Access

CTX-Blog

powered by Ecki's Place

July 11, 2010

32bit icon option missing from the XenApp farm properties

I recently stumbled uppon a really weired problem with 32bit icon support in XenApp. Under certain circumstances the AMC won’t show the option for 32bit icon support in the farm properties even if all prerequisites are perfectly met. We found out the reason for that behaviour only by accident.

The problem can be seen with all versions of Presentation Server 4.5 and XenApp 5.0 for w2k3 as well as for w2k8.

If the problem hits you, the farm properties won’t show the option for 32bit icon support, but there will only be a blank space 🙁

No 32bit icon support in the AMC

The reason for this odd behaviour can be found in the configuration of the farm-discovery. I sometimes use LOCALHOST as the hostname for discovery. This is helpful in situations where you have roaming profiles and IIS is not installed on the XenApp servers.

But if you configure discovery that way there will be no 32bit icon option in the AMC.

Configured with LOCALHOST

If you change the discovery option back to the local server

Konfiguriert mit "Local Server"

the missing option reappeares again.

32bit icon support available

You can toggle that behaviour as you like. Admittedly this is not a common problem but it is odd and if you happen to see it, you will be warned…

Regards
Ecki

October 21, 2008

Smart Card Single Sign On with PNAgent

All available documentation regarding “Single Sign On” or “Credential pass-through” with Smart Card and Citrix clients is limited to the Program Neighborhood client only, as can be seen exemplarily at Brianmadden . I don’t use this client in customer projects for a couple of years now but use the PNAgent or the Web client instead.

With these clients, a pass-through of the Smart Card PIN didn’t work, because they do not read their settings from the APPSRV.INI, which would allow for the neccessary settings.

Since client version 10.0, an Active Directory Group Policy Template can be found in every client installation directory, named “icaclient.adm”. All clients, starting with 10.0 now read the policy settings first and make use of the APPSRV.INI only in case, no policy is defined. This new feature allows now for a “Single Sign On” with SmartCard and PNAgent.

Here is, what you need to do, to get it up and running:

1. On the Presentation Server /XenApp Server

  • Confirm proper operation by logging in to a full desktop on the Citrix server. Insert a Smart Card and it should begin reading it. Enable “Trust requests sent to the XML Service”. This is necessary if using smart card pass through logon.

2. On the Web Interface Server

  • SSL must be configured and active (a web server certificate has to be installed) and the “Directory Service Mapping” has to be activated. This option can be found in the IIS Manager below the properties of the “Web Sites” folder:
  • Web Sites propertiesDirectory Service Mapper

  • The Web Interface site itself must now be configured. Open the Citrix Access Suite Management Console on the Web Interface server and run discovery if necessary to find the Web Interface site you wish to work with.
    Under “Configure Authentication” select “Smart Card with Passthrough”.

3. Registry

  • Check HKLM\System\CurrentControlSet\Control\TerminalServer\WinStations\ICA-tcp the value for “UseDefaultGina” should be 0 (1 disables the CtxGina).

4. Active Directory Policy

  • Import the ADM template into a Policy
  • Go to the “User Configuration” of the policy, leave the Computer part set to “not configured”. The following settings have to be enabled:
  • Citrix Policy

  • <PolicyName>\User Configuration\Administrative Templates\Citrix Components\Presentation Server Client\User Authentication\Smart Card Authentication has to be “Enabled” and “Allow Smart Card Authentication” and “Use pass-through authentication for PIN” have to be activated.
  • Leave everything else to “Not Configured”, provided that you are testing just Smart Card and PIN pass-through.

Now “Single Sign On” with Smart Card and PNAgent should work 😀

Unfortunately these instructions only work for Windows XP and Server 2003. At the moment, no Citrix client, including 11.0, allows for PIN pass-through with Vista and 2008 Server 🙁

Here are some more interesting links:

Regards
Ecki

June 18, 2008

IE kiosk mode

I recently had a customer that wanted Internet Explorer to be published as a locked down version without toolbars and userinterface. The goal was to publish a browser based application to allow for a smart card rollout and not allowing users to browse away from this site. The search for a solution was harder than expected.

The solution most frequently found with Google was the built in “kiosk mode” of Internet Explorer. This mode can be activated by appending the parameter -k to the IE shortcut. For more details see http://support.microsoft.com/kb/154780. In this mode the IE starts in full screen mode, but without the ability to access the navigation panes, toolbars and menus as it would be possible when switching to full screen view by pressing F11. To end such a session, the user is forced to use the Alt. + F4 hotkey and all navigation in IE has to be done through hotkeys too. Not the solution we wanted for standard users 🙁

The next approach were Microsoft Group policies, but they too had too many constraints and issues. One issue here was, that there is no way, to hide the standard toolbars through group policies. It would have been therefore inevitable to manipulate the HKCU branch of the users registry at logon. This is a subject, where the otherwise “overloaded” IE policies are not detailed enough 🙁

The solution came through a VBS object. Internet Explorer can be addresses and controlled through VBS. This gave me the possibility to adjust the user interface of the IE and to hide all toolbars, navigation panes and menues, without disabling basic functionality. The following code starts IE with a predefined URL and makes it much more difficult for users to break out of the predefined environment 🙂

DIM IE
Set IE = CreateObject("InternetExplorer.Application")
IE.Navigate "http://this.is.the.url.to.be.shown"
IE.Visible=True
IE.Toolbar=no
IE.Menubar=no
IE.Statusbar=no
IE.Width=750
IE.Height=600
IE.Resizable=yes
'IE.Top=5
'IE.Left=5

The entry IE.Navigate stands for the target URL. Take care that the whole URL is surrounded by double quotes. Optional parameters are for the windows size (IE.Width/IE.Height) and the windows position on the users desktop (IE.Top/IE.Left).

IE kiosk mode

This script works perfect under Windows XP and 2003 Server. With Vista and 2008 Server administrative privileges are required!

Regards
Ecki

December 9, 2007

Update: PNAgent Filter for Web Interface 4.6

Not long ago, i had to implement the PNAgent Filter for Web Interface 4.6. It turned out, that the code itself of the modification didn’t need any changes from WI 4.5 to WI 4.6. To allow for an easy implementation, i nevertheless created an updated archive of the modification and updated the files for WI 4.6. Therefore all it needs is to replace one file, without the hassle to copy and paste code blocks to the right locations.

Download FilterApps4.6

This modification gives an administrator the power to hide Published Applications from the user. The only thing he has to do is adding a “#” sign in front of the application description. Very handy, if you use PNAgent to populate the Desktop and Start Menu and do not want the published Desktop to appear in the context menu of the PNAgent in the taskbar.

See also: PNAgent Filter for Web Interface 4.5

Regards
Ecki

July 21, 2007

Web Interface 4.6 for Windows available

Yesterday Citrix released the new Web Interface 4.6 for Windows. This version is mandatory for several new features and enhancements introduced with the Rollup Pack 01 for Presentation Server 4.5.

Before installing Web Interface 4.6 you have to update your AMC (Access Management Console for Presentation Server 4.5) first. The new console snap-ins must be present before the new features can be installed successfully. The new AMC can be downloded here.

The download of Web Interface 4.6 and aditional informations can be found here.

Regards
Ecki

July 21, 2007

First Hotfix Rollup Pack for Presentation Server 4.5 available

On July 19th Citrix released the first Hotfix Rollup Pack for Citrix Presentation Server 4.5. This update comprises a couple of new features and options. Beside others, the main improvements are IMHO the following issues:

  • Microsoft Windows Vista/Office 2007 Compatibility Updates
  • Enhanced (16-, 32-, and 48-bit) Icon Support
  • Microsoft Office Live Preview Support

To get the fulll benefit of these compatibilityupdates, you must also deploy Version 10.100 or later of the Presentation ServerClient.

The download and aditional informations can be found here.

Regards
Ecki

July 17, 2007

LANMANServer and LANMANWorkstation Tuning

I recently stumbled across this realy good article about terminal server tuning. This article introduces and explains all the relevant LANMANServer and LANMANWorkstation parameters and registry keys.

Following that, the article discusses the potential optimizing actions and their risks and provides even an ADM template that allows to tune your environment through GPOs.

The complete article can be found here.

Regards
Ecki

July 5, 2007

Restricting access to RDP sessions on a Citrix server

I recently stumbled across this realy good article about restricting access to the RDP/ICA protocol on a Citrix or terminal server through WMI. You don’t have to be a programmer to understand the code, since it is realy easy to use and implement. With just one line of code it is possible to add/remove a user or group from the ICA/RDP protocol, thus allowing for better security for your servers.

If you have to setup or manage several terminal servers, this article can ease your life.

The article can be found here.

Regards
Ecki

June 13, 2007

Presentation Server Load Balancing (Part 1 of n – Overview)

I recently stumbled uppon this realy good article about Presentation Server Load Balancing. This Article is the first in a loose series of articles on this topic.

Citrix admins are highly encouraged to read this article. It can be found here: Presentation Server Load Balancing (Part 1 of n – Overview)

Regards
Ecki

May 25, 2007

Vulnerability in Citrix Session Reliability service, CTX112964

A security flaw in the Citrix Presentation Server Session Reliability service has been found recently. The Session Reliability service is used by some Citrix products to improve user experience when connecting over unreliable networks. By sending a specifically crafted request to this service, an attacker could establish a TCP connection to any port on the local machine. This could be used by the attacker to bypass network security policies and remotely access local ports on the target machine.

This vulnerability is present in the following versions of Citrix products:

  • Citrix MetaFrame Presentation Server 3.0
  • Citrix MetaFrame Presentation Server 4.0
  • Citrix Access Essentials 1.0
  • Citrix Access Essentials 1.5

No other versions of Citrix Presentation Server, Citrix Access Essentials or Citrix Desktop Server are affected by this issue.

Customers running an affected product with the Session Reliability feature disabled are not affected by this issue.

Downloads for all languages are available here (CTX112964).

Regards
Ecki