Navigation

• Create Group Policy Objects
• Windows Group Policy Templates
• Computer Settings for VDAs
• VDA Receiver Configuration
• Additional Computer Settings

Create Group Policy Objects

1. Within Active Directory Users and Computers, create a parent Organizational Unit (OU) to hold all VDA computer objects.
2. Then create sub-OUs, one for each delivery group.
3. Move the VDAs from the Computers container to one of the OUs created in step 2.
   
4. Within Group Policy Management Console, create a Group Policy Object (GPO) called Citrix VDA Computer Settings and link it to the OU created in step 1. If this policy should apply to all Delivery Groups then link it to the parent OU. Or you can link it to Delivery Group-specific sub-OUs.
   
   
5. Modify the properties of the GPO, on the Details tab, so that the User Configuration portion of the GPO is disabled.
   
   
6. Create and link two new GPOs to the VDA OU (in addition to the Citrix VDA Computer Settings GPO). One of the GPOs is called Citrix VDA All Users (including admins) and the other is called Citrix VDA Non-Admin Users (lockdown).
   
   
7. Modify the properties of both of these GPOs and disable the Computer Configuration portion of the GPO.
   
   
8. Click the Citrix VDA Non-Admin Users GPO to highlight it.
9. On the right, switch to the Delegation tab and click Add.
   
10. Find your Citrix Admins group and click OK.
    
11. Change the Permissions to Edit settings and click OK.
    
12. Then on the Delegation tab click Advanced.
    
13. For Citrix Admins, place a check mark in the Deny column in the Apply Group Policy row. If desired, you can also deny the GPO to Domain Admins and Enterprise Admins. Click OK.
    
14. Click Yes when asked to continue.
    
15. For the other two GPOs, add Citrix Admins with Edit Settings permission. But don’t deny Apply Group Policy. The deny entry is only needed on the Lockdown GPO.
    
    

Windows Group Policy Templates

Unfortunately there are some differences between the GPO templates included with 2012 R2 and the GPO templates included with Windows 8.1/10. You’ll need to download the full set of templates.

1. Download the Administrative Templates for Windows 10.
   
2. Run the downloaded Windows10-ADMX.msi.
   
3. In the Welcome to the Administrative Templates for Windows 10 Setup Wizard page, click Next.
   
4. In the License Agreement page, select I Agree and click Next.
   
5. In the Select Installation Folder page, copy the location.
6. Select Everyone and click Next.
   
7. In the Confirm Installation page, click Next.
   
8. In the Installation Complete page, click Close.
   
9. Go to C:\Program Files (x86)\Microsoft Group Policy\Windows 10.
10. Open the PolicyDefinitions folder. Highlight all .admx files. Also highlight your desired languages (e.g. en-US). Copy the files to the clipboard.
    
11. Go to your domain’s sysvol (e.g. \\corp.local\sysvol) and in the corp.local\Policies folder, paste the files in the PolicyDefinitions folder. If you don’t have this folder then you can create it. Or skip to the next step. If prompted, replace the existing files.
    
    
12. If you prefer to not put the files in Sysvol, then instead go to C:\Windows\PolicyDefinitions and paste the files. Overwrite the existing files.
    
    
13. In the PolicyDefinitions folder, look for a file called LocationProviderAdm.admx and delete it. More information at Microsoft 3077013 “‘Microsoft.Policies.Sensors.WindowsLocationProvider’ is already defined” error when you edit a policy in Windows.
    

Group Policy Computer Settings

Edit the Citrix VDA Computer Settings GPO and enable the settings shown below. All settings are located under Computer Configuration > Policies.

Group Policy Settings

• Computer Configuration | Policies | Administrative Templates | System | Group Policy
  • Configure Group Policy Caching = disabled. Windows 8.1/2012 R2 setting
  • Configure Logon Script Delay = enabled, 0 minutes. Windows 8.1/2012 R2 setting.
  • Configure User Group Policy loopback processing mode = Enabled, either Merge or Replace depending on the desired result

http://support.microsoft.com/kb/953768 – User Group Policy loopback processing mode changes in Windows Server 2008 R2. Make sure the VDA computer accounts have Read access to the loopback user GPOs, even if those GPOs only contain user settings.

Power Settings

The following are more applicable to virtual desktops than session hosts:

• Computer Configuration | Policies | Administrative Templates | System | Power Management | Hard Disk Settings
  • Turn Off the hard disk (plugged in) = enabled, 0 seconds
• Computer Configuration | Policies | Administrative Templates | System | Power Management | Sleep Settings
  • Specify the system hibernate timeout (plugged in) = enabled, 0 seconds
  • Specify the system sleep timeout (plugged in) = enabled, 0 seconds
  • Turn off hybrid sleep (plugged in) = enabled, 0 seconds
• Computer Configuration | Policies | Administrative Templates | System | Power Management | Video and Display Settings
  • Turn off the display (plugged in) = enabled, 0 seconds

Remote Assistance Settings

Configure the following so you can shadow users using Director:

• Computer Configuration | Policies | Administrative Templates | System | Remote Assistance
  • Configure Solicited Remote Assistance = disabled
  • Configure Offer Remote Assistance = enabled, specify the Help Desk and Administrator groups that can offer remote assistance
    

User Profiles Settings

• Computer Configuration | Policies | Administrative Templates | System | User Profiles
  • Add the Administrators security group to roaming user profiles = enabled
  • Delete cached copies of roaming profiles = enabled (only enable on persistent session hosts)
  • Do not check for user ownership of Roaming Profile Folders = enabled

Event Viewer Settings

If you are using Provisioning Services, it might be desirable to move the event logs to a persistent cache disk. This allows you to review the event logs even after the Target Device reboots. Use Group Policy Preferences to create the folder on the cache disk.

• Computer Configuration | Policies | Administrative Templates | Windows Components | Event Log Service | Application
  • Control the location of the log file = enabled, D:\EventLogs\Application.evtx
• Computer Configuration | Policies | Administrative Templates | Windows Components | Event Log Service | Security
  • Control the location of the log file = enabled, D:\EventLogs\Security.evtx
• Computer Configuration | Policies | Administrative Templates | Windows Components | Event Log Service | System
  • Control the location of the log file = enabled, D:\EventLogs\System.evtx
• Computer Configuration | Preferences | Folder
  • Action = update
  • Path = D:\EventLogs

Remote Desktop Services Settings

• Computer Configuration | Policies | Administrative Templates | Windows Components | Remote Desktop Services | Remote Desktop Session Host | Connections
  • Restrict Remote Desktop Services users to a single Remote Desktop Services session = disabled
  • More details at http://support.citrix.com/article/CTX131245
• Computer Configuration | Policies | Administrative Templates | Windows Components | Remote Desktop Services | Remote Desktop Session Host | Device and Resource Redirection
  • Allow time zone redirection = enabled
  • Do not allow smart card device redirection = enabled
• Computer Configuration | Policies | Administrative Templates | Windows Components | Remote Desktop Services | Remote Desktop Session Host | Licensing
  • Set the Remote Desktop license mode = enabled, Per User
  • Use the specified Remote Desktop license servers = enabled, your XenDesktop Controllers
• Computer Configuration | Policies | Administrative Templates | Windows Components | Remote Desktop Services | Remote Desktop Session Host | Security
  • Always prompt for password upon connection = disabled (to override other GPOs where it might be enabled)
• Computer Configuration | Policies | Administrative Templates | Windows Components | Remote Desktop Services | Remote Desktop Session Host | Session Time Limits
  • Set a time limit for active but idle Terminal Services sessions = enabled, 3 hours or similar
  • Set time limit for disconnected sessions = enabled, 3 hours or similar

OneDrive Settings – Windows 10

• Computer Configuration | Policies | Administrative Templates | Windows Components | OneDrive
  • Prevent the usage of OneDrive for file storage = enabled

Search Settings – Windows 8.1/10/2012 R2

• Computer Configuration | Policies | Administrative Templates | Windows Components | Search
  • Allow Cortana = disabled (Windows 10)
  • Don’t search the web or display web results in search = enabled
  • Additional search settings can be found here

Store Settings – Windows 8.1/2012 R2 (not Windows 10)

• Computer Configuration | Policies | Administrative Templates | Windows Components | Store
  • Turn off the Store application = enabled
  • More information at http://blogs.technet.com/b/askds/archive/2014/04/09/managing-the-store-app-pin-to-the-taskbar-added-in-the-windows-8-1-update.aspx.

Windows Update Settings

• Computer Configuration | Policies | Administrative Templates |  Windows Components | Windows Update
  • Allow non-administrators to receive update notifications = disabled

After modifying the GPO, use Group Policy Management Console to update the VDA machines.

Or run the command gpupdate /force. Or wait 90 minutes.

Citrix Receiver

If you want pass-through authentication for the Citrix Receiver that is installed on your VDAs, use receiver.admx to enable pass-through authentication.

1. See the instructions at http://www.carlstalhood.com/receiver-for-windows/#admx to copy the receiver.admx file to PolicyDefinitions.
2. Edit the Citrix Computer Settings GPO.
3. Go to Computer Configuration > Policies > Administrative Templates > Citrix Components > Citrix Receiver > User Authentication. On the right, open Local user name and password.
   
4. Enable the setting.
5. Check the top two boxes and click OK.
   

Additional Computer Settings

Microsoft has additional recommended GPO settings for virtual desktops. See http://www.microsoft.com/en-us/download/details.aspx?id=40799

Next Steps

Group Policy Objects – VDA User Settings

Navigation

• User Lockdown
• Internet Explorer
  • IE Security Zones
• Folder Redirection
• Office 2013/2016
• Adobe Reader / Acrobat Reader DC
• ShareFile On-Demand Sync
• File Type Association

User Lockdown

The following is a list of Group Policy Settings recommended by Microsoft to lockdown a Remote Desktop Session Host / Citrix Session. These settings should go in the Citrix VDA Non-Admin Users GPO. All settings are located at User Configuration > Policies.

This page assumes the GPOs have already been created and Loopback Processing has already been enabled.

Control Panel GPO Settings

• User Configuration | Policies | Administrative Templates | Control Panel
  • Always open All Control Panel Items when opening Control Panel = enabled
  • Show only specified Control Panel items = enabled, canonical names = 
    • Microsoft.RegionAndLanguage
    • Microsoft.NotificationAreaIcons
    • MLCFG32.CPL
    • Microsoft.Personalization
    • Microsoft.Mouse
    • Microsoft.DevicesAndPrinters
    • Microsoft.System (lets users see the computer name)
• User Configuration | Policies | Administrative Templates | Control Panel | Add or Remove Programs
  • Remove Add or Remove Programs = enabled
• User Configuration | Policies | Administrative Templates | Control Panel | Programs
  • Hide the Programs Control Panel = enabled

Desktop GPO Settings

• User Configuration | Policies | Administrative Templates | Desktop
  • Hide Network Locations icon on desktop = enabled
  • Prohibit user from manually redirecting Profile Folders = enabled
  • Remove Properties from the Computer icon context menu = enabled
  • Remove Properties from the Recycle Bin icon context menu = enabled

If you prevent access to the Properties of the Computer icon then users might not be able to determine the name of the machine they are connected to.

Start Menu & Taskbar GPO Settings

• User Configuration | Policies | Administrative Templates |  Start Menu & Taskbar
  • Clear the recent programs list for new users = enabled
  • Do not allow pinning Store app to the taskbar = enabled
  • Remove and prevent access to Shut Down, Restart, Sleep, and Hibernate commands = enabled
  • Remove common program groups from Start Menu = enabled (only if you have some other means for putting shortcuts back on the user’s Start Menu/Desktop. Also, enabling this setting might prevent Outlook 2013 desktop alerts. Microsoft 3014833)
  • Remove Help menu from Start Menu = enabled
  • Remove links and access to Windows Update = enabled
  • Remove Network Connections from Start Menu = enabled
  • Remove Network icon from Start Menu = enabled
  • Remove Run menu from Start Menu = enabled
  • Remove the Action Center icon = enabled (not in Windows 10)
  • Remove the networking icon = enabled
  • Remove the Security and Maintenance icon = enabled (Windows 10)
  • Remove user folder link from Start Menu = enabled

If you hide common program groups, then you will need some other method of creating application shortcuts for each user. Group Policy Preferences Shortcuts is the typical method.

Removing the Run menu also prevents users from entering drive letters in Internet Explorer.

System GPO Settings

• User Configuration | Policies | Administrative Templates |  System
  • Prevent access to registry editing tools = enabled, Disable regedit from running silently = No
  • Prevent access to the command prompt = enabled, Disable command prompt script processing = No

Disabling registry editing tools also disables reg.exe. This is true even if silently is set to No.

Explorer GPO Settings

• User Configuration | Policies | Administrative Templates |  Windows Components | File Explorer (Windows 8+) or Windows Explorer (Windows 7)
  • Hide these specified drives in My Computer = enabled, Restrict A, B, C, and D drives only
  • Hides the Manage item on the File Explorer context menu = enabled
  • Prevent access to drives from My Computer = enabled, Restrict A, B, C, and D drives only. If this setting is enabled, you can’t use Start Menu’s search to find programs.
  • Prevent users from adding files to the root of their Users Files folder = enabled
  • Remove “Map Network Drive” and “Disconnect Network Drive” = enabled
  • Remove Hardware tab = enabled
  • Remove Security Tab = enabled

From Citrix Discussions: To hide specific drive letters:

1. User Configuration => Preferences => Windows Settings => Drive Maps => New Mapped Drive
2. Choose Action Update => Drive Letter Existing C => Hide this drive
3. Common Tab: Run in logged-on users’s Security

Windows Update GPO Settings

• User Configuration | Policies | Administrative Templates |  Windows Components | Windows Update
  • Remove access to use all Windows Update features = enabled, 0 – Do not show any notifications

Additional User Settings

Microsoft recommends (http://www.microsoft.com/en-us/download/details.aspx?id=40799 ) additional user settings for virtual desktops.

Internet Explorer Settings

This section assumes the GPOs have already been created.

Internet Explorer First Run Wizard

When a new user launches Internet Explorer, the first run wizard appears.

To prevent this from occurring, edit the Citrix VDA All Users GPO.

Internet Explorer First Run GPO Settings

• User Config | Policies | Administrative Templates | Windows Components | Internet Explorer
  • Prevent managing SmartScreen Filter = enabled, on
  • Prevent running First Run Wizard = enabled, Go directly to home page
  • Specify default behavior for a new tab page = enabled, Home page
  • Turn on Suggested Sites = disabled
• User Config | Policies | Administrative Templates | Windows Components | Internet Explorer | Compatibility View
  • Include updated Web site lists from Microsoft  = enabled
• User Config | Policies | Administrative Templates | Windows Components | Internet Explorer | Internet Control Panel | Advanced Page
  • Turn on Enhanced Protected Mode  = disabled

Enhanced Protected Mode might disable Internet Explorer add-ons. Read the text to determine if it should be disabled.

Users might see a message that Protected mode is turned off for the Local intranet zone.

To prevent this message, do the following:

1. Edit the Citrix VDA All Users GPO.
2. Go to User Configuration > Preferences > Windows Settings > Registry.
3. Create a new Registry Item.
4. Set the Hive to: HKEY_CURRENT_USER
5. Set the Key Path to: Software\Microsoft\Internet Explorer\Main
6. Set the Value name to: NoProtectedModeBanner
7. Set the Value type to: REG_DWORD
8. Set the Value data to: 1
9. Click OK.
   

Published Internet Explorer Settings – Runonce

If a user launches Internet Explorer as a published application, then Internet Explorer might not be fully configured and thus some websites won’t work. By default, Windows runs per-user configuration (ActiveSetup) of Internet Explorer only when the user connects to a full desktop, which doesn’t happen when only launching published apps. To override this behavior so it works with published IE even if the user never connects to a full desktop, do the following:

1. Edit the Citrix VDA All Users GPO.
2. Go to User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff).
3. Double-click Logon.
   
4. Click Add.
   
5. In the Script Name field, enter runonce.exe.
6. In the Script Parameters field, enter /AlternateShellStartup. Click OK.
   

Windows 8.1/2012 R2 might not run the script at logon. Configure the following GPO computer settings to enable the script (configure these in the Citrix VDA Computer Settings GPO):

Logon Script GPO Settings

• Computer Configuration | Policies | Administrative Templates | System | Group Policy
  • Configure Group Policy Caching = disabled. Windows 8.1/2012 R2 setting
  • Configure Logon Script Delay = enabled, 0 minutes. Windows 8.1/2012 R2 setting.
  • Configure User Group Policy loopback processing mode = Enabled, either Merge or Replace depending on the desired result

Internet Explorer Group Policy Preferences

The Internet Explorer Maintenance settings in group policy (User Configuration > Windows Settings > Internet Explorer Maintenance) have been removed in Internet Explorer 10 and Windows Server 2012.

If you run group policy editor on Windows Server 2008 R2 and try to add an Internet Settings object using Group Policy Preferences, notice there is no option to configure Internet Settings for Internet Explorer 9 or Internet Explorer 10.

If you use group policy editor in Windows 8 or Windows 2012, then Internet Explorer 10 is an option.

If you have access to Windows 8/2012, you can add an Internet Settings object for Internet Explorer 10. When configuring a setting, notice the red or green lines (and red or green circles). Only green settings are applied. To change a setting to green, press F6 on your keyboard. To disable a setting, press F7 on your keyboard.

As you look through the tabs, you’ll see a bunch of green items. These green items will be applied and might not be the behavior you expect. To disable all settings on a particular tab, press F8. To turn them back on, press F5.

On the Common tab you can check the box to Apply once and do not reapply.

Internet Explorer Security Zone Configuration

There is a group policy setting at User Config | Policies | Administrative Templates | Windows Components | Internet Explorer | Internet Control Panel | Security Page |  Site to Zone Assignment List that can be used to put Internet sites in Internet Explorer security zones. However, users cannot add their own sites (the user interface in Internet Explorer is grayed out).

This section details an alternative procedure for administrator-configured zones while allowing users to add their own Trusted Sites.

Note: Zones can’t be configured using a Group Policy Preferences Internet Settings object so instead you’ll need to configure registry keys as detailed below.

1. Run Internet Explorer and configure security zones as desired.
2. If you are using Workspace Control in Receiver for Web or need pass-through authentication, make sure you add StoreFront as a Local Intranet Site.
   
3. Run Group Policy Management Console on the same machine where you have security zones configured.
4. Edit the Citrix VDA All Users GPO.
   
5. Go to User Configuration > Preferences > Windows Settings > Registry and create a new Collection Item. Name it IE Zones or similar.
   
6. Right-click the collection and click New > Registry Item.
   
7. Click the … button next to Key Path.
   
8. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains. Click the key corresponding to the FQDN you’re adding. Then select the registry value on the bottom that corresponds to the protocol (e.g. * or https). Click Select. Note: 1 indicates Local Intranet zone.
   
9. Then click OK. Note: 1 indicates Local Intranet zone.
   
10. Feel free to rename the Registry Item to reflect the actual zone.
    
11. Repeat these steps for additional zones.

Internet Explorer Home Page

If you don’t have access to Windows 8/2012 group policy editor, configure the default home page using a registry key.

1. Run Internet Explorer and configure home page as desired.
   
2. Run Group Policy Management Console on the same machine where you have the home page configured.
3. Edit the Citrix VDA All Users GPO.
   
4. Go to User Configuration > Preferences > Windows Settings > Registry and create a new Registry Item.
   
5. Click the … button next to Key Path.
   
6. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main. On the bottom, select Start Page. Then click Select.
   
7. On the Common tab, you can select Apply once and do not reapply. Then click OK.
   

Proxy Settings

If you don’t have access to Windows 8/2012 group policy editor, configure Proxy Settings using registry keys. Proxy Settings are stored under HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings. Use Group Policy Preferences or similar to distribute the registry keys.

To prevent users from changing proxy settings, also configure the following group policy setting.

Internet Explorer GPO Settings

• User Configuration | Policies | Administrative Templates | Windows Components | Internet Explorer | Internet Control Panel
  • Disable the Connections page = enabled

Office 2013/2016

Office 365 Planning

Citrix Implementation Guide Microsoft Office 365 for Citrix XenApp and XenDesktop 7.x contains:

• Considerations for Outlook Cached Mode
• Group Policy settings for Outlook Cached Mode
• For Lync Audio/Video – various options for delivering the Lync client
• Caveats for OneDrive for Business
• Licensing – shared computer activation

Sven Huisman – How-to configure Office 365 Pro in a non-persistent VDI environment: How to do Shared Computer Activation. ADFS recommended for Single Sign-on during Office activation.

Group Policy Templates

Download the Office 2013 group policy templates or Office 2016 group policy templates.

If you installed the 32-bit version of Office 2013/2016 then you’ll need the 32-bit (x86) version of the templates.

1. Go to the downloaded Office 2013 group policy templates and run AdminTemplates_32.exe. Or for Office 2016, run admintemplates_x86_4286-1000_en-us.exe.
   
   
2. Check the box next to Click here to accept and click Continue.
   
   
3. Specify a folder to place the extracted templates in.
   
   
4. Click OK to acknowledge that files extracted successfully.
   
   
5. Go to the folder where you extracted the files and in the ADMX folder copy all of the .admx files and the en-us folder to the clipboard.
   
   
6. Go to \\domain.com\sysvol\domain.com\Policies\PolicyDefinitions and paste the files.
   
7. If you do not have PolicyDefinitions in your Sysvol then instead go to C:\Windows\PolicyDefinitions and paste the files.
   

Group Policy and Tweaks

This section assumes the Group Policy Objects have already been created.

Edit the Citrix VDA All Users GPO and enable the Group Policy settings shown below. All are located under User Configuration > Policies.

• User Configuration | Policies | Administrative Templates | Microsoft Office 2013 (or 2016) | First Run
  • Disable First Run Movie = enabled
  • Disable Office First Run on application boot = enabled
• User Configuration | Policies | Administrative Templates | Microsoft Office 2013 (or 2016) | Global Options |Customize
  • Allow roaming of all user customizations = enabled
• User Configuration | Policies | Administrative Templates | Microsoft Office 2013 (or 2016) | Miscellaneous
  • Disable Office Animations = enabled
  • Do not use hardware graphics acceleration = enabled
  • Suppress recommended settings dialog = enabled
• User Configuration | Policies | Administrative Templates | Microsoft Office 2013 (or 2016) | Privacy | Trust Center
  • Automatically receive small updates to improve reliability = disabled
  • Disable Opt-in Wizard on first run = enabled
  • Enable Customer Experience Improvement Program = disabled
• User Configuration | Policies | Administrative Templates | Microsoft Office 2013 (or 2016) | Tools | Options | General | Service Options… | Online Content
  • Online Content Options = enabled, Allow Office to connect to the Internet
• User Configuration | Policies | Administrative Templates | Microsoft Outlook 2013 (or 2016) | Account Settings | Exchange | Cached Exchange Mode
  • Use Cached Exchange Mode for new and existing Outlook profiles = disabled

  • If you prefer to use Cached Exchange Mode, see Citrix’s Implementation Guide and add below:

    • Cached Exchange Mode Sync Settings = enabled, time-window of downloaded content
    • Administrative Templates | Microsoft Outlook 2013 | Miscellaneous | PST Settings | Default location for OST files = enabled, UNC path to user home directories
• User Configuration | Policies | Administrative Templates | Microsoft Outlook 2013 (or 2016) | Miscellaneous | PST Settings
  • Default location for PST files = enabled, user’s home directory
• User Configuration | Policies | Administrative Templates\ Microsoft Outlook 2013 (or 2016) | Outlook Options | Other | AutoArchive
  • AutoArchive Settings = enabled, uncheck box next to Turn on AutoArchive
• User Configuration | Policies | Administrative Templates | Microsoft Outlook 2013 (or 2016) | Outlook Options | Preferences | Search Options
  • Prevent installation prompts when Windows Desktop Search component is not present = enabled

Microsoft hotfix 2786932 – Dialog boxes and new windows displayed as blank in Office 2013 RemoteApps on a client computer that is running Windows 7 or Windows Server 2008 R2

From Thomas Koetzing – How to disable Office 2013 shadow border:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI\MSO_BORDEREFFECT_WINDOW_CLASS]
"ClassName"="MSO_BORDEREFFECT_WINDOW_CLASS"
"Type"=dword:00001000

Adobe Reader

Adobe Reader Group Policy

1. Download the Adobe Reader XI Policy Templates from Reader XI Administrative Template
2. Copy the .admx file and the en-us folder.
   
3. Go to \\domain.com\SYSVOL\domain.com\Policies\PolicyDefinitions and paste the files. If this folder doesn’t exist, go to C:\Windows\PolicyDefinitions instead.
   
4. Click Yes when asked to replace files.
5. Now open a group policy that applies to all Citrix users.
6. Go to User Configuration > Administrative Templates > Adobe Reader > Preferences > General.
7. Open the setting Accept EULA and Enable it.
   
8. Then open the Display splash screen at launch setting and Disable it.
   

Disable Repair

In Adobe Reader, users can open the Help menu and click Repair Adobe Reader Installation.

Then users are prompted to reboot. Obviously this is not good. Even non-admins can reboot.

1. In regedit, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Acrobat Reader\11.0\Installer.
2. Add the DWORD DisableMaintenance and set it to 1.
   
3. Now the Repair option is grayed out on the Help menu.
   
   

Disable Updates

For Acrobat Reader DC, you must edit the registry to disable Updates. This also works for Adobe Reader XI.

• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Adobe ARM\Legacy\Reader\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}
  • Mode = 0 (disables updates)

In Adobe Reader XI, there is a GUI method of disabling updates:

1. Run Adobe Reader from the Start Menu.
2. Open the Edit menu and click Preferences.
   
3. On the Updater page, change the selection to Do not download or install updates automatically and click OK.
   

Other Optimizations

Rick van Soest Removing “The Cloud” from Adobe Acrobat Reader DC:

• To remove tools, delete them from C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU
• To remove the welcome screen, add the following registry dword value: HKLM\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown
  • bUsageMeasurement (REG_DWORD) = 0
• To remove the “add account” button, HKLM\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cSharePoint
  • BDisableSharePointFeatures (REG_WORD) = 1
• To remove the “Check for update” button, HKLM\Software\Adobe\Acrobat Reader\DC\Installer
  • DisableMaintenance (REG_DWORD) = 1

Citrix Blog Post Optimizing Adobe Reader in XenApp details the following optimizations:

• Remove toolbar on right side of screen
• Remove links from the Help menu
• Disable Adobe ARM
• Disable Autosave

Adobe.com – Citrix Deployments: Before deployment, the product should be configured as needed. In particular, you will want to disable features and behaviors that should not be accessible to end users in an IT-managed environment. For example:

• The Updater should be disabled as described in this guide and the Preference Reference.
• Accept the EULA on behalf of all users by setting the appropriate registry key.
• For multilanguage installations (MUI), set the preferred language for all users via the SUPPRESSLANGSELECTION property or registry settings described in the Preference Reference.
• Deploy enterprise files to the product’s directories (rather than per-user directories) so they are available to all users.
• There are over 500 documented settings. Refer to the Preference Reference for complete registry and plist details.

Scrolling performance

If scrolling performance is poor in graphic intensive documents, try the following:

• Go toEdit > Preferences > Rendering.
• UncheckSmooth line art and Smooth images. Alternatively, you can set these preferences during pre-deployment configuration:
  • HKCU\Software\Adobe\Adobe Acrobat\10.0\Originals\bAntialiasGraphics: 0x00000000
  • HKCU\Software\Adobe\Adobe Acrobat\10.0\Originals\bAntialiasImages: 0x00000000

Distiller performance

• In some environments, Distiller performance may suffer if the messages.log file becomes too large after a number of Distiller operations. Delete this file periodically. It is located at \Application Data\Adobe\Acrobat\Distiller<version>\messages.log.
• Remove unused fonts from the Windows installation.

ShareFile On-Demand Sync

On most Citrix VDA machines, ShareFile Sync should be configured for On-Demand Sync where files are only downloaded when the user demands them. On-Demand Sync is enabled using group policy.

Citrix Whitepaper Implementing ShareFile On-Demand Sync

ShareFile Sync – Install

1. Go to the downloaded ShareFile On-Demand Sync for Windows 2.15. Download the one with the push install description.
   
2. Run the downloaded ShareFileSync64_2.15.104.0.exe.
   
3. In the Please read the Citrix ShareFile Sync License Agreement page, check the box next to I accept the terms and click Install.
   
4. In the Completed the Citrix ShareFile Sync Setup Wizard page, click Finish.
   

ShareFile Sync Group Policy Templates

1. Find the GPO templates at C:\Program Files\Citrix\ShareFile\Sync\Configuration\PolicyDefinitions. Copy them to the clipboard.
   
2. Go to \\corp.local\sysvol\corp.local\Policies and paste the files in the PolicyDefinitions folder. If you don’t have this folder, then paste them in C:\Windows\PolicyDefinitions.
   
   

ShareFile Sync Group Policy Settings

From Dan Brinkmann at discussions.citrix.com: “There is a known issue with XenDesktop 7.6 when there are no XD policies applied it deletes the ShareFile key.” Also at the same post: “Somehow Sharefile will not use proxy settings when in On-Demand mode.”

Edit the Citrix Computer Settings GPO and enable the Group Policy setting shown below. All are located under Computer Configuration > Policies.

• Computer Configuration\Policies\Administrative Templates\ Citrix\Profile Management\File System
  • Exclusion list – directories = add ShareFile to the list
    
• Computer Configuration\Policies\Administrative Templates\ ShareFile\Enterprise Sync
  • On-demandSyncDiskVolume = enabled, C:\

Edit the Citrix VDA All Users Settings GPO and enable the Group Policy setting shown below. All are located under User Configuration > Policies.

• User Configuration | Policies | Administrative Templates |  ShareFile | Enterprise Sync
  • Account = enabled, enter your account address (e.g. company.sharefile.com)
  • Authentication Type = enabled, and configure as appropriate for your environment. If you use SAML Forms, make sure *.sharefile.com and your gateway.company.com DNS names are added to Trusted Sites in Internet Explorer.
  • LocalSyncFolder = enabled,  enter %userprofile%\ShareFile. Network drive is not supported.
  • On-demandPersonalFolder = enabled, check Sync personal folder
• User Configuration | Policies | Administrative Templates| Windows Components | File Explorer (or Windows Explorer)
  • Turn off the display of thumbnails and only display icons = enabled. This setting prevents Windows from downloading ShareFile files when retrieving thumbnails.

After logging in to Citrix and running ShareFile Sync, if you go to the ShareFile folder it will look like the files have been downloaded.

However, if you browse to the same folder from another machine, you’ll see they haven’t been downloaded yet. They will be downloaded when the user demands them.

File Type Association

James Rankin – Deploying per-user file type associations in Windows 8.1 / Server 2012 R2 and beyond: Microsoft’s new DISM method of changing File Type Associations is done at the machine-level. Use Group Policy Preferences to change the machine registry key but on a per-user basis.

Next Steps

• Citrix Policy Settings
• Citrix Profile Management
• Back to XenApp/XenDesktop

Navigation

• Citrix Policy Settings – GPO Method
• Citrix Policy Templates 
• Framehawk Configuration
• Graphics Settings
• Additional Policy Settings

= Recently Updated

Citrix Policy Settings – GPO Method

Citrix offers two methods of configuring policy settings:

• Citrix Studio – also known as FMA policies
• Group Policy Object – Studio adds a Citrix Policy node to the regular Group Policy Editor.

For this page, Citrix Policy refers to policy settings that are provided by Citrix for VDAs. It does not include settings that are native to Microsoft group policies. See the Group Policies topics for more information on the recommended Microsoft group policy settings for a XenApp/XenDesktop environment.

Citrix Policies can be easily configured in Citrix Studio and stored in the site database. However, they are not portable meaning that you can’t export them from one XenApp/XenDesktop site and import them to another.

GPOs are linked to an Active Directory OU and can apply to VDAs in multiple XenApp/XenDesktop sites. If you use the GPO method, make sure the GPOs are linked to OUs that contain VDAs.

If you ever want to copy the Studio policies to a Citrix Policy contained in a GPO, run the following PowerShell commands as mentioned at discussions.citrix.com:

New-PSDrive -PSProvider CitrixGroupPolicy -Name LocalFarmGpo -Root \ ‑Controller "MyController"

New-PSDrive -PSProvider CitrixGroupPOlicy -Name TargetGPO -Root \ ‑DomainGpo "MyGPO"

cd LocalFarmGpo:\User

copy * TargetGPO:\User

Do the same for Computer.

1. Login to a machine (e.g. Controller) that has Citrix Group Policy Management installed.
2. Run Group Policy Management Console. It’s a Windows Feature.
3. Edit a GPO that applies computer settings to the VDA machines.
   
4. In the GPO, expand Computer Configuration, expand Policies and click Citrix Policies.
5. On the right, on the Templates tab, you can create a new policy based on a built-in template. Note: Citrix (Daniel Feller XenDesktop 7.7 and Windows 7) has found that the High Server Scalability template can increase user density by 30%.
   
6. On the Policies tab, you can either edit the Unfiltered policy or you can create a new one that is filtered. Below the policy, click the Settings tab.
   
7. As you edit the policy settings, make note of the Applies to field. Some of the settings do not apply to Virtual Delivery Agent 7.6.
   
   Also notice that some settings apply to Desktop OS (virtual desktop) or Server OS (Remote Desktop Session Host) but not necessarily both. Read the Applies to section to verify.
   
8. Change the Categories drop-down to Auto Client Reconnect.
9. Click Add next to the setting Auto client reconnect logging.
   
   
10. Change the Value to Log auto-reconnect events and click OK.
    
11. Change the Categories drop-down to End User Monitoring.
12. Click Add next to the setting ICA round trip calculations for idle connections.
    
13. Change the selection to Enabled and click OK.
    
14. Change the Categories drop-down to Local App Access.
15. Click Add next to the setting Allow Local App Access.
    
16. Change the selection to Allowed and click OK.
    
17. Change the Categories drop-down to Printing.
18. Click Add next to the setting Universal Print Server enable.
    
19. Change the Value to Enabled with fallback to Windows’ native remote printing. Click OK.
    
20. Change the Categories drop-down to WebSockets.
21. Click Add next to the setting WebSockets connections.
    
22. Change the setting to Allowed and click OK. This is the last Computer setting.
    
23. With the GPO method, Citrix settings are split between Computer and User. The remaining settings are User settings. Edit a GPO that applies to Users.
    
24. Expand User Configuration, expand Policies and click Citrix Policies.
25. On the right, select the Unfiltered policy and below it click the Settings tab. Or you can create a new policy that is filtered.
    
26. Change the Categories drop-down to Audio.
27. Click Add next to the setting Audio quality.
    
28. Change the Value to Medium – optimized for speech and click OK.
    
29. Change the Categories drop-down to Client Sensors.
30. Click Add next to the Allow applications to use the physical location setting.
    
31. Change the selection to Allowed and click OK.
    
32. Change the Categories drop-down to Mobile Experience.
33. Click Add next to the Automatic keyboard display setting.
    
34. Change the selection to Allowed and click OK.
    
35. Click Add next to the Remote the combo box setting.
    
36. Change the selection to Allowed and click OK.
    
37. Change the Category drop-down to Multimedia.
38. Click Add next to the Use GPU for optimizing Windows Media setting.
    
39. Change the selection to Allowed and click OK.
    
40. Change the Categories drop-down to Printing.
41. Click Add next to the setting Auto-create PDF Universal Printer.
    
42. Change the selection to Enabled and click OK.
    
43. Click Add next to the setting Automatic installation of in-box printer drivers.
    
44. Change the selection to Disabled and click OK.
    
45. Click Add next to the setting Direct connections to print servers.
    
46. Change the selection to Disabled and click OK.
    
47. Click Add next to the setting Printer auto-creation event log preference.
    
48. Change the Value to Log errors only and click OK.
    
49. Click Add next to the setting Universal print driver usage.
    
50. Change the Value to Use universal printing only.
    
51. Change the Categories drop-down to Session Limits.
52. If you look at the Applies to text for these settings, notice that they apply to virtual desktops but not Remote Desktop Session Hosts. Session timeouts for Remote Desktop Session Hosts can be configured in a Microsoft GPO.
    
53. Change the Categories drop-down to Time Zone Control.
54. Click Add next to the setting Use local time of client.
    
55. Change Value to Use client time zone. Note: you must also configure the Microsoft GPO Remote Desktop Session Host time zone setting.
    
56. Change the Categories drop-down to USB Devices.
57. Click Add next to the setting Client USB device redirection.
    
58. Change the selection to Allowed and click OK. This is the last generic setting. See the next couple sections for more settings.
    

Citrix Policy Templates

1. The Citrix Policies node of a GPO (or Citrix Studio) has a Templates tab. Each of these templates has pre-defined settings that you can use as a basis for new policies. Note: Citrix (Daniel Feller XenDesktop 7.7 and Windows 7) has found that the High Server Scalability template can increase user density by 30%. 
   
2. Citrix CTX202000 Group Policy Management Template Updates for XenApp/XenDesktop contains additional templates that you can download and import.
   
   
3. If you are using a GPO to configure Citrix Policies, be aware that user settings and computer settings are in different parts of the GPO.
   
4. If you highlight a template, on the bottom of the window is a Settings tab that lets you see what’s contained in the template.
5. To use a template, right-click it and click New Policy.
   

Framehawk Configuration

1. Framehawk is disabled by default because it uses more bandwidth and more server resources. Citrix recommends only enabling it for users on lossy connections with high bandwidth. More details in the Framehawk Virtual Channel Administrator Guide at docs.citrix.com.
2. To enable Framehawk, you edit a Citrix Policy, either in Studio or in a GPO. In either case you need the updated Group Policy Management 2.4 Hotfix 2 or Group Policy Management 2.5 (aka 7.6.300) on the machine where you are editing the policy.
   
   
3. If configuring a GPO, you’ll find the setting in User Configuration > Policies > Citrix Policies.
   
4. Search for Framehawk, add the Framehawk display channel setting and Enable it.
   
   
5. Framehawk requires the newest Citrix Receiver (4.3.100 or newer).
   
   
6. To use Framehawk with Receiver for iOS 6.0, add Framehawk=On to the WFClient section of the file C:\inetpub\wwwroot\Citrix\Store\App_Data\default.ica in StoreFront.
   
7. To use Framehawk through NetScaler Gateway you need NetScaler firmware 11.0 build 62 or newer.
8. Then enable DTLS on the Gateway vServer. This is the same process as enabling DTLS for UDP Audio.
   
9. Framehawk defaults to ports UDP 3224-3324. Open this between the NetScaler SNIP and the VDAs.

Graphics Settings

For an explanation of the graphics policy settings, see:

• Citrix Blog Post Why Should You Care About the New HDX Thinwire describes the new Thinwire+ codec in XenApp/XenDesktop 7.6.300 and how to use Citrix Policies to configure it.  
• Citrix CTX202687 HDX Graphics Modes – Which Policies Apply to DCR/Thinwire/H.264 – An Overview for XenDesktop/XenApp 7.6 FP3 
• Bram Wolfs A graphical deep dive into XenDesktop 7
• Citrix Blog Post What’s new with HDX display in XenDesktop & XenApp 7.x?

From http://discussions.citrix.com/topic/347341-specific-application-freezes-receiver-41-session-window/: If you experience graphics performance problems in XenDesktop 7.6, consider configuring the following settings:

• ICA \ Desktop UI \ Desktop Composition Redirection = Disabled
• ICA \ Graphics \ Legacy Graphics Mode = Enabled

Additional Policy Settings

To improve security, Citrix recommends these additional Citrix Policy settings.

• User \ ICA \ Client clipboard redirection = Prohibit
• User \ ICA \ Desktop launches = Disabled
• User \ ICA \ Launching of non-published programs = Disabled
• User \ ICA \ File Redirection \ Auto connect client drives = Prohibit
• User \ ICA \ File Redirection \ Fixed drives = Disable
• User \ ICA \ File Redirection \ Client network drives = Prohibit
• User \ ICA \ File Redirection \ Client removable drives = Prohibit
• User \ ICA \ Printing \ Client printer redirection = Prohibit
• User \ ICA \ SecureICA \ SecureICA minimum encryption level = RC5 128 bit
• User \ ICA \ Session Limits \ Disconnected session timer = Enabled
• User \ ICA \ Session Limits \ Disconnected session timer internal = 30 minutes
• User \ ICA \ TWAIN devices \ Client TWAIN device redirection = Prohibit
• User \ ICA \ USB devices \ Client USB device redirection = Disable
• User \ ICA \ USB devices \ Client USB device redirection rules = Prohibit
• User \ ICA \ USB devices \ Client USB Plug and Play device redirection = Prohibit

Additional clipboard settings were added in XenApp/XenDesktop 7.6. To see them, set the middle drop-down to All Settings and then search for clipboard. The setting Readonly clipboard does not apply to 7.6 so skip it. Instead, review the three clipboard settings below it. Or you can turn off clipboard altogether by setting Client clipboard redirection to Prohibit.

Under File Redirection is a setting for Read-only client drive access. This allows client drive mapping but prevents files from being copied to the client device.

The following ICA/HDX protocol tuning options should be evaluated to optimize bandwidth consumption and virtual desktop resource utilization:

• User \ ICA \ Desktop UI \ Desktop Wallpaper = Disable
• User \ ICA \ Desktop UI \ Menu animation = Disable
• User \ ICA \ Desktop UI \ View window contents while dragging = Disable
• User \ ICA \ Multi Stream Connections \ Multi-Stream = Enable (and QoS)
• User \ ICA \ Printing \ Direct connection to print servers = Disable
• User \ ICA \ TWAIN devices \ TWAIN Compression Level = High
• User \ ICA \ Visual Display \ Target Frames per Second = 15
• User \ ICA \ Visual Display \ Moving Images \ Minimum Image Quality = Low
• User \ ICA \ Visual Display \ Still Images \ Extra Color Compression = Enabled in very low bandwidth scenarios. Please note that the “Extra Color Compression Threshold” should be configured to an appropriate value.
• User \ ICA \ Visual Display \ Still Images \ Lossy compression level = High or “Heavyweight compression” in case image quality loss is not acceptable (more CPU intensive)
• Enable “Windows Media Redirection”
• Enable “Flash acceleration” with client side content fetching
• Enable “Audio over UDP Real-Time Transport”. Please note that this configuration requires audio quality to be set to “Medium – optimized for speech”
• Set “Progressive compression level” to “Low” or any higher value

For more information, please refer to the Citrix Knowledgebase Article CTX131859 – Best Practices and Recommendations for Citrix Receiver 3 and HDX Technology with XenDesktop 5.5.

Navigation

• Remote PC Catalog and Delivery Group
• Disable Multiple Users per PC
• Install VDA on PC
• Remote PC Maintenance

Remote PC Catalog and Delivery Group

1. In Citrix Studio, Create a machine catalog.
   
2. In the Operating System and Hardware page, select Remote PC Access and click Next.
   
3. In the Machine Accounts page, click Add OUs.
   
4. Browse to an OU containing office PCs and click OK.
   
5. Then click Next.
   
6. In the Scopes page, click Next.
   
7. Name it Remote PC or similar and then click Finish.
   
8. Create a Delivery Group.
   
9. Highlight the Remote PC catalog and click Next.
   
10. Add users that can access the Remote PCs and then click Next.
    
11. In the StoreFront page, click Next.
    
12. In the Scopes page, select a scope and then click Next.
    
13. In the Summary page, enter a name for the Delivery Group and then click Finish.
    

Multiple Users per PC

By default, when using Remote PC Access in XenDesktop, console session on the physical machine can be started to assign multiple users to the same Remote PC desktop, provided they conform to the relevant assignment policies. This gives all these users the ability to start remote sessions on the machine.

This article describes how this feature can be disabled, so only the first applicable user to log on to the machine after it has registered with the Citrix Broker service that gets assigned to the machine.

How to Switch Off Remote PC Access Multiple User Assignment in XenDesktop 7.x – configured on the XenDesktop Controllers.

Install VDA on PC

1. Install .NET Framework 3.5 or 4.0.
2. Disable power saving options (e.g. Hibernate, Sleep, etc.)
3. Download Virtual Delivery Agent 7.6.300 from XenDesktop Platinum, XenDesktop Enterprise, depending on your license .
4. Install Virtual Desktop Agent 7.6.300. Since Remote PC is typically installed on many distributed PCs, use a software deployment tool to install the VDA package using CLI parameters. See Install VDAs using the standalone package at docs.citrix.com for more information.

   VdaWorktationSetup.exe /quiet /components vda,plugins /controllers "Contr-East" /enable_hdx_ports /exclude "Citrix User Profile Manager" /enable_real_time_transport /noreboot
   

5. Install VDA hotfixes. Note: there currently are no hotfixes for VDA 7.6.300.

By default, a remote user’s session is automatically disconnected when a local user initiates a session on that machine (by pressing CTRL+ATL+DEL). To prevent this automatic action, add the following registry entry on the office PC, and then restart the machine.

HKLM\SOFTWARE\Citrix\PortICA\RemotePC\SasNotification=dword:00000001

After the registry change and machine restart, if a local user presses CTRL+ALT+DEL to log on to that PC while it is in use by a remote user, the remote user receives a prompt asking whether or not to allow or deny the local user’s connection. Allowing the connection will disconnect the remote user’s session. See the Citrix Blog Post Remote PC Access – UI Messaging for Console Users for more information.

Remote PC Maintenance

Assign/Un-assign users – There are four methods of assigning users to desktops:

• Let Remote PC do it automatically. The first user that logs into the physical machine will be assigned to the desktop. If single user mode is not enabled then all other users that log into the machine will also be assigned to the desktop.
• In Studio, find the machine, right-click it and click Change User.
  
• In Director, go to machine details and click Manage Users.
  
• Use PowerShell:

asnp citrix.*
Remove-BrokerUser -Machine 'CORP\WIN701' -Name 'CORP\user01'
Add-BrokerUser -Machine 'CORP\WIN701' -Name 'CORP\user01'

Rename desktop icon – For Remote PC, the icon displayed to the user is the actual machine name. This sometimes is not very intuitive. The name displayed to the user can be changed by running a PowerShell command.

asnp citrix.*
Set-BrokerPrivateDesktop CORP\VDI001 PublishedName "Users Desktop"

Display last login time for the machines – Use the following PowerShell to display desktops sorted by when they were last used. Adjust the date filter as desired. You can manually remove the older machines or pipe the results to Remove-BrokerMachine.

asnp citrix.*

Get-BrokerDesktop -CatalogName "Remote PC" -filter {LastConnectionTime -le "2015-02-28"} 
-property AssociatedUserNames,MachineName,LastConnectionTime | Sort-Object LastConnectionTime

The above PowerShell command uses the -filter and -property switches. These switches process the filtering on the server-side, which improves performance.

Navigation

• Planning
• Server Installs:
  • IIS and Message Queuing
  • Server Components
• Session Recording Server Configuration
• Session Recording Agent
• Session Recording Player
• Director Integration

Planning

George Kuruvilla – An Introduction To Session Recording (XA/XD 7.6 Feature Pack 1) – Installation, Configuration and User Experience

Citrix links:

• Docs.citrix.com – Session Recording – for XenApp 7.6 FP1 and FP2
• Citrix CTX200868 – Configuring Security Features of Session Recording
• Citrix CTX200869 – Building a Highly Scalable Session Recording System

XenApp/XenDesktop Platinum Edition licensing is required.

Remote Desktop Session Host VDAs only. No virtual desktops in this release.

There is no relation between Session Recording and XenApp/XenDesktop farms. You can have Agents from multiple XenApp/XenDesktop farms recording to a common Session Recording server. Or you can split a XenApp/XenDesktop farm so that different Agents point to different Session Recording servers. An Agent can only point to one Session Recording server (Load Balancing is not supported).

The Session Recording server will need a hard drive to store the recordings. Disk access is primarily writes.

Offloaded content (e.g. HDX Flash, Lync webcam, MMR) is not recorded.

Session Recording server needs a certificate. The certificate must be trusted by Agents and Players. Internal Certificate Authority recommended.

SQL:

• Supported Versions = SQL 2008 R2 Service Pack 3 through SQL 2014.
• The SQL database is very small.
• The database name is CitrixSessionRecording. Can’t be changed.
• Temporary sysadmin permissions are needed to create the database and sysadmin can be revoked after installation.
• SQL Browser Service must be running.

Download Session Recording from XenApp 7.6 Feature Pack 2, Platinum Edition or XenDesktop 7.6 Feature Pack 2, Platinum Edition, depending on your license:

Session Recording Server Installs

IIS and Message Queuing

1. If you are installing this on Windows Server 2008 R2 then see the prerequisites list at docs.citrix.com.
2. In Server Manager, open the Manage menu and click Add Roles and Features.
   
3. Skip to the Server Roles page.
4. In the Server Roles page, check the box next to Web Server (IIS) and click Next.
   
5. In the Features page, expand Message Queuing, and expand Message Queuing Services.
6. Select Message Queuing Server and HTTP Support. Click Next.
   
7. In the Select role services page, expand Security and click Windows Authentication.
   
8. Expand Application Development and select ASP.NET 4.5.
   
   
9. Expand IIS 6 Management Compatibility and select all four boxes. Click Next through the rest of the wizard.
   
10. Use MMC Certificates snap-in or IIS or similar to request a machine certificate.
    
11. In IIS Manager, right-click the Default Web Site and click Edit Bindings.
    
12. On the right, click Add.
    
13. Change the Type to https.
14. Select the certificate and click OK.
    

Server Components

1. If you are installing this on Windows Server 2008 R2 then see the prerequisites list at docs.citrix.com.
2. The person installing Session Recording needs to be a sysadmin on the remote SQL server.
3. In the SessionRecording7.6.100\Session Recording Administration folder, run Broker_PowerShellSnapIn_x64.msi.
   
4. In the Please read the Citrix Broker PowerShell Snap-In License Agreement page, check the box next to I accept the terms and click Install.
   
5. In the Completed the Citrix Broker PowerShell Snap-In Setup Wizard page, click Finish.
   
6. Run SessionRecordingAdministrationx64.msi.
   
7. In the Welcome to the Citrix Session Recording Administration Installation Wizard page, click Next.
   
8. In the License Agreement page, select I accept the license agreement and click Next.
   
9. In the Select Features page, click Next.
   
10. In the Database and Server Configuration page, enter the name of the SQL server and click Test.
    
11. Enter the name of the Session Recording server in domain\machine-name format and click Next.
    
12. In the Citrix Customer Experience Improvement Program page, make a choice and click Next.
    
    
13. In the Ready to Install the Application page, click Next.
    
14. In the Citrix Session Recording Administration has been successfully installed page, click Finish.
    
15. In SQL Server Management Studio, notice the new CitrixSessionRecording database.
    

Session Recording Server Configuration

1. From Start Menu, run Session Recording Server Properties.
   
2. In the Storage tab, specify a path that has disk space to hold the recordings. UNC is supported but strongly discouraged.
   
3. In the Signing page, select a certificate to sign the recordings.
   
4. In the Playback tab, notice that Session Recording files are encrypted before transmit. Also, it’s possible to view live sessions but live sessions are not encrypted.
   
5. In the Notifications tab you can change the message displayed to users before recording begins.
   
   
6. The CEIP tab lets you enable or disable the Customer Experience Improvement Program.
   
7. When you click OK you’ll be prompted to restart the service.
   
8. From the Start Menu, run Session Recording Authorization Console.
   
9. In the PolicyAdministrator role, add your Citrix Admins group.
10. If you use Director to configure Session Recording, add the Director users to the PolicyAdministrator role.
    
11. In the Player role, add users that can view the recordings.
    
12. From the Start Menu, run Session Recording Policy Console.
    
13. Enter the hostname of the Session Recording server and click OK.
    
14. Only one policy can be enabled at a time. By default, no recording occurs. To enable recording, right-click one of the other two built-in policies and click Activate Policy.
    
15. Or you can create your own policy by right-clicking Recording Policies and clicking Add New Policy.
    
    
16. After the policy is created, right-click it and click Add New Rule.
    
17. Decide if you want notification or not and click Next.
    
18. Choose the rule criteria. Then click the link to specify the groups, applications or servers for the rule. Click Next.
    
19. Give the rule a name and click Finish. Continue adding rules.
    
20. When done creating rules, right-click the policy and click Activate Policy.
    
21. You can also rename the policy you created.
    

Session Recording Agent

Install the Agent on the Remote Desktop Session Host VDAs. Remote Desktop Session Host only (no virtual desktops). Platinum Licensing is required.

1. In Server Manager, open the Manage window and click Add Roles and Features.
   
2. Skip to the Features page.
3. In the Features page, expand Message Queuing. Expand Message Queuing Services.
4. Check the box next to Message Queuing Server. Also check HTTP Support.
   
5. Click Add Features. Click Next.
   
6. In the Select role services page, don’t change anything and click Next.
   
7. In the Confirm installation selections page, click Install.
8. In the SessionRecording7.6.100\Session Recording Agent folder run SessionRecordingAgentx64.msi.
   
9. In the Welcome to the Citrix Session Recording Agent Installation Wizard page, click Next.
   
10. In the License Agreement page, select I accept the license agreement and click Next.
    
11. In the Session Recording Agent Configuration page, enter the FQDN of the Session Recording Server and click Test.
    
12. Click OK and then click Next.
    
13. In the Destination Folder page, click Next.
    
14. In the Ready to Install the Application page, click Next.
    
15. In the Citrix Session Recording Agent has been successfully installed page, click Finish.
    
16. Agent Installation can also be automated. See Automating installations at docs.citrix.com.
17. In the Start Menu is Session Recording Agent Properties.
    
18. You can enable or disable session recording on this Agent.
    

Session Recording Player

Install the Player on any Windows 7 through Windows 8.1 desktop machine. 32-bit color depth is required. Because of the graphics requirements, don’t run the Player as a published application.

1. In the SessionRecording7.6.100\Session Recording Player folder, run SessionRecordingPlayer.msi.
   
2. In the Welcome to the Citrix Session Recording Player Installation Wizard page, click Next.
   
3. In the License Agreement page, select I accept the license agreement and click Next.
   
4. In the Destination Folder page, click Next.
   
5. In the Ready to Install the Application page, click Next.
   
6. In the Citrix Session Recording Player has been successfully installed page, click Finish.
   
7. From the Start Menu, run the Session Recording Player.
   
8. Open the Tools menu and click Options.
   
9. On the Connections tab, click Add.
   
10. Enter the FQDN of the Session Recording server.
    
11. On the Cache tab you can adjust the client-side cache size. Click OK.
    
12. Use the Search box to find recordings.
    
13. Or you can go to Tools > Advanced Search.
    
    
14. Once you find a recording, double-click it to play it.
    
15. To skip spaces where no action occurred, open the Play menu and click Fast Review Mode.
    
16. You can add bookmarks by right-clicking in the viewer pane. Then you can skip to a bookmark by clicking the bookmark in the Events and Bookmarks
    pane.
    

Director Integration

1. On the Director server, run command prompt elevated (as Administrator).
   
2. Run C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /configsessionrecording
3. Enter the Session Recording FQDN when prompted.
   
4. In Director, when you view users or machines, you can change the Session Recording policy. These policy changes don’t apply until a new session is launched.
   
5. If the Session Recording menu says N/A then the Director user needs to be authorized in the Session Recording Authorization Console.
   
   
6. If you use Director to enable or disable recording for a user or machine, rules are added to the active policy on the Session Recording server. They only take affect at next logon.
   

Navigation

• Planning
• SQL Database
• Server Prerequisites
• Server Installation
• Configuration Wizard
•  Launch and Login
• Welcome Wizard
• Users
• Direct Import
• Install Capture
  • Prepare Install Capture Machine
  • Configure AppDNA for Install Capture
  • Perform Install Capture
• Self Provisioning
  • Prepare Self Provisioning Machine
  • Perform Self Provisioning Capture
• Solutions

Planning

Your Citrix License Server must have XenApp or XenDesktop Platinum Edition licenses. If you don’t have Platinum Edition licenses then work with a Citrix Partner to perform AppDNA analysis.

AppDNA server should have the following:

• 12 GB of RAM
• 80 GB free disk space for up to 200 applications. 150 GB if more applications.

SQL Server:

• SQL 2008 R2, 2012, or 2014. SQL Express is not supported.
• AppDNA generates load on SQL during install (duration = few hours) and during import and analysis.
• See Optimize AppDNA > Optimize SQL Server at docs.citrix.com.
• Disk space could easily be 20+ GB.

AppDNA can directly import and analyze .msi installers. For non-.msi installers, you’ll need a machine to capture the install process. The machine(s) should be the same operating system as what you are migrating from. The machine can either be directly accessible through a hypervisor, which means AppDNA can automate the capture process. Or it can be any machine where a user can perform Self Provisioning.

SQL Database

1. Create a new SQL database.
   
   
2. On the Options page, the Collation must be Latin1_General_CI_AS.
   
3. Add a service account to SQL logins.
4. On the Server Roles page, add the service account to the bulkadmin role.
   
5. Give the service account db_owner permission to the AppDNA database.
   

Server Prerequisites

1. On the AppDNA Server, open Computer Management. Edit the Administrators group and add the service account.
   
2. In Server Manager, start the Add Roles and Features Wizard.
3. In the Server Roles page, select Web Server (IIS) and click Next.
   
4. In the Select features page, select .NET Framework 3.5 (and 4.5). Click Next.
   
5. In the Select role services page, select HTTP Redirection. Scroll down.
   
6. Scroll down and under Health and Diagnostics select Request Monitor.
   
7. Scroll down and  under Performance select Dynamic Content Compression.
   
8. Scroll down and under Security select Basic Authentication, IP and Domain Restrictions, URL Authorization, and Windows Authentication.
   
9. Scroll down and under Application Development select everything except CGI and WebSocket Protocol.
   
10. Scroll down and check the box next to IIS 6 Management Compatibility, which includes IIS 6 Metabase Compatibility.
11. Also select IIS Management Scripts and Tools and Management Service. Click Next.
    
12. In the Confirm installation selections page, click Specify an alternate source path.
    
13. Browse to the sources folder on the Windows Server 2012 R2 DVD and click OK.
    
14. Click Install.

Server Installation

1. Run the downloaded AppDNA 7.6.5 (Citrix-AppDNA.msi).
   
2. In the Welcome to the Installation Wizard for Citrix AppDNA 7.6.5 page, click Next.
   
3. In the License agreement page, select I accept the terms and click Next.
4. In the Citrix AppDNA Installation Type page, select Complete and click Next.
   
5. In the Citrix AppDNA installation locations page, click Next.
   
6. In the Ready to install Citrix AppDNA page, click Install.
7. In the Installation Wizard Completed page, click Finish.

Configuration Wizard

1. The Configuration wizard launches.
2. If you see a Prerequisites page, click Enable.
   
3. In the Configure AppDNA page, click Next.
   
4. In the Database creation page, enter the SQL server name, enter the database name, and click Next.
   
5. In the AppDNA web site credentials page, enter the credentials of your service account and click Next.
   
6. In the License database page, enter the address of a Citrix License server that has XenApp/XenDesktop Platinum Licenses and click Next.
   
7. In the System check page, click Configure.
   
8. It will probably take several hours to populate the database.
   
9. Click Close when done.
10. See Optimize AppDNA > Optimize IIS at docs.citrix.com.

 Launch and Login

1. Launch AppDNA from the Start Menu.
   
2. Login as administrator and apps3cur3.
   

Welcome Wizard

1. In the Welcome page, click Next.
   
2. This wizard lets you select which modules to enable. The more modules you enable, the longer it takes to analyze an application. Go through each page and make your selections.
   
   
   
   
3. Then click Configure.
   
4. And click Close.
   

Users

1. Open the Administration menu and click Users.
   
2. In the toolbar, click Import from AD.
   
3. Select your Citrix Admins group and click OK.
   
4. On the right, notice that Administrators role is selected by default.
   
5. Open the File menu and click Exit.
   
6. Launch AppDNA again.
7. On the login page, click Options.
   
8. You can check the box next to Integrated Login and click Log On.
   
9. Go back to Administration > Users.
   
10. Edit the administrator account.
    
11. And change its password.
    

Direct Import

1. Switch to the Import & Analyze workspace.
   
2. On the left, under Import, click Applications.
   
3. On the right, switch to the Direct Import tab.
4. Click Browse in the toolbar. Then browse to an .MSI file.
   
5. The .msi files are shown in the list. Use the checkboxes on the left to select the applications.
   
6. Then on the top right click the Import & Analyze button to begin analysis.
   
7. A progress bar is displayed next to the application.
   
8. Analysis begins immediately. You can change the analysis modules by going to Configure > Modules > Wizard.
   
9. After analysis is complete, select a report you want to view and click Finish on the top right.
   
   
   
10. You can also view reports for applications that have already completely analysis by switching to the Reports: Applications workspace.
    
11. On the left, select a report you want to view.
    
12. You might be prompted to select applications. If you want to change this selection later, there’s a Change Selection button on the toolbar.
    
    
13. The report displays a list of applications with color coding. Click an application name to view more details.
    
    

Install Capture

Install Capture lets you import application installers that are not available as MSI files. AppDNA uses a hypervisor connection to automate the Install Capture process. Alternatively, you can do a manual capture using the Self Provisioning process.

Prepare Install Capture Machine

1. Create a share on the AppDNA machine. The captured data is stored in this share.
   
   
   
2. The operating system of the Install Capture machine should match the operating system version you are migrating from.
3. On the Install Capture machine, make sure Remote Desktop is enabled.
   
4. On the Install Capture machine, browse to the AppDNA server in the C$\Program Files (x86)\Citrix\AppDNA\Tools folder and run Citrix AppDNA VM Configuration.msi.
   
5. In the Welcome to the Installation Wizard for Citrix AppDNA VM Configuration page, click Next.
   
6. In the License Agreement page, select I accept the terms and click Next.
7. In the Ready to Install the Program page, click Install.
8. In the Installation Wizard Completed page, click Finish.
9. Click Yes when prompted to reboot.
   
10. You can either take a snapshot now or AppDNA will do it for you.
    

Configure AppDNA for Install Capture

1. In the AppDNA Console, open the Edit menu and click Settings.
   
2. On the left, switch to the Install Capture page.
3. On the right, click New.
   
4. In the Virtual Machine Configuration Wizard page, click Next.
   
5. In the Virtual machine details page, give the configuration a name.
6. Select vSphere and click Next.
   
7. In the vSphere Host Details page, in the Single Sign-on Server field, enter the Platform Services Controller hostname and :7443.
8. In the vCenter Server field, enter the hostname of the vCenter server.
9. Enter credentials that can snapshot and perform power operations on the Install Capture machine. Click Test and then click Next.
   
10. In the vSphere Virtual Machine page, in the list of machines, select the Install Capture machine and click Next.
    
11. In the vSphere Snapshot selection page, if there are no snapshots, click Take Snapshot.
    
12. Click Test. At least confirm that the machine can be reverted to snapshot. Don’t worry if the console doesn’t open. Click Next.
    
13. In the Virtual machine connection page, enter the hostname of the Install Capture machine and click Test. Note: the RemoteAdmin.exe process only runs while somebody is logged into the machine. Click Next.
    
14. In the Capture output location page, enter the UNC path to the file share on the AppDNA server and click Test. Then click Next.
    
15. In the Virtual machine state page, make a selection and click Next.
    
16. In the Virtual machine configuration summary page, click Finish.
    
17. Click Save to close the Settings window.
    

Perform Install Capture

1. Switch to the Import & Analyze workspace.
   
2. On the left, under Import, click Applications.
   
3. On the right, switch to the Install Capture tab and click Browse.
   
4. If you have more than one Install Capture machine, use the drop-down to select the one you want to use.
   
5. On the top right click Import & analyze.
   
   
6. The virtual machine configuration check window is displayed.
   
7. The Install Capture VM will be started.
   
8. Eventually you’ll be prompted to RDP to the Install Capture machine.
   
9. The capture process begins with a snapshot of the Install Capture machine.
   
10. Then the application is installed. This should happen automatically.
    
11. Then a differencing snapshot is taken and uploaded to AppDNA Server.
    
12. Once the Capture process is complete, Analysis begins immediately.
    

Self Provisioning

Self Provisioning is very similar to Install Capture except there’s no need for direct connectivity between AppDNA server and the hypervisor that hosts the Self Provisioning machine. Once the process is started in the AppDNA console, a different user can complete the snapshot process on the Self Provisioning machine.

Prepare Self Provisioning Machine

1. Make sure AppDNA VM Configuration is installed first.
   
2. On the Self Provisioning machine, browse to the AppDNA server in the C$\Program Files (x86)\Citrix\AppDNA\Tools folder and run Citrix AppDNA Self Provisioning Client.msi.
   
   
3. In the Welcome to the Installation Wizard for Citrix AppDNA Self Provisioning Client page, click Next.
   
4. If you see the Pre-Requisites Check page, stop the installer, install the AppDNA VM Configuration Client and then restart this installer.
   
5. In the License Agreement page, select I accept the terms and click Next.
6. In the Destination Folder page, click Next.
7. In the Ready to Install the Program page, click Install.
8. In the Installation Wizard Completed page, click Finish.
9. Take a snapshot of the Self Provisioning machine.
   

Perform Self Provisioning Capture

1. In the AppDNA Console, switch to the Import & Analyze workspace.
   
2. On the left, click Applications.
   
3. On the right switch to the Self Provisioning tab.
4. Then click the Configuration icon in the toolbar.
   
5. In the Self Provisioning page, enter the UNC path to a share that both machines (AppDNA server and Self Provisioning machine) can access.
   
6. In the toolbar click Browse and browse to the application installer.
   
7. Click Publish to push the files to the file share.
   
   
8. Click in the PublishedFile column to access the full path and copy it to the clipboard.
   
9. On the Self Provisioning machine, run the Self Provisioning Client from the Start Menu.
   
10. Paste in the path and click Start.
    
11. After the snapshot is taken, click the Start button and install the application.
    
12. Once the install is complete, another snapshot will be taken and the results will be uploaded to the share. Click Close.
    
13. Back in the AppDNA console, click Refresh Status and make sure the status changes to Complete.
    
14. Make sure the application is selected and then on the right side of the toolbar click Move to Import.
    
15. This moves the application to the Direct Import tab where you can select the application and click Import & Analyze.
    
    
    

Solutions

CitrixTV XenApp Upgrades with AppDNA demonstrates the Solutions feature of AppDNA 7.6 including: XenApp upgrades, operating system image upgrades, and application interoperability. This is also detailed at Configure solutions at docs.citrix.com.

1. For some of the solutions it is helpful to import operating system images of the machines you are moving from and the machines you are moving to..
2. In the Import & Analyze workspace, on the left click Operating Systems.
   
3. On the right, click Download Snapshot Manager. Run this on a operating system image that you want to import.
   
4. Then click Import from MSI to import the MSI file generated by the Snapshot Manager.
   
5. Switch to the Solutions workspace.
   
6. On the top left click Add solution.
   
7. In the Solutions Templates page, select a solution and click Next.
   
8. In the Solution name page, give the solution a name and click Next.
   
9. In the Platform name page, choose the platform you are migrating from and click Next.
   
10. In the Applications page, select the applications you want to analyze and click Next.
    
11. In the Solution platforms page you can change the Target platforms or add more platforms.
12. Click Build.
    

This page contains a list of available XenApp 6.5 updates. It it not meant to be a comprehensive build procedure. Many of the updates are Limited Release and thus are only accessible to Citrix Partners and Citrix Support.

Navigation

• XenApp 6.5 Hotfix Rollup Pack 6
• XenApp 6.5 Hotfixes
• AppCenter 6.5.13 
• XenApp Commands Hotfix 4
• Citrix Group Policy Management 1.7.10
• Uninstall Citrix Single Sign-on Console
• HDX WMI Provider Update 1
• HDX MediaStream for Flash 2.0 Hotfix 9
• Server Configuration Tool 1.2 Hotfix 3
• Service Provider Automation Tools
• Citrix Receiver Enterprise 3.4 Update 5
• Offline Plug-in 6.7.5
• Citrix Profile Management 5.4
• Universal Print Server Client 7.6 Hotfix 1
• Citrix Group Policy Client Side Extension 1.7 Hotfix 7 
• EdgeSight 5.4 Agent Hotfix 7 for XenApp 6
• Web Interface 5.4 Hotfix 2

= Recently Updated

XenApp 6.5 Hotfix Rollup Pack 6

From CTX120842 Best Practices for Citrix XenApp Hotfix Rollup Pack Installation and Deployment: Citrix recommends the following order of deployment:

• Zone data collector
• Backup zone data collectors
• Database connection server (Applies only to Resource Manager for XenApp 5 for Microsoft Windows Server 2003)
• Primary farm metric server (Applies only to Resource Manager for XenApp 5 for Microsoft Windows Server 2003)
• Backup farm metric server (Applies only to Resource Manager for XenApp 5 for Microsoft Windows Server 2003)
• Member servers

To install a Hotfix Rollup Pack, do the following:

1. Go to the downloaded Hotfix Rollup Pack 6, shift+right-click XA650W2K8R2X64R06.msp and click Copy as path.
   
2. Run cmd.exe elevated.
   
3. Right-click the command prompt and paste the path. Then press <Enter> to run it.
   
   
4. In the Welcome to the Citrix XenApp 6.5 Hotfix Rollup Pack 6 Installation Wizard page, click Next.
   
5. In the Citrix XenApp has been successfully configured page, click Close.
   
6. Click OK when prompted to reboot.
   

XenApp 6.5 Hotfixes

Download post-R06 hotfixes from support.citrix.com by searching for XA650R06*.

Citrix CTX129229 Recommended Hotfixes for XenApp 6.x on Windows Server 2008 R2.

If you have several hotfixes to install, create a script similar to the following to install the hotfixes automatically.

for /f %%i in ('dir /b "%~dp0*650W2K8R2R06*.msp"') do (
start /wait msiexec /p "%~dp0%%i" /passive /norestart /l*v "%temp%\%%i.log"
timeout /t 3 /NOBREAK
)
pause

Then run the script elevated.

AppCenter 6.5.13

1. Go to the downloaded Citrix AppCenter 6.5 Hotfix 13 (DSCXAMx650W013) and run XenAppMx.msi.
   
2. If you see this message, click OK.
   
3. After installation, in Programs and Features, Citrix XenApp Management will be shown as version 6.5.13.0.
   

XenApp Commands Hotfix 4

1. Go to the downloaded XenApp Commands Hotfix 4 (DSCXACmd650WX64004) and run XenApp.Commands.Install_x64.msi.
   
2. In the Please read the Citrix XenApp Commands License Agreement page, check the box next to I accept and click Install.
   
3. If you see a Files in Use page, click OK.
   
4. In the Completed the Citrix XenApp Commands Setup Wizard page, click Finish.
   
5. Programs and Features lists Citrix XenApp Commands as version 6.5.4.1.
   

Citrix Group Policy Management 1.7.10

1. Go to the downloaded Citrix Group Policy Management 1.7.10 (GPMx170WX64010) and run CitrixGroupPolicyManagement_x64.msi. It installs automatically.
   
2. Programs and Features shows it as version 1.7.10.0.
   
3. This update adds a new Citrix Policy setting at Computer > Server Settings > Graceful session logoff: ignore process. This is equivalent to LogoffCheckSysModules.
   

Uninstall Citrix Single Sign-on Console

If you have no desire to implement Citrix Single Sign-on then uninstall the console.

1. Go to Programs and Features, right-click Citrix Single Sign-on Console and click Change.
   
2. On the Application Maintenance page, select Remove and click Next.
   
3. On the Citrix Single Sign-On Console Uninstall page, click Next.
   
4. On the Citrix Single Sign-on Console 5.0 has been successfully uninstalled page, click Finish.
   

HDX WMI Provider Update 1

1. Run Programs and Features, right-click Citrix HDX WMI Provider and click Uninstall. Notice that the version is currently 2.0.0.0
   
2. Go to the downloaded Citrix HDX WMI Provider Update 1 (HDXWMIPROV620W2K8R2X64001) and run CitrixHDXWMIProvider-x64.msi. It installs automatically.
   
3. Programs and Features will now show it as version 2.0.1.0.
   

HDX MediaStream for Flash 2.0 Hotfix 9

1. Run Programs and Features, right-click Citrix HDX MediaStream for Flash – Server and click Uninstall. Notice that the version is currently 2.0.0.0
   
2. Go to the downloaded HDXFlash200WX64009 and run CitrixHDXMediaStreamForFlash-ServerInstall-x64.msi.
   
3. If you refresh Programs and Features, it now shows the version as 2.0.9.0.
   
4. The article details a registry key that needs to be configured.
   

Server Configuration Tool 1.2 Hotfix 3

1. Go to the downloaded Server Configuration Tool 120.003 and run ServerConfigurationInstall.msi. It installs automatically without prompting.
   
2. You can verify installation by looking in Programs and Features. Citrix XenApp Server Configuration Tool should be version 1.2.3.0.
   

Service Provider Automation Tools

1. Run the downloaded CitrixAppDeliverySetupTools.exe.
   
2. Click OK once installation is complete.
   
3. Programs and Features lists Citrix App Delivery Setup Tools as version 1.0.2.300.
   

Citrix Receiver Enterprise 3.4 Update 5

1. Run the downloaded Citrix Receiver Enterprise 3.4 Cumulative Update 5 (CitrixReceiverEnterprise.exe).
   
2. On the Welcome to Citrix Receiver Setup page, click Install.
   
3. Click Yes to reboot when prompted.
   
4. Programs and Features lists Citrix Receiver (Enterprise) as version 13.4.500.4.
   

Offline Plug-in 6.7.5

1. Go to the downloaded Offline Plug-in 6.7.5 and run CitrixOfflinePlugin.exe.
   
2. In the Welcome to the Citrix Offline plug-in Setup page, click Next.
   
3. In the License Agreement page, select I accept the license agreement and click Next.
   
4. In the Client Upgrade Options page, click Next.
   
5. Click OK if prompted that a reboot is required.
   
6. In the Citrix Offline plug-in has been successfully installed page, click Finish.
   
7. Click Yes when prompted to restart.
   
8. Programs and Features lists Citrix Offline Plug-in as version 6.7.5.1.
   

Citrix Profile Management 5.4

1. Go to the downloaded Profile Management 5.4 (ProfileMgmt-5.4.0) and run profilemgt_x64.msi.
   
2. In the Welcome to the Citrix Profile management Setup Wizard page, click Next.
   
3. In the End-User License Agreement page, check the box next to I accept the terms in the License Agreement and click Next.
   
4. In the Destination Folder page, click Next.
   
5. In the Ready to install Citrix Profile management page, click Install.
   
6. In the Completed the Citrix Profile management Setup Wizard page, click Finish.
   
7. Click Yes when prompted to restart.
   
8. Programs and Features lists Citrix Profile Management as version 5.4.0.6104.
   

Universal Print Server Client 7.6 Hotfix 1

1. Go to the downloaded Universal Print Server Client 7.6 Hotfix 1 and run UpsClient760WX64001.exe.
   
2. In the License agreement page, check the box next to I accept the terms and click Install.
   
3. In the Completed the Citrix Universal Print Client Setup Wizard page, click Finish.
   
4. Programs and Features lists Citrix Universal Print Client as version 7.6.1.0.
   

Citrix Group Policy Client Side Extension 1.7 Hotfix 7

1. Go to the downloaded Citrix Group Policy Client Side Extension 1.7 Hotfix 7 (GPCSExt170W28KR2X64007) and run CitrixCse_x64.msi. It installs without prompting. 
   
2. If you look in Programs and Features, it should show version 1.7.7.0.
   

EdgeSight 5.4 Agent Hotfix 7 for XenApp 6

1. Make sure EdgeSight 5.4 Server Hotfix 5 (ES540ServerWX64005) is installed on the EdgeSight Server.
   
2. Go to the downloaded EdgeSight 5.4 Agent Hotfix 7 for XenApp 6 and run EdgeSightXA6Agentx64.msi.
   
3. In the Welcome to the EdgeSight for XenApp x64 Setup page, click Next.
   
4. In the End-User License Agreement page, select I accept the terms in the License Agreement and click Next.
   
5. In the Product Information page, enter the company name specified on the EdgeSight web server and click Next.
   
6. The Agent Location page appears. If you are installing the EdgeSight Agent on a XenApp server that will be converted to a Provisioning Server vDisk, change the path for the data files so they reside on the cache disk (D:). If this is a normal XenApp server that boots from the C: drive, leave the data files in their default path. Click Next when done.
   
7. In the Network Settings page, enter the name of your EdgeSight server and click Next.
   
8. In the Ready to Install page, click Install.
   
9. In the EdgeSight for XenApp x64 Setup Complete page, click Finish.
   
10. Click Yes when prompted to reboot.
    
11. Programs and Features displays the version as 5.4.21.3.
    
12. Check out article http://support.citrix.com/article/ctx111062 for information on how to configure antivirus for the EdgeSight Agent. Do not skip this step.
    

Web Interface 5.4 Hotfix 2

Only run this on your Web Interface servers.

1. Run the downloaded Web Interface 5.4 Hotfix 2 WebInterface.exe from WI540MSI002.
   
2. In the Select Language page, click OK.
   
3. In the Welcome to the Web Interface Installation Wizard page, click Next.
   
4. In the License Agreement page, select I accept and click Next.
   
5. In the Installation Location page, click Next.
   
6. In the Location of Clients page, change the selection to Copy the clients to this computer. Then browse to the Citrix Receiver and Plug-ins folder on the XenApp 6.5 DVD and click Next.
   
7. In the Ready to Install page, click Next.
   
8. In the Web Interface Was Successfully Install page, click Finish.
   

These hotfixes are specific to Remote Desktop Session Host, group policies, printing, and SMB redirector and are not included in the normal Windows Update process. To get the hotfix go to the Microsoft KB article’s webpage. There is a link at the top of the page that takes you to a form where you can request the hotfix.

Available Updates for Remote Desktop Services (Terminal Services) on Windows Server 2008 R2 Service Pack 1 – https://support.microsoft.com/kb/2601888.

Citrix CTX129229 Recommended Hotfixes for XenApp 6.x on Windows Server 2008 R2. Scroll down to the Microsoft Hotfixes section.

Here is the list of hotfixes:

• http://support.microsoft.com/kb/969744 – Underlines are missing when you print a document
• http://support.microsoft.com/kb/981070 – “Windows can’t open Add Printer” error in a 64-bit version of Win7 or of Windows Server 2008 R2
• http://support.microsoft.com/kb/981156 – RemoteApp applications are displayed as black windows when you restart the applications in a Remote desktop connection
• http://support.microsoft.com/kb/2028827 – The applications that use the TDI driver for network traffic may stop responding
• http://support.microsoft.com/kb/2065362 – “Unable to log you on because your profile could not be loaded, please contact your administrator” error when you try to log on to a computer
• http://support.microsoft.com/kb/2301288 – A Remote Desktop Services session is disconnected automatically if you apply the “Interactive logon: smart card removal behavior” Group Policy setting
• http://support.microsoft.com/kb/2385838 – Item-level targeting object picker dialog box shows only the domain in which the Gpmc.msc is started
• http://support.microsoft.com/kb/2386759 – Group Policy preference settings for the settings on the Advanced tab in Internet Explorer 8 do not work as expected
• http://support.microsoft.com/kb/2411000 – You cannot read or copy a file that contains an asterisk character in the stream name
• http://support.microsoft.com/kb/2411938 – “An external error has occurred” error when you change the user rights of an account in Local Security Policy (needed for StoreFront)
• http://support.microsoft.com/kb/2424375 – A remote desktop session may be incorrectly disconnected when a smart card is removed in another remote desktop session
• http://support.microsoft.com/kb/2431799 – Stop error 0x0000007E occurs when multiple users establish Remote Desktop Services sessions
• http://support.microsoft.com/kb/2444328 – You cannot access shared files or shared printers
• http://support.microsoft.com/kb/2444677 – Error message when you try to start Explorer.exe: “Server Execution Failed”
• http://support.microsoft.com/kb/2446026 – An application that uses the Remote Desktop Connection ActiveX control to provide virtualized sessions crashes
• http://support.microsoft.com/kb/2460922 – Group Policy preference item-level targeting does not work for 64-bit versions of Windows 7
• http://support.microsoft.com/kb/2462182 – The “Load a specific theme” Group Policy setting is not applied correctly for a new user
• http://support.microsoft.com/kb/2465772 – An application or service that uses Winsock API or Winsock Kernel API may randomly stop responding
• http://support.microsoft.com/kb/2465990 – “0x80041002 (WBEM_E_NOT_FOUND)” error occurs when you try to open a WMI namespace
• http://support.microsoft.com/kb/2466373 – BACKSPACE or arrow keys do not work in MMC
• http://support.microsoft.com/kb/2468345 – Computer intermittently performs poorly or stops responding when the Storport driver
• http://support.microsoft.com/kb/2479169 – “Word did not save the document” error message when you try to save a document
• http://support.microsoft.com/kb/2479710 – Remote Desktop service crashes when Group Policy settings are refreshed after you enable the “Required secure RPC communication” and “Set client connection encryption level” Group Policy settings
• http://support.microsoft.com/kb/2489291 – You cannot start an application to open a file that has an associated file name extension after you specify the file association by using GPP
• http://support.microsoft.com/kb/2492536 – Msinfo32.exe takes a long time to display or export system information on a computer that has many MSI-X-supported devices
• http://support.microsoft.com/kb/2492765 – User account passwords can be changed in the Sysprep Specialize phase of Sysprep.exe
• http://support.microsoft.com/kb/2493006 – Time synchronization is not performed even though the W32Time service is successfully started
• http://support.microsoft.com/kb/2495523 – A crash memory dump file is not created, or hibernation does not work, when you use a SCSIport miniport driver as the startup device driver
• http://support.microsoft.com/kb/2496744 – A black screen is displayed computer tries to enter hibernation
• http://support.microsoft.com/kb/2498549 – A search window opens unexpectedly after you deploy a Group Policy to disable Windows Explorer search elements
• http://support.microsoft.com/kb/2510636 – An update that improves the startup performance
• http://support.microsoft.com/kb/2511290 – A computer continues to use the original printer driver after you update or replace the printer driver
• http://support.microsoft.com/kb/2519550 – An incorrect program icon appears on the task bar in a remote desktop session
• http://support.microsoft.com/kb/2521923 – A program that requires you to use a smart card stops responding in a remote desktop connection
• http://support.microsoft.com/kb/2522743 – You cannot use a calendar control in a RemoteApp application when you use the RDC 7.0 client to connect to the RemoteApp application
• http://support.microsoft.com/kb/2522761 – Windows Explorer stops responding when you extend the full-screen display on a virtual machine to multiple monitors
• http://support.microsoft.com/kb/2522762 – RemoteApp application does not work correctly from RD Web Access
• http://support.microsoft.com/kb/2524478 – The network location profile changes from “Domain” to “Public”
• http://support.microsoft.com/kb/2524668 – The single sign-on feature does not work when you try to start a full remote desktop connection through RD Web Access
• http://support.microsoft.com/kb/2525246 – “0x0000003B” Stop error when you remotely control a Remote Desktop session
• http://support.microsoft.com/kb/2526028 – Printing performance decreases
• http://support.microsoft.com/kb/2526629 – The logon message is not displayed correctly when you connect to a RemoteApp application from a computer that has multiple monitors
• http://support.microsoft.com/kb/2526870 – Windows may stop responding at the Welcome screen after you enter the user credentials to log on to the computer
• http://support.microsoft.com/kb/2534985 – The virtualized application or the system crashes
• http://support.microsoft.com/kb/2536840 – IP addresses that are used for reconnection are not listed completely in the RD Connection Broker setting
• http://support.microsoft.com/kb/2536989 – Single Sign-On (SSO) feature does not work after you enable the RemoteFX feature
• http://support.microsoft.com/kb/2538047 – Audio capture redirection feature does not work after a second remote desktop connection is created
• http://support.microsoft.com/kb/2541119 – Applications may crash
• http://support.microsoft.com/kb/2545479 – A memory leak occurs, and client requests may take a long time, when you run an application that is based on COM+ and that is registered as single-threaded
• http://support.microsoft.com/kb/2545627 – A multithreaded application might crash
• http://support.microsoft.com/kb/2545735 – “The home folder could not be created” error when an administrator tries to set Remote Desktop Services Home Folder for a user account
• http://support.microsoft.com/kb/2545833 – Slow performance occurs when many user authentication requests are handled
• http://support.microsoft.com/kb/2547752 – Credential authentication does not work if you paste credential information by using the Paste shortcut menu command
• http://support.microsoft.com/kb/2548470 – A WebClient service crashes when you connect a WebDav resource
• http://support.microsoft.com/kb/2549724 – “0x00000044” Stop error when you access shared files
• http://support.microsoft.com/kb/2550581 – When you try to access files on a network share, Windows Explorer stops responding
• http://support.microsoft.com/kb/2550944 – Group Policy logon scripts do not run
• http://support.microsoft.com/kb/2550978 – “0x0000007B” Stop error after you replace an identical iSCSI network adapter
• http://support.microsoft.com/kb/2551503 – A mapped drive that has the non-persistent flag set is displayed as a disconnected drive
• http://support.microsoft.com/kb/2553771 – GetGPOList function does not return all GPOs
• http://support.microsoft.com/kb/2554746 – MSMQ service might not send or receive messages after you restart a computer
• http://support.microsoft.com/kb/2555392 – Garbled printouts after the first page if subsetted fonts are used
• http://support.microsoft.com/kb/2559767 – File corruption occurs when you perform file operations on a file server
• http://support.microsoft.com/kb/2560088 – File permissions inherited from one folder persist after the files are moved to another folder
• http://support.microsoft.com/kb/2561285 – You experience a long domain logon time after you deploy Group Policy preferences to the computer
• http://support.microsoft.com/kb/2563214 – “Access denied” error message when you try to access files in a WebDAV shared folder
• http://support.microsoft.com/kb/2563399 – Remote Registry service leaks memory when it handles customized v2 performance counter queries
• http://support.microsoft.com/kb/2564236 – I/O throughput is low when large files are read sequentially
• http://support.microsoft.com/kb/2568041 – You cannot access allowed applications that are managed by AppLocker
• http://support.microsoft.com/kb/2568409 – You cannot run an application desktop toolbar as a RemoteApp
• http://support.microsoft.com/kb/2571388 – A Remote Desktop Services session stops responding during the logoff process
• http://support.microsoft.com/kb/2574501 – Some lines are missing when you try to print an XPS document
• http://support.microsoft.com/kb/2575946 – “Limit the size of the entire roaming user profile cache” Group Policy setting does not work
• http://support.microsoft.com/kb/2577550 – You may wait for up to 30 seconds when you use a smart card to unlock a computer
• http://support.microsoft.com/kb/2578159 – The logon process stops responding
• http://support.microsoft.com/kb/2578214 – An application crashes when it tries to retrieve file information from an invalid or corrupted file
• http://support.microsoft.com/kb/2578764 – Black lines appear in an application window that is displayed by using DirectX and GDI
• http://support.microsoft.com/kb/2579362 – The redirector component may stop responding when it tries to contact many other computers
• http://support.microsoft.com/kb/2579381 – A remote desktop session does not respond to keyboard input or mouse input after it loses the focus
• http://support.microsoft.com/kb/2580346 – Some pop-up windows of a TS RemoteApp application might be hidden
• http://support.microsoft.com/kb/2582112 – Windows stops responding when an application performs many I/O operations to a network share
• http://support.microsoft.com/kb/2582172 – Remote desktop is not displayed in Full-Screen mode when the screen resolution is 1366× 768 pixels
• http://support.microsoft.com/kb/2582203 – A process that is being terminated stops responding
• http://support.microsoft.com/kb/2585233 – “Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)” error when a client logs off from a Windows Server 2008 R2 Remote Desktop Services session
• http://support.microsoft.com/kb/2585853 – Choppy video playback when you play a high-definition video over a remote desktop connection
• http://support.microsoft.com/kb/2587473 – Topmost windows are not always in the topmost position
• http://support.microsoft.com/kb/2590550 – The desktop does not load and only displays a black or blue background after you log on
• http://support.microsoft.com/kb/2592339 – “0x0000007f” Stop error or system stops when you connect to it by using the RDP protocol
• http://support.microsoft.com/kb/2600484 – Certain user folders are absent from the user profile if the folders are excluded from the roaming profile
• http://support.microsoft.com/kb/2604066 – The top-level window of a RemoteApp application becomes unresponsive.
• http://support.microsoft.com/kb/2614066 – Black screen during a Remote Assistance session
• http://support.microsoft.com/kb/2614136 – Some windows of a Remote Desktop Services (Terminal Services) RemoteApp application might not be displayed correctly
• https://support.microsoft.com/kb/2614892 – A computer stops responding because of a deadlock situation in the Mountmgr.sys driver
• http://support.microsoft.com/kb/2615701 – “Logon Process Initialization Failure” error message and the logon process does not start
• http://support.microsoft.com/kb/2616332 – Output is garbled when you print data or documents by using a service
• http://support.microsoft.com/kb/2617115 – “Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)” error when a client logs off from a Remote Desktop Services session
• http://support.microsoft.com/kb/2617202 – The computer stops responding when you use a WDDM driver
• http://support.microsoft.com/kb/2617687 – Applications or services that start multiple Remote Desktop Services sessions crash
• http://support.microsoft.com/kb/2617878 – You cannot set the LogonTimeout setting after the default RDP listener (RDP-Tcp) is deleted
• http://support.microsoft.com/kb/2618115 – You cannot activate an RD Licensing server or install RDS CALs automatically by using Windows PowerShell
• http://support.microsoft.com/kb/2618574 – Print Spooler service saves the NetBIOS name of the print server
• http://support.microsoft.com/kb/2618837 – GDI objects are not displayed correctly on multiple monitors
• http://support.microsoft.com/kb/2619880 – “The network path was not found” error message when you start a LDAP-related application
• http://support.microsoft.com/kb/2620393 – EUDC fonts are not printed correctly
• http://support.microsoft.com/kb/2620656 – Invalid redirected printers may be available in a Remote Desktop Services session that connects to a RD Session Host server
• http://support.microsoft.com/kb/2621067 – The first-returned IP address is incorrect when you use the getaddrinfo function on a multi-homed computer
• http://support.microsoft.com/kb/2622802 – The Group Policy Client service crashes on a terminal server when multiple users connect to the server at the same time
• http://support.microsoft.com/kb/2633667 – 32-bit NetBIOS applications cannot receive connection close notifications
• http://support.microsoft.com/kb/2625434 – “ERROR_SHARING_VIOLATION” error message in Windows XP or in Windows Server 2003 when you try to open a file on an SMB share on a server
• http://support.microsoft.com/kb/2627489 – Event 1073 is logged after you cancel the logoff process
• http://support.microsoft.com/kb/2634328 – Increased latency occurs on an HTTP connection if the connection is through a load balancer
• http://support.microsoft.com/kb/2634907 – TCP/IP packets that are received out of sequence are discarded
• http://support.microsoft.com/kb/2635500 – Issues when you try to display a large TIFF file that contains multiple pages by using Windows Photo Viewer
• http://support.microsoft.com/kb/2636056 – You cannot select fields in Access 2010 after you open a .zip file in an OLE Objects field
• http://support.microsoft.com/kb/2636585 – Proquota.exe uses incorrect profile quota Group Policy settings
• http://support.microsoft.com/kb/2636613 – Rdpshell.exe process leaks memory when you move a published RemoteApp application’s window on the client side
• http://support.microsoft.com/kb/2637692 – RPC threads may stop responding in Windows 7 or in Windows Server 2008 R2
• http://support.microsoft.com/kb/2638018 – Windows Explorer crashes randomly
• http://support.microsoft.com/kb/2639320 – Performance Monitor data collector set does not collect all required performance counter data
• http://support.microsoft.com/kb/2639505 – Loaded user profiles cannot be unloaded after you run WMI queries for the Win32_StartupCommand class
• http://support.microsoft.com/kb/2642947 – “Index was out of range” error message when a Group Policy report is generated
• http://support.microsoft.com/kb/2645594 – An update to optimize the performance of AMD Bulldozer CPUs
• http://support.microsoft.com/kb/2646168 – “The system cannot find the file specified” error message when you print a document
• http://support.microsoft.com/kb/2646563 – SMB2 directory cache is not updated correctly if a file is deleted
• http://support.microsoft.com/kb/2647169 – Windows Fax and Scan cannot send a fax if Internet Explorer 9 is installed
• http://support.microsoft.com/kb/2647401 – “File Not Found” when you try to open a file in an application
• http://support.microsoft.com/kb/2647409 – Remote Desktop Services sessions are not kept alive as expected
• http://support.microsoft.com/kb/2647452 – Paged pool leaks when you map a network drive and then disconnect it frequently
• http://support.microsoft.com/kb/2647582 – You cannot update the Group Policy settings on a RD Session Host server if IP Virtualization is applied
• http://support.microsoft.com/kb/2647753 – Update rollup for the printing core components
• http://support.microsoft.com/kb/2648397 – You cannot change an expired user account password in a Remote Desktop session from a client computer
• http://support.microsoft.com/kb/2648662 – You cannot install RDS CALs automatically by using Windows PowerShell
• http://support.microsoft.com/kb/2649422 – External users cannot connect to RDS that are published on a RD Gateway server through Forefront UAG
• http://support.microsoft.com/kb/2653385 – Selected subfolder is highlighted unexpectedly when you select the parent folder
• http://support.microsoft.com/kb/2653810 – Security group filter in Group Policy Preferences does not remove a user from a group
• http://support.microsoft.com/kb/2659071 – WinRM does not transfer impersonation tokens correctly
• http://support.microsoft.com/kb/2655998 – Long logon time when you establish an RD session if Printer Redirection is enabled
• http://support.microsoft.com/kb/2659158 – You cannot log on to a domain that uses a disjoint namespace
• http://support.microsoft.com/kb/2661001 – “Please wait for Local Session Manager” message remains for several minutes when you disconnect during the logon process
• http://support.microsoft.com/kb/2661332 – You cannot reestablish a Remote Desktop Services session
• http://support.microsoft.com/kb/2661641 – Explorer.exe process crashes when you close the Display Settings dialog box
• http://support.microsoft.com/kb/2661663 – Stale user profile folders are not deleted completely
• http://support.microsoft.com/kb/2662585 – Printer redirection is not applied to client computers that connect to Remote Desktop Session Host
• http://support.microsoft.com/kb/2664408 – Variable %userdomain% roaming profile path is not resolved correctly
• http://support.microsoft.com/kb/2664055 – Notifications do not appear in the notification area and the View Available Networks feature does not work
• http://support.microsoft.com/kb/2665347 – You cannot connect to a virtual machine by using the Hyper-V Manager MMC snap-in
• http://support.microsoft.com/?id=2665720 – Remote Assistance does not display a desktop that has a resolution of 1366 x 768 correctly
• http://support.microsoft.com/kb/2666484 – “0x0000003B” Stop error on RD Session Host servers that use an RD Connection Broker
• http://support.microsoft.com/kb/2668395 – 32-bit NetBIOS-based application stops responding in an x64-based version of Windows
• http://support.microsoft.com/kb/2670667 – Handle leak occurs in the Audiodg.exe process
• http://support.microsoft.com/kb/2673042 – You experience a long startup time or a long logon time when domain controllers are unavailable
• http://support.microsoft.com/kb/2673347 – Home directory settings that you tried to define by using Group Policy are not applied on a SP1-based VDI client
• http://support.microsoft.com/kb/2675275 – A logoff script is removed incorrectly when you use the GMPC to remove a logon script
• http://support.microsoft.com/kb/2677323 – Handle leak when an application collects performance data
• http://support.microsoft.com/kb/2678068 – Remote Assistance invitation fails in an Active Directory environment
• http://support.microsoft.com/kb/2682011 – Server Manager in Windows Server “8” Beta does not retrieve performance data
• http://support.microsoft.com/kb/2682814 – Windows are displayed incorrectly when you connect to a RemoteApp program
• http://support.microsoft.com/kb/2684793 – Printer security settings are set to the default values incorrectly when you restore a printer
• http://support.microsoft.com/kb/2685088 – The screen saver grace period does not work as expected if the period exceeds 60 seconds
• http://support.microsoft.com/kb/2685909 – Poor performance occurs when you shadow a Remote Desktop session
• http://support.microsoft.com/kb/2690528 – Slow performance when you browse the My Documents folder in the document library
• http://support.microsoft.com/kb/2691156 – The first two bytes of the DWORD registry value for a Group Policy are cleared unexpectedly
• http://support.microsoft.com/kb/2692929 – “0x80041001” error when the Win32_Environment WMI class is queried by multiple requestors
• http://support.microsoft.com/kb/2693187 – “A fatal error occurred” error message when you run the Sysprep command on a VMware virtual machine
• http://support.microsoft.com/kb/2696020 – You are disconnected from a RemoteApp application when you minimize the main frame window of a RemoteApp application that is published
• http://support.microsoft.com/kb/2697479 – Memory leak in Wmiapsrv.exe
• http://support.microsoft.com/kb/2697865 – The Spoolsv.exe process stops responding when you connect to more than 200 network printers
• http://support.microsoft.com/kb/2698155 – On-demand antivirus scans do not work as expected
• http://support.microsoft.com/kb/2699780 – Memory leak in the Remote Registry service
• http://support.microsoft.com/kb/2699817 – RemoteApp session is disconnected when the RDP encryption level is set to Low and RDP compression is disabled
• http://support.microsoft.com/kb/2701851 – An overwrite confirmation dialog box is covered when you overwrite an existing file in an FTP server directory
• http://support.microsoft.com/kb/2701894 – Splwow64 process crashes when you try to print an Adobe document
• http://support.microsoft.com/kb/2705357 – The WMI process stops sending events to WMI clients
• http://support.microsoft.com/kb/2705427 – The Remote Desktop Web Access website does not show any published RemoteApp programs if a RemoteApp source is offline
• http://support.microsoft.com/kb/2705742 – “0x0000003B” Stop error when you use a Citrix XenApp application
• http://support.microsoft.com/kb/2706051 – Wscript.exe process or the Cscript.exe process stops unexpectedly when WSH 5.8 exits
• http://support.microsoft.com/kb/2707157 – WebIO component uses its own DNS cache to resolve an FQDN
• http://support.microsoft.com/kb/2710594 – Memory leak when a file system minifilter driver calls the FltCreateSystemVolumeInformationFolder function
• http://support.microsoft.com/kb/2710870 – DHCPv4 IP address cannot be obtained after you restart a Hyper-V virtual machine
• http://support.microsoft.com/kb/2712331 – Duplicate SID information is added to the MachineLaunchRestriction registry entry when you update the Offer Remote Assistance Group Policy setting
• http://support.microsoft.com/kb/2713128 – A network printer is displayed as offline incorrectly
• http://support.microsoft.com/kb/2715922 – Home folder is not mapped to a client computer when multiple users are logged on to a computer
• http://support.microsoft.com/kb/2716163 – You cannot open a file that is associated with a RemoteApp program
• http://support.microsoft.com/kb/2717541 – Group policy report displays incorrect information
• http://support.microsoft.com/kb/2718841 – “0xc0000005” error message and Windows Explorer stops responding
• http://support.microsoft.com/kb/2719305 – “The system cannot execute the specified program” error when the AppLocker component blocks applications from running
• http://support.microsoft.com/kb/2719347 – Stop error – tcpip.sys
• http://support.microsoft.com/kb/2719704 – “0x0000003B” or “0x000000D5” Stop error – rdpdr.sys
• http://support.microsoft.com/kb/2720345 – Security tab is not displayed in the Properties dialog box
• http://support.microsoft.com/kb/2721341 – Audio output stops intermittently
• http://support.microsoft.com/kb/2726399 – You cannot change the DPI setting through a Remote Desktop session
• http://support.microsoft.com/kb/2727101 – RemoteApp server starts a duplicate instance of a 32-bit RemoteApp application
• http://support.microsoft.com/kb/2727324 – Computer stops responding after you connect to an SMB version 1 server
• http://support.microsoft.com/kb/2728738 – You experience a long logon time when you try to log on to a client computer that uses roaming profiles
• http://support.microsoft.com/kb/2727994 – You cannot open or save Office 2010 documents on a WebDAV file server
• http://support.microsoft.com/kb/2731284 – “33” DOS error code when memory memory-mapped files are cleaned by using the FlushViewOfFile() function (ntfs.sys – 08-10-2012)
• http://support.microsoft.com/kb/2732597 – 0x80070091 error when you perform a drag-and-drop operation to replace a folder in a WebDAV shared folder
• http://support.microsoft.com/kb/2732673 – “Delayed write failed” error message when .pst files are stored on a network file server (rdbss.sys – 07-16-2012)
• http://support.microsoft.com/kb/2733420 – A non-topmost window can be displayed above a window that has the WS_EX_TOPMOST extended window style
• http://support.microsoft.com/kb/2734410 – RPC client application stops responding
• http://support.microsoft.com/kb/2734642 – RDS-based applications crash
• http://support.microsoft.com/kb/2735697 – Computer crashes when you connect to a Citrix XenDesktop virtual machine
• http://support.microsoft.com/kb/2736782 – You cannot save a file by using the Save method of a Recordset object
• http://support.microsoft.com/kb/2737353 – Spoolsv.exe process crashes when you select the “Print to File” option
• http://support.microsoft.com/kb/2737468 – Internet Explorer 8 freezes when you browse a website that is from a less privileged zone
• http://support.microsoft.com/kb/2738974 – Incorrect start time of Group Policy scheduled tasks
• http://support.microsoft.com/kb/2739674 – You cannot connect to remote computers by using the SMB protocol
• http://support.microsoft.com/kb/2740180 – Performance Monitor or a PDH function takes longer than expected to collect performance data
• http://support.microsoft.com/kb/2740374 – A computer that is running Windows Server 2008 R2 SP1 or Windows 7 SP1 freezes under a heavy file I/O load
• http://support.microsoft.com/kb/2740522 – Applications that execute PowerShell scripts crash randomly
• http://support.microsoft.com/kb/2743148 – Non-topmost window appears above a topmost window when you click the Show Desktop button
• http://support.microsoft.com/kb/2743155 – Application crashes when it uses the BitmapImage class to optimize images
• http://support.microsoft.com/kb/2748246 – “The Specified port is unknown” error message when you use GPP to deploy printers
• http://support.microsoft.com/kb/2748302 – Stop error when you use a Citrix XenApp application
• http://support.microsoft.com/kb/2748437 – User profile folder name is displayed as “user name@domain name” when use a UPN to log on
• http://support.microsoft.com/kb/2749262 – Remote Desktop Configuration service crashes together with event ID 1000
• http://support.microsoft.com/kb/2749615 – You cannot enable Server Manager remote management after you install Windows Management Framework 3.0
• http://support.microsoft.com/kb/2750090 – High CPU utilization by the Svchost.exe process and the Lsass.exe process in the Remote Desktop session after you remotely connect to a computer
• http://support.microsoft.com/kb/2750396 – Remote Desktop Services server freezes when you try to log on to or log off the server by using a smart card
• http://support.microsoft.com/kb/2751386 – Group Policy settings and preferences are applied to a roaming profile user who logs on to two computers
• http://support.microsoft.com/kb/2752274 – WH_MOUSE hook receives wrong data when you run a x86-based application to intercept the WM_MOUSEWHEEL messages
• http://support.microsoft.com/kb/2752370 – “0x000000D1” Stop error when you perform a network-related operation (tcpip.sys, fwpkclnt.sys, netio.sys – 9-06-2012)
• http://support.microsoft.com/kb/2752618 – RDS client computer cannot connect to the RDS server by using a remote desktop connection
• http://support.microsoft.com/kb/2753869 – Explorer.exe process crashes when you copy multiple files from one folder to another folder
• http://support.microsoft.com/kb/2754035 – You cannot disable drag-and-drop operations on the Start menu by configuring a registry key
• http://support.microsoft.com/kb/2756041 – Outlook item is unexpectedly copied when you try to move it to a destination folder or desktop by using the drag-and-drop feature
• http://support.microsoft.com/kb/2756999 – Handle leak occurs on a COM client
• http://support.microsoft.com/kb/2761645 – Access Denied error message when a user tries to access a redirected folder share or a home drive share
• http://support.microsoft.com/kb/2764302 – “0x0000001E” Stop error occurs intermittently
• http://support.microsoft.com/kb/2765546 – Icons are not displayed correctly on the taskbar
• http://support.microsoft.com/kb/2768492 – User cannot connect to remote desktop server
• http://support.microsoft.com/kb/2768523 – “0x0000007E” Stop error after you configure a computer to host a web service
• http://support.microsoft.com/kb/2768741 – Visual elements are displayed incorrectly when you connect to a computer using the Remote Desktop Protocol
• http://support.microsoft.com/kb/2769359 – Print job fails when the printer driver isolation feature is set to isolated or shared mode
• http://support.microsoft.com/kb/2769372 – Windows Remote Assistance fails
• http://support.microsoft.com/kb/2769478 – New file or folder does not appear in a Library
• http://support.microsoft.com/kb/2769618 – Cannot play an audio file when an audio file is already playing in Windows Media Player
• http://support.microsoft.com/kb/2769790 – File that a user adds to a remote folder is not displayed in Windows Explorer
• http://support.microsoft.com/kb/2769791 – Windows Audio service stops after you configure remote audio playback
• http://support.microsoft.com/kb/2770175 – RD Gateway service crashes when a client computer tries to connect
• http://support.microsoft.com/kb/2771101 – Folder redirection policy fails after you redirect a folder to a different sub folder
• https://support.microsoft.com/en-us/kb/2775511 – An enterprise hotfix rollup is available for Windows
• http://support.microsoft.com/kb/2778831 – “Client Side Rendering Print Provider” registry key growth
• http://support.microsoft.com/kb/2778834 – File becomes corrupted when you try to overwrite the file while it is opened by another user
• http://support.microsoft.com/kb/2778863 – RD Gateway service crashes
• http://support.microsoft.com/kb/2779073 – “Access is denied” error when remote desktop users try to log on to a terminal server
• http://support.microsoft.com/kb/2780102 – “0x0000003B” Stop error when a Remote Desktop Connection Broker and a Windows 7 SP1 or Windows Server 2008 R2 SP1-based computer are in an RDS farm
• http://support.microsoft.com/kb/2780124 – Icon titles of top-level windows in a RemoteApp application are not displayed on the taskbar
• http://support.microsoft.com/kb/2780130 – “0x00000027” Stop error when you try to use a redirected smart card to log on to a remote computer
• http://support.microsoft.com/kb/2780879 – Hotfix improves TCP window scaling
• http://support.microsoft.com/kb/2783429 – High CPU utilization when you use the Print Management snap-in to add a printer
• http://support.microsoft.com/kb/2785146 – Data is corrupted when there is insufficient memory
• http://support.microsoft.com/kb/2786447 – “0x000000AB” Stop error when a Citrix client logs off from a RD Session Host
• http://support.microsoft.com/kb/2786923 – Dialog boxes and new windows displayed as blank in Office 2013 RemoteApps
• https://support.microsoft.com/kb/2789397 – Data corruption and network issues when you run a WFP-based application
• http://support.microsoft.com/kb/2792026 – SMBv2 client computer freezes when the computer is under a heavy load
• http://support.microsoft.com/kb/2793072 – Generic error message when you change your password on a RD Web Access website
• http://support.microsoft.com/kb/2795616 – Lines in EMF file don’t display correctly
• http://support.microsoft.com/kb/2796764 – The “New” option in the shortcut menu is missing for the root folder of a redirected drive
• http://support.microsoft.com/kb/2797136 – Mapped printers are not added to a client computer
• http://support.microsoft.com/kb/2797749 – Explorer.exe process may crash after you add custom properties to a .doc file
• http://support.microsoft.com/kb/2798286 – RemoteApp application session disconnects from a client computer
• http://support.microsoft.com/kb/2798670 – USB audio stream stalls
• http://support.microsoft.com/kb/2798787 – Name of Group Policy preferences for Internet Explorer are displayed incorrectly
• http://support.microsoft.com/kb/2799035 – Certificate Propagation service crashes when you disconnect an RDS client
• http://support.microsoft.com/kb/2799360 – Svchost.exe process that hosts the network location awareness service crashes
• http://support.microsoft.com/kb/2799406 – Poor performance when you use MSXML6.0
• http://support.microsoft.com/kb/2799904 – Folder Redirection policy is not applied to a network share after you update a Group Policy
• http://support.microsoft.com/kb/2800789 – 0xC0000005 Stop error when the SVCHost.exe process that hosts Remote Desktop Services crashes
• http://support.microsoft.com/kb/2801423 – NTFS permission information for a DFS share takes longer than expected to display
• http://support.microsoft.com/kb/2807716 – Error message when you try to map a drive to a network share
• http://support.microsoft.com/kb/2807971 – Internet Explorer takes a long time to open an HTTPS webpage
• http://support.microsoft.com/kb/2809097 – An application that calls the CloseHandle function on a serial port cannot be exited
• http://support.microsoft.com/kb/2809808 – Takes longer than expected to log off from RDS server remotely
• http://support.microsoft.com/kb/2813636 – You cannot log off an RD session 2752618
• http://support.microsoft.com/kb/2815716 – Splwow64.exe process doesn’t end after a print job finishes
• http://support.microsoft.com/kb/2821049 – COM-based application freezes
• http://support.microsoft.com/kb/2821343 – “Access Denied” error message when you try to access a file share that has Access-based Enumeration enabled
• http://support.microsoft.com/kb/2813636 – You cannot log off an RD session
• http://support.microsoft.com/kb/2831347 – Roaming user profiles are corrupted when a monitoring program executes a WMI query
• http://support.microsoft.com/kb/2834976 – Authenticated users are removed from the Remote Desktop Users group after you set the drain mode
• http://support.microsoft.com/kb/2846340 – Duplicate friendly names of network adapters are displayed
• http://support.microsoft.com/kb/2847346 – Svchost.exe running NSI service leaks memory and non-paged pool memory leak Tag NSpc
• http://support.microsoft.com/kb/2847932 – Language switch fails in a RD session and shortcut menu is not displayed in a RemoteApp session
• http://support.microsoft.com/kb/2853777 – Some text is not printed when you print multiple documents that use the same font in Windows
• http://support.microsoft.com/kb/2856905 – Can’t log on to a Windows Server 2008 R2 SP1-based computer by using a domain user account
• http://support.microsoft.com/kb/2858684 – Not all results are returned by file content search from Windows Explorer
• http://support.microsoft.com/kb/2861819 – Data transfer stops for five seconds in a Windows Socket-based application
• http://support.microsoft.com/kb/2864585 – DSN is not changed or deleted on client computers when you use Group Policy Preferences to configure it
• http://support.microsoft.com/kb/2866519 – You cannot log off from a Remote Desktop session
• http://support.microsoft.com/kb/2866695 – An application stops responding when a file has a circular reference
• http://support.microsoft.com/kb/2867625 – TCP port exhaustion causes key operations to fail when you deploy Group Policy preferences
• http://support.microsoft.com/kb/2868238 – A combo box control selects an unexpected value
• http://support.microsoft.com/kb/2869799 – Group Policy Preferences incorrectly sets a network printer as default
• https://support.microsoft.com/en-us/kb/2870165 – Unknown time zone information in a remote desktop session when you try to query the time zone information from a RDS server
• http://support.microsoft.com/kb/2870437 – Error message when you try to connect to a SQL Server 2012 AlwaysOn failover cluster instance by using the AlwaysOn listener
• http://support.microsoft.com/kb/2871131 – The size of the “HKEY_USERS\.DEFAULT” registry hive continuously increases
• http://support.microsoft.com/kb/2895698 – Users who have the remote audio setting enabled cause the RD Session Host Servers to hang intermittently
• http://support.microsoft.com/kb/2896256 – A remote desktop session cannot start after you add a new user to a computer
• http://support.microsoft.com/kb/2896881 – Long logon time when you use the AddPrinterConnection VBScript command to map printers for users during logon process
• http://support.microsoft.com/kb/2897765 – Outlook crashes when you view an HTML newsletter
• http://support.microsoft.com/kb/2900635 – Print device settings are not updated after you upgrade the driver in Windows
• http://support.microsoft.com/kb/2903025 – Antivirus software doesn’t check whether a file is digitally signed
• http://support.microsoft.com/kb/2904034 – Error code 0x80070003 when a Group Policy preference is applied
• http://support.microsoft.com/kb/2905412 – Stop error 0xD1 on a Windows-based computer with multiple processors
• http://support.microsoft.com/kb/2905569 – The scroll bar in a 32-bit application does not move
• http://support.microsoft.com/kb/2914680 – I/O delays
• http://support.microsoft.com/kb/2915847 – Pages load slowly during a Remote Desktop Services session
• http://support.microsoft.com/kb/2916266 – Mstsc.exe crashes when you print a large document from an RDS session
• https://support.microsoft.com/en-us/kb/2920289 – A Stop Error occurs on a computer that has IPSec configured
• http://support.microsoft.com/kb/2920486 – Cannot edit Group Policy settings on a site
• http://support.microsoft.com/kb/2922790 – Some software products function incorrectly
• http://support.microsoft.com/kb/2923398 – A Remote Desktop session may stop responding when you access a remote shared folder by using SMB version 2
• http://support.microsoft.com/kb/2924678 – “Trusted Publishers” settings are unmanageable in a Group Policy Object
• http://support.microsoft.com/kb/2927422 – Connection times out when you try to connect to SQL Server
• http://support.microsoft.com/kb/2927901 – SetDefaultPrinter sets a wrong default printer
• http://support.microsoft.com/kb/2928492 – Can’t connect to remote applications
• http://support.microsoft.com/kb/2928496 – Wmiprvse.exe freezes
• http://support.microsoft.com/kb/2928800 – Incorrect group name is displayed in folder permission list
• http://support.microsoft.com/kb/2931772 – “0x00000050” Stop error on the terminal server when a session is disconnected
• http://support.microsoft.com/kb/2932119 – Incorrect DNS queries cause unnecessary network traffic when you start GPMC or GPUpdate
• http://support.microsoft.com/kb/2936589/ – User interface buttons stop working in Internet Explorer 8
• http://support.microsoft.com/kb/2936674 – You cannot offer Remote Assistance to another user when you use a mandatory profile
• http://support.microsoft.com/kb/2939399 – An update to disable the Chat feature in Remote Assistance (MSRA.exe)
• http://support.microsoft.com/kb/2964832 – RemoteApp program pop-up window is hidden
• http://support2.microsoft.com/kb/2974617 – Network connectivity is lost when many users run applications on a remote server
• http://support2.microsoft.com/kb/2989007 – Update to support Ultra HD resolution for RDP sessions
• http://support2.microsoft.com/kb/3001265 – “Access Denied” error and all objects and child OUs under OU are deleted in Group Policy Management Console
• http://support2.microsoft.com/kb/3004100 – Stop error 0x0000003B when you try to connect to a server by using Remote Desktop Protocol
• http://support2.microsoft.com/kb/3004543 – Windows 7 or Windows Server 2008 R2 cannot renew IP address from a Windows Server 2012 R2-based DHCP server
• http://support2.microsoft.com/kb/3005788 – Printing preferences window appears behind a RemoteApp window
• http://support2.microsoft.com/kb/3009980 – Shortcuts that are managed by GPO disappear in All Programs
• http://support.microsoft.com/en-us/kb/3014783 – “RDS busy” or “The Group Policy Client failed logon” error when you log on to an application
• http://support2.microsoft.com/kb/3015692 – Gdiplus.dll does not decode a multiframe image frame correctly
• http://support2.microsoft.com/kb/3019282 – Print Spooler service crashes when you print documents on a network shared printer
• http://support2.microsoft.com/kb/3021169 – Computer freezes when updating network driver or installing network filter driver
• http://support2.microsoft.com/kb/3023161 – Remote session disconnects when you are connected to a server by remote desktop
• https://support2.microsoft.com/kb/3029432 – The logon process for new users takes significantly longer as the number of user profiles increases
• http://support.microsoft.com/en-us/kb/3036150 – Remote desktop users can see the printers of the other users
• http://support.microsoft.com/en-us/kb/3036965 – Printing preferences window appears behind a RemoteApp window
• https://support2.microsoft.com/kb/3040017 – XPS driver is slower than GDI driver to print files
• https://support2.microsoft.com/kb/3042839 – Mstscax.dll file leaks handles on a Remote Desktop Protocol 8.1 client
• https://support.microsoft.com/en-us/kb/3042842 – Files cannot be copied when drive redirection is enabled in RDP 8.1 client
• https://support2.microsoft.com/kb/3045882 – Private key is not exported when you export a certificate
• https://support2.microsoft.com/kb/3051475 – Cookies are not passed as part of a session when you make an HTTP connection
• https://support2.microsoft.com/kb/3054251 – Stop Error in Rdbss.sys and unsaved documents
• https://support2.microsoft.com/kb/3064222 – Stop error code “Stop A: 0xA” on a VMWare VM that uses the VMware Memory Ballooning technique on a NUMA node
• https://support2.microsoft.com/kb/3065979 – “GsDraw error (1): GenericError” error occurs and application crashes when you create text outline

Navigation

• Preparation
• Delivery Controller Install
  • Citrix Studio 7.7 Hotfix 1 
  • Create Site / Databases
  • Second Controller
• Studio – Slow Launch
• Database Maintenance:
  • Change DB connect strings, read-committed snapshot, Director grooming, etc.
• Studio Administrators
• vCenter Connection
• Citrix Director
  • Director on Standalone Server
  • Director Single Sign On
  • Director – Multiple XenDesktop Sites
  • Director Alerts and Notifications
  • Director – SCOM Integration 
  • Director Tweaks
  • Director – Saved Filters
  • Director – Custom and Scheduled Reports
• Citrix Licensing Server
  • Upgrade Licensing Server and Enable CEIP
  • Licensing Server High Availability using GSLB
  • Citrix License Server Monitoring
• Remote Desktop Licensing Server
  • Install Remote Desktop Licensing Server
  • Active Remote Desktop Licensing Server
• Health Check

Preparation

Citrix Licensing – If you are going to use an existing Citrix Licensing Server, upgrade it to 11.13.1 build 15004.

SQL Database

• Citrix blog post – Database Sizing Tool for XenDesktop 7
• Citrix article CTX114501 – Supported Databases for Citrix Products
• Citrix recommends SQL Mirroring because it has the fastest failover.
  • SQL Mirroring requires two SQL Standard Edition servers and one SQL Express for the witness server.
  • If you try to stretch the mirror across datacenters, the SQL witness must be placed in a third datacenter that has connectivity to the other two datacenters. However, stretching a single XenApp/XenDesktop site/farm and corresponding SQL mirror across datacenters is not recommended.
  • To setup SQL Mirroring, see Adam Shattuck: XenDesktop 7.6 – enterprise level setup guide (SQL server setups)
• AlwaysOn Availability Groups and SQL Clustering are also supported. However, these features require the much more expensive SQL Enterprise Edition.
• If you want Studio to create the SQL databases automatically, then the person running Studio must be a sysadmin on the SQL instances. No lesser role will work. As an alternative, you can use Studio to create SQL scripts and then run those scripts on the SQL server. In that case you only need the dbcreator and securityadmin roles.
• It is possible to create the databases in advance. However, you must use the non-default Latin1_General_CI_AS_KS collation. After creating the database, mirror it. Then use Citrix Studio to configure the database tables.
• There are typically three databases: one for the site (aka farm), one for Logging (audit log) and one for Monitoring (Director, and formerly known as EdgeSight). Create all three databases in advance and mirror them.
• The monitoring database name must not have any spaces in it. See CTX200325 – Database Naming Limitation when Citrix Director Accesses Monitoring Data Using OData APIs

Windows Features

• Installing Group Policy Management on the Delivery Controller lets you edit GPOs and have access to the Citrix Policies node in the GPO Editor. Or you can install Studio on a different machine that has GPMC installed.
• vSphere Web Client – if you will connect to vSphere Web Client from the Controller machine, Flash Player is only available for IE if you install the Desktop Experience feature. Or you can use Google Chrome.

vSphere

• Create a role in vSphere Client. Assign a service account to the role at the Datacenter or higher level.
• If the vCenter certificates are not trusted, import the vCenter server certificate into the Trusted People store of the Delivery Controller.

Delivery Controller Install

1. To setup SQL Mirroring, see Adam Shattuck: XenDesktop 7.6 – enterprise level setup guide (SQL server setups)
2. A typical size for the Controller VMs is 2-4 vCPU and 8 GB of RAM.
3. On two Delivery Controllers, install the Delivery Controller software from the XenApp/XenDesktop 7.7 media. Download it from XenApp Enterprise, XenApp Platinum, XenDesktop Enterprise, or XenDesktop Platinum, depending on your license. Go to the downloaded XenDesktop 7.7 ISO and run AutoSelect.exe.
   
4. Click Start next to either XenApp or XenDesktop. The only difference is the product name displayed in the installation wizard.
   
5. On the left, click Delivery Controller.
6. You can install all components on one server or on separate servers. Splitting them out is only necessary in large environments or if you want to share the components (e.g. Licensing, StoreFront, Director) across multiple farms.
   
7. In the Features page, uncheck the box next to Install Microsoft SQL Server 2012 SP1 Express and click Next.
   
8. In the Summary page, click Install.
   
9. In the Installation Successful page, click Finish. Studio will automatically launch.
10. Ensure the two Controller VMs do not run on the same hypervisor host. Create an anti-affinity rule.
    

Citrix Studio 7.7 Hotfix 1

Without this fix, you can’t enter quotes in the command line arguments field of published apps.

1. Go to the downloaded Citrix Studio 7.7 Hotfix 1 (DStudio770WX64001) and run DesktopStudio_x64.msi.
   
2. In the Please read the Citrix Studio License Agreement page, check the box next to I accept the terms and click Install.
   
3. In the Completed the Citrix Studio Setup Wizard page, click Finish.
   
4. Programs and Features shows the updated version.
   

Create Site

There are several methods of creating the databases for XenApp/XenDesktop:

• If you have sysadmin permissions to SQL, let Citrix Studio create the databases automatically.
• If you don’t have sysadmin permissions to SQL then use Citrix Studio to generate SQL scripts and send them to a DBA.

Database Mirroring

If you are not using database mirroring then skip to the next section.

Citrix CTX127359 – How to Configure XenDesktop for SQL Database Mirroring: To configure a XenDesktop site for use with a mirrored SQL Server database, complete the following steps:

1. Create an empty database on the principal with the Latin1_General_CI_AS_KS collation sequence.
2. Configure the mirror and witness to start mirroring. For more information, see: http://technet.microsoft.com/en-us/library/ms189047.aspx.
3. Use Citrix Studio in one of the following two ways:
   1. Create the database automatically; mirroring is detected without user intervention.
   2. Create the database manually; two scripts are generated: one to be executed on the principal and one to be executed on the mirror. If you are executing the scripts using SQL Server Management Studio, enable the SQLCMD mode before executing the scripts. After executing the scripts, test the database connection by clicking Test connection and continue through the remainder of the wizard.

To verify mirroring after the wizard has completed, run the PowerShell cmdlet get-configdbconnection and ensure that the Failover Partner has been set in the connection string to the mirror.

Use Studio to Create Database Scripts

1. Launch Citrix Studio. After it loads, click Deliver applications and desktops to your users.
   
2. In the Introduction page, select An empty, unconfigured site. This reduces the number of pages in this Setup wizard. The other pages will be configured later.
3. Enter a Site Name (aka farm name) and click Next. Only administrators see the farm name.
   
4. In the Databases page, change the selection to Generate scripts to manually set up databases on the database server.
5. Change the database names if desired.
   
6. If you are building two Controllers, click Select near the bottom of the same page.
   
7. Click Add.
   
8. Enter the FQDN of the second Controller and click OK. Note: the Delivery Controller software must already be installed on that machine.
   
9. Then click Save.
   
10. If you hover your mouse over 2 selected, it will show both Controllers. Click Next.
    
11. In the Summary page, click Generate scripts.
    
12. A folder will open with six scripts. Edit each of the scripts.
    
13. Near the top of each script are two lines to create the database. Uncomment both lines (including the go line). Then save and close the file.
    
    
14. Once all of the scripts are edited you can send them to your DBA.
15. On the Principal SQL Server, open the file Site_Principal.sql.
    
    
16. Open the Query menu and click SQLCMD Mode.
    
17. Then execute the script.
    
18. If SQLCMD mode was enabled properly then the output should look something like this:
    
19. If you have a mirrored database, run the second script on the mirror SQL instance. Make sure SQLCMD mode is enabled.
    
    
    
20. Repeat for the Logging_Pricipal.sql script.
    
21. You’ll have to enable SQLCMD Mode for each script you open.
    
    
    
22. Repeat for the Monitoring_Principal.sql script.
    
23. Once again enable SQLCMD Mode.
    
    
    
24. The person running Citrix Studio must be added to the SQL Server as a SQL Login and granted the public server role.
    
    
25. Back in Citrix Studio, click the Continue database configuration and Site setup button.
    
26. In the Database page, enter the SQL server name and instance name and click Next.
    
    
27. On the Licensing page, enter the name of the Citrix License Server and click Connect.
    
28. XenApp/XenDesktop 7.7 requires the newest Licensing Server. If your server isn’t compatible, leave it set to localhost and fix it later.
    
29. If the Certificate Authentication appears, select Connect me and click Confirm.
30. Then select your license and click Next.
    
31. In the Summary page, make your selection for Customer Experience Improvement Program and click Finish.
    
32. It will take some time for the site to be created.
    

Verify Database Mirroring

If your database is mirrored, when you run get-brokerdbconnection, you’ll see the Failover Partner in the database connection string.

Second Controller

There are several methods of adding a second Controller to the databases for XenApp/XenDesktop:

• If you have sysadmin permissions to SQL, let Citrix Studio modify the databases automatically.
• If you don’t have sysadmin permissions to SQL then do use Citrix Studio to generate SQL scripts and send them to a DBA.

To use Citrix Studio to create the SQL Scripts:

1. On the 1^st Delivery Controller, if StoreFront is installed, delete the default StoreFront store (/Citrix/Store) and recreate it with your desired Store name (e.g. /Citrix/CompanyStore).
   
2. On the 2^nd Delivery Controller, install XenDesktop as detailed earlier.
3. After running Studio, click Connect this Delivery Controller to an existing Site.
   
4. Enter the name of the first Delivery Controller and click OK.
   
5. If you don’t have elevated SQL permissions, click No when asked if you want to update the database automatically.
   
6. Click Generate scripts.
   
7. A folder will open with six scripts. If not mirroring, then the top three scripts need to be sent to a DBA. If mirroring, send all six.
   
8. On the SQL Server, open open one of the .sql files.
   
   
9. Open the Query menu and click SQLCMD Mode.
   
10. Then execute the XenDesktop script.
    
11. If SQLCMD mode was enabled properly then the output should look something like this:
    
12. Back in Citrix Studio, click OK.
    
13. In the Studio, under Configuration > Controllers, you should see both controllers.
    
14. You can also test the site again if desired.
    

Studio – Slow Launch

From B.J.M. Groenhout at Citrix Discussions: The following adjustments can be made if Desktop Studio (and other Citrix management Consoles) will start slowly:

• Within Internet Explorer, go to Tools – Internet Options – Tab Advanced – Section Security and uncheck the option Check for publisher’s certificate revocation

After adjustment Desktop Studio (MMC) will be started immediately. Without adjustment it may take some time before Desktop Studio (MMC) is started.

Registry setting (can be deployed using Group Policy Preferences):

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
  • “State“=dword:00023e00

Database Maintenance

View Logging Database

To view the contents of the Logging Database, in Studio, click the Logging node. On the right is Create Custom Report. See Citrix article CTX138132 Viewing Configuration Logging Data Not Shown for more info.

Enable Read-Committed Snapshot

The XenDesktop Database can become heavily utilized under load in a large environment. Therefore Citrix recommends enabling the Read_Committed_Snapshot option on the XenDesktop databases to remove contention on the database from read queries. This can improve the interactivity of Studio and Director. It should be noted that this option may increase the load on the tempdb files. See Citrix article CTX137161 How to Enable Read-Committed Snapshot in XenDesktop for configuration instructions.

Change Database Connection Strings

Sometimes the database connection strings need to be modified:

• When moving the SQL databases to a different SQL server
• When enabling mirroring after the databases have already been configured in Studio.

Citrix blog post Updating Database Connection Strings in XenDesktop 7.x has PowerShell scripts to update the database connection strings.

Director Grooming

If XenDesktop is not Platinum Edition then all historical Director data is groomed at 7 days.

For XenDesktop/XenApp Platinum Edition, by default, most of the historical Director data is groomed at 90 days. This can be adjusted up to 367 days by running a PowerShell applet.

1. On a Delivery Controller, run PowerShell and run asnp Citrix.*
   
   
2. Run Get-MonitorConfiguration to see the current grooming settings.
   
3. Run Set-MonitorConfiguration to change the grooming settings.
   

Studio Administrators

Full Administrators

1. In the Studio, under Configuration, click the Administrators node. The first time you access the node you’ll see a Welcome page. Feel free to check the box and then click Close.
2. On the Administrators tab, right-click and click Create Administrator.
   
3. In the Administrator and Scope page, specify a group (e.g. Citrix Admins or Help Desk) that will have permissions to Studio and Director. Click Next.
   
4. On the Role page, select a role and then click Next. For example:
   • Full Administrator for the Citrix Admins group
   • Help Desk Administrator for the Help Desk group
   • Machine Catalog Administrator for the desktop team
     
5. In the Summary page, click Finish.

Help Desk

1. In the Studio, under Configuration, click the Administrators node. On the Administrators tab, right-click and click Create Administrator.
   
2. In the Administrator and Scope page, specify a Help Desk group that will have permissions to Studio and Director. Click Next.
   
3. On the Role page, select the Help Desk Administrator role and then click Next.
   
4. In the Summary page, click Finish.
5. When administrators in the Help Desk role log into Director, all they see is this.
   
   To jazz it up a little, add the Help Desk group to the read-only role.
6. Right-click the Help Desk Administrator and click Edit Administrator.
   
7. Click Add.
   
8. In the Scope page, select a scope and click Next.
   
9. In the Role page, select Read Only Administrator and click Next.
   
10. In the Summary page, click Finish.
11. Then click OK. Now Director will display the dashboard.
    

Provisioning Services w/Personal vDisk

From Citrix docs.citrix.com: The Provisioning Services Soap Service account must be added to the Administrator node of Studio and must have the Machine Administrator or higher role. This ensures that the PvD desktops are put into the Preparing state when the Provisioning Services (PVS) vDisk is promoted to production.

vCenter Connection

XenDesktop uses an Active Directory service account to log into vCenter. This account needs specific permissions in vCenter. To facilitate assigning these permissions, create a new vCenter role and assign it to the XenDesktop service account. The permissions should be applied at the datacenter or higher level.

Import vCenter Certificate

If you replaced the certificates on your vCenter server, then skip this section.

If vCenter is using a self-signed certificate, in order for Delivery Controller to trust the vCenter certificate, you must import the vCenter certificate on both Delivery Controllers.

1. Open a browser and connect to your vCenter Server.
2. Click the padlock and then view the certificate.
   
3. On the Details tab, click Copy to File.
   
4. Save the certificate in any format.
   
   
5. On each Delivery Controller, run mmc.exe. Open the File menu and click Add/Remove Snap-in. If your server is Windows Server 2012 R2 or newer, you can skip a few steps by running certlm.msc.
   
6. Move the Certificates snap-in to the right by highlighting it and clicking Add.
   
7. Select Computer account and click Next.
   
8. Select Local computer and click Finish.
   
9. Click OK.
10. After adding the snap-in, right-click the Trusted People node, expand All Tasks and click Import.
    
11. In the Welcome to the Certificate Import Wizard page, click Next.
12. In the File to Import page, browse to the certificate file you exported earlier. Click Next.
    
13. In the Certificate Store page, click Next.
14. In the Completing the Certificate Import Wizard page, click Finish.
15. Click OK to acknowledge that the import was successful.
16. Repeat these steps on the second Controller. It is important that you do both Controllers before adding the vCenter connection.

Hosting Resources

A Hosting Resource = vCenter + Cluster (Resource Pool) + Storage + Network. When you create a machine catalog, you select a previously defined Hosting Resource and the Cluster, Storage, and Network defined in the Hosting Resource object are automatically selected. If you need some desktops on a different Cluster+Storage+Network then you’ll need to define more Hosting Resources in Studio.

1. In Studio, expand Configuration and click Hosting. Right-click it and click Add Connection and Resources.
   
2. In the Connection page, select VMware vSphere as the Host type.
3. Enter https://vcenter01.corp.local/sdk as the vCenter URL. The URL must contain the FQDN of the vCenter server. If the vCenter certificate is self-signed, ensure it is added to the Trusted People certificate store on all Delivery Controllers. Ensure the entered URL has /sdk on the end.
4. Enter credentials of a service account. Click Next.
   
5. Enter a name for the hosting resource. Since each hosting resource is a combination of vCenter, Cluster, Network, and Datastore, include those names in this field (e.g. vCenter01-Cluster01-Network01-Datastore01).
6. In the Cluster page, click Browse and select a cluster or resource pool.
7. Select a network and click Next.
   
8. On the Storage page, select a datastore for the virtual machines. Maximum flexibility is achievable if you only select one datastore per hosting resource. Create additional hosting resources for each datastore.
9. If desired, change the selection for personal vDisk to use a different storage. Click Next.
   
10. In the Summary page, click Finish.

Citrix Director

Director on Standalone Server

If you are installing Director 7.7 on a standalone server, see Citrix CTX142260 Installing or Upgrading to Citrix Director 7.6.200

1. If you intend to install Director on a standalone server, start with running AutoSelect.exe from the XenApp/XenDesktop 7.7 media.
   
2. On the right, click Citrix Director.
   
3. It will ask you for the location of one Controller in the farm. Then finish the installation wizard.
   
4. In IIS Manager, go to Default Web Site > Director > Application Settings, find Service.AutoDiscoveryAddresses and make sure it points to a Controller and not to localhost.
   
   

Director Single Sign-on

You can configure Director 7.7 to support Integrated Windows Authentication (Single Sign-on).

1. Run IIS Manager. You can launch it from Server Manager (Tools menu) or from the Start Menu or by running inetmgr.
   
2. On the left, expand Sites, expand Default Web Site, and click Director.
   
3. In the middle, double-click Authentication in the IIS section. 
4. Right-click Windows Authentication and Enable it.
   
5. Right-click Anonymous Authentication and Disable it.
   
6. Pass-through auth won’t work from another computer until you set the http SPN for the Director server. See Director 7.7 Windows Authentication not working with NS LB at discussions.citrix.com.
   
7. If Director is not installed on a Controller then you’ll need to configure Kerberos delegation.
   
8. If you are load balancing Director then additional config is required. See Director 7.7 Windows Authentication not working with NS LB at discussions.citrix.com for more info.
   1. Create an AD service account that will be used as the Director’s ApplicationPoolIdentity.
   2. Create SPN and link it to the service account.

      setspn -S http/loadbalanced_URL domain\user

   3. Trust the user account for delegation to any service (Kerberos only) (trust the Director servers for delegation is not necessary in this case). You have to create the SPN before you can do this step.
      
   4. In IIS manager, on the Application Pools (Director), specify the Identity as user we have created in step 1.
      
   5. In IIS manager, select Default Web Site and open the Configuration Editor.
      
   6. Use the drop-down to navigate to the following section:
      

      system.webServer/security/authentication/windowsAuthentication

   7. Set useAppPoolCredentials = True and useKernelMode = False. Click Apply on the top right.
      
      
9. When you connect to Director you will be automatically logged in. You can change the login account by first logging off.
   
10. Then change the drop-down to User credentials.
    

Director – Multiple XenDesktop Sites

1. Run IIS Manager. You can launch it from Server Manager (Tools menu) or from the Start Menu or by running inetmgr.
   
2. On the left, expand Sites, expand Default Web Site, and click Director.
   
3. In the middle pane, double-click Application Settings.
   
4. Find the entry for Service.AutoDiscoveryAddresses and double-click it.
   
5. If Director is installed on a Controller, localhost should already be entered.
6. Add a comma and the NetBIOS name of one of the controllers in the 2^nd XenDesktop Site (farm). Only enter one Controller name. If you have multiple Director servers, you can point each Director server to a different Controller in the 2^nd XenDesktop Site (farm).
7. According to Citrix CTX200543 Desktop Director Access Fails After XenDesktop 7.5 is Upgraded to 7.6, the addresses should be NetBIOS names, not FQDN. Click OK.
   

Director Alerts and Notifications

Director 7.7 supports alert conditions and email notifications. This feature requires XenApp/XenDesktop to be licensed with Platinum Edition. See Citrix Blog Post Configuring & Managing Alerts and Notifications Using Director for more information.

1. While logged into Director, at the top of the page click the Alerts button.
   
2. Switch to the Email Server Configuration tab.
   
3. Enter your SMTP information and click Send Test Message. Then click Save.
   
   
4. Switch to the Citrix Alerts Policy tab.
5. There are three high-level categories of alerts: Site Policy, Delivery Group Policy, and Server OS Policy. Click whichever one you want to configure.
6. Then click Create.
   
7. Give the alert a name.
8. On the bottom left, select a condition and enter thresholds.
   
9. On the bottom right, in the Notifications preferences section, click Add.
   
10. Enter an email address and click Add.
    
11. Click Save when done. Feel free to create more alerts and notifications.
    
12. Citrix has an experimental Desktop Notification Tool. See Citrix Blog Post Desktop Notification Tool For Citrix XenDesktop. 
    

Director – SCOM Integration

Director 7.7 can display alerts from System Center Operations Manager 2012 R2. This feature requires XenApp/XenDesktop Platinum Edition.

1. See Configure SCOM integration at docs.citrix.com for detailed configuration instructions. Also see Marius Sandbu Integrating Citrix XenDesktop 7.7 and System Center Operations Manager.
2. If Director server or System Center Operations Manager server is 2008 R2, then login to the 2008 R2 server, open PowerShell and run Enable-PSRemoting. Yes to everything. This is not needed on Windows Server 2012 R2 servers.
3. On Director 7.7 server, run C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /configscom
   
4. FYI, the DirectorConfig.exe /configscom command enables the following features on the Director server: /FeatureName:IIS-NetFxExtensibility45 /FeatureName:IIS-ASPNET45 /FeatureName:WCF-HTTP-Activation45
5. FYI, the System Center Operations Manager server is listed in IIS Manager at Default Web Site > Director > Application Settings (middle pane) > Connector.SCOM.ManagementServer.
   
6. On the System Center Operations Manager server, edit Remote Management Users local group and add Citrix Admins and other Director users.
7. In System Center Operations Manager Console, go to Administration > User Roles and edit Operations Manager Operators. Add the Citrix Admins and other Director users.
8. See Citrix Blog Post SCOM Alerts in Citrix Director for information on how to view System Center Operations Manager alerts in Director.

Director Tweaks

Prepopulate the domain field

From http://www.xenblog.dk/?p=33: On the Controllers having the Director role installed, locate and edit the ‘LogOn.aspx’ file. By default you can find it at “C:\inetpub\wwwroot\Director\Logon.aspx”

In line 450 you will have the following. To find the line, search for ID=”Domain”. Note: onblur and onfocus attributes were added in newer versions of Director.

<asp:TextBox ID="Domain" runat="server" CssClass="text-box" onfocus="showIndicator(this);" onblur="hideIndicator(this);"></asp:TextBox>

In the ID=”Domain” element, insert a Text attribute and set it to your domain name. Don’t change or add any other attributes. Save the file.

<asp:TextBox ID="Domain" runat="server" Text="Corp" CssClass="text-box" onfocus="showIndicator(this);" onblur="hideIndicator(this);"></asp:TextBox>

This will prepopulate the domain field text box with your domain name and still allow the user to change it, if that should be required. Note: this only seems to work if Single Sign-on is disabled.

Session timeout

By default the idle time session limit of the Director is 245 min. If you wish to change the timeout, here is how to do it.

1. Log on to the Director Server as an administrator
2. Open the ‘IIS Manager’
3. Browse to ‘SitesDefault Web SiteDirector’ in the left hand pane.
4. Open ‘Session State’ in the right hand pane
5. Change the ‘Time-out (in minutes)’ value under ‘Cookie Settings’
6. Click ‘Apply’ in the Actions list

SSL Check

From http://www.shaunritchie.co.uk/citrix-desktop-director-2-1: If you are not securing Director with an SSL certificate you will get this error at the logon screen.

To stop this:

1. Log on to the Director Server as an administrator
2. Open the ‘IIS Manager’
3. Browse to ‘SitesDefault Web SiteDirector’ in the left hand pane.
4. Open ‘Application Settings’ in the right hand pane
5. Set EnableSslCheck to false.
   

Disable Activity Manager

From docs.citrix.com: By default, the Activity Manager in Director displays a list of all the running applications and the Windows description in the title bars of any open applications for the user’s session. This information can be viewed by all administrators that have access to the Activity Manager feature in Director. For Delegated Administrator roles, this includes Full administrator, Delivery Group administrator, and Help Desk Administrator.

To protect the privacy of users and the applications they are running, you can disable the Applications tab from listing running applications.

• On the VDA, modify the registry key located at HKLM\Software\Citrix\Director\TaskManagerDataDisplayed. By default, the key is set to 1. Change the value to 0, which means the information will not be displayed in the Activity Manager.
• On the server with Director installed, modify the setting that controls the visibility of running applications. By default, the value is true, which allows visibility of running applications in the Applications Change the value to false, which disables visibility. This option affects only the Activity Manager in Director, not the VDA. Modify the value of the following setting:
  UI.TaskManager.EnableApplications = false

Large Active Directory

From CTX133013 Desktop Director User Account Search Process is Slow or Fails: By default, all the Global Catalogs for the Active Directory Forest are searched using Lightweight Directory Access Protocol (LDAP). In a large Active Directory environment, this query can take some time or even time out.

1. In Information Server (IIS) Management, under the Desktop Director site, select Application Settings and add a new value called ActiveDirectory.ForestSearch. Set it to False. This disables searching any domain except the user’s domain and the server’s domain.
2. To search more domains, add the searchable domain or domains in the ActiveDirectory.Domains field.
   

Site Groups

From Citrix Blog Post Citrix Director 7.6 Deep-Dive Part 4: Troubleshooting Machines:

If there are a large number of machines, the Director administrator can now configure site groups to perform machine search so that they can narrow down searching for the machine inside a site group. The site groups can be created on the Director server by running the configuration tool via command line by running the command:

C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /createsitegroups

Then provide a site group name and IP address of the delivery controller of the site to create the site group.

Director – Saved Filters

From Scott Osborne and Jarian Gibson at Citrix Discussions: In Director, you can create a filter and save it.

The saved filter is then accessible from the Filters menu structure.

The saved filters are stored on each Director server at C:\Inetpub\wwwroot\Director\UserData. Observations:

• Each user has their own saved filters.
• The saved filters are not replicated across Director servers. You can schedule a robocopy script to do this automatically.
• When upgrading Director, the saved filters are deleted?

Director – Custom and Scheduled Reports

The Monitoring database contains more data than is exposed in Director. To view this data, the Monitoring service has an OData Data Feed that can be queried.

You can use Excel to pull data from the OData Data feed. See Citrix Blog Post – Citrix Director – Analyzing the Monitoring Data by Means of Custom Reports. This particular blog post shows how to use an Excel PivotChart to display the connected Receiver versions.

Or for Linqpad, see Citrix Blog Post – Creating Director Custom reports for Monitoring XenDesktop using Linqpad

Go to Citrix Blog Post Obtain XenDesktop Custom report through Citrix Director and download the tool. Once installed you can create custom reports from within Director. 

Citrix Licensing Server

Upgrade and Enable CEIP

If you have a standalone or separate Citrix Licensing server, upgrade it to 11.13.1.

1. Go to the downloaded Citrix Licensing 11.13.1 build 15004 and run CTX_Licensing.msi.
   
2. In the Welcome to the Citrix Licensing Upgrade Wizard page, click Upgrade.
   
3. In the Citrix Licensing Setup completed successfully page, click Finish.
   
4. Go to C:\Program Files (x86)\Citrix\Licensing\MyFiles and edit the file CITRIX.OPT using an elevated text editor.
   
5. After an upgrade, CEIP (Customer Experience Improvement Program) is set to NONE. You may change it to ANON or DIAG to send License Server information to Citrix. ANON = Anonymous and DIAG = Call Home (customer identifiable). These correspond to the Customer Experience Improvement Program options you would have seen on a fresh install. Also see Citrix Blog Post – Citrix Licensing – Wired to Improve.
   
   
6. If you go to Programs and Features, it should now show version 11.0.0.15004.
   
7. If you login to the license server web console, on the Administration tab, it shows it as version 11.13.1 build 15004.
   
8. You can also view the version in the registry at HKLM\Software\Wow6432Node\Citrix\LicenseServer\Install.
   

Licensing Server HA using GSLB

From Dane Young – Creating a Bulletproof Citrix Licensing Server Infrastructure using NetScaler Global Server Load Balancing (GSLB) and CtxLicChk.ps1 PowerShell Scripts. Here is a summary of the configuration steps. See the blog post for detailed configuration instructions.

1. Build two License Servers in each datacenter with identical server names. Since server names are identical, they can’t be domain-joined.
2. Install identical licenses on all License Servers.
3. Set the DisableStrictNameChecking registry key on all Citrix Licensing servers.
4. Synchronize the certificate files located at C:\Program Files (x86)\Citrix\Licensing\WebServicesForLicensing\Apache\conf. They must be identical on all Licensing Servers.
5. Download CtxLicChk.exe from http://support.citrix.com/article/CTX123935 and place on all Licensing Servers.
6. Schedule the PowerShell script CtxLicChk.ps1 on all Licensing Servers. Get this script from the blog post linked above.
7. Configure NetScaler:
   1. Configure GSLB ADNS services.
   2. Add wildcard Load Balancing service for each Citrix Licensing Server.
   3. Configure service TCP monitoring for ports 27000, 7279, 8082, and 8083.
   4. Create Load Balancing Virtual Server for each Licensing Server.
   5. Set one Load Balancing Virtual Server as backup for the other.
   6. Repeat in second datacenter.
   7. Configure GSLB Services and GSLB Monitoring.
   8. Configure GSLB Virtual Servers. Set one GSLB Virtual Server as backup for the other.
8. Delegate the Citrix Licensing DNS name to the ADNS services on the NetScaler appliances.
9. Configure Citrix Studio to point to the GSLB-enabled DNS name for Citrix Licensing.

Citrix License Server Monitoring

http://www.jonathanmedd.net/2011/01/monitor-citrix-license-usage-with-powershell.html.

Lal Mohan – Citrix License Usage Monitoring Using Powershell

Jaroslaw Sobel – Monitoring Citrix Licenses usage – Graphs using WMI, Powershell and RRDtool. This script generates a graph similar to the following:

Remote Desktop Licensing Server

Install Remote Desktop Licensing Server

Do the following on your XenDesktop Controllers:

1. In Server Manager, open the Manage menu and click Add Roles and Features.
   
2. Click Next until you get to the Server Roles page. Check the box next to Remote Desktop Services and click Next.
   
3. Click Next until you get to the Role Services page. Check the box next to Remote Desktop Licensing and click Next.
   
4. Click Add Features if prompted.
   
5. Then finish the wizard to install the role service.
   

Activate Remote Desktop Licensing

1. After RD Licensing is installed, in Server Manager, open the Tool menu, expand Terminal Services and click Remote Desktop Licensing Manager.
   
2. The tool should find the local server. If it does not, right-click All servers, click Connect and type in the name of the local server. Once the local server can be seen in the list, right-click the server and click Activate Server.
   
3. In the Welcome to the Activate Server Wizard page, click Next.
   
4. In the Connection Method page, click Next.
   
5. In the Company Information page, enter the required information and click Next.
   
6. All of the fields on the Company Information page are optional so you do not have to enter anything. Click Next.
   
7. In the Completing the Activate Server Wizard page, uncheck the box next to Start Install Licenses Wizard now and click Finish. Since the session hosts will be configured to pull Per User licenses, there is no need to install licenses on the RD Licensing Server.
   
8. In RD Licensing Manager, right-click the server and click Review Configuration.
   
9. Ensure you have green check marks. If the person installing Remote Desktop Licensing does not have permissions to add the server to the Terminal Server License Servers group in Active Directory, ask a domain admin to do it manually. If you have the proper permissions, click Add to Group.
   
10. Click Continue when prompted that you must have Domain Admins privileges.
    
11. Click OK when prompted that the computer account has been added.
    
12. Click OK to close the window.
    

Health Check

Andrew Morgan – New Free Tool: Citrix Director Notification Service: The Citrix Director Notification service sits on an edge server as a service (or local to the delivery controller) and periodically checks the health of:

• Citrix Licensing.
• Database Connections.
• Broker Service.
• Core Services.
• Hypervisor Connections.

And if any of these items fall out of bounds, an SMTP alert is sent to the mailbox of your choice for action. The tool will also send “All Clear” emails when these items are resolved, ensuring you are aware when the service has resumed a healthy state.

Related Pages

• Configure RDSH VDAs to use Remote Desktop Licensing Server

On This Page:

• VDA Virtual Machine Hardware
• Windows Configuration
• Install Virtual Delivery Agent 7.7 
  • Virtual Delivery Agent 7.6.300 Hotfixes
  • Change Controller Registration Port to something other than port 80
  • Verify VDA Registration with Controller
• Receivers:
  • Receiver 4.4
  • App Switcher 2.0.2 for Receiver for HTML5
  • Citrix PDF Printer 7.6.2 for Receiver for HTML5
• Framehawk Configuration
• Remote Desktop Licensing Configuration
• Reduce C: Drive Permissions
• Configure Pagefile for Provisioning Services
• Direct Access Users Group – allow non-administrators to RDP to the VDA
• Enable Windows Profiles v3/v4
• Registry Settings – HDX Flash for IE 11, published Explorer, 8dot3, HTML5 Clipboard, 4K Monitors
• Restore Legacy Client Drive Mapping
• COM/LPT Port Redirection
• Print Driver for Mac and Linux Clients
• HTML5 Receiver – SSL for VDA
• Anonymous Accounts
• Antivirus
• Optimize Performance
• Seal and Shut Down
• Troubleshooting – Graphics

= Recently Updated

Hardware

1. If vSphere 6, don’t use hardware version 11 unless you have NVIDIA GRID. VMware 2109650 – Video playback performance issue with hardware version 11 VMs in 2D mode
2. For virtual desktops, give the virtual machine: 2+ vCPU and 2+ GB of RAM
3. For Windows 2008 R2 RDSH, give the virtual machine 4 vCPU and 12-24 GB of RAM
4. For Windows 2012 R2 RDSH, give the virtual machine 8 vCPU, and 24-48 GB of RAM
5. Remove the floppy drive
6. Remove any serial or LPT ports
7. If vSphere:
   1. To reduce disk space, reserve memory. Memory reservations reduce or eliminate the virtual machine .vswp file.
   2. The NIC should be VMXNET3.
8. If this VDA will boot from Provisioning Services:
   1. Give the VDA extra RAM for caching.
   2. Do not enable Memory Hot Plug
      
   3. For vSphere, the NIC must be VMXNET3.
      
   4. For vSphere, configure the CD-ROM to boot from IDE instead of SATA. SATA comes with VM hardware version 10. SATA won’t work with PvS.
      
9. Install the latest version of drivers (e.g. VMware Tools).
   1. If Windows 7 on vSphere, don’t install the VMware SVGA driver. For more details, see CTX201804 Intermittent Connection Failures/Black Screen Issues When Connecting from Multi-Monitor Client Machines to Windows 7 VDA with VDA 7.x on vSphere/ESXi. 
      

If vSphere, disable NIC Hotplug

1. Users could use the systray icon to Eject the Ethernet Controller. Obviously this is bad.
   
2. To disable this functionality, power off the virtual machine.
   
3. Once powered off, right-click the virtual machine and click Edit Settings.
   
4. On the VM Options tab, expand Advanced and then click Edit Configuration.
   
5. Click Add Row.
   
6. On the left, enter devices.hotplug. On the right, enter false.
7. Then click OK a couple times to close the windows.
   
8. The VM can then be powered on.
   

Windows Preparation

1. If RDSH, disable IE Enhanced Security Config
   
2. Optionally, go to Action Center (Windows 8.1 or 2012 R2) or Security and Maintenance (Windows 10) to disable User Account Control and enable SmartScreen .
   
3. Run Windows Update.
   
4. If Windows Firewall is enabled:
   1. Enable File Sharing so you can access the VDA remotely using SMB
      
   2. Enable COM+ Network Access and the three Remote Event Log rules so you can remotely manage the VDA.
      
      
5. Add your Citrix Administrators group to the local Administrators group on the VDA.
   
6. The Remote Desktop Services “Prompt for Password” policy prevents Single Sign-on to the Virtual Delivery Agent. Check registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services. If fPromptForPassword = 1 then you need to fix group policy. The following GPO setting will prevent Single Sign-on from working.
   Computer Configuration Policies Administrative templates Windows Components Remotes Desktop Services Remote desktop Session Host Security Always prompt for password upon connection

   Or set the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\PorticaAutoLogon (DWORD) = 0x10.
7. For Windows 7 VDAs that will use Personal vDisk, install Microsoft hotfix 2614892 – A computer stops responding because of a deadlock situation in the Mountmgr.sys driver. This hotfix solved a Personal vDisk Image update issue detailed at Citrix Discussions.
8. If this VDA is Windows Server 2008 R2, request and install the Windows hotfixes recommended by Citrix CTX129229. Scroll down to see the list of recommended Microsoft hotfixes for Windows Server 2008 R2. Ignore the XenApp 6.x portions of the article. Also see http://www.carlstalhood.com/windows-server-2008-r2-post-sp1-hotfixes/.
   
9. To remove the built-in apps in Windows 10, see Robin Hobo How to remove built-in apps in Windows 10 Enterprise.
10. For Remote Assistance in Citrix Director, configure the GPO setting Computer Configuration | Policies | Administrative Templates | System | Remote Assistance | Offer Remote Assistance. See Jason Samuel – How to setup Citrix Director Shadowing with Remote Assistance using Group Policy for more details.
    

Install Virtual Delivery Agent 7.7

1. For virtual desktops, make sure you are logged into the console. The VDA won’t install if you are connected using RDP.
2. Make sure 8.3 file name generation is not disabled. If so, see CTX131995 – User Cannot Launch Application in Seamless Mode to fix the AppInit_DLLs registry keys.
3. Make sure .NET Framework 4.5.1 is installed.
4. Go to the downloaded XenDesktop 7.7 (XenDesktop Platinum, XenDesktop Enterprise, XenApp Platinum, or XenApp Enterprise) .iso file and run AutoSelect.exe. Alternatively, you can download the standalone VDA package and run that instead.
   
5. Click Start next to either XenApp or XenDesktop. The only difference is the product name displayed in the installation wizard.
   
6. Click Virtual Delivery Agent for Windows Desktop OS or Windows Server OS depending on which type of VDA you are building.
   
7. In the Environment page, select Create a Master Image and click Next.
   
8. For virtual desktops, in the HDX 3D Pro page, click Next.
   
9. In the Core Components page, if you don’t need Citrix Receiver installed on your VDA then uncheck the box. Click Next.
   
10. In the Delivery Controller page, select Do it manually. Enter the FQDN of each Controller. Click Test connection. And then make sure you click Add. Click Next when done.
    
11. In the Features page, click Next. If this is a virtual desktop, you can leave Personal vDisk unchecked now and enable it later.
    
12. In the Firewall page, click Next.
    
13. In the Summary page, click Install.
    
14. For RDSH, click Close when you are prompted to restart.
    
15. After the machine reboots twice, login and installation will continue.
    
16. After installation, click Finish to restart the machine again.
    
17. If 8.3 file name generation is disabled, see CTX131995 – User Cannot Launch Application in Seamless Mode to fix the AppInit_DLLs registry keys.
    

Virtual Delivery Agent 7.6.300 Hotfixes

The core VDA software is actually VDA 7.6.300 so you can install core VDA 7.6.300 hotfixes on a 7.7 VDA. What’s different about 7.7 VDA vs 7.6.300 is the brokering agents, Director agents, and Profile Management built into the VDA 7.7 installer.

1. Download Virtual Delivery Agent 7.6.300 hotfixes. There are DesktopVDACore hotfixes and ServerVDACore hotfixes, depending on which type of VDA you are building.
   
2. Install each hotfix by double-clicking the .msp file.
   
3. In the Welcome to the Citrix HDX TS/WS Setup Wizard page, click Next.
   
4. In the Ready to update page, click Update.
5. In the Completed the Citrix HDX TS/WS Setup Wizard page, click Finish.
6. When prompted to restart, if you have multiple hotfixes to install, click Cancel.
7. Continue installing hotfixes. Restart when done.

Controller Registration Port

Some environments will not accept the default port 80 for Virtual Delivery Agent registration. To change the port, do the following on the Virtual Delivery Agent:

1. Open Programs and Features.
   
2. Find Citrix Virtual Delivery Agent and click Change.
   
3. Click Customize Virtual Delivery Agent Settings.
   
4. Edit the Delivery Controllers and click Next.
   
5. On the Configure Delivery Controller page, change the port number and click Next.
   
6. In the Summary page, click Reconfigure.
   
7. In the Finish Reconfiguration page, click Finish. The machine automatically restarts.
   
8. You must also change the VDA registration port on the Controllers by running BrokerService.exe /VDAPort.

Controller Registration – Verify

1. If you restart the Virtual Delivery Agent machine or restart the Citrix Desktop Service…
   
2. In Windows Logs Application log, you should see an event 1012 from Citrix Desktop Service saying that it successfully registered with a controller. If you don’t see this then you’ll need to fix the ListOfDDCs registry key.
   

Upgrade to Receiver 4.4

VDA 7.7 does not include this update.

If Receiver is installed on your VDA, upgrade it to version 4.4.

1. Go to the downloaded Receiver 4.4 and run CitrixReceiver.exe.
   
2. In the Welcome to Citrix Receiver page, click Start.
   
3. In the License Agreement page, check the box next to I accept the license agreement and click Next.
   
4. If you see the Enable Single Sign-on page, check the box next to Enable Single Sign-on and click Next.
   
5. In the Help make our products better page, make your selection and click Install.
   
6. After installation, click Finish.
   
7. See the Receiver page for configuration instructions.

HTML5 App Switcher 2.0.2

This tool is only used by Receiver for HTML5.

1. .NET Framework 4.0.3 or newer is required.
2. Go to the downloaded Receiver for HTML5 App Switcher (Citrix_AppSwitcher_2.0.2) and run AppSwitcher.msi.
   
3. Check the box next to I accept the terms and click Install.
   
4. In the Completed the App Switcher Setup Wizard page, click Finish.
   
   
5. In Programs and Features, it is shown as version 2.0.2.25.
   

Citrix PDF Printer 7.6.2

This tool is only used by Receiver for HTML5.

1. Go to the downloaded Receiver for HTML5 Citrix PDF Printer 7.6.2 (Citrix_PDFPrinter_7.6.2) and run CitrixPDFPrinter64.msi.
   
2. In the Please read the Citrix PDF printer License Agreement page, check the box next to I accept the terms and click Install.
   
3. In the Completed the Citrix PDF Universal Driver Setup Wizard page, click Finish.
   
4. In Programs and Features, it is shown as version 7.6.2.9.
   
5. Configure a Citrix Policy to enable the PDF printer. The setting is called Auto-create PDF Universal Printer.
   

Framehawk Configuration

To enable Framehawk, see http://www.carlstalhood.com/citrix-policy-settings/#framehawkconfig

Remote Desktop Licensing Configuration

On 2012 R2 RDSH, the only way to configure Remote Desktop Licensing is using group policy (local or domain). This procedure also works for 2008 R2 RDSH. This procedure is not needed on virtual desktops.

1. For local group policy, run gpedit.msc.
   
2. Go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Licensing.
   
3. Double-click Use the specified Remote Desktop license servers. Change it to Enabled and enter the names of the RDS Licensing Servers (typically installed on XenDesktop Controllers). Click OK.
   
4. Double-click Set the Remote Desktop licensing mode. Change it to Enabled and select Per User. Click OK.
   
5. In Server Manager, open the Tools menu, expand Terminal Services and click RD Licensing Diagnoser.
   
6. The Diagnoser should find the license server and indicate the licensing mode. It’s OK if there are no licenses installed on the Remote Desktop License Server.
   

Several people in Citrix Discussions reported the following issue: If you see a message about RD Licensing Grace Period has expired even though RD Licensing is properly configured, see Eric Verdumen No remote Desktop Licence Server availible on RD Session Host server 2012. The solution was to delete the REG_BINARY in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\GracePeriod only leaving the default. You must take ownership and give admin users full control to be able to delete this value.

C: Drive Permissions

This section is more important for shared VDAs like Windows 2008 R2 and Windows 2012 R2.

The default permissions allow users to store files on the C: drive in places other than their profile.

1. Open the Properties dialog box for C:.
   
2. On the Security tab, click Advanced.
   
3. Highlight the line containing Users and Create Folders and click Remove.
   
4. Highlight the line containing Users and Special and click Remove. Click OK.
   
5. Click Yes to confirm the permissions change.
   
6. If you see any of these Error Applying Security windows, click Continue.
   
7. Click OK to close the C: drive properties.

Pagefile

If this image will be converted to a Provisioning Services vDisk, then you must ensure the pagefile is smaller than the cache disk. For example, if you allocate 20 GB of RAM to your Remote Desktop Session Host, and if the cache disk is only 15 GB, then Windows will have a default pagefile size of 20 GB and Provisioning Services will be unable to move it to the cache disk. This causes Provisioning Services to cache to server instead of caching to your local cache disk (or RAM).

1. Open System. In 2012 R2, you can right-click the Start button and click System.
   
2. Click Advanced system settings.
   
3. On the Advanced tab, click the top Settings button.
   
4. On the Advanced tab, click Change.
   
5. Either turn off the pagefile or set the pagefile to be smaller than the cache disk. Don’t leave it set to System managed size. Click OK several times.
   

Direct Access Users

When Citrix Virtual Delivery Agent is installed on a machine, non-administrators can no longer RDP to the machine. A new local group called Direct Access Users is created on each Virtual Delivery Agent. Add your non-administrator RDP users to this local group so they can RDP directly to the machine.

Windows Profiles v3/v4/v5

Roaming Profiles are compatible only between the following client and server operating system pairs. The profile version is also listed.

• v5 = Windows 10 and Windows Server 2016
• v4 = Windows 8.1 and Windows Server 2012 R2
• v3 = Windows 8 and Windows Server 2012
• v2 = Windows 7 and Windows Server 2008 R2
• v2 = Windows Vista and Windows Server 2008

Windows 8.1 and 2012 R2 don’t properly set the profile version. To fix this, ensure update rollup 2887595 is installed. http://support.microsoft.com/kb/2890783. After you apply this update, you must create a registry key before you restart the computer.

1. Run regedit.
2. Locate and then tap or click the following registry subkey:
   HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\ProfSvcParameters
3. On the Edit menu, point to New, and then tap or click DWORD Value.
4. Type UseProfilePathExtensionVersion.
5. Press and hold or right-click UseProfilePathExtensionVersion, and then tap or click Modify.
6. In the Value data box, type 1, and then tap or click OK.
7. Exit Registry Editor.

Then, Windows 8.1 creates a user profile and appends the suffix “.v4” to the profile folder name to differentiate it from version 2 of the profile in Windows 7 and version 3 of the profile in Windows 8.

Registry

HDX Flash

From Citrix Knowledgebase article CTX139939 – Microsoft Internet Explorer 11 – Citrix Known Issues: The registry key value IEBrowserMaximumMajorVersion is queried by the HDX Flash service to check for maximum Internet Explorer version that HDX Flash supports. For Flash Redirection to work with Internet Explorer 11 set the registry key value IEBrowserMaximumMajorVersion to 11 on the machine where HDX flash service is running. In case of XenDesktop it would be the machine where VDA is installed.

• Key = HKLM\SOFTWARE\Wow6432Node\Citrix\HdxMediaStreamForFlash\Server\PseudoServer
  • Value = IEBrowserMaximumMajorVersion (DWORD) = 00000011 (Decimal)

From Citrix Discussions: Add the DWORD ‘FlashPlayerVersionComparisonMask=0′ on the VDA under HKLM\Software\Wow6432Node\Citrix\HdxMediaStreamForFlash\Server\PseudoServer.  This disables the Flash major version checking between the VDA and Client Device.

Published Explorer

This section applies if you intend to publish apps from this VDA.

From Citrix Knoweldgebase article CTX128009 – Explorer.exe Fails to Launch: When publishing the seamless explorer.exe application, the session initially begins to connect as expected. After the loading, the dialog box disappears and the explorer application fails to appear. On the VDA, use the following registry change to set the length of time a client session waits before disconnecting the session:

• Key = HKLM\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI
  • Value = LogoffCheckerStartupDelayInSeconds (DWORD) = 10 (Hexadecimal)

Mfaphook – 8.3 File Names

1. Open a command prompt.
2. Switch to C:\ by running cd /d C:\
3. Run dir /x program*
4. If you don’t see PROGRA~1 then 8.3 is disabled. This will break Citrix.
   
5. If 8.3 is disabled, open regedit and go to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows.
6. On the right is AppInit_DLLs. Edit it and remove the path in front of MFAPHOOK64.DLL.
   
   
   

Login Timeout

XenDesktop by default only allows 90 seconds to complete a logon operation. The timeout can be increased by setting the following:

HKLM\SOFTWARE\Citrix\PortICA

Add a new DWORD AutoLogonTimeout and set the value to decimal 240.

More information at http://discussions.citrix.com/topic/350243-machines-in-registered-state-but-vm-closes-after-welcome-screen/.

Receiver for HTML5 Enhanced Clipboard

From About Citrix Receiver for Chrome 1.9 at docs.citrix.com: To enable enhanced clipboard support, set registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\Virtual Clipboard\Additional Formats\HTML Format\Name=”HTML Format”. Create any missing registry keys. This applies to both virtual desktops and Remote Desktop Session Hosts.

4K Monitors

Citrix CTX201696 – Citrix XenDesktop and XenApp – Support for Monitors Including 4K Resolution and Multi-monitors: Up to eight 4K monitors are supported with the Std-VDA and RDS VDA irrespective of underlying GPU support, provided the required policies and/or registry keys are correctly configured. Currently the Std-VDA for XenDesktop and RDS-VDA for XenApp does not support resolutions higher than 4094 in any dimension.

Framehawk currently does not support 4K monitors. At the time of writing, the number of monitors supported is 1, the use of more monitors will cause the graphics mode to change from Framehawk to Thinwire to support multi-monitor.  The maximum resolution supported by Framehawk is currently 2048×2048.

From CTX200257 – Screen Issues Connecting to 4K Resolution Monitors: Symptom: A blank or corrupt screen is displayed when connecting to Windows 7 or 8.1 Standard XenDesktop Virtual Delivery Agents on a client which has one or more 4K resolution monitors.

1. Calculate the video memory that is required for 4K monitor using the following formula:
   Sum of total monitors (Width * height * 4 * X) where width and height are resolution of the monitor.
   X = 2 if VDA is Windows 7 OR X = 3 if VDA is Windows 88.1
   Suppose a Windows 7 VDA is connecting to a client that has dual 4K monitors (3840×2160), then video buffer should be: (3840 x 2160 x 4 x 2) + (3840 x 2160 x 4 x 2) = ~132MB
2. Open the registry (regedit) and navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vd3v
3. Increase the value of “MaxVideoMemoryBytes” REG_DWORD value to the above calculated memory.
4. Reboot the VDA.

When using Thinwire, Compatibility, Thinwire Plus or Legacy modes, the Display memory Limit policy needs to be configured appropriately for Std-VDA, as per Graphics Policy Settings at docs.citrix.com. The Default value for Display memory Limit is 65536KB and this is sufficient up to 2x4K monitors (2x32400KB). You can find more information on Graphics modes at Citrix Blogs – Site Wide View of HDX Graphics Modes.

Legacy Client Drive Mapping

Citrix Knowledgebase article How to Enable Legacy Client Drive Mapping Format on XenApp: Citrix Client Drive Mapping no longer uses drive letters and instead they appear as local disks. This is similar to RDP drive mapping.

The old drive letter method can be enabled by setting the registry value:

• Key = HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\UncLinks (create the key)
  • Value = UNCEnabled (DWORD) = 0
    

When you reconnect, the client drives will be mapped as drive letters (starts with V: and goes backwards).

COM/LPT Port Redirection

To signal Citrix’ intention to deprecate COM and LPT support in a future major release, policy settings for COM Port and LPT Port Redirection have moved from Studio to the registry, and are now located under HKLM\Software\Citrix\GroupPolicy\Defaults\Deprecated on either your Master VDA image or your physical VDA machines. The COM/LPT port registry values are detailed at docs.citrix.com.

Print Driver for Non-Windows Clients

This section applies to Windows 2012 R2, Windows 8.1, and Windows 10 VDAs.

From Mac Client Printer Mapping Fix for Windows 8/8.1 and Windows Server 2012/2012R2. By default, Non-Windows clients cannot map printers due to a missing print driver on the VDA machine.

1. Requirements:
   • Internet Access
   • Windows Update service enabled
2. Click Start and run Devices and Printers.
   
3. In the Printers section, highlight a local printer (e.g. Microsoft XPS Document Writer). Then in the toolbar click Print server properties.
   
4. Switch to the Drivers tab. Click Change Driver Settings.
   
5. Then click Add.
   
6. In the Welcome to the Add Printer Driver Wizard page, click Next.
   
7. In the Processor Selection page, click Next.
   
8. In the Printer Driver Selection page, click Windows Update. The driver we need won’t be in the list until you click this button. Internet access is required.
   
9. Once Windows Update is complete, highlight HP on the left and then select HP Color LaserJet 2800 Series PS (Microsoft) on the right. Click Next.
   
10. In the Completing the Add Printer Driver Wizard page, click Finish.
    
11. Repeat these instructions to install the following additional drivers:
    • HP LaserJet Series II
    • HP Color LaserJet 4500 PCL 5

SSL for VDA

If you intend to use HTML5 Receiver internally, install certificates on the VDAs so the WebSockets (and ICA) connection will be encrypted. Internal HTML5 Receivers will not accept clear text WebSockets. External users don’t have this problem since they are SSL-proxied through NetScaler Gateway. Notes:

• Each Virtual Delivery Agent needs a machine certificate that matches the machine name. This is feasible for a small number of persistent VDAs. For non-persistent VDAs, you’ll need some automatic means for creating machine certificates every time they reboot.
• As detailed in the following procedure, use PowerShell on the Controller to enable SSL for the Delivery Group. This forces SSL for every VDA in the Delivery Group, which means every VDA in the Delivery Group must have SSL certificates installed.

The Citrix blog post How To Secure ICA Connections in XenApp and XenDesktop 7.6 using SSL has a method for automatically provisioning certificates for pooled virtual desktops by enabling certificate auto-enrollment and setting up a task that runs after the certificate has been enrolled. Unfortunately this does not work for Remote Desktop Session Host.

The following instructions can be found at Configure SSL on a VDA using the PowerShell script at docs.citrix.com.

1. On the VDA machine, run mmc.exe.
2. Add the Certificates snap-in.
3. Point it to Local Computer.
4. Request a certificate from your internal Certificate Authority. You can use either the Computer template or the Web Server template.
   
   You can also use group policy to enable Certificate Auto-Enrollment for the VDA computers.
   
5. Browse to the XenApp/XenDesktop 7.7 ISO. In the Support\Tools\SslSupport folder, shift+right-click the Enable-VdaSSL.ps1 script and click Copy as path.
   
6. Run PowerShell as administrator (elevated).
   
7. Run the command Set-ExecutionPolicy unrestricted. Enter Y to approve.
   
8. In the PowerShell prompt, type in an ampersand (&), and a space.
9. Right-click the PowerShell prompt to paste in the path copied earlier.
10. At the end of the path, type in -Enable
11. If there’s only one certificate on this machine, press Enter.
    
12. If there are multiple certificates, you’ll need to specify the thumprint of the certificate you want to use. Open the Certificates snap-in, open the properties of the machine certificate you want to use, and copy the Thumbprint from the Details tab.
    
    In the PowerShell prompt, at the end of the command, enter ‑CertificateThumbPrint, add a space, and type quotes (").
    Right-click the PowerShell prompt to paste the thumbprint.
    Type quotes (") at the end of the thumbprint. Then remove all spaces from the thumbprint. The thumbprint needs to be wrapped in quotes.
    
13. If this VDA machine has a different service already listening on 443 (e.g. IIS), then the VDA needs to use a different port for SSL connections. At the end of the command in the PowerShell prompt, enter -SSLPort 444 or any other unused port.
    
14. Press <Enter> to run the Enable-VdaSSL.ps1 script.
15. Press <Y> twice to configure the ACLs and Firewall.
16. You might have to reboot before the settings take effect.
    
17. Login to a Controller and run PowerShell as Administrator (elevated).
18. Run the command asnp Citrix.*
    
19. Enter the command:

    Get-BrokerAccessPolicyRule -DesktopGroupName '<delivery-group-name>' | Set-BrokerAccessPolicyRule ‑HdxSslEnabled $true

    where <delivery-group-name> is the name of the Delivery Group containing the VDAs.
    

20. You can run Get-BrokerAccessPolicyRule -DesktopGroupName '<delivery-group-name>' to verify that HDX SSL is enabled.
    
21. Also run the following command:

    Set-BrokerSite –DnsResolutionEnabled $true

You should now be able to connect to the VDA using the HTML5 Receiver from internal machines.

Anonymous Accounts

If you intend to publish apps anonymously then follow this section.

1. Anonymous accounts are created locally on the VDAs. When XenDesktop creates Anon accounts it gives them an idle time as specified at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\AnonymousUserIdleTime. The default is 10 minutes. Adjust as desired.
   
2. You can pre-create the Anon accounts on the VDA by running “C:\Program Files\Citrix\ICAConfigTool\CreateAnonymousUsersApp.exe”. If you don’t run this tool then Virtual Delivery Agent will create them automatically when users log in.
   
3. You can see the local Anon accounts by opening Computer Management, expanding System Tools, expand Local Users and Groups and clicking Users.
   
4. If you open one of the accounts, on the Sessions tab, notice that idle timeout defaults to 10 minutes. Feel free to change it.
   

Group Policy for Anonymous Users

Since Anonymous users are local accounts on each Virtual Delivery Agent, domain-based GPOs will not apply. To work around this limitation, you’ll need to edit the local group policy on each Virtual Delivery Agent.

1. On the Virtual Delivery Agent, run gpedit.exe.
2. Open the File menu and click Add/Remove Snap-in.
   
3. Highlight Group Policy Object Editor and click Add to move it to the right.
   
4. In the Welcome to the Group Policy Wizard page, click Browse.
   
5. On the Users tab, select Non-Administrators.
   
6. Click Finish.
   
7. Now you can configure group policy to lockdown sessions for anonymous users. Since this is a local group policy, you’ll need to repeat the group policy configuration on every Virtual Delivery Agent image. Also, Group Policy Preferences is not available in local group policy.

Antivirus

Install antivirus using your normal procedure. Instructions vary for each Antivirus product.

Microsoft’s virus scanning recommendations (e.g. exclude group policy files) – http://support.microsoft.com/kb/822158.

Citrix’s Recommended Antivirus Exclusions

Citrix CTX127030 Citrix Guidelines for Antivirus Software Configuration: Based on Citrix Consulting’s field experience, organizations might wish to consider configuring antivirus software on session hosts with the settings below.

• Scan on write events or only when files are modified. It should be noted that this configuration is typically regarded as a high security risk by most antivirus vendors. In high-security environments, organizations should consider scanning on both read and write events to protect against threats that target memory, such as Conficker variants.
• Scan local drives or disable network scanning. This assumes all remote locations, which might include file servers that host user profiles and redirected folders, are being monitored by antivirus and data integrity solutions.
• Exclude the pagefile(s) from being scanned.
• Exclude the Print Spooler directory from being scanned.
• Remove any unnecessary antivirus related entries from the Run key (HKLM\Software\Microsoft\Windows\Current Version\Run).
• If using the streamed user profile feature of Citrix Profile management, ensure the antivirus solution is configured to be aware of Hierarchical Storage Manager (HSM) drivers. For more information, refer to Profile Streaming and Enterprise Antivirus Products.

Symantec

Symantec links:

• Symantec TECH91070 Citrix and terminal server best practices for Endpoint Protection.
• Symantec TECH197344 Best practices for virtualization with Symantec Endpoint Protection 12.1.2
• Symantec TECH180229 Symantec Endpoint Protection 12.1 – Non-persistent Virtualization Best Practices
• Symantec TECH123419 How to prepare Symantec Endpoint Protection clients on virtual disks for use with Citrix Provisioning Server has a script that automates changing the MAC address registered with Symantec.
• Citrix Blog Post How to prepare a Citrix Provisioning Services Target Device for Symantec Endpoint Protection

Non-persistent session hosts:

After you have installed the Symantec Endpoint Protection client and disabled Tamper Protection, open the registry editor on the base image.

1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC.
2. Create a new key named Virtualization.
3. Under Virtualization, create a key of type DWORD named IsNPVDIClient and set it to a value of 1.

To configure the purge interval for offline non-persistent session host clients:

1. In the Symantec Endpoint Protection Manager console, on the Admin page, click Domains.
2. In the Domains tree, click the desired domain.
3. Under Tasks, click Edit Domain Properties.
4. On the Edit Domain Properties > General tab, check the Delete non-persistent VDI clients that have not connected for specified time checkbox and change the days value to the desired number. The Delete clients that have not connected for specified time option must be checked to access the option for offline non-persistent VDI clients.
5. Click OK.

Make the following changes to the Communications Settings policy:

1. Configure clients to download policies and content in Pull mode
2. Disable the option to Learn applications that run on the client computers
3. Set the Heartbeat Interval to no less than one hour
4. Enable Download Randomization, set the Randomization window for 4 hours

Make the following changes to the Virus and Spyware Protection policy:

1. Disable all scheduled scans
2. Disable the option to “Allow startup scans to run when users log on” (This is disabled by default)
3. Disable the option to “Run an ActiveScan when new definitions Arrive”

Avoid using features like application learning which send information to the SEPM and rely on client state to optimize traffic flow

Linked clones:

To configure Symantec Endpoint Protection to use Virtual Image Exception to bypass the scanning of base image files

1. On the console, open the appropriate Virus and Spyware Protection policy.
2. Under Advanced Options, click Miscellaneous.
3. On the Virtual Images tab, check the options that you want to enable.
4. Click OK

Trend Micro

Citrix CTX136680 – Slow Server Performance After Trend Micro Installation. Citrix session hosts experience slow response and performance more noticeable while users try to log in to the servers. At some point the performance of the servers is affected, resulting in issues with users logging on and requiring the server to be restarted. This issue is more noticeable on mid to large session host infrastructures.

Trend Micro has provided a registry fix for this type of issue. Create the following registry on all the affected servers. Add new DWORD Value as:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TmFilterParameters] “DisableCtProcCheck”=dword:00000001

Trend Micro Links:

• Trend Micro Docs – Trend Micro Virtual Desktop Support
• Trend Micro Docs – VDI Pre-Scan Template Generation Tool
• Trend Micro 1055260 – Best practice for setting up Virtual Desktop Infrastructure (VDI) in OfficeScan
• Trend Micro 1056376 – Frequently Asked Questions (FAQs) about Virtual Desktop Infrastructure/Support In OfficeScan

Optimize Performance

VDA Optimizer

Installation of the VDA might have already done this but there’s no harm in doing it again. This tool is only available if you installed VDA in Master Image mode.

1. On the master VDA, go to C:\Program Files\Citrix\PvsVm\TargetOSOptimizer and run TargetOSOptimizer.exe.
   
2. Then click OK. Notice that it disables Windows Update.
   

RDSH

Citrix CTX131577 XenApp 6.x (Windows 2008 R2) – Optimization Guide is a document with several registry modifications that are supposed to improve server performance. Ignore the XenApp 6 content and instead focus on the Windows content.

Citrix CTX131995 User Cannot Launch Application in Seamless Mode in a Provisioning Services Server when XenApp Optimization Best Practices are Applied. Do not enable NtfsDisable8dot3NameCreation

Norskale has Windows 2008 R2 Remote Desktop and XenApp 6 Tuning Tips Update.

Windows 7

Microsoft has compiled a list of links to various optimization guides.

It’s a common practice to optimize a Windows 7 virtual machine (VM) template (or image) specifically for VDI use. Usually such customizations include the following.

• Minimize the footprint, e.g. disable some features and services that are not required when the OS is used in “stateless” or “non-persistent” fashion. This is especially true for disk-intensive workloads since disk I/O is a common bottleneck for VDI deployment. (Especially if there are multiple VMs with the same I/O patterns that are timely aligned).
• Lock down user interface (e.g. optimize for specific task workers).

With that said the certain practices are quite debatable and vary between actual real-world deployments. Exact choices whether to disable this or that particular component depend on customer requirements and VDI usage patterns. E.g. in personalized virtual desktop scenario there’s much less things to disable since the machine is not completely “stateless”. Some customers rely heavily on particular UI functions and other can relatively easily trade them off for the sake of performance or standardization (thus enhance supportability and potentially security). This is one of the primary reasons why Microsoft doesn’t publish any “VDI Tuning” guide officially.

Though there are a number of such papers and even tools published either by the community or third parties. This Wiki page is aimed to serve as a consolidated and comprehensive list of such resources.

Daniel Ruiz XenDesktop Windows 7 Optimization and GPO’s Settings –

Microsoft Whitepaper Performance Optimization Guidelines for Windows 7 Desktop Virtualization

Windows 8.1 / 10 / 2012 R2

• Citrix’s Windows 8 and 8.1 Virtual Desktop Optimization Guide
• Citrix Blog Post Windows 8 and Server 2012 Optimization Guide contains the following:
  • A list of services to disable
  • A list of computer settings
  • A list of scheduled tasks to disable
  • A script to do all of the above
• Carl Luberti (Microsoft) Windows 10 VDI Optimization Script
• Microsoft’s Windows 8 VDI optimization script.
• Desktop Virtualization Best Practice Analyzer
  

Optimization Notes:

• If this machine is provisioned using Provisioning Services, do not disable the Shadow Copy services.
• Windows 8 detects VDI and automatically disables SuperFetch. No need to disable it yourself.
• Windows 8 automatically disables RSS and TaskOffload if not supported by the NIC.

Seal and Shut Down

If this session host will be a master image in a Machine Creation Services or Provisioning Services catalog, after the master is fully prepared (including applications), do the following:

1. Go to the properties of the C: drive and run Disk Cleanup.
   
2. On the Tools tab, click Optimize to defrag the drive.
   `
3. Run slmgr.vbs /dlv and make sure it is licensed with KMS and has at least one rearm remaining. It is no longer necessary to manually rearm licensing. XenDesktop will do it automatically.
   
4. Run Delprof2 to clean up local profiles. Get it from http://helgeklein.com/download/.
   
5. Machine Creation Services and Provisioning Services require DHCP.
   

Session hosts commonly have DHCP reservations.

• Shut down the master image. You can now use Studio or Provisioning Services to create a catalog of linked clones.
  

Troubleshooting – Graphics

If Windows 7 on vSphere, don’t install the VMware SVGA driver. For more details, see CTX201804 Intermittent Connection Failures/Black Screen Issues When Connecting from Multi-Monitor Client Machines to Windows 7 VDA with VDA 7.x on vSphere/ESXi.

For an explanation of Citrix’s graphics policy settings, see A graphical deep dive into XenDesktop 7 and What’s new with HDX display in XenDesktop & XenApp 7.x?

Citrix Knowledgebase article CTX200370 – How to Determine HDX Display Mode: Use wmic or HDX Monitor as described in the article to determine which of the following display mode options is being used:

• DCR (Desktop Composition Redirection)
• H.264 / H.264 Compatibility Mode
• Legacy Graphics Mode

Citrix Blog Post – Site Wide View of HDX Graphics Modes; PowerShell script to display graphics mode of currently connected sessions.

Citrix Blog post – Optimising the performance of HDX 3D Pro – Lessons from the field

From Citrix Tips – Black Screen Issues with 7.x VDA: Users would make a successful ICA connection but the screen would stay totally black.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vbdenum]

• “Start”=dword:00000001
• “MaxVideoMemoryBytes”=dword:06000000
• “Group”= “EMS”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vd3d]

• “MaxVideoMemoryBytes”=dword:00000000

From Citrix Knowledgebase article CTX200257 – Screen Issues Connecting to 4K Resolution Monitors in DCR Mode:

1. Calculate the video memory that is required for 4K monitor using the following formula:
   Sum of total monitors (Width * height * 4 * X) where width and height are resolution of the monitor.
   X = 2 if VDA is Windows 7 OR X = 3 if VDA is Windows 88.110
   Example: Suppose a Windows 7 VDA is connecting to a client that has dual 4K monitors (3840×2160), then video buffer should be: (3840×160 x 4 x 2) + (3840 x 2160 x 4 x 2) = ~115MB
2. Open the registry (regedit) and navigate to:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vd3d
3. Increase the value of “MaxVideoMemoryBytes” REG_DWORD value to the above calculated memory.
4. Reboot the VDA

From Citrix Discussions: To exclude applications from Citrix 3D rendering, create a REG_DWORD registry value “app.exe” with value 0 or a registry value “*” with value 0.

• XD 7.1 and XD 7.5:
  • x86: reg add hklm\software\citrix\vd3d\compatibility /v * /t REG_DWORD /f /d 0
  • x64: reg add hklm\software\Wow6432Node\citrix\vd3d\compatibility /v * /t REG_DWORD /f /d 0
• XD 7.6/7.7 both x86 and x64:
  • reg add hklm\software\citrix\vd3d\compatibility /v * /t REG_DWORD /f /d 0

Wildcards are not supported. The asterisk * here has a special meaning “all apps” but is not a traditional wildcard. To blacklist multiple apps e.g. both appa.exe and appb.exe must be done by creating a registry value for each app individually.

This is most problematic in Remote PC since most physical PCs have GPUs. I recently had to blacklist Internet Explorer to prevent lockup issues when switching back to physical.

Related Pages

• Provisioning Services Master Device Preparation
• Catalogs / Delivery Groups

Navigation

• Monitor
• Servers
• Service Group
• Responder
• Load Balancing Virtual Server
• SSL Redirect
• SSL Warning
• CLI Commands

Monitor

1. On the left, expand Traffic Management, expand Load Balancing, and click Monitors.
   
2. On the right, click Add.
   
3. Name it Director or similar.
4. Change the Type drop-down to HTTP.
   
5. If you will use SSL to communicate with the Director servers, then scroll down and check the box next to Secure.
   
6. Switch to the Special Parameters tab.
7. In the HTTP Request field, enter GET /Director/LogOn.aspx?cc=true
8. Click Create.
   

Servers

1. On the left, expand Traffic Management, expand Load Balancing, and click Servers.
   
2. On the right, click Add.
   
3. Enter a descriptive server name. Usually it matches the actual server name.
4. Enter the IP address of the server.
5. Enter comments to describe the server. Click Create.
   
6. Continue adding Director servers.
   

Service Group

1. On the left, expand Traffic Management, expand Load Balancing, and click Service Group.
   
   
2. On the right, click Add.
   
3. Give the Service Group a descriptive name (e.g. svcgrp-Director-SSL).
4. Change the Protocol to HTTP or SSL. If the protocol is SSL, ensure the Director Monitor has Secure enabled.
5. Scroll down and click OK.
   
6. Click where it says No Service Group Member.
   
7. If you did not previously create server objects, then enter the IP address of a Director Server. If you previously created a server objects, then change the selection to Server Based and select the server objects.
8. Enter 80 or 443 as the port. Then click Create.
   
9. On the right, under Advanced Settings, click Monitors.
   
10. On the left, in the Monitors section, click where it says No Service Group to Monitor Binding.
    
11. Click the arrow next to Click to select.
    
12. Select the Director monitor and click Select.
    
13. Then click Bind.
    
14. To verify that the monitor is working, on the left, in the Service Group Members section, click the Service Group Members line.
    
15. Highlight a member and click Monitor Details.
    
16. The Last Response should be Success – HTTP response code 200 received. Click Close twice.
    
17. Then click Done.
    

Responder

Create a Responder policy to redirect users from the root page to /Director.

1. Go to AppExpert > Responder and enable the feature if it isn’t already enabled.
   
2. Go to AppExpert > Responder > Actions.
   
3. On the right, click Add.
   
4. Give the Action a name (e.g. Director_Redirect).
5. Change the Type to Redirect.
6. In the Expression box, enter "/Director", including the quotes.
7. Click Create.
   
8. Go to AppExpert > Responder > Policies.
   
9. On the right, click Add.
   
10. Give the Policy a name (e.g. Director_Redirect).
11. Select the previously created Action.
12. In the Expression box, enter HTTP.REQ.URL.PATH.EQ("/")
13. Click Create.
    

Load Balancing Virtual Server

1. Create or install a certificate that will be used by the SSL Virtual Server. This certificate must match the DNS name for the load balanced Director servers.
2. On the left, under Traffic Management > Load Balancing, click Virtual Servers.
   
   
3. On the right click Add.
   
4. Name it Director-SSL-LB or similar.
5. Change the Protocol to SSL.
6. Specify a new internal VIP.
7. Enter 443 as the Port.
8. Click OK.
   
9. On the left, in the Services and Service Groups section, click where it says No Load Balancing Virtual Server ServiceGroup Binding.
   
10. Click the arrow next to Click to select.
    
11. Select your Director Service Group and click Select.
    
12. Click Bind.
    
13. Click Continue.
    
14. Click where it says No Server Certificate.
    
15. Click the arrow next to Click to select.
    
16. Select the certificate for this Director Load Balancing Virtual Server and click Select.
    
17. Click Bind.
    
18. Click Continue.
    
19. On the right, in the Advanced Settings column, click Persistence.
    
20. Select SOURCEIP persistence.
21. Set the timeout to match the timeout of Director. The default timeout for Director is 245 minutes.
22. The IPv4 Netmask should default to 32 bits.
23. Click OK.
    
24. On the right, in the Advanced Settings section, add the Policies section.
    
25. On the left, in the Policies section, click the plus icon.
    
26. Select Responder in the Choose Policy drop-down and click Continue.
    
27. Select the previously created Director_Redirect policy and click Bind.
    
28. If you haven’t enabled the Default SSL Profile, then perform other normal SSL configuration including: disable SSLv3, bind a Modern Cipher Group, and enable Strict Transport Security.

    bind ssl vserver MyvServer -certkeyName MyCert
    
    set ssl vserver MyvServer -ssl3 DISABLED -tls11 ENABLED -tls12 ENABLED
    
    unbind ssl vserver MyvServer -cipherName ALL
    
    bind ssl vserver MyvServer -cipherName Modern
    
    bind ssl vserver MyvServer -eccCurveName ALL
    
    bind lb vserver MyvServer -policyName insert_STS_header -priority 100 -gotoPriorityExpression END -type RESPONSE

SSL Redirect

1. Right-click the Director SSL Load Balancing Virtual Server and click Add.
   
2. Change the Name to Director-HTTP-SSLRedirect or something like that.
3. Change the Protocol to HTTP.
4. Click OK. This HTTP Virtual Server uses the same VIP as the SSL Load Balancer.
   
5. Bind the AlwaysUp service. See SSL Redirect – Responder Method for more information.
   
6. Bind the http_to_ssl_redirect_responderpol Responder Policy.
7. That’s all this LB vServer needs. Click Done when done.
   

SSL Warning

1. If you are doing SSL Offload (SSL on front end, HTTP on back end), when connecting to Director it might complain about “You are not using a secure connection”.
   
2. To turn off this warning, login to the Director servers and run IIS Manager.
   
3. On the left, navigate to Server > Sites > Default Web Site > Director.
4. In the middle, double-click Application Settings.
   
5. Change UI.EnableSslCheck to false.
   

CLI Commands

Here is a list of NetScaler CLI commands for Director Load Balancing:

add server Director01 10.2.2.18
add server Director02 10.2.2.100
add server 127.0.0.1 127.0.0.1
add service AlwaysUp 127.0.0.1 HTTP 80
add serviceGroup svcgrp-Director-HTTP HTTP
add ssl certKey wildcom -cert WildcardCorpCom_pem -key WildcardCorpCom_pem
add lb vserver Director-SSL-LB SSL 10.2.2.210 443 -persistenceType SOURCEIP -timeout 245
add lb vserver Director-HTTP-SSLRedirect HTTP 10.2.2.210 80 -persistenceType NONE
add responder action Director_Redirect redirect "\"/Director\"" -responseStatusCode 302
add responder action http_to_ssl_redirect_responderact redirect "\"https://\" + HTTP.REQ.HOSTNAME.HTTP_URL_SAFE + HTTP.REQ.URL.PATH_AND_QUERY.HTTP_URL_SAFE" -responseStatusCode 302
add responder policy Director_Redirect "http.REQ.URL.PATH.EQ(\"/\")" Director_Redirect
add responder policy http_to_ssl_redirect_responderpol HTTP.REQ.IS_VALID http_to_ssl_redirect_responderact
bind lb vserver Director-HTTP-SSLRedirect AlwaysUp
bind lb vserver Director-SSL-LB svcgrp-Director-SSL
bind lb vserver Director-SSL-LB -policyName Director_Redirect -priority 100 -gotoPriorityExpression END -type REQUEST
bind lb vserver Director-HTTP-SSLRedirect -policyName http_to_ssl_redirect_responderpol -priority 100 -gotoPriorityExpression END -type REQUEST
add lb monitor Director HTTP -respCode 200 -httpRequest "GET /Director/LogOn.aspx?cc=true" -LRTM DISABLED -secure YES
bind serviceGroup svcgrp-Director-SSL Director01 443
bind serviceGroup svcgrp-Director-SSL Director02 443
bind serviceGroup svcgrp-Director-SSL -monitorName Director
set ssl serviceGroup svcgrp-Director-SSL -tls11 DISABLED -tls12 DISABLED
bind ssl vserver Director-SSL-LB -certkeyName wildcom
bind ssl vserver Director-SSL-LB -eccCurveName P_256
bind ssl vserver Director-SSL-LB -eccCurveName P_384
bind ssl vserver Director-SSL-LB -eccCurveName P_224
bind ssl vserver Director-SSL-LB -eccCurveName P_521

Navigation

• Preparation
• Delivery Controller 7.8 Install
  • Create Site / Databases
  • Second Controller
• Studio – Slow Launch
• Database Maintenance:
  • Change DB connect strings, read-committed snapshot, Director grooming, etc.
• Studio Administrators
• vCenter Connection – Hosting Resources
• Citrix Licensing Server
  • Upgrade Licensing Server to 11.13.1.2 build 16002 
  • Licensing Server High Availability using GSLB
  • Citrix License Server Monitoring
• Remote Desktop Licensing Server
  • Install Remote Desktop Licensing Server
  • Active Remote Desktop Licensing Server
• Health Check

Preparation

Citrix Licensing – If you are going to use an existing Citrix Licensing Server, upgrade it to 11.13.1.2 build 16002.

SQL Database

• Citrix blog post – Database Sizing Tool for XenDesktop 7
• Citrix article CTX114501 – Supported Databases for Citrix Products
• Citrix recommends SQL Mirroring because it has the fastest failover.
  • SQL Mirroring requires two SQL Standard Edition servers and one SQL Express for the witness server.
  • If you try to stretch the mirror across datacenters, the SQL witness must be placed in a third datacenter that has connectivity to the other two datacenters. However, stretching a single XenApp/XenDesktop site/farm and corresponding SQL mirror across datacenters is not recommended.
  • To setup SQL Mirroring, see Adam Shattuck: XenDesktop 7.6 – enterprise level setup guide (SQL server setups)
• AlwaysOn Availability Groups and SQL Clustering are also supported. However, these features require the much more expensive SQL Enterprise Edition.
• If you want Studio to create the SQL databases automatically, then the person running Studio must be a sysadmin on the SQL instances. No lesser role will work. As an alternative, you can use Studio to create SQL scripts and then run those scripts on the SQL server. In that case you only need the dbcreator and securityadmin roles.
• It is possible to create the databases in advance. However, you must use the non-default Latin1_General_CI_AS_KS collation. After creating the database, mirror it. Then use Citrix Studio to configure the database tables.
• There are typically three databases: one for the site (aka farm), one for Logging (audit log) and one for Monitoring (Director, and formerly known as EdgeSight). Create all three databases in advance and mirror them.
• The monitoring database name must not have any spaces in it. See CTX200325 – Database Naming Limitation when Citrix Director Accesses Monitoring Data Using OData APIs

Windows Features

• Installing Group Policy Management on the Delivery Controller lets you edit GPOs and have access to the Citrix Policies node in the GPO Editor. Or you can install Studio on a different machine that has GPMC installed.
• vSphere Web Client – if you will connect to vSphere Web Client from the Controller machine, Flash Player is only available for IE if you install the Desktop Experience feature. Or you can use Google Chrome.

vSphere

• Create a role in vSphere Client. Assign a service account to the role at the Datacenter or higher level.

Delivery Controller Install

1. To setup SQL Mirroring, see Adam Shattuck: XenDesktop 7.6 – enterprise level setup guide (SQL server setups)
2. A typical size for the Controller VMs is 2-4 vCPU and 8 GB of RAM.
3. On two Delivery Controllers, install the Delivery Controller software from the XenApp/XenDesktop 7.8 media. Download it from XenApp Enterprise, XenApp Platinum, XenDesktop Enterprise, or XenDesktop Platinum, depending on your license. Go to the downloaded XenDesktop 7.8 ISO and run AutoSelect.exe.
   
4. Click Start next to either XenApp or XenDesktop. The only difference is the product name displayed in the installation wizard.
   
5. On the left, click Delivery Controller.
6. You can install all components on one server or on separate servers. Splitting them out is only necessary in large environments or if you want to share the components (e.g. Licensing, StoreFront, Director) across multiple farms.
   
7. In the Features page, uncheck the box next to Install Microsoft SQL Server 2012 SP1 Express and click Next.
   
8. In the Summary page, click Install.
   
9. In the Installation Successful page, click Finish. Studio will automatically launch.
10. Ensure the two Controller VMs do not run on the same hypervisor host. Create an anti-affinity rule.
    

Create Site

There are several methods of creating the databases for XenApp/XenDesktop:

• If you have sysadmin permissions to SQL, let Citrix Studio create the databases automatically.
• If you don’t have sysadmin permissions to SQL then use Citrix Studio to generate SQL scripts and send them to a DBA.

Database Mirroring

If you are not using database mirroring then skip to the next section.

Citrix CTX127359 – How to Configure XenDesktop for SQL Database Mirroring: To configure a XenDesktop site for use with a mirrored SQL Server database, complete the following steps:

1. Create an empty database on the principal with the Latin1_General_CI_AS_KS collation sequence.
2. Configure the mirror and witness to start mirroring. For more information, see: http://technet.microsoft.com/en-us/library/ms189047.aspx.
3. Use Citrix Studio in one of the following two ways:
   1. Create the database automatically; mirroring is detected without user intervention.
   2. Create the database manually; two scripts are generated: one to be executed on the principal and one to be executed on the mirror. If you are executing the scripts using SQL Server Management Studio, enable the SQLCMD mode before executing the scripts. After executing the scripts, test the database connection by clicking Test connection and continue through the remainder of the wizard.

To verify mirroring after the wizard has completed, run the PowerShell cmdlet get-configdbconnection and ensure that the Failover Partner has been set in the connection string to the mirror.

Use Studio to Create Database Scripts

1. Launch Citrix Studio. After it loads, click Deliver applications and desktops to your users.
   
2. In the Introduction page, select An empty, unconfigured site. This reduces the number of pages in this Setup wizard. The other pages will be configured later.
3. Enter a Site Name (aka farm name) and click Next. Only administrators see the farm name.
   
4. In the Databases page, change the selection to Generate scripts to manually set up databases on the database server.
5. Change the database names if desired.
   
6. If you are building two Controllers, click Select near the bottom of the same page.
   
7. Click Add.
   
8. Enter the FQDN of the second Controller and click OK. Note: the Delivery Controller software must already be installed on that machine.
   
9. Then click Save.
   
10. If you hover your mouse over 2 selected, it will show both Controllers. Click Next.
    
11. In the Additional Features page, click Next.
    
12. In the Summary page, click Generate scripts.
    
13. A folder will open with six scripts. Edit each of the scripts.
    
14. Near the top of each script are two lines to create the database. Uncomment both lines (including the go line). Then save and close the file.
    
    
15. Once all of the scripts are edited you can send them to your DBA.
16. On the Principal SQL Server, open the file Site_Principal.sql.
    
    
17. Open the Query menu and click SQLCMD Mode.
    
18. Then execute the script.
    
19. If SQLCMD mode was enabled properly then the output should look something like this:
    
20. If you have a mirrored database, run the second script on the mirror SQL instance. Make sure SQLCMD mode is enabled.
    
    
    
21. Repeat for the Logging_Pricipal.sql script.
    
22. You’ll have to enable SQLCMD Mode for each script you open.
    
    
    
23. Repeat for the Monitoring_Principal.sql script.
    
24. Once again enable SQLCMD Mode.
    
    
    
25. The person running Citrix Studio must be added to the SQL Server as a SQL Login and granted the public server role.
    
    
26. Back in Citrix Studio, click the Continue database configuration and Site setup button.
    
27. In the Database page, enter the SQL server name and instance name and click Next.
    
    
28. On the Licensing page, enter the name of the Citrix License Server and click Connect. . If you installed Licensing with your Delivery Controller, then simply enter localhost.
29. XenApp/XenDesktop 7.8 requires the newest Licensing Server. If your server isn’t compatible, leave it set to localhost and fix it later.
    
30. If the Certificate Authentication appears, select Connect me and click Confirm.
31. Then select your license and click Next.
    
32. In the Additional Features page, click Next.
    
33. In the Summary page, make your selection for Customer Experience Improvement Program and click Finish.
    
34. It will take some time for the site to be created.
    

Verify Database Mirroring

If your database is mirrored, when you run get-brokerdbconnection, you’ll see the Failover Partner in the database connection string.

Second Controller

When building the first Delivery Controller the scripts might have already included the second Delivery Controller. Thus no special SQL permissions are needed. If the second Delivery Controller has not already been added to the SQL databases then there are several methods of adding a second Controller to the databases for XenApp/XenDesktop:

• If you have sysadmin permissions to SQL, let Citrix Studio modify the databases automatically.
• If you don’t have sysadmin permissions to SQL then do use Citrix Studio to generate SQL scripts and send them to a DBA.

To use Citrix Studio to create the SQL Scripts:

1. On the first Delivery Controller, if StoreFront is installed, delete the default StoreFront store (/Citrix/Store) and recreate it with your desired Store name (e.g. /Citrix/CompanyStore).
   
2. On the 2^nd Delivery Controller, install XenDesktop as detailed earlier.
3. After running Studio, click Connect this Delivery Controller to an existing Site.
   
4. Enter the name of the first Delivery Controller and click OK.
   
5. If you don’t have elevated SQL permissions, click No when asked if you want to update the database automatically.
   
6. Click Generate scripts.
   
7. A folder will open with six scripts. If not mirroring, then the top three scripts need to be sent to a DBA. If mirroring, send all six.
   
8. On the SQL Server, open open one of the .sql files.
   
   
9. Open the Query menu and click SQLCMD Mode.
   
10. Then execute the XenDesktop script.
    
11. If SQLCMD mode was enabled properly then the output should look something like this:
    
12. Back in Citrix Studio, click OK.
    
13. In the Studio, under Configuration > Controllers, you should see both controllers.
    
14. You can also test the site again if desired.
    

Studio – Slow Launch

From B.J.M. Groenhout at Citrix Discussions: The following adjustments can be made if Desktop Studio (and other Citrix management Consoles) will start slowly:

• Within Internet Explorer, go to Tools – Internet Options – Tab Advanced – Section Security and uncheck the option Check for publisher’s certificate revocation

After adjustment Desktop Studio (MMC) will be started immediately. Without adjustment it may take some time before Desktop Studio (MMC) is started.

Registry setting (can be deployed using Group Policy Preferences):

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
  • “State“=dword:00023e00

Database Maintenance

View Logging Database

To view the contents of the Logging Database, in Studio, click the Logging node. On the right is Create Custom Report. See Citrix article CTX138132 Viewing Configuration Logging Data Not Shown for more info.

Enable Read-Committed Snapshot

The XenDesktop Database can become heavily utilized under load in a large environment. Therefore Citrix recommends enabling the Read_Committed_Snapshot option on the XenDesktop databases to remove contention on the database from read queries. This can improve the interactivity of Studio and Director. It should be noted that this option may increase the load on the tempdb files. See Citrix article CTX137161 How to Enable Read-Committed Snapshot in XenDesktop for configuration instructions.

Change Database Connection Strings

Sometimes the database connection strings need to be modified:

• When moving the SQL databases to a different SQL server
• When enabling mirroring after the databases have already been configured in Studio.

CTX140319 How to Migrate XenDesktop Database to New SQL Server has the correctly ordered list of PowerShell commands to change the database connection strings. Make sure PowerShell is running as administrator before running these commands.

XenApp/XenDesktop 7.8 adds set-applibdbconnection so make sure the commands include setting that DB connection too. 

Step 5 assumes Site, Monitoring, and Logging are one database so you’ll need to adjust the commands if those databases are split. In particular, change $cs in Set-LogDBConnection -DataStore Logging -DBConnection $cs to the Logging database. And change $cs in Set-MonitorDBConnection -DataStore Monitor -DBConnection $cs to the Monitoring database. The other commands don’t need to be changed.

Director Grooming

If XenDesktop is not Platinum Edition then all historical Director data is groomed at 7 days.

For XenDesktop/XenApp Platinum Edition, by default, most of the historical Director data is groomed at 90 days. This can be adjusted up to 367 days by running a PowerShell cmdlet.

1. On a Delivery Controller, run PowerShell and run asnp Citrix.*
   
   
2. Run Get-MonitorConfiguration to see the current grooming settings.
   
3. Run Set-MonitorConfiguration to change the grooming settings.
   

Studio Administrators

Full Administrators

1. In the Studio, under Configuration, click the Administrators node. The first time you access the node you’ll see a Welcome page. Feel free to check the box and then click Close.
2. On the Administrators tab, right-click and click Create Administrator.
   
3. In the Administrator and Scope page, specify a group (e.g. Citrix Admins or Help Desk) that will have permissions to Studio and Director. Click Next.
   
4. On the Role page, select a role and then click Next. For example:
   • Full Administrator for the Citrix Admins group
   • Help Desk Administrator for the Help Desk group
   • Machine Catalog Administrator for the desktop team
     
5. In the Summary page, click Finish.

Help Desk

1. In the Studio, under Configuration, click the Administrators node. On the Administrators tab, right-click and click Create Administrator.
   
2. In the Administrator and Scope page, specify a Help Desk group that will have permissions to Studio and Director. Click Next.
   
3. On the Role page, select the Help Desk Administrator role and then click Next.
   
4. In the Summary page, click Finish.
5. When administrators in the Help Desk role log into Director, all they see is this.
   
   To jazz it up a little, add the Help Desk group to the read-only role.
6. Right-click the Help Desk Administrator and click Edit Administrator.
   
7. Click Add.
   
8. In the Scope page, select a scope and click Next.
   
9. In the Role page, select Read Only Administrator and click Next.
   
10. In the Summary page, click Finish.
11. Then click OK. Now Director will display the dashboard.
    

Provisioning Services w/Personal vDisk

From Considerations: Provisioning Services at Configure and manage Personal vDisk at docs.citrix.com: The Provisioning Services Soap Service account must be added to the Administrator node of Studio and must have the Machine Administrator or higher role. This ensures that the PvD desktops are put into the Preparing state when the Provisioning Services (PVS) vDisk is promoted to production.

vCenter Connection

XenDesktop uses an Active Directory service account to log into vCenter. This account needs specific permissions in vCenter. To facilitate assigning these permissions, create a new vCenter role and assign it to the XenDesktop service account. The permissions should be applied at the datacenter or higher level.

Hosting Resources

A Hosting Resource = vCenter + Cluster (Resource Pool) + Storage + Network. When you create a machine catalog, you select a previously defined Hosting Resource, and the Cluster, Storage, and Network defined in the Hosting Resource object are automatically selected. If you need some desktops on a different Cluster+Storage+Network then you’ll need to define more Hosting Resources in Studio.

1. In Studio, expand Configuration and click Hosting. Right-click it and click Add Connection and Resources.
   
2. In the Connection page, select VMware vSphere as the Connection type.
3. Enter https://vcenter01.corp.local/sdk as the vCenter URL. The URL must contain the FQDN of the vCenter server. Ensure the entered URL has /sdk on the end.
4. Enter credentials of a service account that can log into vCenter.
5. In the Connection name field, give the connection a name. Typically, this matches the name of the vCenter server.
6. If you are not using Machine Creation Services and instead only need the vCenter connection for machine power management, change the Create virtual machines using selection to Other Tools.
7. Click Next.
   
8. If you see a message about the vCenter certificate, check the box next to Trust certificate and click OK.
   
9. Enter a name for the hosting resource. Since each hosting resource is a combination of vCenter, Cluster, Network, and Datastore, include those names in this field (e.g. vCenter01-Cluster01-Network01-Datastore01).
10. In the Cluster page, click Browse and select a cluster or resource pool.
11. Select a network and click Next.
    
12. On the Storage page, select a datastore for the virtual machines. Maximum flexibility is achievable if you only select one datastore per hosting resource. Create additional hosting resources for each datastore.
13. If desired, change the selection for personal vDisk to use a different storage. Click Next.
    
14. In the Summary page, click Finish.

Citrix Licensing Server

Upgrade

Upgrade Citrix Licensing to 11.13.1.2.

1. Go to the downloaded Citrix Licensing 11.13.1.2 build 16002 and run CitrixLicensing.exe.
   
2. Click Upgrade.
   
3. Click Finish.
   
4. If you go to Programs and Features, it should now show version 11.1.0.16002.
   
5. If you login to the license server web console, on the Administration tab, it shows it as version 11.13.1 build 16002.
   
6. You can also view the version in the registry at HKLM\Software\Wow6432Node\Citrix\LicenseServer\Install.
   

Licensing Server HA using GSLB

From Dane Young – Creating a Bulletproof Citrix Licensing Server Infrastructure using NetScaler Global Server Load Balancing (GSLB) and CtxLicChk.ps1 PowerShell Scripts. Here is a summary of the configuration steps. See the blog post for detailed configuration instructions.

1. Build two License Servers in each datacenter with identical server names. Since server names are identical, they can’t be domain-joined.
2. Install identical licenses on all License Servers.
3. Set the DisableStrictNameChecking registry key on all Citrix Licensing servers.
4. Synchronize the certificate files located at C:\Program Files (x86)\Citrix\Licensing\WebServicesForLicensing\Apache\conf. They must be identical on all Licensing Servers.
5. Download CtxLicChk.exe from http://support.citrix.com/article/CTX123935 and place on all Licensing Servers.
6. Schedule the PowerShell script CtxLicChk.ps1 on all Licensing Servers. Get this script from the blog post linked above.
7. Configure NetScaler:
   1. Configure GSLB ADNS services.
   2. Add wildcard Load Balancing service for each Citrix Licensing Server.
   3. Configure service TCP monitoring for ports 27000, 7279, 8082, and 8083.
   4. Create Load Balancing Virtual Server for each Licensing Server.
   5. Set one Load Balancing Virtual Server as backup for the other.
   6. Repeat in second datacenter.
   7. Configure GSLB Services and GSLB Monitoring.
   8. Configure GSLB Virtual Servers. Set one GSLB Virtual Server as backup for the other.
8. Delegate the Citrix Licensing DNS name to the ADNS services on the NetScaler appliances.
9. Configure Citrix Studio to point to the GSLB-enabled DNS name for Citrix Licensing.

Citrix License Server Monitoring

http://www.jonathanmedd.net/2011/01/monitor-citrix-license-usage-with-powershell.html.

Lal Mohan – Citrix License Usage Monitoring Using Powershell

Jaroslaw Sobel – Monitoring Citrix Licenses usage – Graphs using WMI, Powershell and RRDtool. This script generates a graph similar to the following: