powered by Ecki's Place

March 24, 2009

AAC and IE 8.0

Some days ago, Microsoft officialy released IE 8.0. Since IE 8.0 will be available trough Windows Update soon, more and more users will hit existing AAC deployments with this browser. Unfortunately this is not working as expected. This is, how an AAC portal page looks like in IE 8.0 with default settings:


The layout is crushed, links are missing and OWA is nearly unusable 🙁

A small change in the file C:\Inetpub\wwwroot\CitrixSessionInit\NUI.aspx solves the display issue by forcing IE 8.0 into IE 7.0 compatibility mode.

It is sufficient to add the following line in the header of the NUI.aspx file:

<meta http-equiv=”X-UA-Compatible” content=”IE=EmulateIE7″ />

Your header might look like this after the change:

<html xmlns="">
<title>Citrix Access Gateway</title>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />
<meta name="GENERATOR" content="Microsoft Visual Studio .NET 7.1" />
<meta name="CODE_LANGUAGE" content="C#" />
<meta name="vs_defaultClientScript" content="JavaScript" />
<meta name="vs_targetSchema" content="" />
<link rel="SHORTCUT ICON" href="themes/default/images/favicon.ico" type="image/" />
<base id="baseElement" href="" runat="server" />
<link id="cssElement" rel="stylesheet" href="" runat="server" />
<!--[if IE]>
<style type="text/css">

Immediately your portal is rendered again as it should be 🙂


This is not a final solution for the problem, but until Citrix releases a fix for this issue it will do…


December 15, 2007

AAC tuning, part 3

Two Factor Authentication with RSA, SafeWord or any other third party RADIUS solution is a common way to authenticate in a secure manner to an AAC deployment. AAC however labels the input box for the OTP (One Time Password) fix with the text “SecurID-PASSCODE”, “SafeWord CODE:” oder generic with “RADIUS Password”.

Endusers however know their OTP solution most of the time with other names, the name of the RADIUS solution provider for example. This can lead to confusion during the login process.

This problem is easily solved for RSA SecureID and SafeWord. A solution for RADIUS is described further down. As in part 1 and 2, the solution can be found in the “web.config” file in the root of the respective LogonPoint directory.

On a standard AAC server this is presumably:


There is an other version of this file in the “C:\Inetpub\wwwroot\CitrixLogonPoint\” directory which should stay untouched !

This file can be opened and edited with any editor like the Windows NotePad. In the last third of the file you can find a section <appSettings>, which gives you some interesting possibilities. Among other things you can configure the lables for the OTP field, so that it displays a text your users expect. All it needs, is to change the following line below the <appSettings> section:

<add key=”SecondaryAuthenticationPromptOverride” value=”Password:” />
<add key=”SecondaryAuthenticationToolTipOverride” value=”Enter Password” />

Where “Password:” stands for the text to be displayed as lable and “Enter Password” stands for the text, displayed as tool tip.

The section should look like this afterwards:

<add key="DebugConsoleTrace" value="False" />
<add key="AdvancedGatewayClientDownloadUrl" value="" />
<add key="AdvancedGatewayClientActivationDelay" value="10" />
<add key="MaxConnectionsToAuthenticationService" value="20" />
<add key="LogonPointId" value="00000000-0000-0000-0000-000000000000" />
<add key="DeployedBy" value="LACONFIG" />
<add key="ExtendedSecurIdFunctionalityEnabled" value="true" />
<add key="SecondaryAuthenticationPromptOverride" value="SafeWord PIN + Zahlencode:" />
<add key="SecondaryAuthenticationToolTipOverride" value="PIN und Zahlencode eingeben" />
<!- -

After saving the changes, a user calling this manipulated LogonPoint should now see the new lable.

This method unfortunately works only for RSA SecureID and SafeWord. The text displayed, when using a third party RADIUS solution is hard coded and not that easy to manipulate. There is a pending feature request at Citrix, but it isn’t clear, when a solution will be publicly available.

At last I found a very good work-around in the Citrix AAC Forum, published by Joel Donaldson. A simple manipulation of the BasePage.aspx file of the respective LogonPoint solves the problem in an elegant way.

With an english LogonPoint it is sufficient, to add the following paragraph before the </body> tag:

<script type="text/javascript" language="JavaScript">
document.body.innerHTML=document.body.innerHTML.replace("RADIUS Password:","Kobil Einmalpasswort:");

The result will look like this:
Loginprompt nach der Manipulation

If you want to support german LogonPoints also, you need another code block that respects the german notation:

<script type="text/javascript" language="JavaScript">
document.body.innerHTML=document.body.innerHTML.replace("RADIUS-Kennwort:","Kobil Einmalpasswort:");

Other languages can be added easily this way.

If someone is asking itself why this works, this short explanation may help. The script code is looking for the string “RADIUS Password:” in the delivered web page and replaces it with the second parameter of the function “document.body.innerHTML.replace”, in our example “Kobil OTP:”.

Attention, this works only, if JavaScript is enabled in the browser. If JavaScript is disabled, the original text “RADIUS Password:” is displayed. This modification shouldn’t have any other side effects.

< < AAC tuning, part 2

!!! Please read the first comment to this post !!!


July 17, 2007

LANMANServer and LANMANWorkstation Tuning

I recently stumbled across this realy good article about terminal server tuning. This article introduces and explains all the relevant LANMANServer and LANMANWorkstation parameters and registry keys.

Following that, the article discusses the potential optimizing actions and their risks and provides even an ADM template that allows to tune your environment through GPOs.

The complete article can be found here.


June 15, 2007

Truths and Myths of Presentation Server and WAN Optimization

Discussions about optimizing WAN links are on the rise, as a result of an increasing tendency to consolidate server and data centers. Most of the big players in networking business like Cisco, F5, Packeteer, Riverbed and since a couple of months Citrix with his WANScaler (former Orbital Data), just to name a few, are very active in this field. The focus however is usually in accelerating file and print services (SMB/CIFS), as well as frequently used protocols like HTTP, FTP and MAPI (Outlook/Exchange).

Not only since the acquisition of Orbital Data by Citrix in Oktober 2006 more and more people are asking if and how ICA can be optimized. Be it that high latency on satellite links, or GPRS/UMTS slows down screen refreshes to an unacceptable rate, or that one big print job bars a whole site from working, people ask for help more and more. Citrix with their WANScaler raised the expectations in many companies and won’t get tired of deliver their message “we overcome latency” and “latency doesn’t matter anymore”.

As a Riverbed partner in Switzerland i know the technologies and dependencies pretty good and also know about the problems in WAN environments. Therefore i couldn’t believe all those announcements and always tried to scale down the expectations of my customers. My own tests with WANScaler and Riverbed appliances showed no noticeable improvement in this area. I will post a comparison between these two products on this blog shortly. Citrix was only able to provide me with a WANScaler with the unofficial (Citrix)release 3.1.8, which is more or less a rebranded Orbital Date release. I couldn’t get my hands on the actual version 4.1 which is supposed to be the first “real” Citrix version of WANScaler, regardless how much i asked and begged. As soon as i have a chance to test the new release i will post the results here. But now back to the main topic…

Now Citrix consulting finaly released a paper, in which they analyze and describe the possibilities and especially the limits when trying to optimize ICA. I can really recommend this paper for everyone who is awaiting the visit of any kind of “WAN optimizer” for preparation. All other Citrix administrators are encouraged to read this paper too, because this topic will become important sooner or later – and then you will be prepared.

Truths and Myths of Presentation Server and WAN Optimization