Thursday, 30 August 2012

XenDesktop Planning

Please check out for more of my technical posts, alternately please call us on 01932 268289. 

Where and how do you start with planning a XenDesktop deployment???  After looking around the web for a bit I came to a conclusion that there really isn't anything out there that lays out exactly what you need and in what order to do it.

So after thumbling around the edocs that Citrix have on XenDesktop, finding some really good knowledge base articles and basically going through the installation of XenDesktop a few times this is what I've come up with.  

By no means am I saying this is the correct way or order to do a deployment every single time but it will give you (and me...) a good starting point to work from, highlight a few options you should consider before you get started and basically just help you out.

VM Desktop (Golden Image)
It's important that you plan your "golden image" appropriately and decide on how you want to deploy your virtual desktops, are you going to use MCS or PVS?  Are you going install all apps on your image or use XenApp?  These are just some of the questions you need to ask yourself before you start, have a read of the Preparing a Master VM eDocs article.
  • What OS is required?
  • Ensure that the hard disk for the master VM is attached at device location 0.
  • Ensure you set enough hard drive space as this cannot be changed at a later date. vCpu's and memory can be changed though.
  • Install on the VM the appropriate integration tools for your hypervisor.
  • If you plan to deliver desktops from pooled and dedicated machines, join the VM to the domain of which you want users' desktops to be members and ensure that the master VM is available on the host where you want to create the machines.
  • Install the Virtual Desktop Agent from the XenDesktop installation media.
  • Install any third-party tools require such as AV.
  • Install and configure any third-party applications that you do not want to virtualize.  Remember Citrix recommends virtualizing applications and delivering them to users' desktops with XenApp.
Note: In the case of streamed machines, image a vDisk from your master target device before you join the master target device to a domain - have a read of the following doc

If you plan to deliver desktops from pooled and dedicated machines, Citrix recommends that you create a snapshot of your master VM and name the snapshot in a way that allows you to identify the master VM in the future. If you specify a VM rather than a snapshot when creating a pooled or dedicated machine catalog, Desktop Studio will create a snapshot for you but you will not be able to name it.

When installing the VDA ask yourself the following questions before you begin, a lot of this information I found dotted around and there was not a defined things to look out for a consider. 
  • What VDA do you require? VDA for HDX 3D Pro or just the standard VDA?  Remember if you require 3D pro you need to obtain your Key file beforehand.
  • Choose advanced Install unless you are setting up a POC without personal vDisks or HDX 3D Pro, in which case you can select Quick Deploy.
  • Remember to launch the install through the autorun and not by double clicking on the standalone installer.
  • If you are using Personal vDisks what drive letters are already currently in use?  if you require to change the drive letter follow this article.
  • Do you want HA for the VDA?  This is not an alternative to other HA solutions.
  • Have you meet all the VDA requirements?
  • What discovery method are you going to use to communicate with the controller?  AD or registry based?
Planning your Database
XenDesktop 5 and upwards is now fully dependant on an SQL database, all information is stored on the database and controllers communicate only with the database and not with each other.  Things to be considered and planned for are.
  • Windows authentication must be used when connecting to the database.
  • SQL Express can be used but should only be when doing a POC.  Remember Express doesn't offer any kind clustering or mirroring.
  • Check the database requirements.
  • Citrix recommends that you use a HA solution for your database using either the hypervisior's HA feature, SQL mirroring or SQL clustering with mirroring being Citrix's preferred method. 
Note: If you want to mirror the XenDesktop database, ensure that the database uses the full recovery model and not the simple model. When Desktop Studio is used to create a database on an external SQL server, the database is configured to use the simple model by default; this means the transaction log cannot be backed up and the database cannot be mirrored. To ensure the database is configured to use the full recovery model, create the database manually and then use Desktop Studio to generate the necessary setup scripts to be run on the database.

Planning your Controller 
For desktops to be usable they must register with the correct controller or with any one of the controllers if there are more than one.  Here is a good read on Controller planning but things to consider are...
XenDesktop Install
To be totally honest the install of XenDesktop is dead straight forward, its knowing how you want it configured and setup to provide you or your client with the best experience. Things to consider before you start your install on Xendesktop are.
  • How are you going to split the components?
  • Do you already have an existing license server that you can use?
  • What SQL server are you going to use?  More about this later.
  • Is a firewall enabled on the controller?  if so are the necessary ports open?
  • Have you installed the prerequisite? or will you let the install do it for you?
Configuring a XenDesktop site
Before you start to configure your XenDesktop environment it's a good idea to have a few of the following details already decided on before you begin as there is nothing worse than having to do something twice!!!
  • Specify a site name.
  • Licensing server name and port.  NOTE: you will not be prompted for a license server if you've installed the license server component on the controller.
  • Specify the database to use.
  • What hyperversior will you be using?  VMware, XenServer or Hyper-V?  If you are using vmware you may need to either purchase a CA certificate or amend the the proxy.xml on the vCenter.
  • Cluster to use along with the Networking that the VM's will use on the hypervisor.
  • Storage to be used along with the personal vDisk storage if required.
Also another thing to consider when thinking about sites is do you require site failover for DR? You have a couple of options here but from a very high overview you have a couple of options.
  • Configuring the Web Interface RecoveryFarm setting with a list of alternate sites.
  • Use a NetScaler to intelligently load balance and validate that Web Interface and XML services.
  • Fault tolerance can be increased yet further by using the Global Server Load Balancing (GSLB) features of NetScaler.
Choosing the Machine Type
It does help to have the machine type that you require decided on before you start to create your catalog's.  What machine type you require will also decide what image delivery option you need to take - MCS or PVS.  See below for some brief information on MCS vs PVS.

Here is a VERY quick overview of what each desktop is and who it best suits, read the following article for more information.

Pooled - Desktops that are allocated to users on a per-session, first-come first-served basis. Pooled-random machines are assigned to users at each logon and returned to the pool when they log off.  Perfect for task workers who require standardized desktops, who share workstation and do not require to install applications.

Dedicated - Desktops that are assigned to individual users. Machines can be assigned manually or automatically assigned to the first user to connect to them. Whenever users request a desktop, they are always connected to the same machine, so you can allow users to personalize their desktops to suit their needs.

Existing - The existing machine type enables you to use XenDesktop to manage and deliver user desktops that you have already migrated to VMs in the data center.

Physical The physical machine type enables you to use XenDesktop to manage user desktops hosted on dedicated workstations or blade PCs, this enables you to support small numbers of users who have particularly demanding performance requirements.

Streamed The streamed machine type enables you to deliver desktops to VMs and blade PCs that have been configured to load the operating system over the network from Provisioning services. Target devices are managed in Provisioning services as a device collection and the desktops are delivered from a Provisioning services vDisk imaged from a master target device. Using Provisioning services to deliver desktops enables you to leverage the processing power of existing hardware, while realizing all the benefits of centralized desktop management.

Machine Catalog
Machine catalog is a collections of VM's or physical computers are managed as a single entity and can only contain one machine type.

Pooled or dedicated machine catalog

  • A host with sufficient processors, memory, and storage to accommodate the number of machines you plan to create.
  •  master VM from which to create the desktops. 
  • An admin AD account or enough pre-created AD computer accounts to use.
Existing or physical machine catalog

  • VMs or dedicated blade PCs hosting user desktops.
  • Active Directory user and computer accounts to assign to the VMs or blade PCs.

Streamed machine catalog

  • A Provisioning services deployment with a vDisk.
  • Device collections configured to load the vDisk over the network.
  • AD computer accounts managed by PVS for each target device in the device collections.

PVS or Machine Creation Service?
As we are talking about machine types and catalogs I thought it best that we now add a little bit about whether to go with a PVS or use MCS. Just a few points to note on this matter and also read this article which has some really good pointers in.
MCS Pro's 

  • Simpler to manage than PVS.
  • Ideal for smaller deployments.
  • Uses technology within the hypervisor and doesn't require an additional server(s) .
MCS Con's
  • In some tests, it was shown that MCS required 1.5x as many IOPS on the SAN as PVS.
  • MCS can only use dynamic disks, which incurs the expansion penalty during boot storms and reboots.
  • MCSs is limited in that it is meant for hosted VDI desktops only, pooled or dedicated.
PVS Pro's
  • Reduced IOPS compared to MCS.
  • Ideal for large deployments.
  • Organizations looking to utilize a hosted shared desktop model, a streamed VHD model or a Hosted VDI model with blade PCs can use be provided by a PVS.
PVS Con's
  • To some the additional steps required to manage a PVS prove to complicated.
  • Requires additional server(s) to host the PVS.
Client\User Considerations
Without doubt you will have to consider what the needs, wants and experience that a client\user requires.  some pointers for things to consider
This blog will be an ever expanding post but if you feel you would like to add something please don't hesitate to post your thoughts and i'll add them.

Hope this helps.

Wednesday, 29 August 2012

Event ID 10128 on Master Image

Please check out for more of my technical posts, alternately please call us on 01932 268289. 

In my POC environment I was getting the following event id that was stopping me from connecting to a virtual desktop

The WinRM service is not listening for HTTP requests because there was a failure binding to the URL (http://+:80/wsman/) in HTTP.SYS.
No remote requests will be serviced on that URL.
User Action
Please use "netsh http" to check if ACL for URL (http://+:80/wsman/) is set to Network Service.
Additional Data
The error code received from HTTP.sys is 5: Access is denied.
For more information, see Help and Support Center at

Once I ran the below command on the golden image, shut it down and took a snapshot and updated the catalogue to the updated image I could connect to the virtual desktop without any problems.

winrm set winrm/config/Service @{EnableCompatibilityHttpListener="true"}

Error: Unable to contact the Hypervisor

Please check out for more of my technical posts, alternately please call us on 01932 268289. 

I came across this error recently when doing a POC for XenDesktop on Vmware ESXi 5.

Error: Unable to contact the hypervisor. Check that the address, user name, and password are correct; the Controller and hypervisor are connected; and the SSL certificates have been set up correctly if you are using HTTPS.

To get around this issue I had to change the Proxy.xml file located on the Virtual Center to accept HTTP communication which is located in the following directory

C:\ProgramData\VMware\VMware VirtualCenter\proxy.xml

Find the following sections of the XML file and change them from "httpWithRedirect" to "httpAndHttps"

Now from the knowledge base article its a tad confusing which part of the xml file you need to change, ignore the id= part and just look for "/" and change the access mode and also look for "/sdk"and change the access mode.

Wednesday, 22 August 2012

Citrix XenApp failed to connect to the Data Store

Please check out for more of my technical posts, alternately please call us on 01932 268289. 

Recently ran in to an error where I couldn't connect to any XenApp server using the AppCenter and I was getting the following errors within the system event log.

Event ID 3989
Citrix XenApp failed to connect to the Data Store. ODBC error while connecting to the database: 28000 -> [Microsoft][ODBC SQL Server Driver][SQL Server]Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.

Event ID 3632
The server running Citrix XenApp failed to connect to the data store. Invalid database user name or password. Please make sure they are correct. If not, use DSMAINT CONFIG to change them.  Error: IMA_RESULT_ACCESS_DENIED  Indirect: 0  Server:   DSN file: C:\Program Files (x86)\Citrix\Independent Management Architecture\mf20.dsn

Event ID 3612
The server running Citrix XenApp failed to connect to the Data Store IMA_RESULT_ACCESS_DENIED. Invalid database user name or password. Please make sure they are correct. If not, use DSMAINT CONFIG to change them. 

Now it turns out that the farm was configured to use the administrator account for access to the datastore and when the domain administrator password was changed these errors start to appear.

To get round this issue (Not use the domain admin account!!!) run the following DSMAINT command and set the correct password for the administrator account.

DSMAINT CONFIG /user:domain\administrator /pwd:password

Ideally you should change the account used for this to a different account that is used for XenApp only.

Tuesday, 14 August 2012

Mobile Devices and CAG VPX

Please check out for more of my technical posts, alternately please call us on 01932 268289. 

Ok have you run in to the lovely issue with trying to configure a mobile device such as an iOS device or android to connect to a XenApp service site via a CAG VPX?  We'll after reading all the edocs, multiple forums posts and just at of playing I finally got it working.

You may run in to an error and be presented with the following message
"The address given did not provide a valid App list. Please check the address, gateway settings, and your network connection.”"
I've spent a load of time on this and i could never find any documentation that specified what exactly was needed..... do I need to add config.xml to the basic logon point? Do use FQDN or Netbios....Ahh!

Anyways lets begin

Before you start
  1. A Web Interface of 5.4 but at least 5.x.
  2. Access Gateway 5.02 or above.
  3. FQDN certs and intermediate cert.
Web Interface
  1. Create a service site called /mobile but can be anything you choose.
  2. Name farm and add Servers to the site along with XML port and transport type.
  3. Configure the mobile site with "Gateway Direct" in secure access
  4. Add address of externally FQDN (
  5. Set STA as
  6. Authentications point at Web Interface
  7. Set Authentication Method to Prompt
Access Gateway
  1. Configure ICA Access Control List - ICA and SR. 
  2. Configure STA - Exact setting you configured for the WI.
  3. Configure authentication profile you require.
  4. add cert and make sure you also add the intermediate cert and then Chain the certs.
  5. Create a Basic Logon Point called Mobile and check Authenticate with Web Interface
  6. Website Configuration:

  • Home Page - http://XASrv/mobile/config.xml
  • Web Address - http://XASrv/mobile/config.xml

Note: for the Web Address also try just "http://XASrv"

Citrix Receiver mobile
  1. The Root CA certificate that created the AG certificate must be present on the mobile device.
  2. iPad - URL 
  3. iPhone - URL

Use the Online URL Generator to create simple way of setting up the receiver. 

If you think i've missed something off please dont hesitate to let me know.

Wednesday, 1 August 2012

XenApp 6.5 Policies Best Practices

Please check out for more of my technical posts, alternately please call us on 01932 268289. 

Well not as such but this is what I setup for a baseline for each and every XenApp server I setup.  It gives you a good starting point to work from and from this point you can then go on to create additional policy to suit your needs and then apply the additional policy with the use of filters so that it applies to the correct group.  This is a mixture of policies that are recommended by Citrix and some that i just like to add in, the Citrix policies were taken from CTX134081 but this article also gives you some great pointers on UPM and Windows GPO's.

If you have any other policies that you like to set in your baseline policies and/or WAN/LAN/Tablet please post them.

XenApp Baseline User Policy.

Apply this policy as your baseline to all users connecting to your XenApp farm.

ICA\Adobe Flash Delivery\Flash Redirection 

Flash acceleration - Enabled
Flash default behavior - Enable Flash Redirection
Flash event logging - Enabled
Flash intelligent fallback - Enabled
Flash latency threshold - 30 milliseconds

Audio Plug N Play - Allow
Audio quality - Medium
Client audio redirection -  Allow
Client microphone redirection -  Prohibit
ICA\Desktop UI 

Desktop wallpaper - Allowed
Menu animation - Allowed
View window contents while dragging - prohibited
ICA\File Redirection 

Client floppy drives - Prohibit
Client optical drives - Prohibit
Host to client redirection  Disable
Read-only client drive access - Disable
Use asynchronous writes - Enabled
ICA\Port Redirection 

Auto connect client COM ports - Disable
Auto connect client LPT ports - Disable
Client COM port redirection - Disable
Client LPT port redirection - Disable

Client printer redirection - Allow 
Default printer - Set to client’s main printer
Printer auto creation log preference - Errors
Wait for printers to be created (desktop) - Disabled
ICA\Printing\Client Printers 

Auto-create client printers - Default printer only
Auto-generate generic universal driver - Disabled
Client printer names - Standard names
Direct connections to print servers - enabled
Retained and restored client printers - Allowed

Automatic installation of in-bo printer drivers - Disabled
Universal driver usage - Use Universal Printing only if requested driver is unavailable
ICA\Printing\Universal Printing 

Universal printing EMF processing mode - Spool to printer
Universal printing image compression limit - Best Quality
Universal printing optimization defaults - Standard Quality
Caching of embedded images
Caching of embedded fonts
Universal printing preview preference - Use for auto-generated and generic
ICA\Session Limits 

Linger Disconnect Timer Interval - 5 Minutes
Linger Terminate Timer Interval - 10 Minutes
Pre-Launch Disconnect Timer Interval - 15 Minutes
Pre-Launch Terminate Timer Interval - 30 Minutes

Log shadow attempts - Allow
Notify user of pending shadow connections - Allow
Users who can shadow other users - Defined by security
ICA\Time Zone Control 

Estimate local time for legacy clients - Enable
Use local time of client -  Use Client time zone
ICA\TWAIN devices 

Client TWAIN device redirection - Enabled
TWAIN compression level - low
ICA\Visual Display\Moving Images 

Moving Image Compression - Enabled
Server Session Settings
Session importance - Normal
Single Sign-on - Disabled

XenApp Baseline Computer Policy Setting.

Apply this policy as your baseline to all Servers in your XenApp farm.

ICA listener connection timeout - 120000 ms
ICA listener port number - 1494
ICA\Auto Client Reconnect 

Auto client reconnect - Allow 
Auto client reconnect authentication   Not required Require
Auto client reconnect logging   Disabled
ICA\End User Monitoring 

ICA round trip calculation - Enable
ICA round trip calculations for idle connections - Disable

Display memory limit   32768 KB
Display mode degrade preference - Degrade Color Depth First
Dynamic Windows preview - Enabled
Image caching - Enabled
Maimum allowed color depth   32 bit
Notify user when display mode is degraded - Disabled
Queuing and tossing - Enabled

ICA\Graphics Caching
Persistent Cache Threshold - 3000000 Kbps
ICA\Keep Alive 
ICA keep alive timeout - 60 seconds
ICA keep alives - Enabled
Windows Media Redirection - Allowed
ICA\Session Reliability 
Session reliability connections - Prohibited
ICA Shadowing 

Shadowing - Allow
License server host name - License Server name
License server port - 27000
Server Settings
DNS address resolution - Enabled
Full icon caching - enabled
Server Settings\Health Monitoring and Recovery 

Health Monitoring - Enabled
Health Monitoring tests - Use Defaults (please configure as you see fit.)
Server Settings\Memory/CPU 

CPU Management server lever - preferential load balancing
Memory optimization - Enabled
Memory optimization interval - enabled
Server Settings\Reboot Behaviour 

Reboot logon disable time - Choose a value to suit your clients
Reboot Schedule frequency - Choose a value to suit your clients
Reboot Schedule start date  - Reboot Schedule Choose first day of the reboot
Reboot Schedule time - Choose time to restart server
Reboot warning interval - Choose interval which the users are notified about pending restart
Reboot warning users - enabled
Scheduled Reboots - enabled
XML Service 

Trust XML requests - enabled
XML server port - 8080

XenApp WAN/External User Policy.

Apply this policy for users working from branch offices or remote locations with low bandwidth and/or high latency connections.

ICA\Adobe Flash Delivery\Flash Redirection 

Flash acceleration - Enabled

Audio quality -  Medium 
ICA\Client Sensors\Location 

Allow applications to use the physical locations of the client device - allowed (Tablet Devices)
ICA\Desktop UI 

Desktop wallpaper - prohibited
Menu animation - prohibited
View window contents while dragging - prohibited
ICA\File Redirection  

Use asynchronous writes - Enabled 
ICA\Mobile Experience 

Automatic Keyboard Display - Enabled (Tablet Devices)
Launch touch-optimized desktop - Enabled (Tablet Devices)
Remote the combo box - Enabled (Tablet Devices)
ICA\Printing  Wait for printers to be created (desktop) - Disabled 
ICA\Printing\Universal Printing  

Universal printing optimization defaults - Standard Quality
Caching of embedded images
Caching of embedded fonts
ICA\TWAIN devices 

Client TWAIN device redirection - Disabled
ICA\Visual Display  

Max Frames per Second - 15 FPS
ICA\Visual Display\Still Images 

Extra Color Compression - Enabled
Extra Color Compression Threshold - 8192 kbps
Lossy compression level - High
Lossy compression level threshold value - Unlimited