find this setting in the computer half of the GPO. Note: this setting could significantly increase the size of the Monitoring database.

Director Alerts and Notifications

Director supports alert conditions and email notifications. This feature requires XenApp/XenDesktop to be licensed with Platinum Edition. See Citrix Blog Post Configuring & Managing Alerts and Notifications Using Director for more information.

Director 7.11 and newer have CPU, Memory, and ICT RTT alerts. Citrix Blog Post 7 New Categories in Director for Proactive Notifications & Alerts

To configure alerts:

  1. While logged into Director, at the top of the page, click the Alerts button.
  2. Switch to the Email Server Configuration tab.
  3. Enter your SMTP information, and click Send Test Message. Then click Save.


  4. Switch to the Citrix Alerts Policy tab.
  5. There are four high-level categories of alerts: Site Policy, Delivery Group Policy, Server OS Policy, and User Policy. Click whichever one you want to configure.
  6. Director 7.18 comes with Built-in alert Policies. For example, on the Delivery Group Policy tab, find the Smart Alert, and expand it. Then click Edit. Note: this Smart Alert might not appear until you create a Delivery Group in Citrix Studio.
  7. Notice the Conditions that are already enabled. You can change them or add more.
  8. On the bottom right, in the Notification preferences section, click Add.
  9. Enter an email address, and click Done.
  10. On the bottom, click Save.
  11. You can create custom Alert Policies by clicking the Create button on any of these tabs.
  12. For Server OS and User Policy, there are new ICA RTT alerts. See Citrix Blog Post 7 New Categories in Director for Proactive Notifications & Alerts for details on the new alerts in 7.11 and newer.
  13. In Director 7.12 and newer, you can configure alerts to generate an SNMP trap. This is configured in PowerShell as described at Configure alerts policies with SNMP traps at Citrix Docs.
    Set-MonitorNotificationSnmpServerConfiguration        #see Docs for parameter details
    Set-MonitorNotificationPolicy -IsSnmpEnabled $true -Uid <Policy ID>
  14. Citrix has an experimental Desktop Notification Tool. See Citrix Blog Post Desktop Notification Tool For Citrix XenDesktop.

Director – StoreFront Probes

If you are licensed for Platinum Edition, then you can install probe agents on remote machines, and use the probe agents to periodically check if an application can be launched through StoreFront. Applications only – Desktops are not an option.

Custom Studio Role for Probe Administrator

  1. Create a new user account just for probe administration (e.g CORP\ProbeAdmin).
  2. In Citrix Studio, at Configuration > Administrators, on the Roles tab, create a new Role with the permissions shown below.

    • Delivery Groups > Read-only
    • Director > Create\Edit\Remove Alert Email Server Configuration
    • Director > Create\Edit\Remove Probe Configurations
    • Director > View Applications page
    • Director > View Configurations page
    • Director > View Trends page
  3. On the Administrators tab, add an administrator, select your ProbeAdmin account, and assign it the custom Probe Administrator role that you just created.

StoreFront HTTP Basic Authentication

  1. In StoreFront Console, right-click your Store, and click Manage Authentication Methods.
  2. Check the box next to HTTP Basic, and click OK.

Install Probe Agent

To automate the installation and configuration of the Probe Agent, see CTA Dennis Span Citrix Application Probe Agent unattended installation.

On one or more remote machines, download and install the Probe Agent.

  1. Download the Citrix Application Probe Agent 1.0 from https://www.citrix.com/downloads/xenapp-and-xendesktop/components/app-probe-agent.html.
  2. On the remote desktop machine, install Receiver if it isn’t installed already.
  3. Run the downloaded CitrixAppProbeAgent.msi.
  4. In the Welcome to the Citrix Probe Agent Setup Wizard page, click Next.
  5. In the End-User License Agreement page, check the box next to I accept the terms, and click Next.
  6. In the Destination Folder page, click Next.
  7. In the Ready to install Citrix Probe Agent page, click Install.
  8. In the Completed the Citrix Probe Agent Setup Wizard page, click Finish.

Configure Probe Agent

  1. Every Probe Agent machine should have unique StoreFront test user credentials. Create unique accounts for each machine.
  2. From the Start Menu of the remote machine, launch Citrix Probe Agent.
  3. Click Start.
  4. In the Configure Storefront Credentials page, enter the StoreFront Receiver for Web URL.
  5. Enter the username and password for the probe user for this machine.
  6. Click Next.
  7. In the Configure to Display Probe Result page, enter the URL to Director.
  8. Enter the Probe Admin credentials, and click Validate.
  9. Select a Site (farm) if there’s more than one.
  10. Click Next.
  11. In the View Summary page, you may close the window.
  12. Login to Director as the Probe Admin account.
  13. On the top middle, click the Configuration button.
  14. Click Create Probe.
  15. In the Application Probe Configuration page:
    1. Give the probe configuration a name.
    2. Select one or more applications to test.
    3. Select the registered Probe Agent machine(s) to run the probe from.
    4. Enter an email address for probe result notifications.
    5. Select one time per day to run the probe. You can create multiple probe configurations to run the probe multiple times per day.
  16. Click Save.
  17. If you go back to the Configuration page, to edit a probe configuration, select one, and then click the Edit link.
  18. The probe configurations are stored in the Monitoring database, so there shouldn’t be any concerns with load balancing of Director.
  19. To view the probe results, on the top, click Trends. Then switch to the Application Probe Results tab. This page seems to not tell you anything more than if the probe was successful or not.

Director – SCOM Integration

Director 7.8 and newer can display alerts from System Center Operations Manager 2012 R2. This feature requires XenApp/XenDesktop Platinum Edition.

  1. See Configure SCOM integration at Citrix Docs for detailed configuration instructions. Also see Marius Sandbu Integrating Citrix XenDesktop 7.7 and System Center Operations Manager.
  2. If Director server or System Center Operations Manager server is 2008 R2, then login to the 2008 R2 server, open PowerShell and run Enable-PSRemoting. Yes to everything. This is not needed on Windows Server 2012 R2 servers.
  3. On Director server, run C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /configscom
  4. FYI, the DirectorConfig.exe /configscom command enables the following features on the Director server: /FeatureName:IIS-NetFxExtensibility45 /FeatureName:IIS-ASPNET45 /FeatureName:WCF-HTTP-Activation45
  5. FYI, the System Center Operations Manager server is listed in IIS Manager at Default Web Site > Director > Application Settings (middle pane) > Connector.SCOM.ManagementServer.
  6. On the System Center Operations Manager server, edit Remote Management Users local group, and add Citrix Admins, and other Director users.
  7. In System Center Operations Manager Console, go to Administration > User Roles, and edit Operations Manager Operators. Add the Citrix Admins, and other Director users.
  8. See Citrix Blog Post SCOM Alerts in Citrix Director for information on how to view System Center Operations Manager alerts in Director.

Director – Custom Reports

In Director 7.12 and newer, in the Trends view, there’s a Custom Reports tab that guides you through creating a custom OData Query. This tab only appears if you have XenApp/XenDesktop Platinum Edition.

The Monitoring database contains more data than is exposed in Director. To view this data, the Monitoring service has an OData Data Feed that can be queried.

Use Director

The newer Director features usually require Delivery Controllers and VDAs to be at the same version or newer than Director. Director depends on the Monitoring Service that is built into the Delivery Controller. The Monitoring Service gathers data from the VDAs.

See Monitor deployments at Citrix Docs.

See the various Troubleshoot topics at Citrix Docs.

New features in Director 7.18 and newer:

  • In Director, you can view the details of a VDA machine (instead of a user session). If the machine is unregistered, then there’s a link to Health Assistant, which opens Troubleshoot machines  at Citrix Docs.

New features in Director 7.16 and newer:

In Director 7.14 and newer, see CTX223927 How to use Director to troubleshoot application launch errors. This feature is configured in Citrix Policy Settings located in the Computer half at Virtual Delivery Agent Settings > Monitoring. Also see Citrix Blog Post Application Related Session Failure Reporting in Citrix Director 7.15.

In Director 7.14 and newer, see CTX223928 How to use Director to monitor storage performance.

Citrix Blog Post Citrix Director Now Provides Disk Usage Information!:

  • IOPS and disk latency data is enabled by default.
  • IOPS and disk latency is pushed to the database from each VDA at 1 hour interval.
  • Approximately 276 KB of disk space is required to store the CPU, memory, IOPS and disk latency data for one VDA over a period of one year.

In Director 7.14 and newer, see CTX223925 How to use Director to monitor NVIDIA GPU usage.

Citrix Director 7.13 and newer have an Application Instances tab on the Filters page that lets you filter published application sessions based on Session Idle Time (RDS sessions only), Application Name, and all other existing fields, like machine name, and so on. Requires Director 7.13, Controller 7.13, VDA 7.13, and Platinum Edition licensing. See Citrix Blog Post Monitoring Idle Applications and Sessions in Citrix Director. See Troubleshoot applications at Citrix Docs.

If idle time column shows n/a, then you need to wait 10-15 minutes.

In Director 7.13 and newer, the Session Details panel can show if Enlightened Data Transport (EDT, aka HDX on UDP) is enabled in the user’s session. See Citrix Blog Post HDX Adaptive Transport Protocol Monitoring via Director.

George Spiers has a comprehensive guide of all Director 7.12 features at http://www.jgspiers.com/citrix-director/.

Director 7.12 and newer have Connection Failure Details, which is detailed in Citrix Blog Post Director 7.12: Easier Troubleshooting of Machine & Connection Failures. Also see CTX223812 Citrix Director Failure Codes.

Director 7.11 and newer have Process Monitoring, which is detailed in Citrix Blog Post Citrix Director: CPU, Memory Usage and Process Information.

Director 7.9 and newer have Logon Duration improvements.

Citrix Blog Post Interactive Session of Logon Duration in Citrix Director – Explained: Interactive Session Duration = Desktop Ready Event Timestamp (EventId 1000 on VDA) – User Profile Loaded Event Timestamp (EventId 2 on VDA). More details in the Blog Post.

Citrix Blog Post Director 7.6 Failure Reasons Demystified lists possible failure reasons behind an Unregistered alert, and the true meaning of failure reasons such as Connection Refused and Communication Error. It details each failure reason, defines the meanings of these failures, and lists action items that serve as a starting point for troubleshooting the specific scenario. The list is based on Director 7.6.300.