powered by Ecki's Place

March 18, 2018

XenDesktop – Publish desktop to IP address instead of a user group – the missing link

There are some situations where you want to publish a VDI desktop to a certain machine instead of a user group. The way to accomplish that is documented in the following article CTX128232 – How to Configure XenDesktop for a Teaching Lab or Classroom Environment

According to this article you only need to fire up PowerShell, load the Citrix.Broker.Admin.* commandlets, get the DesktopGroupUid of your delivery group and set some BrokerAccessPolicyRules and BrokerAssignmentPolicyRules. In a last step you have to assign an IP address to a domain machine.

Add-PSSnapin Citrix.Broker.Admin.*

Get-BrokerDesktopGroup …

Get-BrokerAccessPolicyRule –DesktopGroupUid <uid> | Set-BrokerAccessPolicyRule –AllowedUsers AnyAuthenticated

Get-BrokerAssignmentPolicyRule –DesktopGroupUid <uid> | Set-BrokerAssignmentPolicyRule –Enabled $false

Set-BrokerPrivateDesktop DOMAIN\MACHINE_A -AssignedIPAddress

A nice article but unfortunately it is incomplete 🙁

The following blog post helped me a little bit further XenDesktop – Assigning Private Desktops by Client IP or Hostname. It showed me some more options for the published desktops like a custom name for every single published desktop and how to view the configured settings afterwards:

Set-BrokerPrivateDesktop DOMAIN\MACHINE_A –AssignedIPAddress –PublishedName “Desktop_A”

Get-BrokerPrivateDesktop | ft MachineName,AssignedIPAddress,AssignedClientName,PublishedName

But still the published desktops where not visible to the configured machines. They connected fine to StoreFront but showed no desktop to launch 🙁

So I started scratching my head and tried to understand how this “magic” could ever work…

The main question was how the Delivery Controller gets to see the real IP address of the client because the client never ever talks directly to the Delivery Controller. All communication is between StoreFront and Client only. This is where it made “click”.

In almost every environment I know StoreFront is load balanced behind some NetScaler or similar device. Therefore the StoreFront server only sees the IP address of the load balancer and not the real client IP. In case of a NetScaler it is the SNIP StoreFront sees as client IP address.

So the solution was as simple as that: Configure NetScaler to pass the real client IP address as “X-Forwarded-For” header to StoreFront which can be done easily on the Service or Service Group used for StoreFront load balancing. StoreFront then extracts the real client IP address from the HTTP header and passes it automatically to the Delivery Controller which finally knows which desktop to deliver.

Immediately after that configuration has been done the desktops appeared with their individual name in StoreFront 🙂



March 6, 2018

NetScaler – WinSCP only access (command policies) – the missing link

NetScaler Command Policies are not extremely well documented and if you don’t know how to work with regular expressions you are doomed. Citrix gives you some ideas on how Command Policies work in this Citrix eDoc Article but there is no hint on how to limit shell and scp/sftp access.

Well the solution is easy if you know how to do it but it took me some time to figure out…

First create a new Command Policy and give it a name like “WinSCP”. Choose “ALLOW” as action and add the following regular expression in the Command Spec* panel.


Second create a new local user like “WinSCP”, set a password and give him login privileges. The other options are optional. Then bind the new “WinSCP” Command Policy to that user.

You’re done 🙂 This command policy allows only access through SCP, or SFTP tools like WinSCP and all other access (GUI, shell) is blocked.


March 8, 2013

IE 10 + Access Gateway Enterprise Logon Screen Issue

People who already use IE 10 will have probably seen this phenomenon while connecting to an Access Gateway Enterprise site. The browser window remains empty after connecting to the AGEE URL. The logon prompt is only visible after switching to compatibility mode. A similar problem has been described on this site a few years ago, s. AAC und IE 8.0

The solution is similar but the files are different.

With Access Gateway Enterprise the file “/netscaler/ns_gui/vpn/index.html” has to be changed according to the following listing (red/bold line added):

<HTML><HEAD><TITLE>Citrix Access Gateway</TITLE>
<link rel="SHORTCUT ICON" href="/vpn/images/AccessGateway.ico" type="image/">
<META http-equiv="X-UA-Compatible" content="IE=EmulateIE9" />
<META http-equiv="Content-Type" content="text/html; charset=UTF-8">
<META content=noindex,nofollow,noarchive name=robots>
<LINK href="/vpn/images/caxtonstyle.css" type=text/css rel=STYLESHEET>
<script type="text/javascript" src="/vpn/resources.js"></script>
<script type="text/javascript" language="javascript">
var Resources = new ResourceManager("resources/{lang}", "logon");

If the fix is working (! close the browser and reopen it !), don’t forget to make this change persistent since the Access Gateway Enterprise “forgets” all the modifications during a reboot! The following Citrix KB article describes, how to make changes survive a reboot: How to Retain the Custom Settings made to the NetScaler Appliance after it is Restarted


April 4, 2007

Citrix Access Gateway Enterprise available

Jay Tomlin wrote an excelent article on this topic. You can find it here:

Jay Tomlin – Timpanogos