Carl Stalhood – Page 55

Delivery Controller 7.8

Last Modified: May 19, 2020 @ 8:07 am

Navigation

Preparation
Delivery Controller 7.8 Install
- Create Site / Databases
- Second Controller
Studio – Slow Launch
Database Maintenance:
- Change DB connect strings, read-committed snapshot, Director grooming, etc.
Studio Administrators
vCenter Connection – Hosting Resources 💡
Citrix Licensing Server
Remote Desktop Licensing Server
- Install Remote Desktop Licensing Server
- Active Remote Desktop Licensing Server
Health Check

Preparation

Citrix Licensing – If you are going to use an existing Citrix Licensing Server, upgrade it to 11.13.1.2 build 16002.

SQL Databases

Citrix blog post Database Sizing Tool for XenDesktop 7 and Bugfix for Database Sizing Tool
Citrix article CTX114501 – Supported Databases for Citrix Products
There are typically three databases: one for the Site (aka farm), one for Logging (audit log) and one for Monitoring (Director).
- The monitoring database name must not have any spaces in it. See CTX200325 Database Naming Limitation when Citrix Director Accesses Monitoring Data Using OData APIs
- If you want Citrix Studio to create the SQL databases automatically, then the person running Studio must be a sysadmin on the SQL instances. No lesser role will work.
- As an alternative, you can use Citrix Studio to create SQL scripts and then run those scripts on the SQL server. In that case you only need the dbcreator and securityadmin roles.
- It is possible to create the databases in advance. However, you must use the non-default Latin1_General_100_CI_AS_KS collation. Then use Citrix Studio to configure the database tables.
Citrix recommends SQL Mirroring because it has the fastest failover.
- SQL Mirroring requires two SQL Standard Edition servers and one SQL Express for the witness server.
- You can setup SQL Mirroring either before installing XenDesktop or after installing XenDesktop. If after, then see Citrix CTX140319 to manually change XenDesktop’s database connection strings How to Migrate XenDesktop Database to New SQL Server.
- To setup SQL Mirroring, see Rob Cartwright: Configure SQL Mirroring For Use With XenDesktop, XenApp, and PVS Databases.
- If you try to stretch the mirror across datacenters, the SQL witness must be placed in a third datacenter that has connectivity to the other two datacenters. However, stretching a single XenApp/XenDesktop site/farm and corresponding SQL mirror across datacenters is not recommended.
AlwaysOn Availability Groups and SQL Clustering are also supported. However, these features require the much more expensive SQL Enterprise Edition.

Windows Features

Installing Group Policy Management on the Delivery Controller lets you edit GPOs and have access to the Citrix Policies node in the GPO Editor. Or you can install Studio on a different machine that has GPMC installed.
vSphere Web Client – if you will connect to vSphere Web Client from the Controller machine, Flash Player is only available for IE if you install the Desktop Experience feature. Or you can use Google Chrome.

vSphere

Create a role in vSphere Client. Assign a service account to the role at the Datacenter or higher level.

Delivery Controller Install

A typical size for the Controller VMs is 2-4 vCPU and 8 GB of RAM.
Make sure the User Right Log on as a service includes NT SERVICE\ALL SERVICES or add NT SERVICE\CitrixTelemetryService to the User Right.
On two Delivery Controllers, install the Delivery Controller software from the XenApp/XenDesktop 7.8 media. Download it from XenApp Enterprise, XenApp Platinum, XenDesktop Enterprise, or XenDesktop Platinum, depending on your license. Go to the downloaded XenDesktop 7.8 ISO and run AutoSelect.exe.
Click Start next to either XenApp or XenDesktop. The only difference is the product name displayed in the installation wizard.
On the left, click Delivery Controller.
You can install all components on one server or on separate servers. Splitting them out is only necessary in large environments or if you want to share the components (e.g. Licensing, StoreFront, Director) across multiple farms.
In the Features page, uncheck the box next to Install Microsoft SQL Server 2012 SP1 Express and click Next.
In the Summary page, click Install.
In the Installation Successful page, click Finish. Studio will automatically launch.
Ensure the two Controller VMs do not run on the same hypervisor host. Create an anti-affinity rule.

Create Site

There are several methods of creating the databases for XenApp/XenDesktop:

If you have sysadmin permissions to SQL, let Citrix Studio create the databases automatically.
If you don’t have sysadmin permissions to SQL then use Citrix Studio to generate SQL scripts and send them to a DBA.

Database Mirroring

If you are not using database mirroring then skip to the next section.

You can setup SQL Mirroring either before configuring XenDesktop or after configuring XenDesktop.

If before, then the empty databases (Site, Logging, Monitoring) must use the Latin1_General_100_CI_AS_KS collation, which is not the default.
If SQL Mirroring is already setup then XenDesktop will detect it and set the database connection strings accordingly. Or you can manually change the database connection strings later as detailed at Citrix CTX140319 How to Migrate XenDesktop Database to New SQL Server.
If you use Citrix Studio to create SQL scripts that populate the databases, then there will be separate SQL scripts for the Primary and Partner.

To verify mirroring after the XenDesktop configuration has completed, run the PowerShell cmdlet get-configdbconnection and ensure that the Failover Partner has been set in the connection string to the mirror.

Use Studio to Create Database Scripts

Launch Citrix Studio. After it loads, click Deliver applications and desktops to your users.
In the Introduction page, select An empty, unconfigured site. This reduces the number of pages in this Setup wizard. The other pages will be configured later.
Enter a Site Name (aka farm name) and click Next. Only administrators see the farm name.
In the Databases page, change the selection to Generate scripts to manually set up databases on the database server.
Change the database names if desired.
If you are building two Controllers, click Select near the bottom of the same page.
Click Add.
Enter the FQDN of the second Controller and click OK. Note: the Delivery Controller software must already be installed on that machine.
Then click Save.
If you hover your mouse over 2 selected, it will show both Controllers. Click Next.
In the Additional Features page, click Next.
In the Summary page, click Generate scripts.
A folder will open with six scripts. Edit each of the scripts.
Near the top of each script are two lines to create the database. Uncomment both lines (including the go line). Then save and close the file.
Once all of the scripts are edited you can send them to your DBA.
On the Principal SQL Server, open the file Site_Principal.sql.
Open the Query menu and click SQLCMD Mode.
Then execute the script.
If SQLCMD mode was enabled properly then the output should look something like this:
If you have a mirrored database, run the second script on the mirror SQL instance. Make sure SQLCMD mode is enabled.
Repeat for the Logging_Pricipal.sql script.
You’ll have to enable SQLCMD Mode for each script you open.
Repeat for the Monitoring_Principal.sql script.
Once again enable SQLCMD Mode.
The person running Citrix Studio must be added to the SQL Server as a SQL Login and granted the public server role.
Back in Citrix Studio, click the Continue database configuration and Site setup button.
In the Database page, enter the SQL server name and instance name and click Next.
On the Licensing page, enter the name of the Citrix License Server and click Connect. . If you installed Licensing with your Delivery Controller, then simply enter localhost.
XenApp/XenDesktop 7.8 requires the newest Licensing Server. If your server isn’t compatible, leave it set to localhost and fix it later.
If the Certificate Authentication appears, select Connect me and click Confirm.
Then select your license and click Next.
In the Additional Features page, click Next.
In the Summary page, make your selection for Customer Experience Improvement Program and click Finish.
It will take some time for the site to be created.

Verify Database Mirroring

If your database is mirrored, when you run get-brokerdbconnection, you’ll see the Failover Partner in the database connection string.

Second Controller

When building the first Delivery Controller the scripts might have already included the second Delivery Controller. Thus no special SQL permissions are needed. If the second Delivery Controller has not already been added to the SQL databases then there are several methods of adding a second Controller to the databases for XenApp/XenDesktop:

If you have sysadmin permissions to SQL, let Citrix Studio modify the databases automatically.
If you don’t have sysadmin permissions to SQL then do use Citrix Studio to generate SQL scripts and send them to a DBA.

To use Citrix Studio to create the SQL Scripts:

On the first Delivery Controller, if StoreFront is installed, delete the default StoreFront store (/Citrix/Store) and recreate it with your desired Store name (e.g. /Citrix/CompanyStore).
On the 2^nd Delivery Controller, install XenDesktop as detailed earlier.
After running Studio, click Connect this Delivery Controller to an existing Site.
Enter the name of the first Delivery Controller and click OK.
If you don’t have elevated SQL permissions, click No when asked if you want to update the database automatically.
Click Generate scripts.
A folder will open with six scripts. If not mirroring, then the top three scripts need to be sent to a DBA. If mirroring, send all six.
On the SQL Server, open open one of the .sql files.
Open the Query menu and click SQLCMD Mode.
Then execute the XenDesktop script.
If SQLCMD mode was enabled properly then the output should look something like this:
Back in Citrix Studio, click OK.
In the Studio, under Configuration > Controllers, you should see both controllers.
You can also test the site again if desired.

Studio – Slow Launch

From B.J.M. Groenhout at Citrix Discussions: The following adjustments can be made if Desktop Studio (and other Citrix management Consoles) will start slowly:

Within Internet Explorer, go to Tools – Internet Options – Tab Advanced – Section Security and uncheck the option Check for publisher’s certificate revocation

After adjustment Desktop Studio (MMC) will be started immediately. Without adjustment it may take some time before Desktop Studio (MMC) is started.

Registry setting (can be deployed using Group Policy Preferences):

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
- “State“=dword:00023e00

Database Maintenance

View Logging Database

To view the contents of the Logging Database, in Studio, click the Logging node. On the right is Create Custom Report. See Citrix article CTX138132 Viewing Configuration Logging Data Not Shown for more info.

Enable Read-Committed Snapshot

The XenDesktop Database can become heavily utilized under load in a large environment. Therefore Citrix recommends enabling the Read_Committed_Snapshot option on the XenDesktop databases to remove contention on the database from read queries. This can improve the interactivity of Studio and Director. It should be noted that this option may increase the load on the tempdb files. See Citrix article CTX137161 How to Enable Read-Committed Snapshot in XenDesktop for configuration instructions.

Change Database Connection Strings

Sometimes the database connection strings need to be modified:

When moving the SQL databases to a different SQL server
When enabling mirroring after the databases have already been configured in Studio.

CTX140319 How to Migrate XenDesktop Database to New SQL Server has the correctly ordered list of PowerShell commands to change the database connection strings. Make sure PowerShell is running as administrator before running these commands.

XenApp/XenDesktop 7.8 adds set-applibdbconnection so make sure the commands include setting that DB connection too. 💡

Step 5 assumes Site, Monitoring, and Logging are one database so you’ll need to adjust the commands if those databases are split. In particular, change $cs in Set-LogDBConnection -DataStore Logging -DBConnection $cs to the Logging database. And change $cs in Set-MonitorDBConnection -DataStore Monitor -DBConnection $cs to the Monitoring database. The other commands don’t need to be changed.

Director Grooming

If XenDesktop is not Platinum Edition then all historical Director data is groomed at 7 days.

For XenDesktop/XenApp Platinum Edition, by default, most of the historical Director data is groomed at 90 days. This can be adjusted up to 367 days by running a PowerShell cmdlet.

On a Delivery Controller, run PowerShell and run asnp Citrix.*
Run Get-MonitorConfiguration to see the current grooming settings.
Run Set-MonitorConfiguration to change the grooming settings.

Studio Administrators

Full Administrators

In the Studio, under Configuration, click the Administrators node. The first time you access the node you’ll see a Welcome page. Feel free to check the box and then click Close.
On the Administrators tab, right-click and click Create Administrator.
In the Administrator and Scope page, specify a group (e.g. Citrix Admins or Help Desk) that will have permissions to Studio and Director. Click Next.
On the Role page, select a role and then click Next. For example:
- Full Administrator for the Citrix Admins group
- Help Desk Administrator for the Help Desk group
- Machine Catalog Administrator for the desktop team
In the Summary page, click Finish.

Help Desk

In the Studio, under Configuration, click the Administrators node. On the Administrators tab, right-click and click Create Administrator.
In the Administrator and Scope page, specify a Help Desk group that will have permissions to Studio and Director. Click Next.
On the Role page, select the Help Desk Administrator role and then click Next.
In the Summary page, click Finish.
When administrators in the Help Desk role log into Director, all they see is this.

To jazz it up a little, add the Help Desk group to the read-only role.
Right-click the Help Desk Administrator and click Edit Administrator.
Click Add.
In the Scope page, select a scope and click Next.
In the Role page, select Read Only Administrator and click Next.
In the Summary page, click Finish.
Then click OK. Now Director will display the dashboard.

Provisioning Services w/Personal vDisk

From Considerations: Provisioning Services at Configure and manage Personal vDisk at docs.citrix.com: The Provisioning Services Soap Service account must be added to the Administrator node of Studio and must have the Machine Administrator or higher role. This ensures that the PvD desktops are put into the Preparing state when the Provisioning Services (PVS) vDisk is promoted to production.

vCenter Connection

XenDesktop uses an Active Directory service account to log into vCenter. This account needs specific permissions in vCenter. To facilitate assigning these permissions, create a new vCenter role and assign it to the XenDesktop service account. The permissions should be applied at the datacenter or higher level. CTX214389 How to Define VMware vSphere User Privileges for XenApp and XenDesktop defines the minimum permissions needed for various activities in XenDesktop: MCS, PvS, Power Management, and AppDisks. 💡

AppDisks requires an additional permission: Virtual Machine > Configuration > Modify Device Settings.

For AppDisks, the read only role must be applied to the vCenter level. See Mark New at discussions.citrix.com for details. ?

Hosting Resources

A Hosting Resource = vCenter + Cluster (Resource Pool) + Storage + Network. When you create a machine catalog, you select a previously defined Hosting Resource, and the Cluster, Storage, and Network defined in the Hosting Resource object are automatically selected. If you need some desktops on a different Cluster+Storage+Network then you’ll need to define more Hosting Resources in Studio.

In Studio, expand Configuration and click Hosting. Right-click it and click Add Connection and Resources.
In the Connection page, select VMware vSphere as the Connection type.
Enter https://vcenter01.corp.local/sdk as the vCenter URL. The URL must contain the FQDN of the vCenter server. Ensure the entered URL has /sdk on the end.
Enter credentials of a service account that can log into vCenter.
In the Connection name field, give the connection a name. Typically, this matches the name of the vCenter server.
If you are not using Machine Creation Services and instead only need the vCenter connection for machine power management, change the Create virtual machines using selection to Other Tools.
Click Next.
If you see a message about the vCenter certificate, check the box next to Trust certificate and click OK.
Enter a name for the hosting resource. Since each hosting resource is a combination of vCenter, Cluster, Network, and Datastore, include those names in this field (e.g. vCenter01-Cluster01-Network01-Datastore01).
In the Cluster page, click Browse and select a cluster or resource pool.
Select a network and click Next.
On the Storage page, select a datastore for the virtual machines. Maximum flexibility is achievable if you only select one datastore per hosting resource. Create additional hosting resources for each datastore.
If desired, change the selection for personal vDisk to use a different storage. Click Next.
In the Summary page, click Finish.

Citrix Licensing Server

Upgrade

Upgrade Citrix Licensing to 11.13.1.2. 💡

Go to the downloaded Citrix Licensing 11.13.1.2 build 16002 and run CitrixLicensing.exe.
Click Upgrade.
Click Finish.
If you go to Programs and Features, it should now show version 11.1.0.16002.
If you login to the license server web console, on the Administration tab, it shows it as version 11.13.1 build 16002.
You can also view the version in the registry at HKLM\Software\Wow6432Node\Citrix\LicenseServer\Install.

Licensing Server HA using GSLB

From Dane Young – Creating a Bulletproof Citrix Licensing Server Infrastructure using NetScaler Global Server Load Balancing (GSLB) and CtxLicChk.ps1 PowerShell Scripts. Here is a summary of the configuration steps. See the blog post for detailed configuration instructions.

Build two License Servers in each datacenter with identical server names. Since server names are identical, they can’t be domain-joined.
Install identical licenses on all License Servers.
Set the DisableStrictNameChecking registry key on all Citrix Licensing servers.
Synchronize the certificate files located at C:\Program Files (x86)\Citrix\Licensing\WebServicesForLicensing\Apache\conf. They must be identical on all Licensing Servers.
Download CtxLicChk.exe from http://support.citrix.com/article/CTX123935 and place on all Licensing Servers.
Schedule the PowerShell script CtxLicChk.ps1 on all Licensing Servers. Get this script from the blog post linked above.
Configure NetScaler:
1. Configure GSLB ADNS services.
2. Add wildcard Load Balancing service for each Citrix Licensing Server.
3. Configure service TCP monitoring for ports 27000, 7279, 8082, and 8083.
4. Create Load Balancing Virtual Server for each Licensing Server.
5. Set one Load Balancing Virtual Server as backup for the other.
6. Repeat in second datacenter.
7. Configure GSLB Services and GSLB Monitoring.
8. Configure GSLB Virtual Servers. Set one GSLB Virtual Server as backup for the other.
Delegate the Citrix Licensing DNS name to the ADNS services on the NetScaler appliances.
Configure Citrix Studio to point to the GSLB-enabled DNS name for Citrix Licensing.

Citrix License Server Monitoring

Citrix Licensing 11.13.1 and newer has historical usage reporting: 💡

Run Citrix Licensing Manager from the Start Menu. Or use a browser to connect to https://MyLicenseServer:8083
Use the drop-down menus to select a license type, select dates, and export to a .csv file.
On the top right is a gear icon where you can set the historical retention period.

http://www.jonathanmedd.net/2011/01/monitor-citrix-license-usage-with-powershell.html.

Lal Mohan – Citrix License Usage Monitoring Using Powershell

Jaroslaw Sobel – Monitoring Citrix Licenses usage – Graphs using WMI, Powershell and RRDtool. This script generates a graph similar to the following:

CtxLicUsage-1d_

Remote Desktop Licensing Server

Install Remote Desktop Licensing Server

Do the following on your XenDesktop Controllers:

In Server Manager, open the Manage menu and click Add Roles and Features.
Click Next until you get to the Server Roles page. Check the box next to Remote Desktop Services and click Next.
Click Next until you get to the Role Services page. Check the box next to Remote Desktop Licensing and click Next.
Click Add Features if prompted.
Then finish the wizard to install the role service.

Activate Remote Desktop Licensing

After RD Licensing is installed, in Server Manager, open the Tool menu, expand Terminal Services and click Remote Desktop Licensing Manager.
The tool should find the local server. If it does not, right-click All servers, click Connect and type in the name of the local server. Once the local server can be seen in the list, right-click the server and click Activate Server.
In the Welcome to the Activate Server Wizard page, click Next.
In the Connection Method page, click Next.
In the Company Information page, enter the required information and click Next.
All of the fields on the Company Information page are optional so you do not have to enter anything. Click Next.
In the Completing the Activate Server Wizard page, uncheck the box next to Start Install Licenses Wizard now and click Finish. Since the session hosts will be configured to pull Per User licenses, there is no need to install licenses on the RD Licensing Server.
In RD Licensing Manager, right-click the server and click Review Configuration.
Ensure you have green check marks. If the person installing Remote Desktop Licensing does not have permissions to add the server to the Terminal Server License Servers group in Active Directory, ask a domain admin to do it manually. If you have the proper permissions, click Add to Group.
Click Continue when prompted that you must have Domain Admins privileges.
Click OK when prompted that the computer account has been added.
Click OK to close the window.

Health Check

Andrew Morgan – New Free Tool: Citrix Director Notification Service: The Citrix Director Notification service sits on an edge server as a service (or local to the delivery controller) and periodically checks the health of:

Citrix Licensing.
Database Connections.
Broker Service.
Core Services.
Hypervisor Connections.

And if any of these items fall out of bounds, an SMTP alert is sent to the mailbox of your choice for action. The tool will also send “All Clear” emails when these items are resolved, ensuring you are aware when the service has resumed a healthy state.

Configure RDSH VDAs to use Remote Desktop Licensing Server

StoreFront 2407 through 3.5 – Basic Configuration

Last Modified: Aug 28, 2024 @ 2:54 pm

373 Comments

Navigation

This article applies to StoreFront versions 2407, 2402 LTSR CU1, 2203 LTSR CU5, 1912 LTSR CU9, and all other versions 3.5 and newer.

Change Log
StoreFront Versions
StoreFront Installation / Upgrade
Store Name – Rename
SSL Certificate
- Delivery Controllers – SSL
Base URL – Change
Default Web Page
Authentication Configuration
Receiver for Web (browser interface)
Favorites, Categories, and Default View – Default to Categories view instead of All
Beacons
Propagate Changes
Export/Import StoreFront Configuration
Logon Simulator

💡 = Recently Updated

Change Log

2024 Aug 28 – HTML5 Workspace app – updated with Workspace app for HTML5 version 2408
2024 Aug 20 – Updated Versions section for StoreFront 2402 LTSR CU1
2024 Aug 8 – Deploy Workspace app – updated for Workspace app 2405.10 for Windows
2024 July 31 – Updated Versions and Install sections for StoreFront 2407
2024 June 4 – Updated Versions section for StoreFront 2203 LTSR CU5
2024 July 9 – Deploy Workspace app – updated for Workspace app 2405 for Mac
2024 Jan 24 – Versions – StoreFront security vulnerability
2023 Dec 20 – Next Generation Experience in StoreFront 2311
2023 Dec 20 – Citrix Workspace web extensions at Citrix Docs
2024 April 30 – Updated Versions and Install sections for StoreFront 1912 LTSR CU9
2023 June 5 – added link to CTX559036 Storefront 2302 CU2 – All Apps are now showing on initial landing page instead of categories view.
2022 July 9 – updated Versions section with 3.12.9000 (from 7.15 LTSR Cumulative Update 9)
2022 Apr 21 – Updated Versions and Install sections for StoreFront 2203 Hotfix 1
2022 Mar 30 – CTX399424 Gateway Callback and / or XML Communication fails after upgrade to Storefront 2203 for a workaround.
2022 Mar 27 – Updated Versions and Install sections for StoreFront 2203 LTSR
- Apps tab – uncategorized applications in CU5

StoreFront Versions

The most recent StoreFront release is version 2407.

Starting with version 1811, the version numbering changed to a YYMM (year/month) format.
Versions 2402, 2203, and 1912 are Long Term Service Releases (LTSR).

The default user interface in StoreFront 1811 and newer is now the “purple” interface, which is different from versions 3.16 and older. Be aware of this change before you upgrade StoreFront. Customizations might not work in the new interface. There doesn’t appear to be any way to revert to the older user interface. The Next-gen experience in 2311 and newer is not enabled by default but can be enabled manually.

Download one of the following versions of StoreFront. For LTSR versions of Citrix Virtual Apps and Desktops (CVAD), deploy the StoreFront that comes with your version of LSTR CVAD.

For Current Release, download StoreFront 2407
For CVAD 2402, download StoreFront 2402 LTSR CU1.
For CVAD 2203, download StoreFront 2203 LTSR CU5. StoreFront 2203 LTSR CU4 Update 1 and later fix a security vulnerability.
For CVAD 1912 LTSR, download StoreFront 1912 LTSR CU9 (Cumulative Update 9).

StoreFront Installation / Upgrade

For small environments, it might be OK to install StoreFront on the Delivery Controller machines. But usually StoreFront and Delivery Controllers are separate machines.

If StoreFront will pull icons from multiple Citrix Virtual Apps and Desktops sites/farms, then StoreFront should be installed on its own machines.

To automate the installation of StoreFront, see Dennis Span Citrix StoreFront unattended installation with PowerShell.

Citrix Blog Post StoreFront 3.0 Scalability recommends StoreFront servers to be sized with 4 vCPU and 8 GB RAM.

If upgrading, do the following before beginning the upgrade:
1. Other Users – Use Task Manager > Users tab to logoff any other user currently logged into the machine.
2. Export the StoreFront configuration so you can restore it if something goes wrong.
3. Stop the World Wide Web Publishing Service.
4. Stop all StoreFront services.
5. Close all PowerShell and StoreFront consoles.
6. Citrix CTX226419 StoreFront upgrade fails to keep the setting in default ICA file. Take a backup of default.ica and usernamepassword.tfrm from C:\inetpub\wwwroot\Citrix\StoreName\App_Data. After upgrading StoreFront, replace the new default.ica and usernamepassword.tfrm with the old default.ica and usernamepassword.tfrm files to ensure you retain the old settings.
7. If Microsoft SCOM Agent is installed, then stop the Microsoft Monitoring Agent service.
8. See Patrick van den Born Avoid 1603 errors when upgrading Citrix StoreFront 2.x to Citrix StoreFront 3.5
Operating system support:
- StoreFront 2407 and newer are not supported on Windows Server 2016.
- StoreFront 2203 and newer are supported on Windows Server 2022.
- StoreFront 2203 is not supported on Windows Server 2012 R2.
- StoreFront 1912 and newer are supported on Windows Server 2019.
Run CitrixStoreFront-x64.exe from the CVAD ISO at /x64/StoreFront. Or download it separately.
In the License Agreement page, check the box next to I accept the terms, and click Next.
In the Review prerequisites page, click Next.
In the Ready to install page, click Install.
In the Successfully installed StoreFront page, click Finish.
Click Yes if prompted to reboot.
FAS – If you upgraded a StoreFront server that was connected to Citrix Federated Authentication Service (FAS), then also upgrade Citrix Federated Authentication Service.

If this is a new install, skip to the Initial Configuration.

If you are upgrading from StoreFront 3.8 or older, then do the following to add SAML Authentication as an option. This feature lets you perform SAML against StoreFront without needing Citrix Gateway. If you did a fresh deployment of 3.9 or newer, then SAML is already added.

Right-click your Store, and click Manage Authentication Methods.
On the bottom, click the Advanced button, and click Install or uninstall authentication methods.
Check the box next to SAML Authentication, and click OK.
If you don’t want to configure SAML at this time, then uncheck the authentication method. See the Federated Authentication Service article for SAML details.

Initial Configuration

In StoreFront 3.8 and newer, you can create multiple stores in different IIS websites. This functionality is not exposed in the GUI and instead the entire StoreFront configuration must be performed using PowerShell. See Citrix Blog Post StoreFront 3.8 is Available NOW! for sample PowerShell commands to create the stores.

You can also use PowerShell to create a store and configure it as detailed at CTX206009 How to configure a Store via Powershell.

If this is a new deployment of StoreFront, do the following to perform the initial configuration:

In PowerShell, run Set-ExecutionPolicy RemoteSigned.
The management console should launch automatically. If not, launch Citrix StoreFront from the Start Menu.
In the middle, click Create a new deployment.
In the Base URL page, if you installed an SSL certificate on the StoreFront server, then the Hostname should already be filled in. For now, you can leave it set to the server’s name and then change it later once you set up SSL and load balancing. Click Next.
In the Getting Started page, click Next.
In the Store Name page, enter a name for the store. The name entered here is part of the URL path (e.g. /Citrix/CorpStoreWeb)
Check the box next to Set this Receiver for Web site as IIS default and click Next.
In the Delivery Controllers page, click Add.
Enter a descriptive name for the Citrix Virtual Apps and Desktops (CVAD). This name does not need to match the actual farm name.
Add the two Delivery Controllers. Change the Transport Type to HTTP. Click OK. You can set it to HTTPS is you have valid certificates (trusted by StoreFront) installed on your Delivery Controllers.
If you have multiple Citrix Virtual Apps and Desktops sites/farms, feel free to add them now. You can also add older XenApp 6.5 farms. Click Next when done.
In the Remote Access page, don’t check the box. Just click Next. You can set this up later.
In the Authentication Methods page, check the boxes next to Domain pass-through and Pass-through from Citrix Gateway. Click Next.
Note: if you want Domain pass-through authentication for browser users, you also need to enable it for Receiver for Web as detailed later in this article.
In the XenApp Services URL page, click Create.
In the Summary page, click Finish.

Second StoreFront Server

After the server group is created, NT SERVICE\CitrixConfigurationReplication and NT SERVICE\CitrixClusterService must remain in the Administrators group on both StoreFront servers or propagation will fail.

Install StoreFront on the second server.
Create/Import an SSL certificate and bind it to the Default Web Site.
Login to the first StoreFront server. In the StoreFront management console, right-click Server Group and click Add Server.
Copy the Authorization code.
Note: the Please wait message means it is waiting on you to add the 2^nd server. You don’t actually have to wait.
Login to the second StoreFront server and launch the management console. In the middle, click Join existing server group.
In the Join Server Group page, enter the name of the first StoreFront server and enter the Authorization code copied earlier. Click Join.
Then click OK.
Go back to the first server. Click OK.
Notice this message. It is good advice.
All changes made on one StoreFront server must be manually propagated to the other StoreFront server. You do that by right-clicking Server Group, and clicking Propagate Changes.
When you propagate changes, the default web page might not be replicated to the other nodes. Copy C:\inetpub\wwwroot\web.config manually to each node.

Customer Experience Improvement Program

StoreFront 3.9 and newer enable Customer Experience Improvement Program (CEIP) by default. To disable it, create the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Telemetry\CEIP\Enabled (DWORD) and set it to 0 (zero). Also see CEIP at Install, set up, upgrade, and uninstall at Citrix Docs.

See https://www.carlstalhood.com/delivery-controller-2203-ltsr-and-licensing/#ceip for additional places where CEIP is enabled.

Citrix Analytics

StoreFront 1906 and newer supports uploading data to Citrix Analytics.

The client devices must be running Workspace app 1903 and newer.

See Enable Analytics on Virtual Apps and Desktops on-premises at Citrix Docs.

Store Name – Rename

If you installed StoreFront on your Delivery Controller, it will have a default store named Store. If you don’t like the default Store Name (/Citrix/Store) then you will need to remove the store and re-add it.

Note: Some at Citrix Discussions (A protocol error occurred while communicating with the Authentication Service) have reported authentication issues after following this procedure. It’s probably cleaner to uninstall StoreFront and reinstall it.

In the StoreFront console, on the left, click Stores.
Right-click your store, and click Remove Store.
Click Yes.
On the left, right-click Stores, and click Create Store.
In the Getting Started page, click Next.
In the Store Name page, enter a name for the store. The name entered here is part of the URL path (e.g. /Citrix/CorpStoreWeb).
Check the box next to Set this Receiver for Web site as IIS default and click Next.
In the Delivery Controllers page, click Add.
Enter a descriptive name for the Citrix Virtual Apps and Desktops farm. This name does not need to match the actual farm name. (If StoreFront 3.5, don’t put spaces or periods in the farm name)
Change the Type to XenDesktop or Citrix Virtual Apps and Desktops.
Add the two Delivery Controllers.
Change the Transport Type to HTTP. Click OK. You can leave it set to HTTPS (recommended) if you have valid certificates (trusted by StoreFront) on your Delivery Controllers.
If you have multiple Citrix Virtual Apps and Desktops farms, feel free to add them now. You can also add older XenApp farms. Or later, you can add farms in Store > Manage Delivery Controllers. Click Next when done.
In the Remote Access page, don’t check the box and click Next. You can set this up later.
In the Authentication Methods page, check the boxes next to Domain pass-through and Pass-through from Citrix Gateway. Click Next.
In the XenApp Services URL page, click Create.
In the Created Successfully page, click Finish.

SSL Certificate

StoreFront requires SSL. You will save yourself much heartache if you install valid, trusted certificates on the StoreFront servers or your load balancer. There are two options for StoreFront SSL.

SSL Offload: Use Citrix ADC to do SSL Offload and load balancing. In this scenario, install the SSL certificate on the load balancer. You can leave the StoreFront servers listening on HTTP and no IIS server certificate. The SSL certificate on the Citrix ADC must match the DNS name that resolves to the load balancing VIP.
SSL End-to-end: Install an SSL certificate on each StoreFront server and bind it to IIS. This allows you to use SSL protocol between the load balancer and the StoreFront servers.

If your load balancer cannot terminate SSL, then the StoreFront IIS certificate must match the DNS name that resolves to the load balancing VIP.

For load balancers that can terminate SSL (e.g., Citrix ADC), the StoreFront IIS server certificate should match the StoreFront server name. If StoreFront is installed on the Delivery Controllers, with server-specific certificates you can later enable HTTPS in the StoreFront Store Delivery Controller configuration.

Another option is to create an SSL certificate with Subject Alternative Names for the load balanced DNS name and each of the StoreFront server FQDNs. Then import this one certificate on all StoreFront servers. Or a wildcard certificate could match all of these names.

In either case, be aware that Email-based discovery in Citrix Receiver requires the certificate to not only match the StoreFront load balanced DNS name but the certificate must also match discoverReceiver.email.suffix for every email domain. Usually, the only option to match multiple email domains is with Subject Alternative Names. If you have multiple email suffixes, then you will need multiple Subject Alternative Names, each beginning with discoverReceiver. If you don’t plan on implementing email-based discovery, then you don’t have to worry about these discoverReceiver Subject Alternative Names.

If the certificate does not match discoverReceiver.email.suffix, then users will see this message when attempting to use email discovery in Citrix Workspace app.

When adding Subject Alternative Names to a certificate, the first Subject Alternative Name should be the same as the Load Balancing FQDN. The remaining Subject Alternative Names should be discoverReceiver.email.suffix for every email domain.

When you view a Subject Alternative Name certificate, on the Details tab, click Subject Alternative Name to verify that all names are listed including the DNS name that resolves to the load balancing VIP.

There are several methods of creating a certificate for StoreFront.

If you are implementing Single FQDN for internal and external users, then the certificate for external Citrix Gateway can also be used for internal StoreFront.
- Single FQDN has additional Subject Alternative Name certificate requirements, including Internal Beacon FQDN and Callback FQDN.
If you will support non-domain-joined machines (e.g., iPads, thin clients) connecting to your internal StoreFront, then the StoreFront certificate should be signed by a public Certificate Authority. You can use IIS to request the certificate. You can then export the certificate from IIS and import it to Citrix ADC (for Load Balancing and Citrix Gateway). Public Certificate Authorities (e.g., GoDaddy, Digicert, etc.) let you enter additional Subject Alternative Names when you purchase the certificate.
If all internal machines are domain-joined, then you can use an internal Certificate Authority to create the StoreFront certificate. The Certificates MMC snap-in can be used to create an internal certificate signed by a Microsoft Certificate Authority. The MMC method allows you to specify Subject Alternative Names.

Once the certificate is created or imported, bind it to IIS:

In IIS Manager, right-click the Default Web Site, and click Edit Bindings.
Click Add.
Change the Type to https and select the SSL certificate. Do NOT put anything in the Host name field. Click OK, and then click Close.

Delivery Controllers – SSL

Delivery Controllers can be SSL enabled by using one of two methods:

If IIS is installed on the Delivery Controller, simply install/create a certificate, and bind it to the Default Web Site.
If IIS is not installed on the Delivery Controller, then you need to run a command line program as described at SSL for Delivery Controller.

Once SSL certificates are installed on the Delivery Controller servers, then you can configure the StoreFront Store to use SSL when communicating with the Delivery Controllers.

In the StoreFront Console, on the left click Stores.
In the middle, right-click your store, and click Manage Delivery Controllers.
Highlight the deployment and click Edit.
The Servers list must contain FQDNs that match the certificates installed on those Delivery Controller servers.
Change the Transport type to HTTPS.
Click OK twice.
See CTX399424 Gateway Callback and / or XML Communication fails after upgrade to Storefront 2203 for a workaround. The fix is included in StoreFront 2203.1.

Base URL – Change

Configure load balancing of the StoreFront servers, including SSL certificate.
In the Citrix StoreFront console, right-click Server Group, and click Change Base URL.
Enter the StoreFront Load Balancing FQDN as the new Base URL in https://storefront.corp.com format.
1. Receiver requires that the Base URL is https. It won’t accept http.
2. If you want the StoreFront Base URL to be the same as your Gateway FQDN, then see the Single FQDN instructions.
Click OK.

If the Base URL is https, but you don’t have certificates installed on your StoreFront servers (aka SSL Offload), then you’ll need to do the following:

On the left, click the Stores node.
In the middle, right-click your store, and click Manage Receiver for Web Sites.
Click Configure.
On the Advanced Settings page, change Enable loopback communication to OnUsingHttp. Click OK, and then click Close.

Default Web Page

After changing the Base URL, you’ll need to update the IIS Default Website.

On the left, right-click Stores, and click Set Default Website.
Check the box next to Set a Receiver for Web site as the default page in IIS and click OK.
Click Yes to overwrite.
If you go to C:\inetpub\wwwroot and edit the file web.config, you’ll see the redirect.

Authentication Configuration

In the Citrix StoreFront console, on the left, click the Stores node.
In the middle, right-click your store, and click Manage Authentication Methods.
Check the boxes next to Domain pass-through and Pass-through from Citrix Gateway.
If you intend to enable pass-through authentication from Receiver Self-Service (native Workspace app) or from Receiver for Web (web browser), then in Web Studio (CVAD 2212 and newer), go to Settings and Enable XML trust.
- Or go to a Delivery Controller and run the command
  Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $True from a Windows PowerShell command prompt. You might have to run asnp citrix.* first.
If StoreFront is not in the same domain (or trusted domain) as the users, then you can configure StoreFront to delegate authentication to the Delivery Controllers. See XML service-based authentication at Citrix Docs.
- StoreFront 3.6 and newer can be workgroup members without joining a domain.
Click the top gear icon, and then click Configure Trusted Domains.
Select Trusted domains only, click Add, and enter the domain names in DNS format. The DNS suffix is needed if doing userPrincipalName authentication from Citrix Gateway.
Select one of the domains as the default.
If desired, check the box next to Show domains list in logon page. Click OK.
Click the top gear icon, and then click Manage Password Options.
Make your selection, and click OK.
Be careful with password changes. Any time somebody changes their password through StoreFront, a profile will be created for that user on the StoreFront server. Use a tool like delprof2.exe to periodically delete these local profiles.
If you have Citrix Virtual Apps and Desktops and installed Self-Service Password Reset, you can integrate SSPR with StoreFront 3.7 or newer by clicking the top gear icon and clicking Configure Account Self-Service. This option is only available if your Base URL is https (encrypted). See the following for detailed implementation guides.
- Citrix CTX217143 Self-Service Password Reset Central Store Creation Tool
- Citrix CTX224244 How Do I Deploy Self-Service Password Reset For the First Time
- George Spiers Citrix Self-Service Password Reset
Change the selection to Citrix SSPR, and click Configure.
Check both boxes and enter the URL of the SSPR server using the displayed example (with /MPMService on the end). Click OK three times.
With SSPR enabled, a new Tasks tab lets users enroll with SSPR.
The logon page also has an Account Self-Service link.

Next Generation Experience

In StoreFront 2311 and newer, you can do the following to enable the Next-gen experience theme, which looks the same as Workspace in Citrix Cloud, including the Activity Manager.

In the StoreFront Console, on the left, click the Stores node.
In the middle, right-click your store, and click Manage Receiver for Web Sites.
Click Configure.
On the UI Experience page, select Next generation experience and click OK.

Customize Receiver Appearance

You can go to Stores > Manage Receiver for Web Sites > Configure > Customize Appearance to change logos and colors. Additional customization can be performed using the SDK.

You can also Manage Featured App Groups.

In StoreFront 1811 and newer, Featured App Groups are shown in the user interface as Collections.

The HOME page shows the Feature App Groups in a ribbon with arrows to let the user see more Featured App Groups. The ribbon view is limited to three icons per Featured App Group. When the user clicks a Featured App Group, every icon in the Featured App Groups is shown.
The APPS page has a Collections tab showing all collections and the number of icons in each Collection.
When the user clicks a collection, all icons in the collection are shown. The user can click Add All on the top right to mark all of the icons as Favorites.

To create Featured App Groups:

Go to Stores > myStore > Manage Receiver for Web Sites > Configure.
In the Edit Receiver for Web site window, on the Featured App Groups page, click Create.
Give the Collection a name and a description.
At the bottom, there are three methods of adding icons to the Feature App Group.
If you select the Keyword option, then enter a keyword that will be added to the published apps that are in this collection.
In Citrix Studio, go to the Properties of a published application. In the Description field, at the end, enter KEYWORDS:myCollectionKeyword.

In StoreFront older than version 1811:

Featured App Groups are displayed at the top of the Apps > All page.
By default, Featured App Groups are displayed with continual horizontal scrolling. This is OK if you have several Featured App Groups but doesn’t look right if you only have one Featured App Group.
Michael Bednarek has posted some code at Citrix Discussions to disable the continuous horizontal scrolling.
If you want to display more than 3 apps per group, see Michael Bednarek at Modify Receiver for Web site at Citrix Discussions.

Receiver for Web (browser) Pass-through Authentication

On the left, click the Stores node.
In the middle, right-click your store, and click Manage Receiver for Web Sites.
Click Configure.
On the Authentication Methods page, if desired, check the box next to Domain pass-through. Click OK.
If the StoreFront URL is in the browser’s Local Intranet zone, then you’ll see a prompt to automatically Log On. This only appears once.
If you want to default to Pass-through without any user prompt, then see Citrix Blog Post Configuring domain pass-through as your default authentication method.

Workspace app for HTML5 2408

On the left, click the Stores node.
In the middle, right-click your store, and click Manage Receiver for Web Sites.
Click Configure.
On the Deploy Citrix Receiver / Workspace app page, change the drop-down to Use Receiver for HTML5 if local Citrix Receiver/Workspace is unavailable.
By default, the HTML5 session opens in a new tab. You can optionally enable Launch applications in the same tab as Receiver for Web. See Configure Citrix Receiver for HTML5 use of browser tabs at Citrix Docs for more information.
Click OK, and then click Close.
Download the Workspace app 2408 for HTML5.
Note: new versions of Workspace app for HTML5 are released frequently. For example, 2306 and newer support the new launch experience.
Install the HTML5 Workspace app (CitrixHTML5Client-x64.exe) on one of the StoreFront servers. It installs without prompting. Repeat this step on all StoreFront servers in the Server Group since Propagate Changes doesn’t seem to propagate the new Workspace App.
To see the installed version of HTML5 Workspace app, in StoreFront console, click the Stores node on the left.
In the middle pane, in the bottom half, switch to the Receiver for Web Sites tab. You might have to click Refresh to see the new version.

HTML5 Workspace app configuration

Copy/paste of text using Ctrl+C and Ctrl+V – HTML5 Workspace app version 1907 app adds support for copy/paste of text using Ctrl+C and Ctrl+V and the feature is enabled by default. More info at Enhanced clipboard experience at Citrix Docs.
Multi-monitor – HTML5 Workspace app has a multi-monitor feature, which is enabled by default.
To configure HTML5 Workspace app, edit the file “C:\Program Files\Citrix\Receiver StoreFront\HTML5Client\configuration.js”.
1. Customer Experience Improvement Program (CEIP) is enabled by default. To disable CEIP in HTML5 Workspace App 1906 and newer, find the first analytics section and change enabled to false.
2. To disable CEIP in HTML5 Workspace App 1905 and older, search for the ceip section, and change it to false.
In the StoreFront console, on the left, right-click Server Group, and click Propagate Changes.
For VDA 7.15 and older, optionally, install Citrix PDF Printer on the VDAs. The PDF printer is in the Additional Components section of the HTML5 Workspace app download page.
Note: in VDA 7.16 and newer, the PDF Printer is included with the VDA installation and no longer needs to be installed separately.

Other HTML5 Receiver configurations you can change by either editing C:\Program Files\Citrix\Receiver StoreFront\HTML5Client\configuration.js, or use the Citrix Workspace app (earlier known as Citrix Receiver) for Chrome and HTML5 – Configuration Utility downloadable from CTX229141.

HTML5 Workspace app has improved PDF printing in Chrome and Firefox. Enable it by setting supportedBrowsers to true.
When printing from HTML5 Workspace app to the Citrix PDF Printer, the user must click Continue to show the PDF. You can get rid of this prompt. In the configuration.js file, scroll down to the line containing printDialog and set it to true.
The new HTML5 Workspace app toolbar can be disabled or customized by editing the file C:\Program Files\Citrix\Receiver StoreFront\HTML5Client\configuration.js.

If HTML5 Workspace app is enabled, users have the option of selecting either native or HTML5 by clicking Change Citrix Receiver or Change Citrix Workspace app.

In StoreFront 1912 and newer, click the gear icon on the top right and then click Account Settings.
Click either Change Citrix Workspace app or Change Citrix Receiver..
If you want to use the locally installed Workspace app, then click the blue Detect Citrix Workspace app or blue Detect Receiver button. If you want to use the HTML5 Client, click Use light version.

Citrix Blog Post Receiver for HTML5 and Chrome File Transfer Explained:

How to use the toolbar to transfer files
Citrix Policy settings to enable/disable file transfer
VDA registry settings to control file transfer
HTML5Client\Configuration.js settings for client-side configuration
How to view HTML5Client log file

Deploy Citrix Workspace app

Citrix recommends that all users install the Citrix Workspace Web Extension in their endpoint browsers. This extension eliminates the need for StoreFront to detect the locally installed Workspace app and enables .ica files to be downloaded to memory instead of to disk. StoreFront support for the extension is enabled by default in StoreFront 2311 and newer. See Citrix Workspace web extensions at Citrix Docs.
StoreFront can deploy Workspace app to users that don’t have Workspace app installed. In StoreFront console, on the left, click the Stores node.
In the middle, right-click your store, and click Manage Receiver for Web Sites.
Click Configure.
On the Deploy Citrix Receiver/ Workspace app page, check the box next to Allow users to download HDX engine (plug in).
Change both source drop-downs to Local files on the StoreFront server.
1. For Windows, download one of the following:
  - Workspace app for Windows 2405.10. Version 2405.10 is a Current Release.
  - For LTSR, download Citrix Workspace app for Windows LTSR 2402 CU1.
2. For Mac, download Workspace app 2405 for Mac.
3. Click each of the Browse buttons and browse to the downloaded Workspace app.
4. You can optionally enable Upgrade plug-in at logon.
5. Click OK when done, and Close when done.
If you prefer for users to download Workspace app from the Citrix website, then note that StoreFront might default to downloading Receiver instead of Workspace app. To change it to Workspace app, do the following:
1. In StoreFront Console, in the Deploy Citrix Receiver/ Workspace app page, change Windows source and Mac source to Files on remote server (through URL).
2. Enter the following paths. The default paths might be http instead of https and you should change them to https.
```
Windows Receiver = https://downloadplugins.citrix.com/Windows/CitrixWorkspaceApp.exe
Mac Receiver = https://downloadplugins.citrix.com/Mac/CitrixWorkspaceApp.dmg
```
When users connect to Receiver for Web, they will be prompted to install or upgrade. In StoreFront 2203 and newer, the screens say Workspace app.
In older versions of StoreFront, the screens might say Citrix Receiver instead of Citrix Workspace app.
You can change it to Citrix Workspace app by following the instructions at CTX221097 How to rename items on StoreFront?.
- Search the list of strings in the KB article for any string containing the word Receiver, copy the string to C:\inetpub\wwwroot\Citrix\StoreWeb\custom\strings.en.js, and change it to Workspace app. A few of the strings are shown below. Make sure there are commas between each item except the last item.
If you don’t want StoreFront to detect the locally installed Workspace app, then edit the Receiver for Web site, switch to the Advanced Settings page and uncheck the box next to Enable protocol handler. This disables the button that asks users to Detect Workspace app.

Receiver for Web Timeout

On the left, click the Stores node.
In the middle, right-click your store, and click Manage Receiver for Web Sites.
Click Configure.
On the Session Settings page, set the Session timeout as desired, and click OK.
If you are using a Citrix ADC, you will need to change the Global Session Timeout located at Citrix Gateway => Global Settings => Change Global Settings (right pane) => Client Experience (tab) => Session Time-out (mins).
- This Citrix Gateway Session Time-out only applies to StoreFront and AAA. If you want it to also apply to ICA sessions, then on the Network Configuration tab, set ICA Session Timeout to ON. Source = CTX218008 How to configure ICA Proxy Connection Termination upon AAA Session Time Out.
From Change the session time-out of Citrix Receiver for Web at Citrix Docs: If you increase the session timeout for RfWeb to be more than 1 hour, you must also increase the maxLifetime appropriately in c:\inetpub\wwwroot\Citrix\Authentication\Web.config.
If your desired timeout value is greater than 8 hours, you should also edit tokenLifeTime in c:\inetpub\wwwroot\Citrix\StoreWeb\web.config.

Favorites, Categories, and Default Tab

By default, when a user logs into StoreFront, the HOME tab or Favorites tab is selected. Users can go to other tabs to add icons to the list of Favorites.

In StoreFront 1811 and newer:

Favorites are shown on the HOME tab.
Favorites are also shown on the APPS view on the Favorites tab.
The user can click the star icon next to a published icon to mark that published icon as a Favorite and add it to the HOME view and Favorites tab.
On the APPS view, the user can expand the Categories drop-down and select a Category to view all icons in that Category.
- To default to the Categories view, see the custom code at CTX559036 Storefront 2302 CU2 – All Apps are now showing on initial landing page instead of categories view.
- StoreFront 1912 CU2 and newer has an option to collapse the categories after one is selected. Notice the Uncategorized folder.
- After clicking a category, the user must click Categories again to switch to a different category.
- StoreFront 1912 CU5 and StoreFront 2203 have an option to show Uncategorized icons directly below the Categories list if no Category is selected by the user.
- This feature is configured in StoreFront console > click your store > Manage Receiver for Web sites > Configure > Category Settings. 1912 CU5 and 2203 adds the checkbox option to Move uncategorized apps into an Uncategorized folder. It’s checked by default, but you can uncheck it.
Categories are configured in the Properties of the published application on the Delivery page.
Collections are configured as Featured App Groups.

In StoreFront older than 1811:

There’s a FAVORITES view.
On the APPS or DESKTOPS views, the user can click the Details link next to a published icon.
Then the user can click Add to Favorites to add the icon to the FAVORITES view.

Favorites can be controlled by the administrator:

You can completely remove the FAVORITES or HOME views by going to Stores > myStore > Configure Store Settings > User Subscriptions, and choose Disable User Subscriptions (Mandatory Store).
To force a published application to be favorited (subscribed), use one of the following keywords in the published application description:
- KEYWORDS: Auto = the application is automatically subscribed. But users can remove the favorite.
- KEYWORDS: Mandatory = the application is automatically subscribed, and users cannot remove the favorite.
- With Mandatory applications there is no option to remove the application from Favorites.

Citrix Blog Post How to implement dynamic landing pages in StoreFront has code for the following: If favorites exist, go to favorites tab. If favorites do not exist, go to the store tab. 💡

//If favorites exist, go to favorites tab. If favorites do not exist, go to the store tab.
var favoritesExist = false;

CTXS.Extensions.sortMyAppList = function (app_array,defaultSortFn) {
//This version checks if the amount of user favorites are greater than or equal
//to "favoriteThreshold".
  var favoriteThreshold = 1;
  var favoriteCount = 0;
  for (var i = 0; i < app_array.length; i++){ if (app_array[i].canBeRemoved()){ favoriteCount++; } } if (favoriteCount >= favoriteThreshold){
    favoritesExist = true;
  }

  //This should always be called at the end
  defaultSortFn();
};

CTXS.Extensions.afterDisplayHomeScreen = function (callback) {
  if (favoritesExist == false){
    CTXS.ExtensionAPI.changeView("store");
  }
};

Trentent Tye has a simple customization for C:\inetpub\wwwroot\Citrix\StoreWeb\custom\script.js to default to the APPS view if the user doesn’t have any favorites. See Citrix Storefront – Adventures in customization – Default to “Store” view if you have no favourited app’s.
```
CTXS.Extensions.afterDisplayHomeScreen = function (callback) {
 /* If the user has no favorited apps, set the view to the apps view */
 if (CTXS.Store.getMyApps().length == 0) {
 CTXS.ExtensionAPI.changeView("store")
 }
};
```
You can change the default view and view visibility by going to the Stores > myStore > Manage Receiver for Web Sites > Configure > Client Interface Settings page.
In StoreFront 1811 and newer, if you want to default to the APPS tab with Categories view expanded, then see CTP Sam Jacobs at Storefront 1811 – Default to Categories view at Citrix Discussions. Or see Citrix Blog Post How to land on the categories view in StoreFront 1811+.
- Add the following to C:\Inetpub\wwwroot\Citrix\StoreWeb\custom\script.js.
  Note: if you already have afterDisplayHomeScreen in your script.js file, then you’ll need to merge them.
```
function categoriesDelay() {
$('#categoriesTabBtn').click();
}

CTXS.Extensions.afterDisplayHomeScreen = function (callback) {
CTXS.ExtensionAPI.changeView('store');
window.setTimeout(categoriesDelay,250);
callback();
};
```
In StoreFront older than version 1811, if you change the default view to APPS, then you might also want to default to the Categories view instead of the All view.
- When publishing applications in Citrix Studio, on the Delivery page, specify an Application category so that the applications are organized into folders.
- To default the Apps view to the Categories view instead of the All view, add the following code to the end of the file C:\Inetpub\wwwroot\Citrix\StoreWeb\custom\script.js. More details at Storefront 3.0 – change default view at Citrix Discussions.
```
CTXS.Extensions.afterDisplayHomeScreen = function (callback) {
     CTXS.ExtensionAPI.navigateToFolder('/');
};

CTXS.Extensions.onViewChange = function (viewName) {
  if (viewName == 'store') {
    window.setTimeout(function () {
    CTXS.ExtensionAPI.navigateToFolder('\\');
    }, 0);
  }
};
```
- Then when you login to StoreFront, you’ll see Apps > Categories as the default view. This works in Workspace app too.

Beacons

On the left, right-click Stores, and click Manage Beacons.
Configure an Internal Beacon. Receiver Self-Service (Workspace app native interface) tries to connect to the Internal Beacon to determine if Workspace app is currently internal or not. If the Internal Beacon is reachable then Receiver Self-Service assumes it is internal, and thus connects to the StoreFront Base URL. If the Internal Beacon is not reachable, then Receiver Self-Service assumes it is external and thus connects to Citrix Gateway. For this to work properly, the Internal Beacon must not be resolvable externally.
If you are not doing Single FQDN, then the Internal Beacon can be the StoreFront FQDN since the StoreFront FQDN is usually only available internally.

If you are doing Single FQDN, then you can’t use the StoreFront FQDN. Instead, you must use a different internal website for the beacon. If you need to support internal iPads, due to differences in how iPads determine location, the Internal Beacon should be a new FQDN that resolves to the StoreFront Load Balancing VIP, thus requiring the StoreFront certificate to match both the Internal Beacon and the Base URL. If internal iPads are not needed, then the Internal Beacon can be any internal website.

If you want to force internal Receiver Self-Service users to connect through Citrix Gateway (for AppFlow reporting), you can set the Internal Beacon to a fake URL. Since the Internal Beacon is never resolvable, Receiver Self-Service always uses Citrix Gateway. Or you can use Optimal Gateway to achieve the same goal.
The External beacons are used by Workspace app to determine if Workspace app has Internet access or not. You can use any reliable Internet DNS name. http://ping.citrix.com is no longer valid and should be changed to some other address. Click OK when done.

Propagate Changes

Any time you make a change on one StoreFront server, you must propagate the changes to the other StoreFront server.

In the StoreFront console, on the left, right-click Server Group, and click Propagate Changes.
You might see a message saying that you made changes on the wrong server.
Click Yes when asked to propagate changes.
Click OK when done.
When you propagate changes, the default web page is not replicated to the other nodes. Copy C:\inetpub\wwwroot\web.config manually to each node.

Export/Import StoreFront Configuration

Use the following PowerShell cmdlets to export StoreFront Configuration into a .zip file (encryption optional) and import to a different StoreFront server group:

Export-STFConfiguration
Import-STFConfiguration

See Export and import the StoreFront configuration at Citrix Docs for details.

Logon Simulator

ControlUp has ScoutBees logon simulator for StoreFront and Citrix Gateway.

eG Innovations has a free Logon Simulator for Citrix XenApp and XenDesktop.

Director Load Balancing – NetScaler 11

Last Modified: Nov 6, 2020 @ 7:25 am

37 Comments

Monitor

On the left, expand Traffic Management, expand Load Balancing, and click Monitors.
On the right, click Add.
Name it Director or similar.
Change the Type drop-down to HTTP.
If you will use SSL to communicate with the Director servers, then scroll down and check the box next to Secure.
Switch to the Special Parameters tab.
In the HTTP Request field, enter GET /Director/LogOn.aspx?cc=true
If Single Sign-on is enabled on Director, then you might have to add 302 as a Response Code.
Click Create.

Servers

On the left, expand Traffic Management, expand Load Balancing, and click Servers.
On the right, click Add.
Enter a descriptive server name. Usually it matches the actual server name.
Enter the IP address of the server.
Enter comments to describe the server. Click Create.
Continue adding Director servers.

Service Group

On the left, expand Traffic Management, expand Load Balancing, and click Service Group.
On the right, click Add.
Give the Service Group a descriptive name (e.g. svcgrp-Director-SSL).
Change the Protocol to HTTP or SSL. If the protocol is SSL, ensure the Director Monitor has Secure enabled.
Scroll down and click OK.
Click where it says No Service Group Member.
If you did not previously create server objects, then enter the IP address of a Director Server. If you previously created a server objects, then change the selection to Server Based and select the server objects.
Enter 80 or 443 as the port. Then click Create.
On the right, under Advanced Settings, click Monitors.
On the left, in the Monitors section, click where it says No Service Group to Monitor Binding.
Click the arrow next to Click to select.
Select the Director monitor and click Select.
Then click Bind.
To verify that the monitor is working, on the left, in the Service Group Members section, click the Service Group Members line.
Highlight a member and click Monitor Details.
The Last Response should be Success – HTTP response code 200 received. Click Close twice.
Then click Done.

Responder

Create a Responder policy to redirect users from the root page to /Director.

Go to AppExpert > Responder and enable the feature if it isn’t already enabled.
Go to AppExpert > Responder > Actions.
On the right, click Add.
Give the Action a name (e.g. Director_Redirect).
Change the Type to Redirect.
In the Expression box, enter "/Director", including the quotes.
Click Create.
Go to AppExpert > Responder > Policies.
On the right, click Add.
Give the Policy a name (e.g. Director_Redirect).
Select the previously created Action.
In the Expression box, enter HTTP.REQ.URL.PATH.EQ("/")
Click Create.

Load Balancing Virtual Server

Create or install a certificate that will be used by the SSL Virtual Server. This certificate must match the DNS name for the load balanced Director servers.
On the left, under Traffic Management > Load Balancing, click Virtual Servers.
On the right click Add.
Name it Director-SSL-LB or similar.
Change the Protocol to SSL.
Specify a new internal VIP.
Enter 443 as the Port.
Click OK.
On the left, in the Services and Service Groups section, click where it says No Load Balancing Virtual Server ServiceGroup Binding.
Click the arrow next to Click to select.
Select your Director Service Group and click Select.
Click Bind.
Click Continue.
Click where it says No Server Certificate.
Click the arrow next to Click to select.
Select the certificate for this Director Load Balancing Virtual Server and click Select.
Click Bind.
Click Continue.
On the right, in the Advanced Settings column, click Persistence.
Select SOURCEIP persistence.
Set the timeout to match the timeout of Director. The default timeout for Director is 245 minutes.
The IPv4 Netmask should default to 32 bits.
Click OK.
On the right, in the Advanced Settings section, add the Policies section.
On the left, in the Policies section, click the plus icon.
Select Responder in the Choose Policy drop-down and click Continue.
Select the previously created Director_Redirect policy and click Bind.

If you haven’t enabled the Default SSL Profile, then perform other normal SSL configuration including: disable SSLv3, bind a Modern Cipher Group, and enable Strict Transport Security.

bind ssl vserver MyvServer -certkeyName MyCert

set ssl vserver MyvServer -ssl3 DISABLED -tls11 ENABLED -tls12 ENABLED

unbind ssl vserver MyvServer -cipherName ALL

bind ssl vserver MyvServer -cipherName Modern

bind ssl vserver MyvServer -eccCurveName ALL

bind lb vserver MyvServer -policyName insert_STS_header -priority 100 -gotoPriorityExpression END -type RESPONSE

SSL Redirect

Right-click the Director SSL Load Balancing Virtual Server and click Add.
Change the Name to Director-HTTP-SSLRedirect or something like that.
Change the Protocol to HTTP.
Click OK. This HTTP Virtual Server uses the same VIP as the SSL Load Balancer.
Bind the AlwaysUp service. See SSL Redirect – Responder Method for more information.
Bind the http_to_ssl_redirect_responderpol Responder Policy.
That’s all this LB vServer needs. Click Done when done.

SSL Warning

If you are doing SSL Offload (SSL on front end, HTTP on back end), when connecting to Director it might complain about “You are not using a secure connection”.
To turn off this warning, login to the Director servers and run IIS Manager.
On the left, navigate to Server > Sites > Default Web Site > Director.
In the middle, double-click Application Settings.
Change UI.EnableSslCheck to false.

CLI Commands

Here is a list of NetScaler CLI commands for Director Load Balancing:

add server Director01 10.2.2.18
add server Director02 10.2.2.100
add server 127.0.0.1 127.0.0.1
add service AlwaysUp 127.0.0.1 HTTP 80
add serviceGroup svcgrp-Director-HTTP HTTP
add ssl certKey wildcom -cert WildcardCorpCom_pem -key WildcardCorpCom_pem
add lb vserver Director-SSL-LB SSL 10.2.2.210 443 -persistenceType SOURCEIP -timeout 245
add lb vserver Director-HTTP-SSLRedirect HTTP 10.2.2.210 80 -persistenceType NONE
add responder action Director_Redirect redirect "\"/Director\"" -responseStatusCode 302
add responder action http_to_ssl_redirect_responderact redirect "\"https://\" + HTTP.REQ.HOSTNAME.HTTP_URL_SAFE + HTTP.REQ.URL.PATH_AND_QUERY.HTTP_URL_SAFE" -responseStatusCode 302
add responder policy Director_Redirect "http.REQ.URL.PATH.EQ(\"/\")" Director_Redirect
add responder policy http_to_ssl_redirect_responderpol HTTP.REQ.IS_VALID http_to_ssl_redirect_responderact
bind lb vserver Director-HTTP-SSLRedirect AlwaysUp
bind lb vserver Director-SSL-LB svcgrp-Director-SSL
bind lb vserver Director-SSL-LB -policyName Director_Redirect -priority 100 -gotoPriorityExpression END -type REQUEST
bind lb vserver Director-HTTP-SSLRedirect -policyName http_to_ssl_redirect_responderpol -priority 100 -gotoPriorityExpression END -type REQUEST
add lb monitor Director HTTP -respCode 200 -httpRequest "GET /Director/LogOn.aspx?cc=true" -LRTM DISABLED -secure YES
bind serviceGroup svcgrp-Director-SSL Director01 443
bind serviceGroup svcgrp-Director-SSL Director02 443
bind serviceGroup svcgrp-Director-SSL -monitorName Director
set ssl serviceGroup svcgrp-Director-SSL -tls11 DISABLED -tls12 DISABLED
bind ssl vserver Director-SSL-LB -certkeyName wildcom
bind ssl vserver Director-SSL-LB -eccCurveName P_256
bind ssl vserver Director-SSL-LB -eccCurveName P_384
bind ssl vserver Director-SSL-LB -eccCurveName P_224
bind ssl vserver Director-SSL-LB -eccCurveName P_521

SmartAccess / SmartControl – NetScaler 11

Last Modified: Nov 6, 2020 @ 7:25 am

67 Comments

Navigation

Prerequisites
Endpoint Analysis
- EPA Troubleshooting 💡
SmartControl
SmartAccess

💡 = Recently Updated

SmartAccess / SmartControl

SmartAccess and SmartControl let you change ICA connection behavior (e.g. disable client device mappings) based on how users connect. Decisions are based on NetScaler Gateway Virtual Server name, Session Policy name, and Endpoint Analysis scan success or failure.

SmartAccess can also control application/desktop icon visibility.

Prerequisites

Other than the NetScaler appliance license, both SmartAccess and SmartControl have the same prerequisites. You can configure SmartAccess in XenApp/XenDesktop at any time but it won’t work until you do the following:

NetScaler appliance license – SmartAccess works with all editions of NetScaler appliances. However, SmartControl only works with NetScaler Platinum Edition.
Gateway Universal licenses – Both SmartAccess and SmartControl require NetScaler Gateway Universal licenses. NetScaler 11.1 build 49 and newer come with a minimum of 500 Universal licenses so this might no longer be an issue. In 11.1 build 49 and newer, NetScaler Standard Edition comes with 500 licenses, NetScaler Enterprise Edition comes with 1,000 licenses, and NetScaler Platinum Edition comes with unlimited licenses.
On the NetScaler, go to System > Licenses and make sure you have NetScaler Gateway Universal Licenses allocated to the appliance. The Universal licenses are allocated to the hostname of the appliance (click the gear icon), not the MAC address. In a High Availability pair, if each node has a different hostname then you can allocate the licenses to one hostname, then reallocate to the other hostname.
After installing licenses, go to NetScaler Gateway > Global Settings.
On the top right, click Change authentication AAA settings.
At the top of the page, change the Maximum Number of Users to match your installed license count. Then click OK. This setting is commonly missed and if not configured it defaults to only 5 concurrent connections.
On a XenApp/XenDesktop Controller, run PowerShell as Administrator.
Run asnp citrix.* to load the snapins.
Run Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true to enable Trust XML.
In StoreFront Console, go to the NetScaler Gateway node and edit (Change General Settings) the existing Gateway object.
Make sure a Callback URL is configured to resolve to a NetScaler Gateway VIP on the same appliance that authenticated the user. The Callback Gateway’s certificate must match the FQDN entered here. If you are configuring Single FQDN for internal and external then the Callback FQDN must be different than the Single FQDN.
On the NetScaler, go to NetScaler Gateway > Virtual Servers and edit your Gateway Virtual Server.
In the Basic Settings section, click the pencil icon.
Click More.
Uncheck the box next to ICA Only and click OK. This tells NetScaler Gateway to start using Universal licenses and enables the SmartAccess and SmartControl features.

Once the prerequisites are in place, do the following as detailed below:

Optionally, configure Endpoint Analysis.
Configure either SmartControl or SmartAccess.

Endpoint Analysis

Endpoint Analysis scans are completely optional. You can configure SmartControl and SmartAccess without implementing any Endpoint Analysis.

Endpoint Analysis is supported on Windows and Mac devices. Other devices, like iOS and Android, do not support Endpoint Analysis. If you want to allow mobile device connectivity, then make sure you have an access mechanism (e.g. ICA Proxy) that works if the Endpoint Analysis scan fails.

There are two methods of Endpoint Analysis: pre-authentication and post-authentication. For pre-authentication, configure an Endpoint Analysis expression in a Preauthentication Policy. For post-authentication, configure the Endpoint Analysis expression on one or more Session Policies.

With a Preauthentication Policy, if the Endpoint Analysis scan fails then users can’t login.
With a Postauthentication Policy, Endpoint Analysis doesn’t run until after the user logs in. Typically, you create multiple Session Policies. One or more policies has Endpoint Analysis expressions. Leave one policy without an Endpoint Analysis expression so there’s a fallback in case the client device doesn’t support Endpoint Analysis (e.g. mobile devices). The name of the Session Policy is then used later in Citrix Policies and Citrix Delivery Groups.

NetScaler 11 has two Endpoint Analysis engines: the classic Client Security engine and the newer OPSWAT Advanced EPA engine.

To configure OPSWAT Advanced EPA expressions:

When creating a Preauthentication Policy or Session Policy, click the OPSWAT EPA Editor link.
Use the drop-down menus to select the scan criteria. Then click Done.

See the following links for more Advanced EPA information:

Advanced Endpoint Analysis Policy Expression Reference at docs.citrix.com
Citrix Blog Post Patch Management Endpoint Analysis on NetScaler Gateway

To configure Client Security expressions:

When creating a Preauthentication Policy or Session Policy, click the Expression Editor link.
Change the Expression Type to Client Security.
Use the Component drop-down to select a component. A common configuration is to check for domain membership as detailed at CTX128040 How to Configure a Registry-Based Scan Expression to Look for Domain Membership.
You can also use EPA expressions when configuring a Quarantine Group.

Once the Policies are created, bind them to your NetScaler Gateway Virtual Server:

Edit a NetScaler Gateway Virtual Server.
Scroll down to the Policies section and click the plus icon.
Select either Preauthentication or Session and select the policy you already created. Then click Bind.

EPA Troubleshooting

Citrix CTX209148 Understanding/Configuring EPA Verbose Logging Feature: 💡

Go to NetScaler Gateway > Global Settings.
On the right, click Change Global Settings.
On the Security tab, click Advanced Settings.
Scroll down, check the box next to Enable Client Security Logging, and click OK.
When the scan fails, the user is presented with a Case ID.
You can then grep /var/log/ns.log for the Case ID. Or search your syslog.

To determine why your EPA scans fail, on the client machine, go to HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Secure Access Client.
Make a DWORD value named “EnableEPALogging” and set the value to 1.

After attempting the scan again, you’ll find the file %localappdata%\Citrix\AGEE\epaHelper_epa_plugin.txt with details for each scan expression.

NetscalerAssasin EPA OPSWAT Packet flow and Troubleshooting shows a Wireshark trace of an EPA scan.

SmartControl

NetScaler 11.0 has a new SmartControl feature, where you can configure some of the SmartAccess functionality directly on the appliance. See Configuring SmartControl at docs.citrix.com for detailed instructions.

If you are using a Preauthentication Policy to run an Endpoint Analysis scan, edit the Preauth profile.
Configure the Default EPA Group with a new group name. You’ll use this group name later.
If you are instead using a Session Policy/Profile to run the post-authentication Endpoint Analysis scan, on the Security tab, use the Smartgroup field to define a group name for users that pass the scan. You’ll use this group name later.
On the left, expand NetScaler Gateway, expand Policies, and click ICA.
On the right, switch to the Access Profiles tab and click Add.
Configure the restrictions as desired and click OK.
Switch to the ICA Action tab and click Add.
Give the Action a name and select the Access Profile. Click Create.
Switch to the ICA Policies tab and click Add.
Select the previously created ICA Action.
Enter an expression. You can use REQ.USER.IS_MEMBER_OF(“MyGroup”) where MyGroup is the name of the SmartGroup you configured in the session profile or preauth scan. Click Create when done.
Edit your Gateway Virtual Server.
Scroll down to the Policies section and click the plus icon.
Change the Policy Type to ICA and click Continue.
Select the SmartControl policy you created earlier and click Bind.

SmartAccess

CTX138110 How to Configure the SmartAccess feature on Access Gateway Enterprise Edition Appliance

In XenApp/XenDesktop, edit a Citrix policy and add the Access Control filter. If you are using GPO to deliver Citrix Policies, then only Citrix Policies in the user half of the GPO support Access Control filters.

You can leave the default wildcards for farm name and condition to match all NetScaler Gateway connections. Or you can match specific NetScaler Gateway / Session Policy connections:

AG farm name = name of the NetScaler Gateway Virtual Server.
Access condition = name of the NetScaler Gateway Session Policy.

You typically create a Citrix policy to turn off all client device mappings for all external users. Then you create a higher priority Citrix policy that re-enables client device mappings for those users that passed the Endpoint Analysis scan expression on a particular Session Policy.

If you edit a Delivery Group, there’s an Access Policy page where you can hide or show the Delivery Group for all NetScaler Gateway connections or for specific NetScaler Gateway Virtual Server / Session Policy connections.

Farm name = NetScaler Gateway Virtual Server name
Filter = NetScaler Gateway Session Policy name

This configuration is only available at the entire Delivery Group. It is not possible to perform this configuration for only specific published applications unless they are on different Delivery Groups.

Virtual Delivery Agent (VDA) 7.7

Last Modified: Nov 7, 2020 @ 6:35 am

28 Comments

Navigation:

VDA Virtual Machine Hardware
Windows Configuration
Install Virtual Delivery Agent 7.7
- Virtual Delivery Agent 7.6.300 Hotfixes
- Change Controller Registration Port to something other than port 80
- Verify VDA Registration with Controller
Profile Management 5.4.1 💡
Receivers:
- Receiver 4.4.1000
- App Switcher 2.0.2 for Receiver for HTML5
- Citrix PDF Printer 7.8.0 for Receiver for HTML5
Framehawk Configuration
Remote Desktop Licensing Configuration
Reduce C: Drive Permissions
Configure Pagefile for Provisioning Services
Direct Access Users Group – allow non-administrators to RDP to the VDA
Enable Windows Profiles v3/v4
Registry Settings – HDX Flash for IE 11, published Explorer, 8dot3, HTML5 Clipboard, 4K Monitors
Restore Legacy Client Drive Mapping
COM/LPT Port Redirection
Print Driver for Mac and Linux Clients
HTML5 Receiver – SSL for VDA
Anonymous Accounts
Antivirus
Optimize Performance
Seal and Shut Down
Troubleshooting – Graphics
Uninstall VDA

💡 = Recently Updated

Hardware

If vSphere 6, don’t use hardware version 11 unless you have NVIDIA GRID. VMware 2109650 – Video playback performance issue with hardware version 11 VMs in 2D mode
For virtual desktops, give the virtual machine: 2+ vCPU and 2+ GB of RAM
For Windows 2008 R2 RDSH, give the virtual machine 4 vCPU and 12-24 GB of RAM
For Windows 2012 R2 RDSH, give the virtual machine 8 vCPU, and 24-48 GB of RAM
Remove the floppy drive
Remove any serial or LPT ports
If vSphere:
1. To reduce disk space, reserve memory. Memory reservations reduce or eliminate the virtual machine .vswp file.
2. The NIC should be VMXNET3.
If this VDA will boot from Provisioning Services:
1. Give the VDA extra RAM for caching.
2. Do not enable Memory Hot Plug
3. For vSphere, the NIC must be VMXNET3.
4. For vSphere, configure the CD-ROM to boot from IDE instead of SATA. SATA comes with VM hardware version 10. SATA won’t work with PvS.
Install the latest version of drivers (e.g. VMware Tools).
1. If Windows 7 on vSphere, don’t install the VMware SVGA driver. For more details, see CTX201804 Intermittent Connection Failures/Black Screen Issues When Connecting from Multi-Monitor Client Machines to Windows 7 VDA with VDA 7.x on vSphere/ESXi.

If vSphere, disable NIC Hotplug

Users could use the systray icon to Eject the Ethernet Controller. Obviously this is bad.
To disable this functionality, power off the virtual machine.
Once powered off, right-click the virtual machine and click Edit Settings.
On the VM Options tab, expand Advanced and then click Edit Configuration.
Click Add Row.
On the left, enter devices.hotplug. On the right, enter false.
Then click OK a couple times to close the windows.
The VM can then be powered on.

Windows Preparation

If RDSH, disable IE Enhanced Security Config
Optionally, go to Action Center (Windows 8.1 or 2012 R2) or Security and Maintenance (Windows 10) to disable User Account Control and enable SmartScreen .
Run Windows Update.
If Windows Firewall is enabled:
1. Enable File Sharing so you can access the VDA remotely using SMB
2. Enable COM+ Network Access and the three Remote Event Log rules so you can remotely manage the VDA.
Add your Citrix Administrators group to the local Administrators group on the VDA.
The Remote Desktop Services “Prompt for Password” policy prevents Single Sign-on to the Virtual Delivery Agent. Check registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services. If fPromptForPassword = 1 then you need to fix group policy. The following GPO setting will prevent Single Sign-on from working.
Computer Configuration Policies Administrative templates Windows Components Remotes Desktop Services Remote desktop Session Host Security Always prompt for password upon connection

Or set the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\PorticaAutoLogon (DWORD) = 0x10.
For Windows 7 VDAs that will use Personal vDisk, install Microsoft hotfix 2614892 – A computer stops responding because of a deadlock situation in the Mountmgr.sys driver. This hotfix solved a Personal vDisk Image update issue detailed at Citrix Discussions.
If this VDA is Windows Server 2008 R2, request and install the Windows hotfixes recommended by Citrix CTX129229. Scroll down to see the list of recommended Microsoft hotfixes for Windows Server 2008 R2. Ignore the XenApp 6.x portions of the article. Also see https://www.carlstalhood.com/windows-server-2008-r2-post-sp1-hotfixes/.
To remove the built-in apps in Windows 10, see Robin Hobo How to remove built-in apps in Windows 10 Enterprise.
For Remote Assistance in Citrix Director, configure the GPO setting Computer Configuration | Policies | Administrative Templates | System | Remote Assistance | Offer Remote Assistance. See Jason Samuel – How to setup Citrix Director Shadowing with Remote Assistance using Group Policy for more details.

Install Virtual Delivery Agent 7.7

For virtual desktops, make sure you are logged into the console. The VDA won’t install if you are connected using RDP.
Make sure 8.3 file name generation is not disabled. If so, see CTX131995 – User Cannot Launch Application in Seamless Mode to fix the AppInit_DLLs registry keys.
Make sure .NET Framework 4.5.1 is installed.
Go to the downloaded XenDesktop 7.7 (XenDesktop Platinum, XenDesktop Enterprise, XenApp Platinum, or XenApp Enterprise) .iso file and run AutoSelect.exe. Alternatively, you can download the standalone VDA package and run that instead.
Click Start next to either XenApp or XenDesktop. The only difference is the product name displayed in the installation wizard.
Click Virtual Delivery Agent for Windows Desktop OS or Windows Server OS depending on which type of VDA you are building.
In the Environment page, select Create a Master Image and click Next.
For virtual desktops, in the HDX 3D Pro page, click Next.
In the Core Components page, if you don’t need Citrix Receiver installed on your VDA then uncheck the box. Click Next.
In the Delivery Controller page, select Do it manually. Enter the FQDN of each Controller. Click Test connection. And then make sure you click Add. Click Next when done.
In the Features page, click Next. If this is a virtual desktop, you can leave Personal vDisk unchecked now and enable it later.
In the Firewall page, click Next.
In the Summary page, click Install.
For RDSH, click Close when you are prompted to restart.
After the machine reboots twice, login and installation will continue.
After installation, click Finish to restart the machine again.
If 8.3 file name generation is disabled, see CTX131995 – User Cannot Launch Application in Seamless Mode to fix the AppInit_DLLs registry keys.

Virtual Delivery Agent 7.6.300 Hotfixes

The core VDA software is actually VDA 7.6.300 so you can install core VDA 7.6.300 hotfixes on a 7.7 VDA. What’s different about 7.7 VDA vs 7.6.300 is the brokering agents, Director agents, and Profile Management built into the VDA 7.7 installer.

Download Virtual Delivery Agent 7.6.300 hotfixes. There are DesktopVDACore hotfixes and ServerVDACore hotfixes, depending on which type of VDA you are building.
Install each hotfix by double-clicking the .msp file.
In the Welcome to the Citrix HDX TS/WS Setup Wizard page, click Next.
In the Ready to update page, click Update.
In the Completed the Citrix HDX TS/WS Setup Wizard page, click Finish.
When prompted to restart, if you have multiple hotfixes to install, click Cancel.
Continue installing hotfixes. Restart when done.

Controller Registration Port

Some environments will not accept the default port 80 for Virtual Delivery Agent registration. To change the port, do the following on the Virtual Delivery Agent:

Open Programs and Features.
Find Citrix Virtual Delivery Agent and click Change.
Click Customize Virtual Delivery Agent Settings.
Edit the Delivery Controllers and click Next.
On the Configure Delivery Controller page, change the port number and click Next.
In the Summary page, click Reconfigure.
In the Finish Reconfiguration page, click Finish. The machine automatically restarts.
You must also change the VDA registration port on the Controllers by running BrokerService.exe /VDAPort.

Controller Registration – Verify

If you restart the Virtual Delivery Agent machine or restart the Citrix Desktop Service…
In Windows Logs Application log, you should see an event 1012 from Citrix Desktop Service saying that it successfully registered with a controller. If you don’t see this then you’ll need to fix the ListOfDDCs registry key.
You can also run Citrix’s Health Assistant on the VDA.

Profile Management 5.4.1 💡

Warning: If you are upgrading and have existing Windows 2012 R2 profiles based on the !CTX_OSNAME! variable, see http://discussions.citrix.com/topic/374111-psa-upm-54-ctx-osname-server-2012-value-change/ for why your profiles might stop working.

Go to the downloaded Profile Management 5.4.1 and run profilemgt_x64.msi.
In the Welcome to the Citrix Profile Management Setup Wizard page, click Next.
In the End-User License Agreement page, check the box next to I accept the terms in the License Agreement and click Next.
In the Destination Folder page, click Next.
In the Ready to install Citrix Profile Management page, click Install.
If you see Files in Use, click OK.
Click OK to continue the installation.
In the Completed the Citrix Profile Management Setup Wizard page, click Finish.
Click Yes when prompted to restart.

UPM 5.4.1 breaks Logon Duration in Citrix Director. To fix it, run the following commands:

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe "C:\Program Files\Citrix\Virtual Desktop Agent\upmWmiMetrics.dll"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe "C:\Program Files\Citrix\Virtual Desktop Agent\upmWmiAdmin.dll"

See the Profile Management page for configuration instructions.

Upgrade to Receiver 4.4.1000

VDA 7.7 does not include this update.

If Receiver is installed on your VDA, upgrade it to version 4.4.1000 (or 4.4.1002) 💡

Go to the downloaded Receiver 4.4.1000 and run CitrixReceiver.exe.
In the Welcome to Citrix Receiver page, click Start.
In the License Agreement page, check the box next to I accept the license agreement and click Next.
If you see the Enable Single Sign-on page, check the box next to Enable Single Sign-on and click Next.
In the Help make our products better page, make your selection and click Install.
After installation, click Finish.
See the Receiver page for configuration instructions.

HTML5 App Switcher 2.0.2

This tool is no longer needed for Receiver for HTML5 2.0 and newer.

.NET Framework 4.0.3 or newer is required.
Go to the downloaded Receiver for HTML5 App Switcher (Citrix_AppSwitcher_2.0.2) and run AppSwitcher.msi.
Check the box next to I accept the terms and click Install.
In the Completed the App Switcher Setup Wizard page, click Finish.
In Programs and Features, it is shown as version 2.0.2.25.

Citrix PDF Printer 7.8.0

This tool is only used by Receiver for HTML5.

Go to the downloaded Receiver for HTML5 Citrix PDF Printer 7.8.0 (Citrix_PDFPrinter_7.8.0) and run CitrixPDFPrinter64.msi.
In the Please read the Citrix PDF printer License Agreement page, check the box next to I accept the terms and click Install.
In the Completed the Citrix PDF Universal Driver Setup Wizard page, click Finish.
In Programs and Features, it is shown as version 7.8.0.10.
Configure a Citrix Policy to enable the PDF printer. The setting is called Auto-create PDF Universal Printer.

Framehawk Configuration

To enable Framehawk, see https://www.carlstalhood.com/citrix-policy-settings/#framehawkconfig

Remote Desktop Licensing Configuration

On 2012 R2 RDSH, the only way to configure Remote Desktop Licensing is using group policy (local or domain). This procedure also works for 2008 R2 RDSH. This procedure is not needed on virtual desktops.

For local group policy, run gpedit.msc.
Go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Licensing.
Double-click Use the specified Remote Desktop license servers. Change it to Enabled and enter the names of the RDS Licensing Servers (typically installed on XenDesktop Controllers). Click OK.
Double-click Set the Remote Desktop licensing mode. Change it to Enabled and select Per User. Click OK.
In Server Manager, open the Tools menu, expand Terminal Services and click RD Licensing Diagnoser.
The Diagnoser should find the license server and indicate the licensing mode. It’s OK if there are no licenses installed on the Remote Desktop License Server.

Several people in Citrix Discussions reported the following issue: If you see a message about RD Licensing Grace Period has expired even though RD Licensing is properly configured, see Eric Verdumen No remote Desktop Licence Server availible on RD Session Host server 2012. The solution was to delete the REG_BINARY in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\GracePeriod only leaving the default. You must take ownership and give admin users full control to be able to delete this value.

C: Drive Permissions

This section is more important for shared VDAs like Windows 2008 R2 and Windows 2012 R2.

The default permissions allow users to store files on the C: drive in places other than their profile.

Open the Properties dialog box for C:.
On the Security tab, click Advanced.
Highlight the line containing Users and Create Folders and click Remove.
Highlight the line containing Users and Special and click Remove. Click OK.
Click Yes to confirm the permissions change.
If you see any of these Error Applying Security windows, click Continue.
Click OK to close the C: drive properties.

Pagefile

If this image will be converted to a Provisioning Services vDisk, then you must ensure the pagefile is smaller than the cache disk. For example, if you allocate 20 GB of RAM to your Remote Desktop Session Host, and if the cache disk is only 15 GB, then Windows will have a default pagefile size of 20 GB and Provisioning Services will be unable to move it to the cache disk. This causes Provisioning Services to cache to server instead of caching to your local cache disk (or RAM).

Open System. In 2012 R2, you can right-click the Start button and click System.
Click Advanced system settings.
On the Advanced tab, click the top Settings button.
On the Advanced tab, click Change.
Either turn off the pagefile or set the pagefile to be smaller than the cache disk. Don’t leave it set to System managed size. Click OK several times.

Direct Access Users

When Citrix Virtual Delivery Agent is installed on a machine, non-administrators can no longer RDP to the machine. A new local group called Direct Access Users is created on each Virtual Delivery Agent. Add your non-administrator RDP users to this local group so they can RDP directly to the machine.

Windows Profiles v3/v4/v5

Roaming Profiles are compatible only between the following client and server operating system pairs. The profile version is also listed.

v5 = Windows 10 and Windows Server 2016
v4 = Windows 8.1 and Windows Server 2012 R2
v3 = Windows 8 and Windows Server 2012
v2 = Windows 7 and Windows Server 2008 R2
v2 = Windows Vista and Windows Server 2008

Windows 8.1 and 2012 R2 don’t properly set the profile version. To fix this, ensure update rollup 2887595 is installed. http://support.microsoft.com/kb/2890783. After you apply this update, you must create a registry key before you restart the computer.

Run regedit.
Locate and then tap or click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\ProfSvcParameters
On the Edit menu, point to New, and then tap or click DWORD Value.
Type UseProfilePathExtensionVersion.
Press and hold or right-click UseProfilePathExtensionVersion, and then tap or click Modify.
In the Value data box, type 1, and then tap or click OK.
Exit Registry Editor.

Then, Windows 8.1 creates a user profile and appends the suffix “.v4” to the profile folder name to differentiate it from version 2 of the profile in Windows 7 and version 3 of the profile in Windows 8.

Registry

HDX Flash

From Citrix Knowledgebase article CTX139939 – Microsoft Internet Explorer 11 – Citrix Known Issues: The registry key value IEBrowserMaximumMajorVersion is queried by the HDX Flash service to check for maximum Internet Explorer version that HDX Flash supports. For Flash Redirection to work with Internet Explorer 11 set the registry key value IEBrowserMaximumMajorVersion to 11 on the machine where HDX flash service is running. In case of XenDesktop it would be the machine where VDA is installed.

Key = HKLM\SOFTWARE\Wow6432Node\Citrix\HdxMediaStreamForFlash\Server\PseudoServer
- Value = IEBrowserMaximumMajorVersion (DWORD) = 00000011 (Decimal)

From Citrix Discussions: Add the DWORD ‘FlashPlayerVersionComparisonMask=0′ on the VDA under HKLM\Software\Wow6432Node\Citrix\HdxMediaStreamForFlash\Server\PseudoServer. This disables the Flash major version checking between the VDA and Client Device.

Published Explorer

This section applies if you intend to publish apps from this VDA.

From Citrix Knoweldgebase article CTX128009 – Explorer.exe Fails to Launch: When publishing the seamless explorer.exe application, the session initially begins to connect as expected. After the loading, the dialog box disappears and the explorer application fails to appear. On the VDA, use the following registry change to set the length of time a client session waits before disconnecting the session:

Key = HKLM\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI
- Value = LogoffCheckerStartupDelayInSeconds (DWORD) = 10 (Hexadecimal)

Mfaphook – 8.3 File Names

Open a command prompt.
Switch to C:\ by running cd /d C:\
Run dir /x program*
If you don’t see PROGRA~1 then 8.3 is disabled. This will break Citrix.
If 8.3 is disabled, open regedit and go to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows.
On the right is AppInit_DLLs. Edit it and remove the path in front of MFAPHOOK64.DLL.

Logon Disclaimer Window Size

From Xenapp 7.8 – Session Launch Security/Warning Login Banner at Citrix Discussions: If your logon disclaimer window has scroll bars, set the following registry values:

HKLM\Software\Wow6432node\Citrix\CtxHook\AppInit_DLLS\Multiple Monitor Hook\LogonUIWidth = DWORD:300
HKLM\Software\Wow6432node\Citrix\CtxHook\AppInit_DLLS\Multiple Monitor Hook\LogonUIHeight = DWORD:200

Login Timeout

Citrix CTX203760 VDI Session Launches Then Disappears: XenDesktop, by default, only allows 180 seconds to complete a logon operation. The timeout can be increased by setting the following:

HKLM\SOFTWARE\Citrix\PortICA

Add a new DWORD AutoLogonTimeout and set the value to decimal 240 or higher (up to 3600).

Also see Citrix Discussions Machines in “Registered” State, but VM closes after “Welcome” screen.

Receiver for HTML5 Enhanced Clipboard

From About Citrix Receiver for Chrome 1.9 at docs.citrix.com: To enable enhanced clipboard support, set registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\Virtual Clipboard\Additional Formats\HTML Format\Name=”HTML Format”. Create any missing registry keys. This applies to both virtual desktops and Remote Desktop Session Hosts.

4K Monitors

Citrix CTX201696 – Citrix XenDesktop and XenApp – Support for Monitors Including 4K Resolution and Multi-monitors: Up to eight 4K monitors are supported with the Std-VDA and RDS VDA irrespective of underlying GPU support, provided the required policies and/or registry keys are correctly configured. Currently the Std-VDA for XenDesktop and RDS-VDA for XenApp does not support resolutions higher than 4094 in any dimension.

Framehawk currently does not support 4K monitors. At the time of writing, the number of monitors supported is 1, the use of more monitors will cause the graphics mode to change from Framehawk to Thinwire to support multi-monitor. The maximum resolution supported by Framehawk is currently 2048×2048.

From CTX200257 – Screen Issues Connecting to 4K Resolution Monitors: Symptom: A blank or corrupt screen is displayed when connecting to Windows 7 or 8.1 Standard XenDesktop Virtual Delivery Agents on a client which has one or more 4K resolution monitors.

Calculate the video memory that is required for 4K monitor using the following formula:
Sum of total monitors (Width * height * 4 * X) where width and height are resolution of the monitor.

X = 2 if VDA is Windows 7 OR X = 3 if VDA is Windows 88.1

Suppose a Windows 7 VDA is connecting to a client that has dual 4K monitors (3840×2160), then video buffer should be: (3840 x 2160 x 4 x 2) + (3840 x 2160 x 4 x 2) = ~132MB
Open the registry (regedit) and navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vd3v
Increase the value of “MaxVideoMemoryBytes” REG_DWORD value to the above calculated memory.
Reboot the VDA.

When using Thinwire, Compatibility, Thinwire Plus or Legacy modes, the Display memory Limit policy needs to be configured appropriately for Std-VDA, as per Graphics Policy Settings at docs.citrix.com. The Default value for Display memory Limit is 65536KB and this is sufficient up to 2x4K monitors (2x32400KB). You can find more information on Graphics modes at Citrix Blogs – Site Wide View of HDX Graphics Modes.

Legacy Client Drive Mapping

Citrix Knowledgebase article How to Enable Legacy Client Drive Mapping Format on XenApp: Citrix Client Drive Mapping no longer uses drive letters and instead they appear as local disks. This is similar to RDP drive mapping.

The old drive letter method can be enabled by setting the registry value:

Key = HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\UncLinks (create the key)
- Value = UNCEnabled (DWORD) = 0

When you reconnect, the client drives will be mapped as drive letters (starts with V: and goes backwards).

COM/LPT Port Redirection

To signal Citrix’ intention to deprecate COM and LPT support in a future major release, policy settings for COM Port and LPT Port Redirection have moved from Studio to the registry, and are now located under HKLM\Software\Citrix\GroupPolicy\Defaults\Deprecated on either your Master VDA image or your physical VDA machines. The COM/LPT port registry values are detailed at docs.citrix.com.

Print Driver for Non-Windows Clients

This section applies to Windows 2012 R2, Windows 8.1, and Windows 10 VDAs.

From Mac Client Printer Mapping Fix for Windows 8/8.1 and Windows Server 2012/2012R2. By default, Non-Windows clients cannot map printers due to a missing print driver on the VDA machine.

Requirements:
- Internet Access
- Windows Update service enabled
Click Start and run Devices and Printers.
In the Printers section, highlight a local printer (e.g. Microsoft XPS Document Writer). Then in the toolbar click Print server properties.
Switch to the Drivers tab. Click Change Driver Settings.
Then click Add.
In the Welcome to the Add Printer Driver Wizard page, click Next.
In the Processor Selection page, click Next.
In the Printer Driver Selection page, click Windows Update. The driver we need won’t be in the list until you click this button. Internet access is required.
Once Windows Update is complete, highlight HP on the left and then select HP Color LaserJet 2800 Series PS (Microsoft) on the right. Click Next.
In the Completing the Add Printer Driver Wizard page, click Finish.
Repeat these instructions to install the following additional drivers:
- HP LaserJet Series II
- HP Color LaserJet 4500 PCL 5

SSL for VDA

If you intend to use HTML5 Receiver internally, install certificates on the VDAs so the WebSockets (and ICA) connection will be encrypted. Internal HTML5 Receivers will not accept clear text WebSockets. External users don’t have this problem since they are SSL-proxied through NetScaler Gateway. Notes:

Each Virtual Delivery Agent needs a machine certificate that matches the machine name. This is feasible for a small number of persistent VDAs. For non-persistent VDAs, you’ll need some automatic means for creating machine certificates every time they reboot.
As detailed in the following procedure, use PowerShell on the Controller to enable SSL for the Delivery Group. This forces SSL for every VDA in the Delivery Group, which means every VDA in the Delivery Group must have SSL certificates installed.

The Citrix blog post How To Secure ICA Connections in XenApp and XenDesktop 7.6 using SSL has a method for automatically provisioning certificates for pooled virtual desktops by enabling certificate auto-enrollment and setting up a task that runs after the certificate has been enrolled. Unfortunately this does not work for Remote Desktop Session Host.

The following instructions can be found at Configure SSL on a VDA using the PowerShell script at docs.citrix.com.

On the VDA machine, run mmc.exe.
Add the Certificates snap-in.
Point it to Local Computer.
Request a certificate from your internal Certificate Authority. You can use either the Computer template or the Web Server template.

You can also use group policy to enable Certificate Auto-Enrollment for the VDA computers.
Browse to the XenApp/XenDesktop 7.7 ISO. In the Support\Tools\SslSupport folder, shift+right-click the Enable-VdaSSL.ps1 script and click Copy as path.
Run PowerShell as administrator (elevated).
Run the command Set-ExecutionPolicy unrestricted. Enter Y to approve.
In the PowerShell prompt, type in an ampersand (&), and a space.
Right-click the PowerShell prompt to paste in the path copied earlier.
At the end of the path, type in -Enable
If there’s only one certificate on this machine, press Enter.
If there are multiple certificates, you’ll need to specify the thumprint of the certificate you want to use. Open the Certificates snap-in, open the properties of the machine certificate you want to use, and copy the Thumbprint from the Details tab.

In the PowerShell prompt, at the end of the command, enter ?CertificateThumbPrint, add a space, and type quotes (").

Right-click the PowerShell prompt to paste the thumbprint.

Type quotes (") at the end of the thumbprint. Then remove all spaces from the thumbprint. The thumbprint needs to be wrapped in quotes.
If this VDA machine has a different service already listening on 443 (e.g. IIS), then the VDA needs to use a different port for SSL connections. At the end of the command in the PowerShell prompt, enter -SSLPort 444 or any other unused port.
Press <Enter> to run the Enable-VdaSSL.ps1 script.
Press <Y> twice to configure the ACLs and Firewall.
You might have to reboot before the settings take effect.
Login to a Controller and run PowerShell as Administrator (elevated).
Run the command asnp Citrix.*

Enter the command:

Get-BrokerAccessPolicyRule -DesktopGroupName '<delivery-group-name>' | Set-BrokerAccessPolicyRule ?HdxSslEnabled $true

where <delivery-group-name> is the name of the Delivery Group containing the VDAs.

You can run Get-BrokerAccessPolicyRule -DesktopGroupName '<delivery-group-name>' to verify that HDX SSL is enabled.

Also run the following command:

Set-BrokerSite –DnsResolutionEnabled $true

You should now be able to connect to the VDA using the HTML5 Receiver from internal machines.

Anonymous Accounts

If you intend to publish apps anonymously then follow this section.

Anonymous accounts are created locally on the VDAs. When XenDesktop creates Anon accounts it gives them an idle time as specified at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\AnonymousUserIdleTime. The default is 10 minutes. Adjust as desired.
You can pre-create the Anon accounts on the VDA by running “C:\Program Files\Citrix\ICAConfigTool\CreateAnonymousUsersApp.exe”. If you don’t run this tool then Virtual Delivery Agent will create them automatically when users log in.
You can see the local Anon accounts by opening Computer Management, expanding System Tools, expand Local Users and Groups and clicking Users.
If you open one of the accounts, on the Sessions tab, notice that idle timeout defaults to 10 minutes. Feel free to change it.

Group Policy for Anonymous Users

Since Anonymous users are local accounts on each Virtual Delivery Agent, domain-based GPOs will not apply. To work around this limitation, you’ll need to edit the local group policy on each Virtual Delivery Agent.

On the Virtual Delivery Agent, run gpedit.exe.
Open the File menu and click Add/Remove Snap-in.
Highlight Group Policy Object Editor and click Add to move it to the right.
In the Welcome to the Group Policy Wizard page, click Browse.
On the Users tab, select Non-Administrators.
Click Finish.
Now you can configure group policy to lockdown sessions for anonymous users. Since this is a local group policy, you’ll need to repeat the group policy configuration on every Virtual Delivery Agent image. Also, Group Policy Preferences is not available in local group policy.

Antivirus

Install antivirus using your normal procedure. Instructions vary for each Antivirus product.

Microsoft’s virus scanning recommendations (e.g. exclude group policy files) – http://support.microsoft.com/kb/822158.

Citrix’s Recommended Antivirus Exclusions

Citrix CTX127030 Citrix Guidelines for Antivirus Software Configuration: Based on Citrix Consulting’s field experience, organizations might wish to consider configuring antivirus software on session hosts with the settings below.

Scan on write events or only when files are modified. It should be noted that this configuration is typically regarded as a high security risk by most antivirus vendors. In high-security environments, organizations should consider scanning on both read and write events to protect against threats that target memory, such as Conficker variants.
Scan local drives or disable network scanning. This assumes all remote locations, which might include file servers that host user profiles and redirected folders, are being monitored by antivirus and data integrity solutions.
Exclude the pagefile(s) from being scanned.
Exclude the Print Spooler directory from being scanned.
Remove any unnecessary antivirus related entries from the Run key (HKLM\Software\Microsoft\Windows\Current Version\Run).
If using the streamed user profile feature of Citrix Profile management, ensure the antivirus solution is configured to be aware of Hierarchical Storage Manager (HSM) drivers. For more information, refer to Profile Streaming and Enterprise Antivirus Products.

Symantec

Symantec links:

Symantec TECH91070 Citrix and terminal server best practices for Endpoint Protection.
Symantec TECH197344 Best practices for virtualization with Symantec Endpoint Protection 12.1.2
Symantec TECH180229 Symantec Endpoint Protection 12.1 – Non-persistent Virtualization Best Practices
Symantec TECH123419 How to prepare Symantec Endpoint Protection clients on virtual disks for use with Citrix Provisioning Server has a script that automates changing the MAC address registered with Symantec.
Citrix Blog Post How to prepare a Citrix Provisioning Services Target Device for Symantec Endpoint Protection

Non-persistent session hosts:

After you have installed the Symantec Endpoint Protection client and disabled Tamper Protection, open the registry editor on the base image.

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC.
Create a new key named Virtualization.
Under Virtualization, create a key of type DWORD named IsNPVDIClient and set it to a value of 1.

To configure the purge interval for offline non-persistent session host clients:

In the Symantec Endpoint Protection Manager console, on the Admin page, click Domains.
In the Domains tree, click the desired domain.
Under Tasks, click Edit Domain Properties.
On the Edit Domain Properties > General tab, check the Delete non-persistent VDI clients that have not connected for specified time checkbox and change the days value to the desired number. The Delete clients that have not connected for specified time option must be checked to access the option for offline non-persistent VDI clients.
Click OK.

Make the following changes to the Communications Settings policy:

Configure clients to download policies and content in Pull mode
Disable the option to Learn applications that run on the client computers
Set the Heartbeat Interval to no less than one hour
Enable Download Randomization, set the Randomization window for 4 hours

Make the following changes to the Virus and Spyware Protection policy:

Disable all scheduled scans
Disable the option to “Allow startup scans to run when users log on” (This is disabled by default)
Disable the option to “Run an ActiveScan when new definitions Arrive”

Avoid using features like application learning which send information to the SEPM and rely on client state to optimize traffic flow

Linked clones:

To configure Symantec Endpoint Protection to use Virtual Image Exception to bypass the scanning of base image files

On the console, open the appropriate Virus and Spyware Protection policy.
Under Advanced Options, click Miscellaneous.
On the Virtual Images tab, check the options that you want to enable.
Click OK

Trend Micro

Citrix CTX136680 – Slow Server Performance After Trend Micro Installation. Citrix session hosts experience slow response and performance more noticeable while users try to log in to the servers. At some point the performance of the servers is affected, resulting in issues with users logging on and requiring the server to be restarted. This issue is more noticeable on mid to large session host infrastructures.

Trend Micro has provided a registry fix for this type of issue. Create the following registry on all the affected servers. Add new DWORD Value as:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TmFilterParameters] “DisableCtProcCheck”=dword:00000001

Trend Micro Links:

Trend Micro Docs – Trend Micro Virtual Desktop Support
Trend Micro Docs – VDI Pre-Scan Template Generation Tool
Trend Micro 1055260 – Best practice for setting up Virtual Desktop Infrastructure (VDI) in OfficeScan
Trend Micro 1056376 – Frequently Asked Questions (FAQs) about Virtual Desktop Infrastructure/Support In OfficeScan

Optimize Performance

VDA Optimizer

Installation of the VDA might have already done this but there’s no harm in doing it again. This tool is only available if you installed VDA in Master Image mode.

On the master VDA, go to C:\Program Files\Citrix\PvsVm\TargetOSOptimizer and run TargetOSOptimizer.exe.
Then click OK. Notice that it disables Windows Update.

RDSH

Citrix CTX131577 XenApp 6.x (Windows 2008 R2) – Optimization Guide is a document with several registry modifications that are supposed to improve server performance. Ignore the XenApp 6 content and instead focus on the Windows content.

Citrix CTX131995 User Cannot Launch Application in Seamless Mode in a Provisioning Services Server when XenApp Optimization Best Practices are Applied. Do not enable NtfsDisable8dot3NameCreation

Norskale has Windows 2008 R2 Remote Desktop and XenApp 6 Tuning Tips Update.

Windows 7

Microsoft has compiled a list of links to various optimization guides.

It’s a common practice to optimize a Windows 7 virtual machine (VM) template (or image) specifically for VDI use. Usually such customizations include the following.

Minimize the footprint, e.g. disable some features and services that are not required when the OS is used in “stateless” or “non-persistent” fashion. This is especially true for disk-intensive workloads since disk I/O is a common bottleneck for VDI deployment. (Especially if there are multiple VMs with the same I/O patterns that are timely aligned).
Lock down user interface (e.g. optimize for specific task workers).

With that said the certain practices are quite debatable and vary between actual real-world deployments. Exact choices whether to disable this or that particular component depend on customer requirements and VDI usage patterns. E.g. in personalized virtual desktop scenario there’s much less things to disable since the machine is not completely “stateless”. Some customers rely heavily on particular UI functions and other can relatively easily trade them off for the sake of performance or standardization (thus enhance supportability and potentially security). This is one of the primary reasons why Microsoft doesn’t publish any “VDI Tuning” guide officially.

Though there are a number of such papers and even tools published either by the community or third parties. This Wiki page is aimed to serve as a consolidated and comprehensive list of such resources.

Daniel Ruiz XenDesktop Windows 7 Optimization and GPO’s Settings –

Microsoft Whitepaper Performance Optimization Guidelines for Windows 7 Desktop Virtualization

Windows 10 / Windows 8.1 / Windows 2012 R2

VMware’s OS Optimization Tool plus Login VSI’s tuning template
James Rankin Improving Windows 10 logon time:
- Use Remove-AppXProvisionedPackage to remove Modern apps. See the article for a list of apps to remove.
- Import a Standard Start Tiles layout (Export-StartLayout)
- Create a template user profile
Citrix’s Windows 8 and 8.1 Virtual Desktop Optimization Guide contains the following:
- A list of services to disable
- A list of computer settings
- A list of scheduled tasks to disable
- A script to do all of the above
Carl Luberti (Microsoft) Windows 10 VDI Optimization Script
Microsoft’s Windows 8 VDI optimization script.
Desktop Virtualization Best Practice Analyzer

Optimization Notes:

If this machine is provisioned using Provisioning Services, do not disable the Shadow Copy services.
Windows 8 detects VDI and automatically disables SuperFetch. No need to disable it yourself.
Windows 8 automatically disables RSS and TaskOffload if not supported by the NIC.

Seal and Shut Down

If this session host will be a master image in a Machine Creation Services or Provisioning Services catalog, after the master is fully prepared (including applications), do the following:

Go to the properties of the C: drive and run Disk Cleanup.
On the Tools tab, click Optimize to defrag the drive.
`
Run slmgr.vbs /dlv and make sure it is licensed with KMS and has at least one rearm remaining. It is no longer necessary to manually rearm licensing. XenDesktop will do it automatically.
Run Delprof2 to clean up local profiles. Get it from http://helgeklein.com/download/.
Machine Creation Services and Provisioning Services require DHCP.

Session hosts commonly have DHCP reservations.

Shut down the master image. You can now use Studio or Provisioning Services to create a catalog of linked clones.

Troubleshooting – Graphics

If Windows 7 on vSphere, don’t install the VMware SVGA driver. For more details, see CTX201804 Intermittent Connection Failures/Black Screen Issues When Connecting from Multi-Monitor Client Machines to Windows 7 VDA with VDA 7.x on vSphere/ESXi.

For an explanation of Citrix’s graphics policy settings, see A graphical deep dive into XenDesktop 7 and What’s new with HDX display in XenDesktop & XenApp 7.x?

Citrix Knowledgebase article CTX200370 – How to Determine HDX Display Mode: Use wmic or HDX Monitor as described in the article to determine which of the following display mode options is being used:

DCR (Desktop Composition Redirection)
H.264 / H.264 Compatibility Mode
Legacy Graphics Mode

Citrix Blog Post – Site Wide View of HDX Graphics Modes; PowerShell script to display graphics mode of currently connected sessions.

Citrix Blog post – Optimising the performance of HDX 3D Pro – Lessons from the field

From Citrix Tips – Black Screen Issues with 7.x VDA: Users would make a successful ICA connection but the screen would stay totally black.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vbdenum]

“Start”=dword:00000001
“MaxVideoMemoryBytes”=dword:06000000
“Group”= “EMS”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vd3d]

“MaxVideoMemoryBytes”=dword:00000000

From Citrix Knowledgebase article CTX200257 – Screen Issues Connecting to 4K Resolution Monitors in DCR Mode:

Calculate the video memory that is required for 4K monitor using the following formula:
Sum of total monitors (Width * height * 4 * X) where width and height are resolution of the monitor.

X = 2 if VDA is Windows 7 OR X = 3 if VDA is Windows 88.110

Example: Suppose a Windows 7 VDA is connecting to a client that has dual 4K monitors (3840×2160), then video buffer should be: (3840×160 x 4 x 2) + (3840 x 2160 x 4 x 2) = ~115MB
Open the registry (regedit) and navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vd3d
Increase the value of “MaxVideoMemoryBytes” REG_DWORD value to the above calculated memory.
Reboot the VDA

From Citrix Discussions: To exclude applications from Citrix 3D rendering, create a REG_DWORD registry value “app.exe” with value 0 or a registry value “*” with value 0.

XD 7.1 and XD 7.5:
- x86: reg add hklm\software\citrix\vd3d\compatibility /v * /t REG_DWORD /f /d 0
- x64: reg add hklm\software\Wow6432Node\citrix\vd3d\compatibility /v * /t REG_DWORD /f /d 0
XD 7.6/7.7 both x86 and x64:
- reg add hklm\software\citrix\vd3d\compatibility /v * /t REG_DWORD /f /d 0

Wildcards are not supported. The asterisk * here has a special meaning “all apps” but is not a traditional wildcard. To blacklist multiple apps e.g. both appa.exe and appb.exe must be done by creating a registry value for each app individually.

This is most problematic in Remote PC since most physical PCs have GPUs. I recently had to blacklist Internet Explorer to prevent lockup issues when switching back to physical.

Uninstall VDA

Uninstall the VDA from Programs and Features.

Then see CTX209255 VDA Cleanup Utility.

Delivery Controller 7.7

Last Modified: Nov 7, 2020 @ 6:35 am

27 Comments

Navigation

Preparation
Delivery Controller Install
Studio – Slow Launch
Database Maintenance:
- Change DB connect strings, read-committed snapshot, Director grooming, etc.
Studio Administrators
vCenter Connection
Citrix Director
Citrix Licensing Server
Remote Desktop Licensing Server
- Install Remote Desktop Licensing Server
- Active Remote Desktop Licensing Server
Health Check

Preparation

Citrix Licensing – If you are going to use an existing Citrix Licensing Server, upgrade it to 11.13.1.2 build 16002. This is newer than what’s on the XenApp/XenDesktop 7.7 ISO.

SQL Databases

Citrix blog post Database Sizing Tool for XenDesktop 7 and Bugfix for Database Sizing Tool
Citrix article CTX114501 – Supported Databases for Citrix Products
There are typically three databases: one for the Site (aka farm), one for Logging (audit log) and one for Monitoring (Director).
- The monitoring database name must not have any spaces in it. See CTX200325 Database Naming Limitation when Citrix Director Accesses Monitoring Data Using OData APIs
- If you want Citrix Studio to create the SQL databases automatically, then the person running Studio must be a sysadmin on the SQL instances. No lesser role will work.
- As an alternative, you can use Citrix Studio to create SQL scripts and then run those scripts on the SQL server. In that case you only need the dbcreator and securityadmin roles.
- It is possible to create the databases in advance. However, you must use the non-default Latin1_General_100_CI_AS_KS collation. Then use Citrix Studio to configure the database tables.
Citrix recommends SQL Mirroring because it has the fastest failover.
- SQL Mirroring requires two SQL Standard Edition servers and one SQL Express for the witness server.
- You can setup SQL Mirroring either before installing XenDesktop or after installing XenDesktop. If after, then see Citrix CTX140319 to manually change XenDesktop’s database connection strings How to Migrate XenDesktop Database to New SQL Server.
- To setup SQL Mirroring, see Rob Cartwright: Configure SQL Mirroring For Use With XenDesktop, XenApp, and PVS Databases.
- If you try to stretch the mirror across datacenters, the SQL witness must be placed in a third datacenter that has connectivity to the other two datacenters. However, stretching a single XenApp/XenDesktop site/farm and corresponding SQL mirror across datacenters is not recommended.
AlwaysOn Availability Groups and SQL Clustering are also supported. However, these features require the much more expensive SQL Enterprise Edition.

Windows Features

Installing Group Policy Management on the Delivery Controller lets you edit GPOs and have access to the Citrix Policies node in the GPO Editor. Or you can install Studio on a different machine that has GPMC installed.
vSphere Web Client – if you will connect to vSphere Web Client from the Controller machine, Flash Player is only available for IE if you install the Desktop Experience feature. Or you can use Google Chrome.

vSphere

Create a role in vSphere Client. Assign a service account to the role at the Datacenter or higher level.
If the vCenter certificates are not trusted, import the vCenter server certificate into the Trusted People store of the Delivery Controller.

Delivery Controller Install

A typical size for the Controller VMs is 2-4 vCPU and 8 GB of RAM.
On two Delivery Controllers, install the Delivery Controller software from the XenApp/XenDesktop 7.7 media. Download it from XenApp Enterprise, XenApp Platinum, XenDesktop Enterprise, or XenDesktop Platinum, depending on your license. Go to the downloaded XenDesktop 7.7 ISO and run AutoSelect.exe.
Click Start next to either XenApp or XenDesktop. The only difference is the product name displayed in the installation wizard.
On the left, click Delivery Controller.
You can install all components on one server or on separate servers. Splitting them out is only necessary in large environments or if you want to share the components (e.g. Licensing, StoreFront, Director) across multiple farms.
In the Features page, uncheck the box next to Install Microsoft SQL Server 2012 SP1 Express and click Next.
In the Summary page, click Install.
In the Installation Successful page, click Finish. Studio will automatically launch.
Ensure the two Controller VMs do not run on the same hypervisor host. Create an anti-affinity rule.

Citrix Studio 7.7 Hotfix 1

Without this fix, you can’t enter quotes in the command line arguments field of published apps.

Go to the downloaded Citrix Studio 7.7 Hotfix 1 (DStudio770WX64001) and run DesktopStudio_x64.msi.
In the Please read the Citrix Studio License Agreement page, check the box next to I accept the terms and click Install.
In the Completed the Citrix Studio Setup Wizard page, click Finish.
Programs and Features shows the updated version.

Create Site

There are several methods of creating the databases for XenApp/XenDesktop:

If you have sysadmin permissions to SQL, let Citrix Studio create the databases automatically.
If you don’t have sysadmin permissions to SQL then use Citrix Studio to generate SQL scripts and send them to a DBA.

Database Mirroring

If you are not using database mirroring then skip to the next section.

You can setup SQL Mirroring either before configuring XenDesktop or after configuring XenDesktop.

If before, then the empty databases (Site, Logging, Monitoring) must use the Latin1_General_100_CI_AS_KS collation, which is not the default.
If SQL Mirroring is already setup then XenDesktop will detect it and set the database connection strings accordingly. Or you can manually change the database connection strings later as detailed at Citrix CTX140319 How to Migrate XenDesktop Database to New SQL Server.
If you use Citrix Studio to create SQL scripts that populate the databases, then there will be separate SQL scripts for the Primary and Partner.

Use Studio to Create Database Scripts

Launch Citrix Studio. After it loads, click Deliver applications and desktops to your users.
In the Introduction page, select An empty, unconfigured site. This reduces the number of pages in this Setup wizard. The other pages will be configured later.
Enter a Site Name (aka farm name) and click Next. Only administrators see the farm name.
In the Databases page, change the selection to Generate scripts to manually set up databases on the database server.
Change the database names if desired.
If you are building two Controllers, click Select near the bottom of the same page.
Click Add.
Enter the FQDN of the second Controller and click OK. Note: the Delivery Controller software must already be installed on that machine.
Then click Save.
If you hover your mouse over 2 selected, it will show both Controllers. Click Next.
In the Summary page, click Generate scripts.
A folder will open with six scripts. Edit each of the scripts.
Near the top of each script are two lines to create the database. Uncomment both lines (including the go line). Then save and close the file.
Once all of the scripts are edited you can send them to your DBA.
On the Principal SQL Server, open the file Site_Principal.sql.
Open the Query menu and click SQLCMD Mode.
Then execute the script.
If SQLCMD mode was enabled properly then the output should look something like this:
If you have a mirrored database, run the second script on the mirror SQL instance. Make sure SQLCMD mode is enabled.
Repeat for the Logging_Pricipal.sql script.
You’ll have to enable SQLCMD Mode for each script you open.
Repeat for the Monitoring_Principal.sql script.
Once again enable SQLCMD Mode.
The person running Citrix Studio must be added to the SQL Server as a SQL Login and granted the public server role.
Back in Citrix Studio, click the Continue database configuration and Site setup button.
In the Database page, enter the SQL server name and instance name and click Next.
On the Licensing page, enter the name of the Citrix License Server and click Connect.
XenApp/XenDesktop 7.7 requires the newest Licensing Server. If your server isn’t compatible, leave it set to localhost and fix it later.
If the Certificate Authentication appears, select Connect me and click Confirm.
Then select your license and click Next.
In the Summary page, make your selection for Customer Experience Improvement Program and click Finish.
It will take some time for the site to be created.

Verify Database Mirroring

If your database is mirrored, when you run get-brokerdbconnection, you’ll see the Failover Partner in the database connection string.

Second Controller

There are several methods of adding a second Controller to the databases for XenApp/XenDesktop:

If you have sysadmin permissions to SQL, let Citrix Studio modify the databases automatically.
If you don’t have sysadmin permissions to SQL then do use Citrix Studio to generate SQL scripts and send them to a DBA.

To use Citrix Studio to create the SQL Scripts:

On the 1^st Delivery Controller, if StoreFront is installed, delete the default StoreFront store (/Citrix/Store) and recreate it with your desired Store name (e.g. /Citrix/CompanyStore).
On the 2^nd Delivery Controller, install XenDesktop as detailed earlier.
After running Studio, click Connect this Delivery Controller to an existing Site.
Enter the name of the first Delivery Controller and click OK.
If you don’t have elevated SQL permissions, click No when asked if you want to update the database automatically.
Click Generate scripts.
A folder will open with six scripts. If not mirroring, then the top three scripts need to be sent to a DBA. If mirroring, send all six.
On the SQL Server, open open one of the .sql files.
Open the Query menu and click SQLCMD Mode.
Then execute the XenDesktop script.
If SQLCMD mode was enabled properly then the output should look something like this:
Back in Citrix Studio, click OK.
In the Studio, under Configuration > Controllers, you should see both controllers.
You can also test the site again if desired.

Studio – Slow Launch

From B.J.M. Groenhout at Citrix Discussions: The following adjustments can be made if Desktop Studio (and other Citrix management Consoles) will start slowly:

Within Internet Explorer, go to Tools – Internet Options – Tab Advanced – Section Security and uncheck the option Check for publisher’s certificate revocation

After adjustment Desktop Studio (MMC) will be started immediately. Without adjustment it may take some time before Desktop Studio (MMC) is started.

Registry setting (can be deployed using Group Policy Preferences):

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
- “State“=dword:00023e00

Database Maintenance

View Logging Database

To view the contents of the Logging Database, in Studio, click the Logging node. On the right is Create Custom Report. See Citrix article CTX138132 Viewing Configuration Logging Data Not Shown for more info.

Enable Read-Committed Snapshot

The XenDesktop Database can become heavily utilized under load in a large environment. Therefore Citrix recommends enabling the Read_Committed_Snapshot option on the XenDesktop databases to remove contention on the database from read queries. This can improve the interactivity of Studio and Director. It should be noted that this option may increase the load on the tempdb files. See Citrix article CTX137161 How to Enable Read-Committed Snapshot in XenDesktop for configuration instructions.

Change Database Connection Strings

Sometimes the database connection strings need to be modified:

When moving the SQL databases to a different SQL server
When enabling mirroring after the databases have already been configured in Studio.

Director Grooming

If XenDesktop is not Platinum Edition then all historical Director data is groomed at 7 days.

For XenDesktop/XenApp Platinum Edition, by default, most of the historical Director data is groomed at 90 days. This can be adjusted up to 367 days by running a PowerShell applet.

On a Delivery Controller, run PowerShell and run asnp Citrix.*
Run Get-MonitorConfiguration to see the current grooming settings.
Run Set-MonitorConfiguration to change the grooming settings.

Studio Administrators

Full Administrators

In the Studio, under Configuration, click the Administrators node. The first time you access the node you’ll see a Welcome page. Feel free to check the box and then click Close.
On the Administrators tab, right-click and click Create Administrator.
In the Administrator and Scope page, specify a group (e.g. Citrix Admins or Help Desk) that will have permissions to Studio and Director. Click Next.
On the Role page, select a role and then click Next. For example:
- Full Administrator for the Citrix Admins group
- Help Desk Administrator for the Help Desk group
- Machine Catalog Administrator for the desktop team
In the Summary page, click Finish.

Help Desk

In the Studio, under Configuration, click the Administrators node. On the Administrators tab, right-click and click Create Administrator.
In the Administrator and Scope page, specify a Help Desk group that will have permissions to Studio and Director. Click Next.
On the Role page, select the Help Desk Administrator role and then click Next.
In the Summary page, click Finish.
When administrators in the Help Desk role log into Director, all they see is this.

To jazz it up a little, add the Help Desk group to the read-only role.
Right-click the Help Desk Administrator and click Edit Administrator.
Click Add.
In the Scope page, select a scope and click Next.
In the Role page, select Read Only Administrator and click Next.
In the Summary page, click Finish.
Then click OK. Now Director will display the dashboard.

Provisioning Services w/Personal vDisk

From Citrix docs.citrix.com: The Provisioning Services Soap Service account must be added to the Administrator node of Studio and must have the Machine Administrator or higher role. This ensures that the PvD desktops are put into the Preparing state when the Provisioning Services (PVS) vDisk is promoted to production.

vCenter Connection

Import vCenter Certificate

If you replaced the certificates on your vCenter server, then skip this section.

If vCenter is using a self-signed certificate, in order for Delivery Controller to trust the vCenter certificate, you must import the vCenter certificate on both Delivery Controllers.

Open a browser and connect to your vCenter Server.
Click the padlock and then view the certificate.
On the Details tab, click Copy to File.
Save the certificate in any format.
On each Delivery Controller, run mmc.exe. Open the File menu and click Add/Remove Snap-in. If your server is Windows Server 2012 R2 or newer, you can skip a few steps by running certlm.msc.
Move the Certificates snap-in to the right by highlighting it and clicking Add.
Select Computer account and click Next.
Select Local computer and click Finish.
Click OK.
After adding the snap-in, right-click the Trusted People node, expand All Tasks and click Import.
In the Welcome to the Certificate Import Wizard page, click Next.
In the File to Import page, browse to the certificate file you exported earlier. Click Next.
In the Certificate Store page, click Next.
In the Completing the Certificate Import Wizard page, click Finish.
Click OK to acknowledge that the import was successful.
Repeat these steps on the second Controller. It is important that you do both Controllers before adding the vCenter connection.

Hosting Resources

A Hosting Resource = vCenter + Cluster (Resource Pool) + Storage + Network. When you create a machine catalog, you select a previously defined Hosting Resource and the Cluster, Storage, and Network defined in the Hosting Resource object are automatically selected. If you need some desktops on a different Cluster+Storage+Network then you’ll need to define more Hosting Resources in Studio.

In Studio, expand Configuration and click Hosting. Right-click it and click Add Connection and Resources.
In the Connection page, select VMware vSphere as the Host type.
Enter https://vcenter01.corp.local/sdk as the vCenter URL. The URL must contain the FQDN of the vCenter server. If the vCenter certificate is self-signed, ensure it is added to the Trusted People certificate store on all Delivery Controllers. Ensure the entered URL has /sdk on the end.
Enter credentials of a service account. Click Next.
Enter a name for the hosting resource. Since each hosting resource is a combination of vCenter, Cluster, Network, and Datastore, include those names in this field (e.g. vCenter01-Cluster01-Network01-Datastore01).
In the Cluster page, click Browse and select a cluster or resource pool.
Select a network and click Next.
On the Storage page, select a datastore for the virtual machines. Maximum flexibility is achievable if you only select one datastore per hosting resource. Create additional hosting resources for each datastore.
If desired, change the selection for personal vDisk to use a different storage. Click Next.
In the Summary page, click Finish.

Citrix Director

Director on Standalone Server

If you are installing Director 7.7 on a standalone server, see Citrix CTX142260 Installing or Upgrading to Citrix Director 7.6.200

If you intend to install Director on a standalone server, start with running AutoSelect.exe from the XenApp/XenDesktop 7.7 media.
On the right, click Citrix Director.
It will ask you for the location of one Controller in the farm. Then finish the installation wizard.
In IIS Manager, go to Default Web Site > Director > Application Settings, find Service.AutoDiscoveryAddresses and make sure it points to a Controller and not to localhost.
If you built multiple Director servers, then use NetScaler to load balance them.

Director Single Sign-on

You can configure Director 7.7 to support Integrated Windows Authentication (Single Sign-on). Note: there seem to be issues when not connecting from the local machine or when connecting through a load balancer.

Run IIS Manager. You can launch it from Server Manager (Tools menu) or from the Start Menu or by running inetmgr.
On the left, expand Sites, expand Default Web Site, and click Director.
In the middle, double-click Authentication in the IIS section.
Right-click Windows Authentication and Enable it.
Right-click Anonymous Authentication and Disable it.
Pass-through auth won’t work from another computer until you set the http SPN for the Director server. See Director 7.7 Windows Authentication not working with NS LB at discussions.citrix.com.
If Director is not installed on a Controller then you’ll need to configure Kerberos delegation.
If you are load balancing Director then additional config is required. See Director 7.7 Windows Authentication not working with NS LB at discussions.citrix.com for more info.
1. Create an AD service account that will be used as the Director’s ApplicationPoolIdentity.
2. Create SPN and link it to the service account.
```
setspn -S http/loadbalanced_URL domain\user
```
3. Trust the user account for delegation to any service (Kerberos only) (trust the Director servers for delegation is not necessary in this case). You have to create the SPN before you can do this step.
4. In IIS manager, on the Application Pools (Director), specify the Identity as user we have created in step 1.
5. In IIS manager, select Default Web Site and open the Configuration Editor.
6. Use the drop-down to navigate to the following section:
```
system.webServer/security/authentication/windowsAuthentication
```
7. Set useAppPoolCredentials = True and useKernelMode = False. Click Apply on the top right.
When you connect to Director you will be automatically logged in. You can change the login account by first logging off.
Then change the drop-down to User credentials.

Director – Multiple XenDesktop Sites

Run IIS Manager. You can launch it from Server Manager (Tools menu) or from the Start Menu or by running inetmgr.
On the left, expand Sites, expand Default Web Site, and click Director.
In the middle pane, double-click Application Settings.
Find the entry for Service.AutoDiscoveryAddresses and double-click it.
If Director is installed on a Controller, localhost should already be entered.
Add a comma and the NetBIOS name of one of the controllers in the 2^nd XenDesktop Site (farm). Only enter one Controller name. If you have multiple Director servers, you can point each Director server to a different Controller in the 2^nd XenDesktop Site (farm).
According to Citrix CTX200543 Desktop Director Access Fails After XenDesktop 7.5 is Upgraded to 7.6, the addresses should be NetBIOS names, not FQDN. Click OK.

Director Alerts and Notifications

Director 7.7 supports alert conditions and email notifications. This feature requires XenApp/XenDesktop to be licensed with Platinum Edition. See Citrix Blog Post Configuring & Managing Alerts and Notifications Using Director for more information.

While logged into Director, at the top of the page click the Alerts button.
Switch to the Email Server Configuration tab.
Enter your SMTP information and click Send Test Message. Then click Save.
Switch to the Citrix Alerts Policy tab.
There are three high-level categories of alerts: Site Policy, Delivery Group Policy, and Server OS Policy. Click whichever one you want to configure.
Then click Create.
Give the alert a name.
On the bottom left, select a condition and enter thresholds.
On the bottom right, in the Notifications preferences section, click Add.
Enter an email address and click Add.
Click Save when done. Feel free to create more alerts and notifications.
Citrix has an experimental Desktop Notification Tool. See Citrix Blog Post Desktop Notification Tool For Citrix XenDesktop. 💡

Director – SCOM Integration

Director 7.7 can display alerts from System Center Operations Manager 2012 R2. This feature requires XenApp/XenDesktop Platinum Edition.

See Configure SCOM integration at docs.citrix.com for detailed configuration instructions. Also see Marius Sandbu Integrating Citrix XenDesktop 7.7 and System Center Operations Manager.
If Director server or System Center Operations Manager server is 2008 R2, then login to the 2008 R2 server, open PowerShell and run Enable-PSRemoting. Yes to everything. This is not needed on Windows Server 2012 R2 servers.
On Director 7.7 server, run C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /configscom
FYI, the DirectorConfig.exe /configscom command enables the following features on the Director server: /FeatureName:IIS-NetFxExtensibility45 /FeatureName:IIS-ASPNET45 /FeatureName:WCF-HTTP-Activation45
FYI, the System Center Operations Manager server is listed in IIS Manager at Default Web Site > Director > Application Settings (middle pane) > Connector.SCOM.ManagementServer.
On the System Center Operations Manager server, edit Remote Management Users local group and add Citrix Admins and other Director users.
In System Center Operations Manager Console, go to Administration > User Roles and edit Operations Manager Operators. Add the Citrix Admins and other Director users.
See Citrix Blog Post SCOM Alerts in Citrix Director for information on how to view System Center Operations Manager alerts in Director.

Director Tweaks

Prepopulate the domain field

From http://www.xenblog.dk/?p=33: On the Controllers having the Director role installed, locate and edit the ‘LogOn.aspx’ file. By default you can find it at “C:\inetpub\wwwroot\Director\Logon.aspx”

In line 450 you will have the following. To find the line, search for ID=”Domain”. Note: onblur and onfocus attributes were added in newer versions of Director.

<asp:TextBox ID="Domain" runat="server" CssClass="text-box" onfocus="showIndicator(this);" onblur="hideIndicator(this);"></asp:TextBox>

In the ID=”Domain” element, insert a Text attribute and set it to your domain name. Don’t change or add any other attributes. Save the file.

<asp:TextBox ID="Domain" runat="server" Text="Corp" CssClass="text-box" onfocus="showIndicator(this);" onblur="hideIndicator(this);"></asp:TextBox>

This will prepopulate the domain field text box with your domain name and still allow the user to change it, if that should be required. Note: this only seems to work if Single Sign-on is disabled.

Session timeout

By default the idle time session limit of the Director is 245 min. If you wish to change the timeout, here is how to do it.

Log on to the Director Server as an administrator
Open the ‘IIS Manager’
Browse to ‘SitesDefault Web SiteDirector’ in the left hand pane.
Open ‘Session State’ in the right hand pane
Change the ‘Time-out (in minutes)’ value under ‘Cookie Settings’
Click ‘Apply’ in the Actions list

SSL Check

From http://euc.consulting/blog/citrix-desktop-director-2-1: If you are not securing Director with an SSL certificate you will get this error at the logon screen.

To stop this:

Log on to the Director Server as an administrator
Open the ‘IIS Manager’
Browse to ‘SitesDefault Web SiteDirector’ in the left hand pane.
Open ‘Application Settings’ in the right hand pane
Set EnableSslCheck to false.

Disable Activity Manager

From docs.citrix.com: By default, the Activity Manager in Director displays a list of all the running applications and the Windows description in the title bars of any open applications for the user’s session. This information can be viewed by all administrators that have access to the Activity Manager feature in Director. For Delegated Administrator roles, this includes Full administrator, Delivery Group administrator, and Help Desk Administrator.

To protect the privacy of users and the applications they are running, you can disable the Applications tab from listing running applications.

On the VDA, modify the registry key located at HKLM\Software\Citrix\Director\TaskManagerDataDisplayed. By default, the key is set to 1. Change the value to 0, which means the information will not be displayed in the Activity Manager.
On the server with Director installed, modify the setting that controls the visibility of running applications. By default, the value is true, which allows visibility of running applications in the Applications Change the value to false, which disables visibility. This option affects only the Activity Manager in Director, not the VDA. Modify the value of the following setting:
UI.TaskManager.EnableApplications = false

Large Active Directory

From CTX133013 Desktop Director User Account Search Process is Slow or Fails: By default, all the Global Catalogs for the Active Directory Forest are searched using Lightweight Directory Access Protocol (LDAP). In a large Active Directory environment, this query can take some time or even time out.

In Information Server (IIS) Management, under the Desktop Director site, select Application Settings and add a new value called ActiveDirectory.ForestSearch. Set it to False. This disables searching any domain except the user’s domain and the server’s domain.
To search more domains, add the searchable domain or domains in the ActiveDirectory.Domains field.

Site Groups

From Citrix Blog Post Citrix Director 7.6 Deep-Dive Part 4: Troubleshooting Machines:

If there are a large number of machines, the Director administrator can now configure site groups to perform machine search so that they can narrow down searching for the machine inside a site group. The site groups can be created on the Director server by running the configuration tool via command line by running the command:

C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /createsitegroups

Then provide a site group name and IP address of the delivery controller of the site to create the site group.

Director – Saved Filters

From Scott Osborne and Jarian Gibson at Citrix Discussions: In Director, you can create a filter and save it.

The saved filter is then accessible from the Filters menu structure.

The saved filters are stored on each Director server at C:\Inetpub\wwwroot\Director\UserData. Observations:

Each user has their own saved filters.
The saved filters are not replicated across Director servers. You can schedule a robocopy script to do this automatically.
When upgrading Director, the saved filters are deleted?

Director – Custom and Scheduled Reports

The Monitoring database contains more data than is exposed in Director. To view this data, the Monitoring service has an OData Data Feed that can be queried.

You can use Excel to pull data from the OData Data feed. See Citrix Blog Post – Citrix Director – Analyzing the Monitoring Data by Means of Custom Reports. This particular blog post shows how to use an Excel PivotChart to display the connected Receiver versions.

Or for Linqpad, see Citrix Blog Post – Creating Director Custom reports for Monitoring XenDesktop using Linqpad

Go to Citrix Blog Post Obtain XenDesktop Custom report through Citrix Director and download the tool. Once installed you can create custom reports from within Director.

Citrix Licensing Server

Upgrade

Upgrade Citrix Licensing to 11.13.1.2. This is newer than what’s on the XenApp/XenDesktop 7.7 ISO. 💡

Go to the downloaded Citrix Licensing 11.13.1.2 build 16002 and run CitrixLicensing.exe.
Click Upgrade.
Click Finish.
If you go to Programs and Features, it should now show version 11.1.0.16002.
If you login to the license server web console, on the Administration tab, it shows it as version 11.13.1 build 16002.
You can also view the version in the registry at HKLM\Software\Wow6432Node\Citrix\LicenseServer\Install.

Licensing Server HA using GSLB

Build two License Servers in each datacenter with identical server names. Since server names are identical, they can’t be domain-joined.
Install identical licenses on all License Servers.
Set the DisableStrictNameChecking registry key on all Citrix Licensing servers.
Synchronize the certificate files located at C:\Program Files (x86)\Citrix\Licensing\WebServicesForLicensing\Apache\conf. They must be identical on all Licensing Servers.
Download CtxLicChk.exe from http://support.citrix.com/article/CTX123935 and place on all Licensing Servers.
Schedule the PowerShell script CtxLicChk.ps1 on all Licensing Servers. Get this script from the blog post linked above.
Configure NetScaler:
1. Configure GSLB ADNS services.
2. Add wildcard Load Balancing service for each Citrix Licensing Server.
3. Configure service TCP monitoring for ports 27000, 7279, 8082, and 8083.
4. Create Load Balancing Virtual Server for each Licensing Server.
5. Set one Load Balancing Virtual Server as backup for the other.
6. Repeat in second datacenter.
7. Configure GSLB Services and GSLB Monitoring.
8. Configure GSLB Virtual Servers. Set one GSLB Virtual Server as backup for the other.
Delegate the Citrix Licensing DNS name to the ADNS services on the NetScaler appliances.
Configure Citrix Studio to point to the GSLB-enabled DNS name for Citrix Licensing.

Citrix License Server Monitoring

Citrix Licensing 11.13.1 and newer has historical usage reporting: 💡

Run Citrix Licensing Manager from the Start Menu. Or use a browser to connect to https://MyLicenseServer:8083
Use the drop-down menus to select a license type, select dates, and export to a .csv file.
On the top right is a gear icon where you can set the historical retention period.

http://www.jonathanmedd.net/2011/01/monitor-citrix-license-usage-with-powershell.html.

Lal Mohan – Citrix License Usage Monitoring Using Powershell

Jaroslaw Sobel – Monitoring Citrix Licenses usage – Graphs using WMI, Powershell and RRDtool. This script generates a graph similar to the following:

CtxLicUsage-1d_

Remote Desktop Licensing Server

Install Remote Desktop Licensing Server

Do the following on your XenDesktop Controllers:

In Server Manager, open the Manage menu and click Add Roles and Features.
Click Next until you get to the Server Roles page. Check the box next to Remote Desktop Services and click Next.
Click Next until you get to the Role Services page. Check the box next to Remote Desktop Licensing and click Next.
Click Add Features if prompted.
Then finish the wizard to install the role service.

Activate Remote Desktop Licensing

After RD Licensing is installed, in Server Manager, open the Tool menu, expand Terminal Services and click Remote Desktop Licensing Manager.
The tool should find the local server. If it does not, right-click All servers, click Connect and type in the name of the local server. Once the local server can be seen in the list, right-click the server and click Activate Server.
In the Welcome to the Activate Server Wizard page, click Next.
In the Connection Method page, click Next.
In the Company Information page, enter the required information and click Next.
All of the fields on the Company Information page are optional so you do not have to enter anything. Click Next.
In the Completing the Activate Server Wizard page, uncheck the box next to Start Install Licenses Wizard now and click Finish. Since the session hosts will be configured to pull Per User licenses, there is no need to install licenses on the RD Licensing Server.
In RD Licensing Manager, right-click the server and click Review Configuration.
Ensure you have green check marks. If the person installing Remote Desktop Licensing does not have permissions to add the server to the Terminal Server License Servers group in Active Directory, ask a domain admin to do it manually. If you have the proper permissions, click Add to Group.
Click Continue when prompted that you must have Domain Admins privileges.
Click OK when prompted that the computer account has been added.
Click OK to close the window.

Health Check

Citrix Licensing.
Database Connections.
Broker Service.
Core Services.
Hypervisor Connections.

Configure RDSH VDAs to use Remote Desktop Licensing Server

VMware vRealize Operations for Horizon 6.4

Last Modified: Nov 7, 2020 @ 6:34 am

13 Comments

Navigation

This post is for 6.4 and older. See vRealize Operations for Horizon 6.5 and newer.

Planning
Download Files
Deploy vROps Appliance
Configure vSphere Adapter
Install Horizon Adapter 6.4 PAK File
Install Horizon Broker Agent 6.4
- Configure Horizon Broker Agent
Desktop Agent 6.4

💡 = Recently Updated

Planning

What’s New: VMware vRealize Operations 6.5:

Log Insight integration
vRealize Business for Cloud integration
Automatic upgrade of in-guest End Point Operations agents
Higher scalability
Webhooks for connections with other platforms (e.g. Slack)

VMware Blog Post VMware vRealize Operations for Horizon and Published Applications 6.4, Part 1: What’s New: In this release, you will find the following features:

App Volumes – Monitors AppStack attach time during the user login process.
Application usage – Reports who used which applications and when, for RDSH applications and desktops, and also for virtual desktops.
Application CPU and Memory Usage Reporting – configure the Horizon Adapter in vROps to watch specific processes.
Application-crash alerts – Notifies administrators of application crashes.
Root-cause analysis dashboard – Quickly pinpoints what is causing user issues.
Cloud Pod Architecture – Quickly identifies the pod that is hosting a user or session, and the pod host.
Access Point – Alerts administrators about Access Point capacity.

vROps Webinar Series 2016 – Part 12 – What’s New with vROps 6.4 – 1 hour, 13 minute YouTube video.

vRealize Operations 6.3: What’s New, Hint it just got even better at VMware Blogs contains screenshots of the new features in vROps 6.3.

VMware 2146615 vRealize Operations Manager 6.3 Sizing Guidelines:

Download Files

Download vRealize Operations Manager 6.4 appliance, which is listed on vROps for Horizon download page. Or download vRealize Operations Manager 6.5 appliance. VMware’s Product Interoperability Matrix indicates that both versions are compatible.
Go to the download page for vRealize Operations for Horizon 6.4.
Download the vRealize Operations for Horizon Adapter.
Download the vRealize Operations for Horizon Broker Agent 64-Bit.
Download the vRealize Operations for Horizon Desktop Agent.

Deploy Appliance

In vSphere Web Client, navigate to the vCenter object, right-click it, and click Deploy OVF Template.
In the Select Source page, select Local file, browse to the vRealize Operations 6.4 .ova file, or vRealize Operations 6.5 .ova file, and click Next.
In the Review details page, click Next.
If you see a Accept EULAs page, click Accept, and then click Next.
In the Select name and folder page, enter a name for the appliance, select a folder, and click Next.
If you see a Deployment Configuration page, select a size, and then click Next.
In the Select a resource page, select a cluster, and then click Next.
In the Storage page, select Thin Provision, select a datastore, and then click Next.
In the Setup networks page, select a port group and click Next.
In the Customize template page, select a time zone.
Expand Networking Properties.
Enter the IP address information for the appliance. You can also specify the time zone. Then click Next.
In the Ready to Complete page, check the box next to Power on after deployment, and then click Finish.

Create Cluster

Power on the new virtual appliance.
Wait for the appliance to start.
Use a browser to go to https://IPAddress/admin. If you see a Service unavailable message, wait a couple minutes and try again.
You might also see this message. Try again.
On the bottom of the page, click New Installation.
In the Getting Started page, click Next.
In the Set Administrator Password page, enter a password based on the listed requirements. Click Next.
In the Choose Certificate page, you can upload a PEM certificate.

The Certificate file must have .pem extension. It will not accept any other extension. Also, make sure the certificate file has both the certificate and keyfile. If there are intermediate Certificate Authorities, add them to the PEM file. Click Next when done.
In the Deployment Settings page, enter a name for the master node.
Enter a NTP Server Address and click Add. Then click Next.
In the Ready to Complete page, click Finish.

Start Cluster

From the https://IPAddress/admin page, click Start vRealize Operations Manager.
Click Yes. This will take several minutes.
Log into the appliance.
On the Welcome page, click Next.
In the Accept EULA page, check the box next to I accept the terms, and click Next.
In the Enter Product License Key page, enter the vRealize Operations license key, click Validate License Key, and click Next. Note: there is a separate license for vROps for Horizon that will be entered later.
In the Customer Experience Improvement Program page, make a choice, and click Next.
In the Ready to Complete page, click Finish.

Patch/Upgrade Appliance

Download the Upgrade Pack or Hot Patch from the vRealize Operations 6.4 download page or vRealize Operations 6.5 download page.
Use a browser to go to https://vROpsIP/admin and login as admin.
On the left, switch to the Software Update page.
On the right, click Install a Software Update.
Click Browse and browse to an upgrade or Hot Patch .pak file downloaded from vmware.com. You must upgrade the operating system first (.pak file name containing VA-OS), and then upgrade vRealize Operations Manager (file name without OS in it).
Click Upload.
Click Next.
In the End User License Agreement page, check the box next to I accept the terms and click Next.
Installation begins.
After rebooting and logging in again, the Software Update page shows that the update has been completed.
After upgrading both the OS and vROps, the System Status page should show version 6.4.0.4276418.

Configure vSphere Adapter

Login to the appliance.
Go to Administration > Solutions.
Highlight the VMware vSphere Solution, and click the Configure button in the toolbar.
In the Configure adapters page, highlight the vCenter Adapter.
On the bottom, enter a name for the vCenter adapter.
Enter the address of the vCenter server.
Click the plus icon to add a Credential.
Enter credentials for the vCenter server, and click OK.
Click Test Connection.
Click OK to accept the certificate.
Click OK to acknowledge that the test was successful.
Click Save Settings when done.
Click OK to acknowledge that adapter instance was successfully saved.
Click Close.
Note: it takes four weeks for vRealize Operations to determine dynamic thresholds.
Additional adapters can be downloaded from VMware Solution Exchange – https://solutionexchange.vmware.com/store

vSphere SSON

In the vRealize Operations console, go to Administration > Authentication Sources.
On the right, click the green plus icon.
Enter a display name.
From the Source Type drop-down select SSO SAML.
Enter the FQDN of the Platform Services Controller.
Enter credentials of an account that is in the Single Sign-on Admins group.
Select Grant administrator role to vRealize Operations Manager for future configuration.
Click Test.
Check the box to Accept this Certificate, and click OK.
Click OK to acknowledge that the test was successful.
Click OK.
The Import User Groups wizard launches automatically. In the Import User Groups page, enter a group name, click Search, and then select the group. Click Next.
On the Roles and Objects page, from the Select Role drop-down select Administrator.
Check the box next to Assign this role to the group.
Check the box next to Allow access to all objects in the system. Click Finish.
You can now login using a vCenter Single Sign-on account.

Session Timeout

The vRealize Operations webpage defaults to 30 minutes timeout. To change it, go to Administration > Global Settings and click the pencil icon.
The maximum value for Session Timeout is 34560. Click OK.

Alerting

In vRealize Operations console, go to Administration > Outbound Settings.
On the right, click the green plus icon.
From the Plugin Type drop-down select Standard Email Plugin.
Give the Instance a name.
Enter the SMTP information and click Test.
Click OK to acknowledge that the test was successful.
Then click Save.
You can then go to Content > Notifications, and create notifications.
Give the rule a name.
For Method, select the Standard Email Plugin and the instance you created earlier.
Enter recipients.
Select Triggers and Criticality. Click Save.

Install Horizon Adapter 6.4 PAK File

Login to the vRealize Operations appliance web page.
Go to Administration > Solutions.
On the right, click the green plus icon.
In the Select Solution page, click Browse.
Browse to VMware-vrops-viewadapter-6.4…pak and select it.
Click Upload.
Click Next.
In the End User License Agreement page, check the box next to I accept the terms, and click Next.
After it’s done installing, in the Install page, click Finish.

Horizon Adapter Licensing

In the vRealize Operations web page, go to Administration > Licensing.
On the right, click the green plus icon.
Select VMware Horizon.
Enter the vROps for Horizon license key and click Validate. Note: this key is different than the vRealize Operations key.
Click Save.

Configure Horizon Adapter

Here are some guidelines regarding the Horizon adapter:

You can only have one Horizon adapter per vRealize Operations appliance.
Each adapter can handle up to 10,000 virtual desktops.
Multiple Horizon pods can point to a single adapter.

Do the following to create and configure a Horizon adapter:

In vRealize Operations Manager, go back to Administration > Solutions.
On the right, highlight the VMware Horizon adapter, and click the Configure icon.
On the top part, highlight the Horizon Adapter.
On the bottom, give the adapter a Display Name and an Adapter ID.
Click the green plus icon to add a credential.
Give the credential a name. Enter a new password (shared key), and click OK. You’ll use this password later.
Click Test Connection.
Click OK to acknowledge that the test was successful.
On the bottom right, click Save Settings.
Click OK.
Then click Close.

Enable SSH

VMware Knowledgebase article – Enabling SSH access in vRealize Operations Manager 6.0.x (2100515):

Connect to the vRealize Operations Manager virtual machine console.
Press Alt+F1, and login as root.
Note: By default there is no root password configured.
Start the SSH service by running the command:
service sshd start
To configure SSH to start automatically run this command:
chkconfig sshd on

Appliance Firewall for Horizon Adapter

Login as root to the CLI of the appliance using SSH, or the virtual machine console.
Use vi to edit the file /opt/vmware/etc/vmware-vcops-firewall.conf.
Look for the TCPPORTS line that adds 3091:3094. Right below that line, add a new line containing TCPPORTS=”$TCPPORTS 3099:3101″. In vi, press i to enter insert mode and then press <Esc> to exit insert mode.
Enter :wq to save the file and exit.
Run /etc/init.d/vmware-vcops-firewall restart.
If you have vRealize Operations for Horizon Desktop Agents that are older than 6.2, then you’ll need to enable TLS 1.0 by editing the properties file. See Create an Instance of the Horizon Adapter at pubs.vmware.com for more information.
If you have more than 1,000 Desktop Agents, see VMware 2096607 Adjusting the ARP cache on a vRealize Operations Manager remote collector node

Install Horizon Broker Agent

Login to one View Connection Server in your pod. Only install the Broker Agent on one View Connection Server in each pod.
Run the downloaded VMware-v4vbrokeragent-x86_64-6.4.0.exe.
In the Welcome to the VMware vRealize Operations for Horizon Broker Agent Setup Wizard page, click Next.
In the End-User License Agreement page, check the box next to I accept the terms and click Next.
In the Ready to install the Broker Agent page, click Install.
In the Completed the VMware vRealize Operations for Horizon Broker Agent Setup Wizard page, click Finish.

Configure Horizon Broker Agent

The Configuration tool will appear immediately after installation. Or launch vRealize Operations View Broker Agent Settings from the Start Menu.
In the Pair Adapter page, enter the IP address of the vRealize Operations appliance, enter 3091 for the port, enter the adapter password, and click Pair.
After broker pairing is successful, click Next. If this doesn’t work, make sure the firewall ports are opened on the vRealize Operations appliance.
In the View Connection Server page, enter credentials for Horizon View, and click Test.
Then click Next.
In the Event DB and Desktop page, enter the SQL credentials to access the Events database, and click Test.
Then click Next.
In the Configure App Volumes Managers to Monitoring page, enter the App Volumes info and click Test. Click the plus icon to move it to the bottom. Then click Next.
In the Monitor Access Point with Broker Agent page, enter a name, enter the Access Point IP, enter 9443 as the port, enter the admin credentials, and click Test.
Click the plus icon to move the Access Point appliance to the bottom. Then click Next.
In the Intervals and Timeouts page, click Next.
In the Configure the Logging parameters page, click Next.
In the Broker Agent Service page, click Start. Then click Next.
In the Review changes page, click Finish.
In the vRealize Operations web console, from the Home page, you can view the Horizon Adapter Self Health dashboard to verify that the adapter and broker agent are functional.

Desktop Agent

The Desktop Agent should be installed on every Horizon Agent machine. Horizon 7 Agents come with vROps Desktop Agents. If you’re not running the latest version of Horizon 7 Agent, then upgrade the vROps Desktop Agent on those machines.

Run the downloaded vRealize Operations for Horizon Desktop Agent 6.4.0 (VMware-v4vdeskopagent-x86_64-6.4.0.exe).
In the Welcome to the VMware vRealize Operations for Horizon Desktop Agent Setup Wizard agent, click Next.
In the End-User License Agreement page, check the box next to I accept the terms in the License Agreement and click Next.
In the Ready to install the Desktop Agent page, click Install.
In the Completed the VMware vRealize Operations for Horizon Desktop Agent Setup Wizard page, click Finish.
If you go to C:\Program Files\VMware\VMware View\Agent\bin and view the properties of the v4pa_agent.exe file, then you’ll see the installed version of the Desktop Agent.

Back to VMware Horizon 7

NetScaler Scripting

Last Modified: Nov 7, 2020 @ 6:34 am

72 Comments

Navigation

Change Log
Script to Extract Configuration
Configure NetScaler from PowerShell
Nitro REST API Documentation

💡 = Recently Updated

Changelog

2019 Mar 11 – Script to Extract Configuration – rewrote the section in instructional format
2018 Dec 2 – Configuration Extractor – added a nFactor visualizer
2018 Nov 17 – Configuration Extractor – Out-GridView (GUI) for vServer selection
2018 Sep 19 – Configuration Extractor – several fixes
2018 July 4 – Configuration Extractor
- Added “*” to select all vServers
- Updated for 12.1 (SSL Log Profile, IP Set, Analytics Profile)
- Extract local LB VIPs from Session Action URLs (e.g. StoreFront URL to local LB VIP)
- Extract DNS vServers from “set vpn parameter” and Session Actions
2018 Jan 4 – Configuration Extractor, Sirius’ Mark Scott added code to browse to open and save files. Added kcdaccounts to extraction.
2018 Jan 3 – new Powershell-based NetScaler Configuration Extractor script

NetScaler ADC Configuration Extractor

NetScaler ADC Configuration Extractor extracts every NetScaler ADC CLI command needed to rebuild one or more Virtual Servers. Here’s how to use the script:

The extraction script loads a NetScaler ADC Configuration file and parses it. To get a NetScaler ADC Configuration file:
1. On your NetScaler ADC, go to System > Diagnostics > Running Configuration and then click the link on bottom to save text to a file.
To download the extraction script, point your browser to https://github.com/cstalhood/Get-ADCVServerConfig/blob/master/Get-ADCVServerConfig.ps1, right-click the Raw button, and Save link as.
Run the extraction script in PowerShell. One option is to right-click the script file and click Run with PowerShell. (note: the script doesn’t seem to work on Windows 7)
Browse for the Running Configuration file that you saved from an appliance.
The script will prompt you to select one or more Virtual Servers.
The script then enumerates all objects linked to the chosen Virtual Servers (e.g. Responder Policies) and provides their configuration too.
The script also outputs global settings that might affect the operation of the chosen Virtual Servers.
The CLI output is listed in proper order. For example, create monitors before binding them to Service Groups.
If the config includes an “authentication vserver”, then a nFactor Visualizer will be shown.
The extracted Virtual Server CLI configuration can be used for documentation
Or you can apply the outputted configuration to a different NetScaler ADC appliance:
1. To import this output to a different NetScaler ADC, first change the IP addresses of the outputted Virtual Servers so there won’t be any IP Conflict after you import.
2. SSH (Putty) to the other NetScaler ADC.
3. Then simply copy the outputted lines and paste them into the SSH prompt.
4. Alternatively, for longer output file, you can upload the output file to the other NetScaler ADC (e.g. upload to /tmp directory), and then run batch -fileName on the new NetScaler ADC while specifying the uploaded filename (e.g. /tmp/nsconfig.conf).
  - Note: the batch command requires that the input file name be in lower case only and without any spaces in the file name.

I originally attempted a dynamic extraction using complicated regular expressions, but there wasn’t enough control over the extraction and output process. The new PowerShell script explicitly enumerates specific objects, thus providing complete control over the output. For example, before binding a cipher group to a Virtual Server, the current ciphers must first be removed.

The script uses several techniques to avoid false positive matches, primarily substring matches.

Let me know what bugs you encounter.

Configure NetScaler ADC from PowerShell

You can use any scripting language that supports REST calls. This section is based on PowerShell 3 and its Invoke-RestMethod cmdlet.

Brandon Olin published a PowerShell module for NetScaler at Github. 💡

CTP Esther Barthel maintains a PowerShell module for NetScaler at https://github.com/cognitionIT/PS-NITRO. See Citrix Synergy TV – SYN325 – Automating NetScaler: talking NITRO with PowerShell for an overview.

The below NetScalerPowerShell.zip contains PowerShell functions that use REST calls to configure a NetScaler appliance. It only takes a few seconds to wipe a NetScaler and configure it with almost everything detailed on this site. A glaring omission is file operations including licenses, certificate files, and customized monitor scripts and the PowerShell script assumes these files are already present on the appliance.

[sdm_download id=”1909″ fancy=”0″]

Most of the functions should work on 10.5 and 11.0 with a few obvious exceptions like RDP Proxy. Here are some other differences between 10.5 and 11.0:

PUT operations in NetScaler 11 do not need an entity name in the URL; however 10.5 does require entity names in every PUT URL.
https URL for REST calls works without issue in NetScaler 11, but NetScaler 10.5 had inconsistent errors. http works without issue in NetScaler 10.5.

Nitro REST API Documentation

NetScaler Nitro REST API documentation can be found on any NetScaler by clicking the Downloads tab. The documentation is updated whenever you upgrade your firmware.

Look for the Nitro API Documentation.

Extract the files, and then launch index.html.

Start by reading the Getting Started Guide, and then expand the Configuration node to see detailed documentation for every REST call.

The Nitro API is also documented at REST Web Services at Citrix Docs.

Windows Server 2008 R2 Post-SP1 Hotfixes

Last Modified: Sep 2, 2018 @ 7:47 am

20 Comments

Convenience Rollup

On May 17, 2016, Microsoft released a Convenience Rollup for Windows 2008 R2 and Windows 7. This Rollup includes almost all fixes released after SP1 through April 2016. See the article for the list of excluded hotfixes.

If you have not yet run Windows Updates, download and install 3020369.
Then install the Convenience Rollup hotfix by running AMD64-all-windows6.1-kb3125574-v4-x64.msu. This hotfix is 476 MB.
Click Yes to install the software update.

Individual Hotfixes

Alternatively, you can install individual hotfixes. These hotfixes are specific to Remote Desktop Session Host, group policies, printing, and SMB redirector and are not included in the normal Windows Update process. To get the hotfix go to the Microsoft KB article’s webpage. There is a link at the top of the page that takes you to a form where you can request the hotfix.

Available Updates for Remote Desktop Services (Terminal Services) on Windows Server 2008 R2 Service Pack 1 – https://support.microsoft.com/kb/2601888.

Citrix CTX129229 Recommended Hotfixes for XenApp 6.x on Windows Server 2008 R2. Scroll down to the Microsoft Hotfixes section.

Here is the list of hotfixes:

http://support.microsoft.com/kb/969744 – Underlines are missing when you print a document
http://support.microsoft.com/kb/981070 – “Windows can’t open Add Printer” error in a 64-bit version of Win7 or of Windows Server 2008 R2
http://support.microsoft.com/kb/981156 – RemoteApp applications are displayed as black windows when you restart the applications in a Remote desktop connection
http://support.microsoft.com/kb/2028827 – The applications that use the TDI driver for network traffic may stop responding
http://support.microsoft.com/kb/2065362 – “Unable to log you on because your profile could not be loaded, please contact your administrator” error when you try to log on to a computer
http://support.microsoft.com/kb/2301288 – A Remote Desktop Services session is disconnected automatically if you apply the “Interactive logon: smart card removal behavior” Group Policy setting
http://support.microsoft.com/kb/2385838 – Item-level targeting object picker dialog box shows only the domain in which the Gpmc.msc is started
http://support.microsoft.com/kb/2386759 – Group Policy preference settings for the settings on the Advanced tab in Internet Explorer 8 do not work as expected
http://support.microsoft.com/kb/2411000 – You cannot read or copy a file that contains an asterisk character in the stream name
http://support.microsoft.com/kb/2411938 – “An external error has occurred” error when you change the user rights of an account in Local Security Policy (needed for StoreFront)
http://support.microsoft.com/kb/2424375 – A remote desktop session may be incorrectly disconnected when a smart card is removed in another remote desktop session
http://support.microsoft.com/kb/2431799 – Stop error 0x0000007E occurs when multiple users establish Remote Desktop Services sessions
http://support.microsoft.com/kb/2444328 – You cannot access shared files or shared printers
http://support.microsoft.com/kb/2444677 – Error message when you try to start Explorer.exe: “Server Execution Failed”
http://support.microsoft.com/kb/2446026 – An application that uses the Remote Desktop Connection ActiveX control to provide virtualized sessions crashes
http://support.microsoft.com/kb/2460922 – Group Policy preference item-level targeting does not work for 64-bit versions of Windows 7
http://support.microsoft.com/kb/2462182 – The “Load a specific theme” Group Policy setting is not applied correctly for a new user
http://support.microsoft.com/kb/2465772 – An application or service that uses Winsock API or Winsock Kernel API may randomly stop responding
http://support.microsoft.com/kb/2465990 – “0x80041002 (WBEM_E_NOT_FOUND)” error occurs when you try to open a WMI namespace
http://support.microsoft.com/kb/2466373 – BACKSPACE or arrow keys do not work in MMC
http://support.microsoft.com/kb/2468345 – Computer intermittently performs poorly or stops responding when the Storport driver
http://support.microsoft.com/kb/2479169 – “Word did not save the document” error message when you try to save a document
http://support.microsoft.com/kb/2479710 – Remote Desktop service crashes when Group Policy settings are refreshed after you enable the “Required secure RPC communication” and “Set client connection encryption level” Group Policy settings
http://support.microsoft.com/kb/2489291 – You cannot start an application to open a file that has an associated file name extension after you specify the file association by using GPP
http://support.microsoft.com/kb/2492536 – Msinfo32.exe takes a long time to display or export system information on a computer that has many MSI-X-supported devices
http://support.microsoft.com/kb/2492765 – User account passwords can be changed in the Sysprep Specialize phase of Sysprep.exe
http://support.microsoft.com/kb/2493006 – Time synchronization is not performed even though the W32Time service is successfully started
http://support.microsoft.com/kb/2495523 – A crash memory dump file is not created, or hibernation does not work, when you use a SCSIport miniport driver as the startup device driver
http://support.microsoft.com/kb/2496744 – A black screen is displayed computer tries to enter hibernation
http://support.microsoft.com/kb/2498549 – A search window opens unexpectedly after you deploy a Group Policy to disable Windows Explorer search elements
http://support.microsoft.com/kb/2510636 – An update that improves the startup performance
http://support.microsoft.com/kb/2511290 – A computer continues to use the original printer driver after you update or replace the printer driver
http://support.microsoft.com/kb/2519550 – An incorrect program icon appears on the task bar in a remote desktop session
http://support.microsoft.com/kb/2521923 – A program that requires you to use a smart card stops responding in a remote desktop connection
http://support.microsoft.com/kb/2522743 – You cannot use a calendar control in a RemoteApp application when you use the RDC 7.0 client to connect to the RemoteApp application
http://support.microsoft.com/kb/2522761 – Windows Explorer stops responding when you extend the full-screen display on a virtual machine to multiple monitors
http://support.microsoft.com/kb/2522762 – RemoteApp application does not work correctly from RD Web Access
http://support.microsoft.com/kb/2524478 – The network location profile changes from “Domain” to “Public”
http://support.microsoft.com/kb/2524668 – The single sign-on feature does not work when you try to start a full remote desktop connection through RD Web Access
http://support.microsoft.com/kb/2525246 – “0x0000003B” Stop error when you remotely control a Remote Desktop session
http://support.microsoft.com/kb/2526028 – Printing performance decreases
http://support.microsoft.com/kb/2526629 – The logon message is not displayed correctly when you connect to a RemoteApp application from a computer that has multiple monitors
http://support.microsoft.com/kb/2526870 – Windows may stop responding at the Welcome screen after you enter the user credentials to log on to the computer
http://support.microsoft.com/kb/2534985 – The virtualized application or the system crashes
http://support.microsoft.com/kb/2536840 – IP addresses that are used for reconnection are not listed completely in the RD Connection Broker setting
http://support.microsoft.com/kb/2536989 – Single Sign-On (SSO) feature does not work after you enable the RemoteFX feature
http://support.microsoft.com/kb/2538047 – Audio capture redirection feature does not work after a second remote desktop connection is created
http://support.microsoft.com/kb/2541119 – Applications may crash
http://support.microsoft.com/kb/2545479 – A memory leak occurs, and client requests may take a long time, when you run an application that is based on COM+ and that is registered as single-threaded
http://support.microsoft.com/kb/2545627 – A multithreaded application might crash
http://support.microsoft.com/kb/2545735 – “The home folder could not be created” error when an administrator tries to set Remote Desktop Services Home Folder for a user account
http://support.microsoft.com/kb/2545833 – Slow performance occurs when many user authentication requests are handled
http://support.microsoft.com/kb/2547752 – Credential authentication does not work if you paste credential information by using the Paste shortcut menu command
http://support.microsoft.com/kb/2548470 – A WebClient service crashes when you connect a WebDav resource
http://support.microsoft.com/kb/2549724 – “0x00000044” Stop error when you access shared files
http://support.microsoft.com/kb/2550581 – When you try to access files on a network share, Windows Explorer stops responding
http://support.microsoft.com/kb/2550944 – Group Policy logon scripts do not run
http://support.microsoft.com/kb/2550978 – “0x0000007B” Stop error after you replace an identical iSCSI network adapter
http://support.microsoft.com/kb/2551503 – A mapped drive that has the non-persistent flag set is displayed as a disconnected drive
http://support.microsoft.com/kb/2553771 – GetGPOList function does not return all GPOs
http://support.microsoft.com/kb/2554746 – MSMQ service might not send or receive messages after you restart a computer
http://support.microsoft.com/kb/2555392 – Garbled printouts after the first page if subsetted fonts are used
http://support.microsoft.com/kb/2559767 – File corruption occurs when you perform file operations on a file server
http://support.microsoft.com/kb/2560088 – File permissions inherited from one folder persist after the files are moved to another folder
http://support.microsoft.com/kb/2561285 – You experience a long domain logon time after you deploy Group Policy preferences to the computer
http://support.microsoft.com/kb/2563214 – “Access denied” error message when you try to access files in a WebDAV shared folder
http://support.microsoft.com/kb/2563399 – Remote Registry service leaks memory when it handles customized v2 performance counter queries
http://support.microsoft.com/kb/2564236 – I/O throughput is low when large files are read sequentially
http://support.microsoft.com/kb/2568041 – You cannot access allowed applications that are managed by AppLocker
http://support.microsoft.com/kb/2568409 – You cannot run an application desktop toolbar as a RemoteApp
http://support.microsoft.com/kb/2571388 – A Remote Desktop Services session stops responding during the logoff process
http://support.microsoft.com/kb/2574501 – Some lines are missing when you try to print an XPS document
http://support.microsoft.com/kb/2575946 – “Limit the size of the entire roaming user profile cache” Group Policy setting does not work
http://support.microsoft.com/kb/2577550 – You may wait for up to 30 seconds when you use a smart card to unlock a computer
http://support.microsoft.com/kb/2578159 – The logon process stops responding
http://support.microsoft.com/kb/2578214 – An application crashes when it tries to retrieve file information from an invalid or corrupted file
http://support.microsoft.com/kb/2578764 – Black lines appear in an application window that is displayed by using DirectX and GDI
http://support.microsoft.com/kb/2579362 – The redirector component may stop responding when it tries to contact many other computers
http://support.microsoft.com/kb/2579381 – A remote desktop session does not respond to keyboard input or mouse input after it loses the focus
http://support.microsoft.com/kb/2580346 – Some pop-up windows of a TS RemoteApp application might be hidden
http://support.microsoft.com/kb/2582112 – Windows stops responding when an application performs many I/O operations to a network share
http://support.microsoft.com/kb/2582172 – Remote desktop is not displayed in Full-Screen mode when the screen resolution is 1366× 768 pixels
http://support.microsoft.com/kb/2582203 – A process that is being terminated stops responding
http://support.microsoft.com/kb/2585233 – “Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)” error when a client logs off from a Windows Server 2008 R2 Remote Desktop Services session
http://support.microsoft.com/kb/2585853 – Choppy video playback when you play a high-definition video over a remote desktop connection
http://support.microsoft.com/kb/2587473 – Topmost windows are not always in the topmost position
http://support.microsoft.com/kb/2590550 – The desktop does not load and only displays a black or blue background after you log on
http://support.microsoft.com/kb/2592339 – “0x0000007f” Stop error or system stops when you connect to it by using the RDP protocol
http://support.microsoft.com/kb/2600484 – Certain user folders are absent from the user profile if the folders are excluded from the roaming profile
http://support.microsoft.com/kb/2604066 – The top-level window of a RemoteApp application becomes unresponsive.
http://support.microsoft.com/kb/2614066 – Black screen during a Remote Assistance session
http://support.microsoft.com/kb/2614136 – Some windows of a Remote Desktop Services (Terminal Services) RemoteApp application might not be displayed correctly
https://support.microsoft.com/kb/2614892 – A computer stops responding because of a deadlock situation in the Mountmgr.sys driver
http://support.microsoft.com/kb/2615701 – “Logon Process Initialization Failure” error message and the logon process does not start
http://support.microsoft.com/kb/2616332 – Output is garbled when you print data or documents by using a service
http://support.microsoft.com/kb/2617115 – “Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)” error when a client logs off from a Remote Desktop Services session
http://support.microsoft.com/kb/2617202 – The computer stops responding when you use a WDDM driver
http://support.microsoft.com/kb/2617687 – Applications or services that start multiple Remote Desktop Services sessions crash
http://support.microsoft.com/kb/2617878 – You cannot set the LogonTimeout setting after the default RDP listener (RDP-Tcp) is deleted
http://support.microsoft.com/kb/2618115 – You cannot activate an RD Licensing server or install RDS CALs automatically by using Windows PowerShell
http://support.microsoft.com/kb/2618574 – Print Spooler service saves the NetBIOS name of the print server
http://support.microsoft.com/kb/2618837 – GDI objects are not displayed correctly on multiple monitors
http://support.microsoft.com/kb/2619880 – “The network path was not found” error message when you start a LDAP-related application
http://support.microsoft.com/kb/2620393 – EUDC fonts are not printed correctly
http://support.microsoft.com/kb/2620656 – Invalid redirected printers may be available in a Remote Desktop Services session that connects to a RD Session Host server
http://support.microsoft.com/kb/2621067 – The first-returned IP address is incorrect when you use the getaddrinfo function on a multi-homed computer
http://support.microsoft.com/kb/2622802 – The Group Policy Client service crashes on a terminal server when multiple users connect to the server at the same time
http://support.microsoft.com/kb/2633667 – 32-bit NetBIOS applications cannot receive connection close notifications
http://support.microsoft.com/kb/2625434 – “ERROR_SHARING_VIOLATION” error message in Windows XP or in Windows Server 2003 when you try to open a file on an SMB share on a server
http://support.microsoft.com/kb/2627489 – Event 1073 is logged after you cancel the logoff process
http://support.microsoft.com/kb/2634328 – Increased latency occurs on an HTTP connection if the connection is through a load balancer
http://support.microsoft.com/kb/2634907 – TCP/IP packets that are received out of sequence are discarded
http://support.microsoft.com/kb/2635500 – Issues when you try to display a large TIFF file that contains multiple pages by using Windows Photo Viewer
http://support.microsoft.com/kb/2636056 – You cannot select fields in Access 2010 after you open a .zip file in an OLE Objects field
http://support.microsoft.com/kb/2636585 – Proquota.exe uses incorrect profile quota Group Policy settings
http://support.microsoft.com/kb/2636613 – Rdpshell.exe process leaks memory when you move a published RemoteApp application’s window on the client side
http://support.microsoft.com/kb/2637692 – RPC threads may stop responding in Windows 7 or in Windows Server 2008 R2
http://support.microsoft.com/kb/2638018 – Windows Explorer crashes randomly
http://support.microsoft.com/kb/2639320 – Performance Monitor data collector set does not collect all required performance counter data
http://support.microsoft.com/kb/2639505 – Loaded user profiles cannot be unloaded after you run WMI queries for the Win32_StartupCommand class
http://support.microsoft.com/kb/2642947 – “Index was out of range” error message when a Group Policy report is generated
http://support.microsoft.com/kb/2645594 – An update to optimize the performance of AMD Bulldozer CPUs
http://support.microsoft.com/kb/2646168 – “The system cannot find the file specified” error message when you print a document
http://support.microsoft.com/kb/2646563 – SMB2 directory cache is not updated correctly if a file is deleted
http://support.microsoft.com/kb/2647169 – Windows Fax and Scan cannot send a fax if Internet Explorer 9 is installed
http://support.microsoft.com/kb/2647401 – “File Not Found” when you try to open a file in an application
http://support.microsoft.com/kb/2647409 – Remote Desktop Services sessions are not kept alive as expected
http://support.microsoft.com/kb/2647452 – Paged pool leaks when you map a network drive and then disconnect it frequently
http://support.microsoft.com/kb/2647582 – You cannot update the Group Policy settings on a RD Session Host server if IP Virtualization is applied
http://support.microsoft.com/kb/2647753 – Update rollup for the printing core components
http://support.microsoft.com/kb/2648397 – You cannot change an expired user account password in a Remote Desktop session from a client computer
http://support.microsoft.com/kb/2648662 – You cannot install RDS CALs automatically by using Windows PowerShell
http://support.microsoft.com/kb/2649422 – External users cannot connect to RDS that are published on a RD Gateway server through Forefront UAG
http://support.microsoft.com/kb/2653385 – Selected subfolder is highlighted unexpectedly when you select the parent folder
http://support.microsoft.com/kb/2653810 – Security group filter in Group Policy Preferences does not remove a user from a group
http://support.microsoft.com/kb/2659071 – WinRM does not transfer impersonation tokens correctly
http://support.microsoft.com/kb/2655998 – Long logon time when you establish an RD session if Printer Redirection is enabled
http://support.microsoft.com/kb/2659158 – You cannot log on to a domain that uses a disjoint namespace
http://support.microsoft.com/kb/2661001 – “Please wait for Local Session Manager” message remains for several minutes when you disconnect during the logon process
http://support.microsoft.com/kb/2661332 – You cannot reestablish a Remote Desktop Services session
http://support.microsoft.com/kb/2661641 – Explorer.exe process crashes when you close the Display Settings dialog box
http://support.microsoft.com/kb/2661663 – Stale user profile folders are not deleted completely
http://support.microsoft.com/kb/2662585 – Printer redirection is not applied to client computers that connect to Remote Desktop Session Host
http://support.microsoft.com/kb/2664408 – Variable %userdomain% roaming profile path is not resolved correctly
http://support.microsoft.com/kb/2664055 – Notifications do not appear in the notification area and the View Available Networks feature does not work
http://support.microsoft.com/kb/2665347 – You cannot connect to a virtual machine by using the Hyper-V Manager MMC snap-in
http://support.microsoft.com/?id=2665720 – Remote Assistance does not display a desktop that has a resolution of 1366 x 768 correctly
http://support.microsoft.com/kb/2666484 – “0x0000003B” Stop error on RD Session Host servers that use an RD Connection Broker
http://support.microsoft.com/kb/2668395 – 32-bit NetBIOS-based application stops responding in an x64-based version of Windows
http://support.microsoft.com/kb/2670667 – Handle leak occurs in the Audiodg.exe process
http://support.microsoft.com/kb/2673042 – You experience a long startup time or a long logon time when domain controllers are unavailable
http://support.microsoft.com/kb/2673347 – Home directory settings that you tried to define by using Group Policy are not applied on a SP1-based VDI client
http://support.microsoft.com/kb/2675275 – A logoff script is removed incorrectly when you use the GMPC to remove a logon script
http://support.microsoft.com/kb/2677323 – Handle leak when an application collects performance data
http://support.microsoft.com/kb/2678068 – Remote Assistance invitation fails in an Active Directory environment
http://support.microsoft.com/kb/2682011 – Server Manager in Windows Server “8” Beta does not retrieve performance data
http://support.microsoft.com/kb/2682814 – Windows are displayed incorrectly when you connect to a RemoteApp program
http://support.microsoft.com/kb/2684793 – Printer security settings are set to the default values incorrectly when you restore a printer
http://support.microsoft.com/kb/2685088 – The screen saver grace period does not work as expected if the period exceeds 60 seconds
http://support.microsoft.com/kb/2685909 – Poor performance occurs when you shadow a Remote Desktop session
http://support.microsoft.com/kb/2690528 – Slow performance when you browse the My Documents folder in the document library
http://support.microsoft.com/kb/2691156 – The first two bytes of the DWORD registry value for a Group Policy are cleared unexpectedly
http://support.microsoft.com/kb/2692929 – “0x80041001” error when the Win32_Environment WMI class is queried by multiple requestors
http://support.microsoft.com/kb/2693187 – “A fatal error occurred” error message when you run the Sysprep command on a VMware virtual machine
http://support.microsoft.com/kb/2696020 – You are disconnected from a RemoteApp application when you minimize the main frame window of a RemoteApp application that is published
http://support.microsoft.com/kb/2697479 – Memory leak in Wmiapsrv.exe
http://support.microsoft.com/kb/2697865 – The Spoolsv.exe process stops responding when you connect to more than 200 network printers
http://support.microsoft.com/kb/2698155 – On-demand antivirus scans do not work as expected
http://support.microsoft.com/kb/2699780 – Memory leak in the Remote Registry service
http://support.microsoft.com/kb/2699817 – RemoteApp session is disconnected when the RDP encryption level is set to Low and RDP compression is disabled
http://support.microsoft.com/kb/2701851 – An overwrite confirmation dialog box is covered when you overwrite an existing file in an FTP server directory
http://support.microsoft.com/kb/2701894 – Splwow64 process crashes when you try to print an Adobe document
http://support.microsoft.com/kb/2705357 – The WMI process stops sending events to WMI clients
http://support.microsoft.com/kb/2705427 – The Remote Desktop Web Access website does not show any published RemoteApp programs if a RemoteApp source is offline
http://support.microsoft.com/kb/2705742 – “0x0000003B” Stop error when you use a Citrix XenApp application
http://support.microsoft.com/kb/2706051 – Wscript.exe process or the Cscript.exe process stops unexpectedly when WSH 5.8 exits
http://support.microsoft.com/kb/2707157 – WebIO component uses its own DNS cache to resolve an FQDN
http://support.microsoft.com/kb/2710594 – Memory leak when a file system minifilter driver calls the FltCreateSystemVolumeInformationFolder function
http://support.microsoft.com/kb/2710870 – DHCPv4 IP address cannot be obtained after you restart a Hyper-V virtual machine
http://support.microsoft.com/kb/2712331 – Duplicate SID information is added to the MachineLaunchRestriction registry entry when you update the Offer Remote Assistance Group Policy setting
http://support.microsoft.com/kb/2713128 – A network printer is displayed as offline incorrectly
http://support.microsoft.com/kb/2715922 – Home folder is not mapped to a client computer when multiple users are logged on to a computer
http://support.microsoft.com/kb/2716163 – You cannot open a file that is associated with a RemoteApp program
http://support.microsoft.com/kb/2717541 – Group policy report displays incorrect information
http://support.microsoft.com/kb/2718841 – “0xc0000005” error message and Windows Explorer stops responding
http://support.microsoft.com/kb/2719305 – “The system cannot execute the specified program” error when the AppLocker component blocks applications from running
http://support.microsoft.com/kb/2719347 – Stop error – tcpip.sys
http://support.microsoft.com/kb/2719704 – “0x0000003B” or “0x000000D5” Stop error – rdpdr.sys
http://support.microsoft.com/kb/2720345 – Security tab is not displayed in the Properties dialog box
http://support.microsoft.com/kb/2721341 – Audio output stops intermittently
http://support.microsoft.com/kb/2726399 – You cannot change the DPI setting through a Remote Desktop session
http://support.microsoft.com/kb/2727101 – RemoteApp server starts a duplicate instance of a 32-bit RemoteApp application
http://support.microsoft.com/kb/2727324 – Computer stops responding after you connect to an SMB version 1 server
http://support.microsoft.com/kb/2728738 – You experience a long logon time when you try to log on to a client computer that uses roaming profiles
http://support.microsoft.com/kb/2727994 – You cannot open or save Office 2010 documents on a WebDAV file server
http://support.microsoft.com/kb/2731284 – “33” DOS error code when memory memory-mapped files are cleaned by using the FlushViewOfFile() function (ntfs.sys – 08-10-2012)
http://support.microsoft.com/kb/2732597 – 0x80070091 error when you perform a drag-and-drop operation to replace a folder in a WebDAV shared folder
http://support.microsoft.com/kb/2732673 – “Delayed write failed” error message when .pst files are stored on a network file server (rdbss.sys – 07-16-2012)
http://support.microsoft.com/kb/2733420 – A non-topmost window can be displayed above a window that has the WS_EX_TOPMOST extended window style
http://support.microsoft.com/kb/2734410 – RPC client application stops responding
http://support.microsoft.com/kb/2734642 – RDS-based applications crash
http://support.microsoft.com/kb/2735697 – Computer crashes when you connect to a Citrix XenDesktop virtual machine
http://support.microsoft.com/kb/2736782 – You cannot save a file by using the Save method of a Recordset object
http://support.microsoft.com/kb/2737353 – Spoolsv.exe process crashes when you select the “Print to File” option
http://support.microsoft.com/kb/2737468 – Internet Explorer 8 freezes when you browse a website that is from a less privileged zone
http://support.microsoft.com/kb/2738974 – Incorrect start time of Group Policy scheduled tasks
http://support.microsoft.com/kb/2739674 – You cannot connect to remote computers by using the SMB protocol
http://support.microsoft.com/kb/2740180 – Performance Monitor or a PDH function takes longer than expected to collect performance data
http://support.microsoft.com/kb/2740374 – A computer that is running Windows Server 2008 R2 SP1 or Windows 7 SP1 freezes under a heavy file I/O load
http://support.microsoft.com/kb/2740522 – Applications that execute PowerShell scripts crash randomly
http://support.microsoft.com/kb/2743148 – Non-topmost window appears above a topmost window when you click the Show Desktop button
http://support.microsoft.com/kb/2743155 – Application crashes when it uses the BitmapImage class to optimize images
http://support.microsoft.com/kb/2748246 – “The Specified port is unknown” error message when you use GPP to deploy printers
http://support.microsoft.com/kb/2748302 – Stop error when you use a Citrix XenApp application
http://support.microsoft.com/kb/2748437 – User profile folder name is displayed as “user name@domain name” when use a UPN to log on
http://support.microsoft.com/kb/2749262 – Remote Desktop Configuration service crashes together with event ID 1000
http://support.microsoft.com/kb/2749615 – You cannot enable Server Manager remote management after you install Windows Management Framework 3.0
http://support.microsoft.com/kb/2750090 – High CPU utilization by the Svchost.exe process and the Lsass.exe process in the Remote Desktop session after you remotely connect to a computer
http://support.microsoft.com/kb/2750396 – Remote Desktop Services server freezes when you try to log on to or log off the server by using a smart card
http://support.microsoft.com/kb/2751386 – Group Policy settings and preferences are applied to a roaming profile user who logs on to two computers
http://support.microsoft.com/kb/2752274 – WH_MOUSE hook receives wrong data when you run a x86-based application to intercept the WM_MOUSEWHEEL messages
http://support.microsoft.com/kb/2752370 – “0x000000D1” Stop error when you perform a network-related operation (tcpip.sys, fwpkclnt.sys, netio.sys – 9-06-2012)
http://support.microsoft.com/kb/2752618 – RDS client computer cannot connect to the RDS server by using a remote desktop connection
http://support.microsoft.com/kb/2753869 – Explorer.exe process crashes when you copy multiple files from one folder to another folder
http://support.microsoft.com/kb/2754035 – You cannot disable drag-and-drop operations on the Start menu by configuring a registry key
http://support.microsoft.com/kb/2756041 – Outlook item is unexpectedly copied when you try to move it to a destination folder or desktop by using the drag-and-drop feature
http://support.microsoft.com/kb/2756999 – Handle leak occurs on a COM client
http://support.microsoft.com/kb/2761645 – Access Denied error message when a user tries to access a redirected folder share or a home drive share
http://support.microsoft.com/kb/2764302 – “0x0000001E” Stop error occurs intermittently
http://support.microsoft.com/kb/2765546 – Icons are not displayed correctly on the taskbar
http://support.microsoft.com/kb/2768492 – User cannot connect to remote desktop server
http://support.microsoft.com/kb/2768523 – “0x0000007E” Stop error after you configure a computer to host a web service
http://support.microsoft.com/kb/2768741 – Visual elements are displayed incorrectly when you connect to a computer using the Remote Desktop Protocol
http://support.microsoft.com/kb/2769359 – Print job fails when the printer driver isolation feature is set to isolated or shared mode
http://support.microsoft.com/kb/2769372 – Windows Remote Assistance fails
http://support.microsoft.com/kb/2769478 – New file or folder does not appear in a Library
http://support.microsoft.com/kb/2769618 – Cannot play an audio file when an audio file is already playing in Windows Media Player
http://support.microsoft.com/kb/2769790 – File that a user adds to a remote folder is not displayed in Windows Explorer
http://support.microsoft.com/kb/2769791 – Windows Audio service stops after you configure remote audio playback
http://support.microsoft.com/kb/2770175 – RD Gateway service crashes when a client computer tries to connect
http://support.microsoft.com/kb/2771101 – Folder redirection policy fails after you redirect a folder to a different sub folder
https://support.microsoft.com/en-us/kb/2775511 – An enterprise hotfix rollup is available for Windows
http://support.microsoft.com/kb/2778831 – “Client Side Rendering Print Provider” registry key growth
http://support.microsoft.com/kb/2778834 – File becomes corrupted when you try to overwrite the file while it is opened by another user
http://support.microsoft.com/kb/2778863 – RD Gateway service crashes
http://support.microsoft.com/kb/2779073 – “Access is denied” error when remote desktop users try to log on to a terminal server
http://support.microsoft.com/kb/2780102 – “0x0000003B” Stop error when a Remote Desktop Connection Broker and a Windows 7 SP1 or Windows Server 2008 R2 SP1-based computer are in an RDS farm
http://support.microsoft.com/kb/2780124 – Icon titles of top-level windows in a RemoteApp application are not displayed on the taskbar
http://support.microsoft.com/kb/2780130 – “0x00000027” Stop error when you try to use a redirected smart card to log on to a remote computer
http://support.microsoft.com/kb/2780879 – Hotfix improves TCP window scaling
http://support.microsoft.com/kb/2783429 – High CPU utilization when you use the Print Management snap-in to add a printer
http://support.microsoft.com/kb/2785146 – Data is corrupted when there is insufficient memory
http://support.microsoft.com/kb/2786447 – “0x000000AB” Stop error when a Citrix client logs off from a RD Session Host
http://support.microsoft.com/kb/2786923 – Dialog boxes and new windows displayed as blank in Office 2013 RemoteApps
https://support.microsoft.com/kb/2789397 – Data corruption and network issues when you run a WFP-based application
http://support.microsoft.com/kb/2792026 – SMBv2 client computer freezes when the computer is under a heavy load
http://support.microsoft.com/kb/2793072 – Generic error message when you change your password on a RD Web Access website
http://support.microsoft.com/kb/2795616 – Lines in EMF file don’t display correctly
http://support.microsoft.com/kb/2796764 – The “New” option in the shortcut menu is missing for the root folder of a redirected drive
http://support.microsoft.com/kb/2797136 – Mapped printers are not added to a client computer
http://support.microsoft.com/kb/2797749 – Explorer.exe process may crash after you add custom properties to a .doc file
http://support.microsoft.com/kb/2798286 – RemoteApp application session disconnects from a client computer
http://support.microsoft.com/kb/2798670 – USB audio stream stalls
http://support.microsoft.com/kb/2798787 – Name of Group Policy preferences for Internet Explorer are displayed incorrectly
http://support.microsoft.com/kb/2799035 – Certificate Propagation service crashes when you disconnect an RDS client
http://support.microsoft.com/kb/2799360 – Svchost.exe process that hosts the network location awareness service crashes
http://support.microsoft.com/kb/2799406 – Poor performance when you use MSXML6.0
http://support.microsoft.com/kb/2799904 – Folder Redirection policy is not applied to a network share after you update a Group Policy
http://support.microsoft.com/kb/2800789 – 0xC0000005 Stop error when the SVCHost.exe process that hosts Remote Desktop Services crashes
http://support.microsoft.com/kb/2801423 – NTFS permission information for a DFS share takes longer than expected to display
http://support.microsoft.com/kb/2807716 – Error message when you try to map a drive to a network share
http://support.microsoft.com/kb/2807971 – Internet Explorer takes a long time to open an HTTPS webpage
http://support.microsoft.com/kb/2809097 – An application that calls the CloseHandle function on a serial port cannot be exited
http://support.microsoft.com/kb/2809808 – Takes longer than expected to log off from RDS server remotely
http://support.microsoft.com/kb/2813636 – You cannot log off an RD session 2752618
http://support.microsoft.com/kb/2815716 – Splwow64.exe process doesn’t end after a print job finishes
http://support.microsoft.com/kb/2821049 – COM-based application freezes
http://support.microsoft.com/kb/2821343 – “Access Denied” error message when you try to access a file share that has Access-based Enumeration enabled
http://support.microsoft.com/kb/2813636 – You cannot log off an RD session
http://support.microsoft.com/kb/2831347 – Roaming user profiles are corrupted when a monitoring program executes a WMI query
http://support.microsoft.com/kb/2834976 – Authenticated users are removed from the Remote Desktop Users group after you set the drain mode
http://support.microsoft.com/kb/2846340 – Duplicate friendly names of network adapters are displayed
http://support.microsoft.com/kb/2847346 – Svchost.exe running NSI service leaks memory and non-paged pool memory leak Tag NSpc
http://support.microsoft.com/kb/2847932 – Language switch fails in a RD session and shortcut menu is not displayed in a RemoteApp session
http://support.microsoft.com/kb/2853777 – Some text is not printed when you print multiple documents that use the same font in Windows
http://support.microsoft.com/kb/2856905 – Can’t log on to a Windows Server 2008 R2 SP1-based computer by using a domain user account
http://support.microsoft.com/kb/2858684 – Not all results are returned by file content search from Windows Explorer
http://support.microsoft.com/kb/2861819 – Data transfer stops for five seconds in a Windows Socket-based application
http://support.microsoft.com/kb/2864585 – DSN is not changed or deleted on client computers when you use Group Policy Preferences to configure it
http://support.microsoft.com/kb/2866519 – You cannot log off from a Remote Desktop session
http://support.microsoft.com/kb/2866695 – An application stops responding when a file has a circular reference
http://support.microsoft.com/kb/2867625 – TCP port exhaustion causes key operations to fail when you deploy Group Policy preferences
http://support.microsoft.com/kb/2868238 – A combo box control selects an unexpected value
http://support.microsoft.com/kb/2869799 – Group Policy Preferences incorrectly sets a network printer as default
https://support.microsoft.com/en-us/kb/2870165 – Unknown time zone information in a remote desktop session when you try to query the time zone information from a RDS server
http://support.microsoft.com/kb/2870437 – Error message when you try to connect to a SQL Server 2012 AlwaysOn failover cluster instance by using the AlwaysOn listener
http://support.microsoft.com/kb/2871131 – The size of the “HKEY_USERS\.DEFAULT” registry hive continuously increases
http://support.microsoft.com/kb/2895698 – Users who have the remote audio setting enabled cause the RD Session Host Servers to hang intermittently
http://support.microsoft.com/kb/2896256 – A remote desktop session cannot start after you add a new user to a computer
http://support.microsoft.com/kb/2896881 – Long logon time when you use the AddPrinterConnection VBScript command to map printers for users during logon process
http://support.microsoft.com/kb/2897765 – Outlook crashes when you view an HTML newsletter
http://support.microsoft.com/kb/2900635 – Print device settings are not updated after you upgrade the driver in Windows
http://support.microsoft.com/kb/2903025 – Antivirus software doesn’t check whether a file is digitally signed
http://support.microsoft.com/kb/2904034 – Error code 0x80070003 when a Group Policy preference is applied
http://support.microsoft.com/kb/2905412 – Stop error 0xD1 on a Windows-based computer with multiple processors
http://support.microsoft.com/kb/2905569 – The scroll bar in a 32-bit application does not move
http://support.microsoft.com/kb/2914680 – I/O delays
http://support.microsoft.com/kb/2915847 – Pages load slowly during a Remote Desktop Services session
http://support.microsoft.com/kb/2916266 – Mstsc.exe crashes when you print a large document from an RDS session
https://support.microsoft.com/en-us/kb/2920289 – A Stop Error occurs on a computer that has IPSec configured
http://support.microsoft.com/kb/2920486 – Cannot edit Group Policy settings on a site
http://support.microsoft.com/kb/2922790 – Some software products function incorrectly
http://support.microsoft.com/kb/2923398 – A Remote Desktop session may stop responding when you access a remote shared folder by using SMB version 2
http://support.microsoft.com/kb/2924678 – “Trusted Publishers” settings are unmanageable in a Group Policy Object
http://support.microsoft.com/kb/2927422 – Connection times out when you try to connect to SQL Server
http://support.microsoft.com/kb/2927901 – SetDefaultPrinter sets a wrong default printer
http://support.microsoft.com/kb/2928492 – Can’t connect to remote applications
http://support.microsoft.com/kb/2928496 – Wmiprvse.exe freezes
http://support.microsoft.com/kb/2928800 – Incorrect group name is displayed in folder permission list
http://support.microsoft.com/kb/2931772 – “0x00000050” Stop error on the terminal server when a session is disconnected
http://support.microsoft.com/kb/2932119 – Incorrect DNS queries cause unnecessary network traffic when you start GPMC or GPUpdate
http://support.microsoft.com/kb/2936589/ – User interface buttons stop working in Internet Explorer 8
http://support.microsoft.com/kb/2936674 – You cannot offer Remote Assistance to another user when you use a mandatory profile
http://support.microsoft.com/kb/2939399 – An update to disable the Chat feature in Remote Assistance (MSRA.exe)
http://support.microsoft.com/kb/2964832 – RemoteApp program pop-up window is hidden
http://support2.microsoft.com/kb/2974617 – Network connectivity is lost when many users run applications on a remote server
http://support2.microsoft.com/kb/2989007 – Update to support Ultra HD resolution for RDP sessions
http://support2.microsoft.com/kb/3001265 – “Access Denied” error and all objects and child OUs under OU are deleted in Group Policy Management Console
http://support2.microsoft.com/kb/3004100 – Stop error 0x0000003B when you try to connect to a server by using Remote Desktop Protocol
http://support2.microsoft.com/kb/3004543 – Windows 7 or Windows Server 2008 R2 cannot renew IP address from a Windows Server 2012 R2-based DHCP server
http://support2.microsoft.com/kb/3005788 – Printing preferences window appears behind a RemoteApp window
http://support2.microsoft.com/kb/3009980 – Shortcuts that are managed by GPO disappear in All Programs
http://support.microsoft.com/en-us/kb/3014783 – “RDS busy” or “The Group Policy Client failed logon” error when you log on to an application
http://support2.microsoft.com/kb/3015692 – Gdiplus.dll does not decode a multiframe image frame correctly
http://support2.microsoft.com/kb/3019282 – Print Spooler service crashes when you print documents on a network shared printer
http://support2.microsoft.com/kb/3021169 – Computer freezes when updating network driver or installing network filter driver
http://support2.microsoft.com/kb/3023161 – Remote session disconnects when you are connected to a server by remote desktop
https://support2.microsoft.com/kb/3029432 – The logon process for new users takes significantly longer as the number of user profiles increases
http://support.microsoft.com/en-us/kb/3036150 – Remote desktop users can see the printers of the other users
http://support.microsoft.com/en-us/kb/3036965 – Printing preferences window appears behind a RemoteApp window
https://support2.microsoft.com/kb/3040017 – XPS driver is slower than GDI driver to print files
https://support2.microsoft.com/kb/3042839 – Mstscax.dll file leaks handles on a Remote Desktop Protocol 8.1 client
https://support.microsoft.com/en-us/kb/3042842 – Files cannot be copied when drive redirection is enabled in RDP 8.1 client
https://support2.microsoft.com/kb/3045882 – Private key is not exported when you export a certificate
https://support2.microsoft.com/kb/3051475 – Cookies are not passed as part of a session when you make an HTTP connection
https://support2.microsoft.com/kb/3054251 – Stop Error in Rdbss.sys and unsaved documents
https://support2.microsoft.com/kb/3064222 – Stop error code “Stop A: 0xA” on a VMWare VM that uses the VMware Memory Ballooning technique on a NUMA node
https://support2.microsoft.com/kb/3065979 – “GsDraw error (1): GenericError” error occurs and application crashes when you create text outline

XenApp 6.5 Updates

Last Modified: Sep 2, 2018 @ 7:53 am

59 Comments

This page contains a list of available XenApp 6.5 updates. It it not meant to be a comprehensive build procedure. Many of the updates are Limited Release and thus are only accessible to Citrix Partners and Citrix Support.

Navigation

XenApp 6.5 Hotfix Rollup Pack 7
XenApp 6.5 Hotfixes 💡
AppCenter 6.5.13
XenApp Commands Hotfix 4
Citrix Group Policy Management 1.7.11
Uninstall Citrix Single Sign-on Console
HDX WMI Provider Update 1
HDX MediaStream for Flash 2.0 Hotfix 9
Server Configuration Tool 1.2 Hotfix 3
Service Provider Automation Tools
Citrix Receiver Enterprise 3.4 Update 5
Offline Plug-in 6.7.6
Citrix Profile Management 5.7
Universal Print Server Client 7.6 Hotfix 1
Citrix Group Policy Client Side Extension 1.7 Hotfix 9
EdgeSight 5.4 Agent Hotfix 7 for XenApp 6
Web Interface 5.4 Hotfix 2

💡 = Recently Updated

XenApp 6.5 Hotfix Rollup Pack 7

From CTX120842 Best Practices for Citrix XenApp Hotfix Rollup Pack Installation and Deployment: Citrix recommends the following order of deployment:

Zone data collector
Backup zone data collectors
Database connection server (Applies only to Resource Manager for XenApp 5 for Microsoft Windows Server 2003)
Primary farm metric server (Applies only to Resource Manager for XenApp 5 for Microsoft Windows Server 2003)
Backup farm metric server (Applies only to Resource Manager for XenApp 5 for Microsoft Windows Server 2003)
Member servers

To install a Hotfix Rollup Pack, do the following:

Go to the downloaded Hotfix Rollup Pack 7, shift+right-click XA650W2K8R2X64R07.msp and click Copy as path.
Run cmd.exe elevated.
Right-click the command prompt and paste the path. Then press <Enter> to run it.
In the Welcome to the Citrix XenApp 6.5 Hotfix Rollup Pack 7 Installation Wizard page, click Next.
In the Citrix XenApp has been successfully configured page, click Close.
Click OK when prompted to reboot.

XenApp 6.5 Hotfixes

Download post-R07 hotfixes from support.citrix.com by searching for XA650R07*. For example, Hotfix 11 contains a fix for the Citrix Print Management Service. 💡

Citrix CTX129229 Recommended Hotfixes for XenApp 6.x on Windows Server 2008 R2.

If you have several hotfixes to install, create a script similar to the following to install the hotfixes automatically.

for /f %%i in ('dir /b "%~dp0*650W2K8R2R07*.msp"') do (
start /wait msiexec /p "%~dp0%%i" /passive /norestart /l*v "%temp%\%%i.log"
timeout /t 3 /NOBREAK
)
pause

Then run the script elevated.

AppCenter 6.5.13

Go to the downloaded Citrix AppCenter 6.5 Hotfix 13 (DSCXAMx650W013) and run XenAppMx.msi.
If you see this message, click OK.
After installation, in Programs and Features, Citrix XenApp Management will be shown as version 6.5.13.0.

XenApp Commands Hotfix 4

Go to the downloaded XenApp Commands Hotfix 4 (DSCXACmd650WX64004) and run XenApp.Commands.Install_x64.msi.
In the Please read the Citrix XenApp Commands License Agreement page, check the box next to I accept and click Install.
If you see a Files in Use page, click OK.
In the Completed the Citrix XenApp Commands Setup Wizard page, click Finish.
Programs and Features lists Citrix XenApp Commands as version 6.5.4.1.

Citrix Group Policy Management 1.7.11

Go to the downloaded Citrix Group Policy Management 1.7.11 (GPMx170WX64011) and run CitrixGroupPolicyManagement_x64.msi. It installs automatically. Note: this hotfix might break AD GPOs.
Programs and Features shows it as version 1.7.11.0.
This update adds a new Citrix Policy setting at Computer > Server Settings > Graceful session logoff: ignore process. This is equivalent to LogoffCheckSysModules.

Uninstall Citrix Single Sign-on Console

If you have no desire to implement Citrix Single Sign-on then uninstall the console.

Go to Programs and Features, right-click Citrix Single Sign-on Console and click Change.
On the Application Maintenance page, select Remove and click Next.
On the Citrix Single Sign-On Console Uninstall page, click Next.
On the Citrix Single Sign-on Console 5.0 has been successfully uninstalled page, click Finish.

HDX WMI Provider Update 1

Run Programs and Features, right-click Citrix HDX WMI Provider and click Uninstall. Notice that the version is currently 2.0.0.0
Go to the downloaded Citrix HDX WMI Provider Update 1 (HDXWMIPROV620W2K8R2X64001) and run CitrixHDXWMIProvider-x64.msi. It installs automatically.
Programs and Features will now show it as version 2.0.1.0.

HDX MediaStream for Flash 2.0 Hotfix 9

Run Programs and Features, right-click Citrix HDX MediaStream for Flash – Server and click Uninstall. Notice that the version is currently 2.0.0.0
Go to the downloaded HDXFlash200WX64009 and run CitrixHDXMediaStreamForFlash-ServerInstall-x64.msi.
If you refresh Programs and Features, it now shows the version as 2.0.9.0.
The article details a registry key that needs to be configured.

Server Configuration Tool 1.2 Hotfix 3

Go to the downloaded Server Configuration Tool 120.003 and run ServerConfigurationInstall.msi. It installs automatically without prompting.
You can verify installation by looking in Programs and Features. Citrix XenApp Server Configuration Tool should be version 1.2.3.0.

Service Provider Automation Tools

Run the downloaded CitrixAppDeliverySetupTools.exe.
Click OK once installation is complete.
Programs and Features lists Citrix App Delivery Setup Tools as version 1.0.2.300.

Citrix Receiver Enterprise 3.4 Update 5

Run the downloaded Citrix Receiver Enterprise 3.4 Cumulative Update 5 (CitrixReceiverEnterprise.exe).
On the Welcome to Citrix Receiver Setup page, click Install.
Click Yes to reboot when prompted.
Programs and Features lists Citrix Receiver (Enterprise) as version 13.4.500.4.

Offline Plug-in 6.7.6

Go to the downloaded Offline Plug-in 6.7.6 and run CitrixOfflinePlugin.exe.
In the Welcome to the Citrix Offline plug-in Setup page, click Next.
In the License Agreement page, select I accept the license agreement and click Next.
In the Client Upgrade Options page, click Next.
Click OK if prompted that a reboot is required.
In the Citrix Offline plug-in has been successfully installed page, click Finish.
Click Yes when prompted to restart.
Programs and Features lists Citrix Offline Plug-in as version 6.7.6.1.

Citrix Profile Management 5.7

Download Profile Management 5.7. Expand Components that are on the product ISO but also packaged separately to find it.
Run profilemgt_x64.msi.
In the Welcome to the Citrix Profile management Setup Wizard page, click Next.
In the End-User License Agreement page, check the box next to I accept the terms in the License Agreement and click Next.
In the Destination Folder page, click Next.
In the Ready to install Citrix Profile management page, click Install.
In the Completed the Citrix Profile management Setup Wizard page, click Finish.
Click Yes when prompted to restart.
Programs and Features lists Citrix Profile Management as version 5.7.0.13003.

Universal Print Server Client 7.6 Hotfix 1

Go to the downloaded Universal Print Server Client 7.6 Hotfix 1 and run UpsClient760WX64001.exe.
In the License agreement page, check the box next to I accept the terms and click Install.
In the Completed the Citrix Universal Print Client Setup Wizard page, click Finish.
Programs and Features lists Citrix Universal Print Client as version 7.6.1.0.

Citrix Group Policy Client Side Extension 1.7 Hotfix 9

Go to the downloaded Citrix Group Policy Client Side Extension 1.7 Hotfix 9 (GPCSExt170W28KR2X64009) and run CitrixCse_x64.msi. It installs without prompting.
If you look in Programs and Features, it should show version 1.7.9.0.

EdgeSight 5.4 Agent Hotfix 7 for XenApp 6

Make sure EdgeSight 5.4 Server Hotfix 5 (ES540ServerWX64005) is installed on the EdgeSight Server.
Go to the downloaded EdgeSight 5.4 Agent Hotfix 7 for XenApp 6 and run EdgeSightXA6Agentx64.msi.
In the Welcome to the EdgeSight for XenApp x64 Setup page, click Next.
In the End-User License Agreement page, select I accept the terms in the License Agreement and click Next.
In the Product Information page, enter the company name specified on the EdgeSight web server and click Next.
The Agent Location page appears. If you are installing the EdgeSight Agent on a XenApp server that will be converted to a Provisioning Server vDisk, change the path for the data files so they reside on the cache disk (D:). If this is a normal XenApp server that boots from the C: drive, leave the data files in their default path. Click Next when done.
In the Network Settings page, enter the name of your EdgeSight server and click Next.
In the Ready to Install page, click Install.
In the EdgeSight for XenApp x64 Setup Complete page, click Finish.
Click Yes when prompted to reboot.
Programs and Features displays the version as 5.4.21.3.
Check out article http://support.citrix.com/article/ctx111062 for information on how to configure antivirus for the EdgeSight Agent. Do not skip this step.

Web Interface 5.4 Hotfix 2

Only run this on your Web Interface servers.

Run the downloaded Web Interface 5.4 Hotfix 2 WebInterface.exe from WI540MSI002.
In the Select Language page, click OK.
In the Welcome to the Web Interface Installation Wizard page, click Next.
In the License Agreement page, select I accept and click Next.
In the Installation Location page, click Next.
In the Location of Clients page, change the selection to Copy the clients to this computer. Then browse to the Citrix Receiver and Plug-ins folder on the XenApp 6.5 DVD and click Next.
In the Ready to Install page, click Next.
In the Web Interface Was Successfully Install page, click Finish.

Navigation

Preparation

SQL Databases

Windows Features

vSphere

Delivery Controller Install

Create Site

Database Mirroring

Use Studio to Create Database Scripts

Verify Database Mirroring

Second Controller

Studio – Slow Launch

Database Maintenance

View Logging Database

Enable Read-Committed Snapshot

Change Database Connection Strings

Director Grooming

Studio Administrators

Full Administrators

Help Desk

Provisioning Services w/Personal vDisk

vCenter Connection

Hosting Resources

Citrix Licensing Server

Upgrade

Licensing Server HA using GSLB

Citrix License Server Monitoring

Remote Desktop Licensing Server

Install Remote Desktop Licensing Server

Activate Remote Desktop Licensing

Health Check

Related Pages

Navigation

Change Log

StoreFront Versions

StoreFront Installation / Upgrade

Initial Configuration

Second StoreFront Server

Customer Experience Improvement Program

Citrix Analytics

Store Name – Rename

SSL Certificate

Delivery Controllers – SSL

Base URL – Change

Default Web Page

Authentication Configuration

Next Generation Experience

Customize Receiver Appearance

Receiver for Web (browser) Pass-through Authentication

Workspace app for HTML5 2408

HTML5 Workspace app configuration

Deploy Citrix Workspace app

Receiver for Web Timeout

Favorites, Categories, and Default Tab

Beacons

Propagate Changes

Export/Import StoreFront Configuration

Logon Simulator

Related Pages

Navigation

Monitor

Servers

Service Group

Responder

Load Balancing Virtual Server

SSL Redirect

SSL Warning

CLI Commands

Navigation

SmartAccess / SmartControl

Prerequisites

Endpoint Analysis

EPA Troubleshooting

SmartControl

SmartAccess

Related Pages

Navigation:

Hardware

If vSphere, disable NIC Hotplug

Windows Preparation