XenApp 6.5 Policies Best Practices

Please check out www.kaztechsolutions.co.uk for more of my technical posts, alternately please call us on 01932 268289. 

Well not as such but this is what I setup for a baseline for each and every XenApp server I setup.  It gives you a good starting point to work from and from this point you can then go on to create additional policy to suit your needs and then apply the additional policy with the use of filters so that it applies to the correct group.  This is a mixture of policies that are recommended by Citrix and some that i just like to add in, the Citrix policies were taken from CTX134081 but this article also gives you some great pointers on UPM and Windows GPO's.

If you have any other policies that you like to set in your baseline policies and/or WAN/LAN/Tablet please post them.

XenApp Baseline User Policy.
Apply this policy as your baseline to all users connecting to your XenApp farm.

ICA\Adobe Flash Delivery\Flash Redirection 
Flash acceleration - Enabled
Flash default behavior - Enable Flash Redirection
Flash event logging - Enabled
Flash intelligent fallback - Enabled
Flash latency threshold - 30 milliseconds
ICA\Audio 
Audio Plug N Play - Allow
Audio quality - Medium
Client audio redirection -  Allow
Client microphone redirection -  Prohibit
ICA\Desktop UI 
Desktop wallpaper - Allowed
Menu animation - Allowed
View window contents while dragging - prohibited
ICA\File Redirection 
Client floppy drives - Prohibit
Client optical drives - Prohibit
Host to client redirection  Disable
Read-only client drive access - Disable
Use asynchronous writes - Enabled
ICA\Port Redirection 
Auto connect client COM ports - Disable
Auto connect client LPT ports - Disable
Client COM port redirection - Disable
Client LPT port redirection - Disable
ICA\Printing 
Client printer redirection - Allow 
Default printer - Set to client’s main printer
Printer auto creation log preference - Errors
Wait for printers to be created (desktop) - Disabled
ICA\Printing\Client Printers 
Auto-create client printers - Default printer only
Auto-generate generic universal driver - Disabled
Client printer names - Standard names
Direct connections to print servers - enabled
Retained and restored client printers - Allowed
ICA\Printing\Drivers 
Automatic installation of in-bo printer drivers - Disabled
Universal driver usage - Use Universal Printing only if requested driver is unavailable
ICA\Printing\Universal Printing 
Universal printing EMF processing mode - Spool to printer
Universal printing image compression limit - Best Quality
Universal printing optimization defaults - Standard Quality
Caching of embedded images
Caching of embedded fonts
Universal printing preview preference - Use for auto-generated and generic
ICA\Session Limits 
Linger Disconnect Timer Interval - 5 Minutes
Linger Terminate Timer Interval - 10 Minutes
Pre-Launch Disconnect Timer Interval - 15 Minutes
Pre-Launch Terminate Timer Interval - 30 Minutes
ICA\Shadowing 
Log shadow attempts - Allow
Notify user of pending shadow connections - Allow
Users who can shadow other users - Defined by security
ICA\Time Zone Control 
Estimate local time for legacy clients - Enable
Use local time of client -  Use Client time zone
ICA\TWAIN devices 
Client TWAIN device redirection - Enabled
TWAIN compression level - low
ICA\Visual Display\Moving Images 
Moving Image Compression - Enabled
Server Session Settings
Session importance - Normal
Single Sign-on - Disabled

XenApp Baseline Computer Policy Setting.
Apply this policy as your baseline to all Servers in your XenApp farm.

ICA
ICA listener connection timeout - 120000 ms
ICA listener port number - 1494
ICA\Auto Client Reconnect 
Auto client reconnect - Allow 
Auto client reconnect authentication   Not required Require
Auto client reconnect logging   Disabled
ICA\End User Monitoring 
ICA round trip calculation - Enable
ICA round trip calculations for idle connections - Disable
ICA\Graphics 
Display memory limit   32768 KB
Display mode degrade preference - Degrade Color Depth First
Dynamic Windows preview - Enabled
Image caching - Enabled
Maimum allowed color depth   32 bit
Notify user when display mode is degraded - Disabled
Queuing and tossing - Enabled
ICA\Graphics Caching
Persistent Cache Threshold - 3000000 Kbps
ICA\Keep Alive 
ICA keep alive timeout - 60 seconds
ICA keep alives - Enabled
ICA\Multimedia 
Windows Media Redirection - Allowed
ICA\Session Reliability 
Session reliability connections - Prohibited
ICA Shadowing 
Shadowing - Allow
Licensing
License server host name - License Server name
License server port - 27000
Server Settings
DNS address resolution - Enabled
Full icon caching - enabled
Server Settings\Health Monitoring and Recovery 
Health Monitoring - Enabled
Health Monitoring tests - Use Defaults (please configure as you see fit.)
Server Settings\Memory/CPU 
CPU Management server lever - preferential load balancing
Memory optimization - Enabled
Memory optimization interval - enabled
Server Settings\Reboot Behaviour 
Reboot logon disable time - Choose a value to suit your clients
Reboot Schedule frequency - Choose a value to suit your clients
Reboot Schedule start date  - Reboot Schedule Choose first day of the reboot
Reboot Schedule time - Choose time to restart server
Reboot warning interval - Choose interval which the users are notified about pending restart
Reboot warning users - enabled
Scheduled Reboots - enabled
XML Service 
Trust XML requests - enabled
XML server port - 8080

XenApp WAN/External User Policy.
Apply this policy for users working from branch offices or remote locations with low bandwidth and/or high latency connections.

ICA\Adobe Flash Delivery\Flash Redirection 
Flash acceleration - Enabled
ICA\Audio 
Audio quality -  Medium 
ICA\Client Sensors\Location 
Allow applications to use the physical locations of the client device - allowed (Tablet Devices)
ICA\Desktop UI 
Desktop wallpaper - prohibited
Menu animation - prohibited
View window contents while dragging - prohibited
ICA\File Redirection  
Use asynchronous writes - Enabled 
ICA\Mobile Experience 
Automatic Keyboard Display - Enabled (Tablet Devices)
Launch touch-optimized desktop - Enabled (Tablet Devices)
Remote the combo box - Enabled (Tablet Devices)
ICA\Printing  Wait for printers to be created (desktop) - Disabled 
ICA\Printing\Universal Printing  
Universal printing optimization defaults - Standard Quality
Caching of embedded images
Caching of embedded fonts
ICA\TWAIN devices 
Client TWAIN device redirection - Disabled
ICA\Visual Display  
Max Frames per Second - 15 FPS
ICA\Visual Display\Still Images 
Extra Color Compression - Enabled
Extra Color Compression Threshold - 8192 kbps
Lossy compression level - High
Lossy compression level threshold value - Unlimited

How to find your Datastore for XenApp

Please check out www.kaztechsolutions.co.uk for more of my technical posts, alternately please call us on 01932 268289.

Sometimes you inherit a customer/client that you have no details for and therefore cannot find out certain information quick enough!!!

If you need to find out where the Datastore is for a certain installation just check the following regkey. 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\IMA\Database Settings.

Citrix Licensing Service will not start!!!

Please check out www.kaztechsolutions.co.uk for more of my technical posts, alternately please call us on 01932 268289. 

OK I know I've not been working with Citrix as long as some people but this is the first time I've come across this this problem...  For some reason on a customers Citrix environment the Citrix Licensing Service would not start...

you will get an event id something like the following


Faulting application name: lmadmin.exe, version: 11.9.0.0, time stamp: 0x4d6bbff6
Faulting module name: lmadmin.exe, version: 11.9.0.0, time stamp: 0x4d6bbff6
Exception code: 0xc0000005
Fault offset: 0x0005e222
Faulting process id: 0x2a58
Faulting application start time: 0x01cd65da86623391
Faulting application path: C:\Program Files (x86)\Citrix\Licensing\LS\lmadmin.exe
Faulting module path: C:\Program Files (x86)\Citrix\Licensing\LS\lmadmin.exe
Report Id: c469cc23-d1cd-11e1-ab7b-0050568070dc


The client was running License server 11.9.0 Build 11011 and to resolve this issue i had to rename the "C:\Program Files\Citrix\Licensing\LS\conf\concurrent_state.xml" and then start the licensing service again and all works fine.

The issue is resolved in License server 11.10

http://support.citrix.com/article/CTX129747

New Microsoft Excel 2010 Worksheets are Not Shown in Taskbar

Please check out www.kaztechsolutions.co.uk for more of my technical posts, alternately please call us on 01932 268289. 

I came across this today when you open a new Microsoft Excel 2010 worksheet, the new sheet is not shown on the taskbar, only the main Microsoft Excel icon is shown on the taskbar. 

This is because the Excel hook is not injected into any process because the seamless engine component (Sehook20.dll) responsible for the fix fails to load into the user session. Sehook20 fails to load because active accessibility hook is disabled in the Seamless Flags settings. Seamless flags are often used when troubleshooting problematic display issues.

I got round it by adding the following registry key.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\ExcelHook
Name: Enabled
Type: REG_DWORD
Data: 1

Get out the following article for more details.

http://support.citrix.com/article/CTX133198/

Citrix Session Monitoring & Control Console

Please check out www.kaztechsolutions.co.uk for more of my technical posts, alternately please call us on 01932 268289. 

I found this great article about Citrix Tool called "Citrix Session Monitoring & Control Console" from Thomas Koetzing that describes in detail the functions and use of SMCC.

http://www.thomaskoetzing.de/index.php?option=com_content&task=view&id=133&Itemid=205

You can also read a bit more about it on the edocs web page too.

http://support.citrix.com/proddocs/topic/xenapp65-admin/ps-printing-limiting-printing-bandwidth-all.html

The Situation:

You have performance problems with user session(s) and want to see what's going on in the session. Is the display not updated or the printing channel? Is speedscreen working or do I have network problems? You can use the performance monitor for that but there is also a GUI, the SMCC. 
  
The running SMCCAfter you have started the SMCC you have to select a specific ICA Session. I have selected the ICA-tcp#2 of the remotely logged in Administrator. Now you will see the overall Session Data of the selected ica session. Check out the Compession, the Session Line speed or even the session Latency and also the update time.

Switch to the Session Channels 

Now take a deeper look in the Admin ICA session. Switch to the Session Channels and see every single Channel that is running in the session. It depends on your MetaFrame settings which channel is active or you have allowed. For example the "old" Printing Channels (CTXLPT1, CTXLPT2), "old" COM Ports Channels (CTXCOM1, CTXCOM2), Clipboard... etc. and the main ICA Control Channel (CTXCTL).
In the Session Channels you can take Control of the Session total Bandwidth therefore use the slider, but in the next step you can take Control of each Virtual Session Channel.

Take Control of a Channel 

Click on the CTXCTL and you will get the Virtual Channel Control. Now you can take control of that specific channel. Here a quick try out, copy as the Admin some megs to the mapped client drive and when the system is copying the files, open the CTXCDM and set the Priority to low and apply it You will see the copy time will decrease.

The SMCC might help you with your Thin Clients (Linux, Windows CE), Fat Client, PALM's or what ever you use for connecting to the Citrix MetaFrame Server and Montitor and Control the ICA Session for troubleshooting and pin point your problem.

XenApp 6.5 event ID 30107 and 10001

Please check out www.kaztechsolutions.co.uk for more of my technical posts, alternately please call us on 01932 268289. 

Ok so i started to get a XA 6.5 farm up and running for testing and i ran in to the following errors.

Event ID 30107


Site path: C:\inetpub\wwwroot\Citrix\PNAgent.

The Citrix servers reported that they are too busy to provide access to the selected resource. This message was reported from the XML Service at address http://CTXSERVER/scripts/wpnbr.dll [com.citrix.xml.NFuseProtocol.RequestAddress].  [Unique Log ID: db5427d9]

Event ID 10001

A usable server cannot be found on which to launch the application. Application: MyDesktop, Client: MYWORKSTATION (address: 10.10.10.10;;;), User DOMAIN. Check your worker group definitions and load balancing policies to verify appropriate servers are assigned for MyDesktop. 

How i got round this.

1.  Setup a worker containing my servers

2.  Applied a load evaluator to the App.

3.  Applied XA650W2K8R2X64001

4.  Restarted XA server

Also make sure you don't have 1 in the following regkey.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections

Errors occurred when using "Servername" in the discovery

Please check out www.kaztechsolutions.co.uk for more of my technical posts, alternately please call us on 01932 268289. 

After running discovery, the following error message is received:

“Errors occurred when using Servername in the discovery process.”

Double-clicking the error message to see the error details reveals the following:

“An unexpected error occurred. Check that the server name is correct, that the server is on, that Citrix Presentation Server is installed on this server, and that the Citrix MFCOM Service is running.”

Make sure the user is a member of the Distributed COM Users and try your discovery again and it should pickup the server correctly.

Citrix Delivery Services Console: Unknown Error Occurred and Can’t Display Users?

Please check out www.kaztechsolutions.co.uk for more of my technical posts, alternately please call us on 01932 268289. 

Sometimes when trying to view user sessions in the access management console, the console fails to display any users but rather displays an error message:

“An error occurred. Try performing the task again. If the problem persists, contact support.”  Then under details “Unknown error occurred”

This typically indicates the console is having trouble enumerating users or getting valid data back from the data collector. I then found that clicking on each individual server to display users pinpointed which server was not able to provide information as it popped up with its own error unknown message.

I then stopped the IMA service on this server which does not impact users sessions in progress (but will prevent new sessions from being directed to that server). I then ran dsmaint recreateLHC which recreates the local host cache, a subset of the datastore. Then I restarted IMA and made sure the server was back in the farm (verify with theQFARM command)

XenApp 6.5 - Enhanced Desktop Experience

Please check out www.kaztechsolutions.co.uk for more of my technical posts, alternately please call us on 01932 268289. 

To deploy hosted desktops with the Windows 7 look and feel and control desktop customization through Group Policy think about using XenApp's 6.5 new feature Enhanced Desktop Experience. 

When you install XenApp 6.5 the Windows Desktop Experience Integration role is installed by default through the Server Role Manager and the installation sequence performs the following tasks. 

• Adds the Desktop Experience and XPS Viewer features to the Windows server configuration.
• Moves the Citrix folder items in the Start menu to the Administrative Tools folder (including the Citrix AppCenter).
• Creates a new Windows Theme file and sets the default wallpaper.
• Starts the Windows Themes service and configures it to start automatically.

Now to get Enhanced Desktop Experience working do the following

1. First run the Set-ExecutionPolicy AllSigned command within powershell as this will allow you to run the Citrix powershell script that we need to run later.

 2.  Now change your directory to "C:\Program Files (x86)\Citrix\App Delivery Setup Tools\" and once you have changed directory run the following command  .\New-CtxManagedDesktopGPO.ps1 and wait for it to finish.

3.  Once the command has finished you are ready to apply one of the following group polices to the OU that you require.

CtxStartMenuTaskbarUser - Enables the Windows 7 look and feel for published desktops. It also changes the pinned shortcuts on the Taskbar and configures the user's Start menu to match the Windows 7 environment. This GPO includes a script that executes when a user logs on to the server for the first time. To ensure the script executes correctly, the PowerShell execution policy on the server must be set to AllSigned.

CtxPersonalizableUser - Configures the user account that is accessing the XenApp server. It configures Windows policies to limit the available Control Panel applets and restricts users from installing programs, viewing properties, scheduling tasks, or shutting down the server.

CtxRestrictedUser - Includes most of the policies from the CtxPersonalizableUser GPO. Additionally, this GPO configures the Desktop wallpaper policy to prevent users from personalizing their desktops and prevents users from modifying settings for the Start menu and Taskbar.

CtxRestrictedComputer - Configures certain restrictions on the XenApp servers allocated to the tenant. This GPO restricts users from accessing Windows Update or removable server drives.

4.  OK before i apply any of the policies to an OU lets have a look at XenApps standard published desktop that a user would get without these GPO's applied and as you can see its a standard Windows Server 2008 desktop.

5.  Looking at the new GPO's that the powershell script created you can see that its automatically created the 4 GPO (CtxStartMenuTaskbarUser, CtxPersonalizableUser, CtxRestrictedUser, CtxRestrictedComputer).  Now I've applied CtxPersonalizableUser and CtxStartMenuTaskbarUser to the OU that the XA server's are in and if you have another GPO to handle general XA GPO's (in my case the XA Servers GPO) make sure that this GPO has the loopback processing mode enabled and set to replace so that the settings within the CtxPersonalizableUser GPO apply correctly.

 6.  Now as you can see once the GPO's are applied currently to the OU and a user lunches their published desktop you can now see that the Enhanced Desktop Experience is working correctly.

NOTE 1: At first I did have a bit of a problem getting this to actually work currently with a users profile that was already created but after installing this HOTFIX it seemed to work successfully.  If you are still having issues after applying this hotfix try to delete/rename the local profile/roaming/UPM profile and get the user to log in with a fresh profile to test.

XenApp 6.5 Pre-Launch

Please check out www.kaztechsolutions.co.uk for more of my technical posts, alternately please call us on 01932 268289. 

Now setting up Session Pre-Launch is a every simple task but I though I would would just add a bit more regarding the topic along with some screen shoots of how I set it up. 

The pre-launch feature allows a pre-launch session to be created when a user logs on, pre-launch session reduces the launch time of the first application. The default application ctxprelaunch.exe runs in the session, but is not visible to the user.  Also keep in mind that once a pre-launch session starts it does take a XenApp license regardless of whether a user launches an app or not and this setting will apply to all users.

1.   First right click on an App and select other tasks> Create Pre-Launch application.

2.  It will now create a PreLaunch-AppName application, me personally i like to change the name of this to PreLaunch-FarmName (Or something more descriptive) since you only need to create one PreLaunch per farm.

 3.  Next add the Pre-launch Disconnect Timer Interval policy - Amount of time before the pre-launch application disconnects the session (60 minutes by default). Once disconnected, the session gives up the XenApp license. When a user launches an application, the session is reconnected. This timer does not disconnect a session if a user launches an application. If the interval is not configured, the pre-launch session is not ever disconnected.

 4.  Next add the Pre-launch Terminate Timer Interval policy - Maximum amount of time before the pre-launch application exits (60 minutes by default). Starting a user application in the session also terminates the pre-launch application. Once the pre-launch application exits, the session remains alive if the user's applications are running or if you configured session lingering.

 5.  Now if you are setting this up for the first time remember to restart your receiver and once you do have a look at the connected users

NOTE: Customizing the pre-launch feature using Administrative Templates is not supported. However, you can change the pre-launch configuration by modifying the registry values, located at:

For 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\ICA Client\Prelaunch and HKEY_CURRENT_USER\Software\Citrix\ICA Client\Prelaunch

For 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\ICA Client\Prelaunch