CTX-Blog

If you are already working with Merchandising Server, you will probably know this problem.

Citrix provides an update for his Offline –Plugin that eliminates 45 bugs. The update 6.0.1 is available as regular download since many weeks now but if you try to find the update on your Merchandising Server you won’t find it. Even a manual rescan of the available plugins doesn’t help

The reason is a missing XML file, which Merchandising Server needs to control the installation and configuration of the plugins. Apparently Citrix won’t make this XML file available to the public, see Citrix Blog: App Streaming-6.0.1 LCM Update

I have therefore taken the time to have a look at the following resources:

- Citrix-TV
- Citrix eDocs
- Metadata Reference

and finally created my own XML file.

To save your time, I will provide you with the XML file needed here: XenAppStreamingMetaData.xml

On the Merchandising Server it is now possible to upload the actual Offline-Plugin together with the new XML file. After that step you can deploy the update through standard deliveries as usual.

Why Citrix doesn’t provide this file itself is a miracle to me. In fact this behavior doesn’t help to convince people to use Merchandising Server. I hope Citrix is rethinking the way they provide updates to Merchandising Server in the future…

Regards
Ecki

All available documentation regarding “Single Sign On” or “Credential pass-through” with Smart Card and Citrix clients is limited to the Program Neighborhood client only, as can be seen exemplarily at Brianmadden . I don’t use this client in customer projects for a couple of years now but use the PNAgent or the Web client instead.

With these clients, a pass-through of the Smart Card PIN didn’t work, because they do not read their settings from the APPSRV.INI, which would allow for the neccessary settings.

Since client version 10.0, an Active Directory Group Policy Template can be found in every client installation directory, named “icaclient.adm”. All clients, starting with 10.0 now read the policy settings first and make use of the APPSRV.INI only in case, no policy is defined. This new feature allows now for a “Single Sign On” with SmartCard and PNAgent.

Here is, what you need to do, to get it up and running:

1. On the Presentation Server /XenApp Server

• Confirm proper operation by logging in to a full desktop on the Citrix server. Insert a Smart Card and it should begin reading it. Enable “Trust requests sent to the XML Service”. This is necessary if using smart card pass through logon.

2. On the Web Interface Server

• SSL must be configured and active (a web server certificate has to be installed) and the “Directory Service Mapping” has to be activated. This option can be found in the IIS Manager below the properties of the “Web Sites” folder:



• The Web Interface site itself must now be configured. Open the Citrix Access Suite Management Console on the Web Interface server and run discovery if necessary to find the Web Interface site you wish to work with.
  Under “Configure Authentication” select “Smart Card with Passthrough”.

3. Registry

• Check HKLM\System\CurrentControlSet\Control\TerminalServer\WinStations\ICA-tcp the value for “UseDefaultGina” should be 0 (1 disables the CtxGina).

4. Active Directory Policy

• Import the ADM template into a Policy
• Go to the “User Configuration” of the policy, leave the Computer part set to “not configured”. The following settings have to be enabled:



• <PolicyName>\User Configuration\Administrative Templates\Citrix Components\Presentation Server Client\User Authentication\Smart Card Authentication has to be “Enabled” and “Allow Smart Card Authentication” and “Use pass-through authentication for PIN” have to be activated.

• Leave everything else to “Not Configured”, provided that you are testing just Smart Card and PIN pass-through.

Now “Single Sign On” with Smart Card and PNAgent should work

Unfortunately these instructions only work for Windows XP and Server 2003. At the moment, no Citrix client, including 11.0, allows for PIN pass-through with Vista and 2008 Server

Here are some more interesting links:

• Error: Smartcard support is not allowed on pass through servers
• Internet Explorer 7 Known Issues
• Readme for Web Interface 4.6 for Presentation Server – German

Regards
Ecki

A few days ago, Citrix released the hotfixes AAC450W003 and hotfix AG2000_v457. Beside a couple of bug fixes, there are some really interesting things in these releases:

Hotfix AAC450W003 invalidates some parts of my last posting in “AAC tuning, part 3″. A couple of months ago, i asked Citrix to allow customers to change the caption of the RADIUS input box on the logon page. In my last article i showed a way to change the caption easily for RSA and SafeWord deployments and pointed out a way to change the text with a little script in case of another RADIUS solution. However this solution had some unwanted side effects and so i’m glad that Citrix came up with a solution for all deployments. The procedure described in the first section of “AAC tuning, part 3″ stays valid but is now applicable for all RADIUS deployments too, given you installed hotfix AAC450W003 correctly.

Vista is now supported with AAC 4.5, but it is still beta. This means, that you are now able to check Vista clients through EPA-scans, provided by Citrix. My first tests have been successfull. CAUTION: If you use EPA-scans from EPAFactory/Accario you have to wait for an update from Accario to support AAC 4.5 HF03. This should be available around the 20th of Mai.

The list of supported AV scanner and personal firewalls has become a little longer. McAfee 8.5i, Symantec AVE 10.0, Symantec Endpoint Protection 11.0 and Trend Micro 8.0 are now officially supported at last.

The download and readme for AAC can be found here: CTX117123, AAC45W003

The download and readme for CAG 4.5.7 can be found here: CTX117123, Hotfix AG2000_v457

Regards
Ecki

Users can choose the user interface language of the ICA Client for Win32 10.x and above through a dialog box the ICA Client provides during installation.

If users want to change the Language after the installation this can be done from the command line. Simply open a command prompt, browse to the ICA Client directory and run

Wfica32.exe /UserUILocale

Then add the required language and move it to the top of the list.

After a restart the ICA Client should appear with the new language selected.

Regards
Ecki

On July 19th Citrix released the first Hotfix Rollup Pack for Citrix Presentation Server 4.5. This update comprises a couple of new features and options. Beside others, the main improvements are IMHO the following issues:

• Microsoft Windows Vista/Office 2007 Compatibility Updates
• Enhanced (16-, 32-, and 48-bit) Icon Support
• Microsoft Office Live Preview Support

To get the fulll benefit of these compatibilityupdates, you must also deploy Version 10.100 or later of the Presentation ServerClient.

The download and aditional informations can be found here.

Regards
Ecki

July 18.: Citrix released a Hotfix for Citrix Access Gateway. This hotfix is applicable to the Model 2000 and the Model 2010 appliance that supports the Access Gateway Standard Edition, Version 4.5 and Access Gateway Advanced Edition, Version 4.5. This update comprises a couple of new features and options. Beside others, the main improvements are IMHO the following issues:

• Caching of one time passwords can now be disabled
• WANScaler integration (protocol and TCP optimizations through the SSL VPN client)
• Vista client support

Since a couple of security updates are comprised in this Package, administrators shouldn’t wait with installing this update.

The download and aditional informations can be found here.

Regards
Ecki

Is there any AAC admin happy with the way, EPA scans behave? Once you create just one EPA scan in the AMC (Access Management Console), the EPA scan gets started automatically on every LogonPoint, regardless whether this is wanted/needed or not.

This behavior is for example very annoying at OWA (Outlook Web Access) LogonPoints, that are created only to allow restricted access to the personal mail from anywhere. To operate “client less” from anyplace, anywhere, no EPA scans may be required. On a standard LogonPoint the EPA scan appears anyway with his download and installation directions. If you click on the “Skip Scan” button, you can proceed without scanning your PC, but the download of the EPA scan client still takes place in the background, steeling you valuable bandwidth. In addition, less computer versed users in an internet cafe with restricted PCs might end up trying to install the EPA scan client over and over without a chance to succeed…

Recently I stumbled upon an option that is able to stop this “misbehavior”. Well hidden and badly documented, the chances are good, that only few people discovered this option so far. The solution can be found in the “web.config” file in the root of the respective LogonPoint directory.

On a standard AAC server this is presumably:

C:\Inetpub\wwwroot\CitrixLogonPoint\#LogonPointName#

There is an other version of this file in the “C:\Inetpub\wwwroot\CitrixLogonPoint\” directory which should stay untouched !

This file can be opened and edited with any editor like the Windows NotePad. In the last third of the file you can find a section <appSettings>, which gives you some interesting possibilities. Among other things you can disable EPA scans here. All it needs is to add the following line below the <appSettings> section:

<add key=”EndpointAnalysisDisabled” value=“true” />

The section should look like this afterwards:

<appSettings>
<add key="DebugConsoleTrace" value="False" />
<add key="AdvancedGatewayClientDownloadUrl" value="http://www.citrix.com" />
<add key="AdvancedGatewayClientActivationDelay" value="10" />
<add key="MaxConnectionsToAuthenticationService" value="20" />
<add key="LogonPointId" value="00000000-0000-0000-0000-000000000000" />
<add key="DeployedBy" value="LACONFIG" />
<add key="ExtendedSecurIdFunctionalityEnabled" value="true" />
<add key="SecondaryAuthenticationIsOptional" value="false" />
<add key="EndpointAnalysisDisabled" value="True" />
<!- -

After saving the changes, a user calling this manipulated LogonPoint will now be forwarded immediately to the login prompt without seeing any EPA “nag screen”

AAC tuning, part 2 >>

!!! Please read the first comment to this post !!!

Regards
Ecki

It is a little known fact, that the Secure Access Client (4.2 and later, including net6vpn.exe) offers some interesting command line parameters. I will therefore present them here. The most intersting part is the ability to automate installation of the client via software deployment or simple batch script.

Note: These parameters are case-sensitive.

The following parameters are available:

• -C Configure the Virtual Private Networking (VPN) client–bring up the GUI configuration screen
  Example: “CitrixSAClient.exe –C”

• -H Connect to a specific server address and port (Syntax: -H SERVER_IP:PORT)
  Example: “CitrixSAClient.exe –H 192.168.1.1:443″

• -p Connect with a proxy IP address and port (Syntax: -p PROXY_IP:PORT)
  Example: “CitrixSAClient.exe –p 192.168.1.1:8080″

• -i Install the client. This is used in combination with other parameters for silent installations
  Example: “CitrixSAClient.exe –i”

• -D Sets the URL for the desktop icon for Advanced Access Control mode (Syntax: -D AG_AAC_URL)
  Example: “CitrixSAClient.exe -D https://cag.company.com”

• -Q Quiet mode parameter–this can only be used during an install (-i) or uninstall (-U). It must appear before all other parameters
  Example: “CitrixSAClient.exe –Q”

• -U Uninstall the VPN client and drivers
  Example: “CitrixSAClient.exe –U”

• -v Shows the version of the client you are launching
  Example: “CitrixSAClient.exe –v”

Below is a syntax example for a silent installation with Advanced Access Control integration:
CitrixSAClient.exe –Q –D https://AG_AAC_URL –i

A silent installation for Access Gateway Standard would look like that:
CitrixSAClient.exe –Q –H [AG_SYSTEM_FQDN]:[AG_SYSTEM_PORT] –i

From CTX108757.

Regards
Ecki

Citrix Advanced Products Group investigates emerging technologies relevant to the Citrix business mission, and creates research, prototypes and first release versions of products addressing these technologies. As part of this effort, the Advanced Products Group periodically releases technical preview versions of products to the Citrix community to encourage feedback.

Overview
DynamicUSB allows you to access a USB drive in a Presentation Server session in situations where the device is connected to a client system after the Presentation Server session is established.

The utility creates a directory under C:\CitrixUSBStore in the client file system for each USB drive that is inserted into the client device. This linked directory reflects the contents of the USB drive; thus, all directories and files in the USB drive appear as directories and files under the linked directory. If the USB key is subsequently removed, the utility deletes the corresponding link directory.

The user can access the linked directory from a Presentation Server session using client drive mapping functionality.

Prerequisites
This utility is designed to work only on client systems that support the New Technology File System (NTFS). A Windows XP or later variant of the client operating system is a prerequisite.

Installing DynamicUSB
There is no specific installer for this utility. Extract the executable DynamicUSB.EXE and proceed to use it as described below.

How to Use DynamicUSB

1. Run DynamicUSB.EXE on the client workstation. It creates a system tray icon.

2. Plug in a USB key. DynamicUSB creates a directory called C:\CitrixUSBStore\Drive_X where:

• X: is the USB drive letter assigned to the USB key by the client operating system

• Drive_X is a link to X:\

3. When you unplug the USB key, the utility deletes the directory Drive_X.

You can observe directory Drive_X being dynamically created or destroyed in the Presentation Server session as you plug or unplug your USB key.

Modify the Default Root Directory for Linked Directories
To modify the default directory in which linked directories are created (C:\CitrixUSBStore), launch DynamicUSB with the following command line:

DynamicUSB FullPathoftheDesiredRootDirectory

If FullPathoftheDesiredRootDirectory has spaces, enclose it with double quotation marks as shown below:

DynamicUSB “FullPathoftheDesiredRootDirectory”

You can download the tool here.

Regards
Ecki