Group Policy Objects – VDA User Settings

Navigation

• User Lockdown
• Internet Explorer
  • IE Security Zones
• Folder Redirection
• Office 2013/2016
• Adobe Reader / Acrobat Reader DC
• ShareFile On-Demand Sync
• File Type Association

User Lockdown

The following is a list of Group Policy Settings recommended by Microsoft to lockdown a Remote Desktop Session Host / Citrix Session. These settings should go in the Citrix VDA Non-Admin Users GPO. All settings are located at User Configuration > Policies.

This page assumes the GPOs have already been created and Loopback Processing has already been enabled.

Control Panel GPO Settings

• User Configuration | Policies | Administrative Templates | Control Panel
  • Always open All Control Panel Items when opening Control Panel = enabled
  • Show only specified Control Panel items = enabled, canonical names = 
    • Microsoft.RegionAndLanguage
    • Microsoft.NotificationAreaIcons
    • MLCFG32.CPL
    • Microsoft.Personalization
    • Microsoft.Mouse
    • Microsoft.DevicesAndPrinters
    • Microsoft.System (lets users see the computer name)
• User Configuration | Policies | Administrative Templates | Control Panel | Add or Remove Programs
  • Remove Add or Remove Programs = enabled
• User Configuration | Policies | Administrative Templates | Control Panel | Programs
  • Hide the Programs Control Panel = enabled

Desktop GPO Settings

• User Configuration | Policies | Administrative Templates | Desktop
  • Hide Network Locations icon on desktop = enabled
  • Prohibit user from manually redirecting Profile Folders = enabled
  • Remove Properties from the Computer icon context menu = enabled
  • Remove Properties from the Recycle Bin icon context menu = enabled

If you prevent access to the Properties of the Computer icon then users might not be able to determine the name of the machine they are connected to.

Start Menu & Taskbar GPO Settings

• User Configuration | Policies | Administrative Templates |  Start Menu & Taskbar
  • Clear the recent programs list for new users = enabled
  • Do not allow pinning Store app to the taskbar = enabled
  • Remove and prevent access to Shut Down, Restart, Sleep, and Hibernate commands = enabled
  • Remove common program groups from Start Menu = enabled (only if you have some other means for putting shortcuts back on the user’s Start Menu/Desktop. Also, enabling this setting might prevent Outlook 2013 desktop alerts. Microsoft 3014833)
  • Remove Help menu from Start Menu = enabled
  • Remove links and access to Windows Update = enabled
  • Remove Network Connections from Start Menu = enabled
  • Remove Network icon from Start Menu = enabled
  • Remove Run menu from Start Menu = enabled
  • Remove the Action Center icon = enabled (not in Windows 10)
  • Remove the networking icon = enabled
  • Remove the Security and Maintenance icon = enabled (Windows 10)
  • Remove user folder link from Start Menu = enabled

If you hide common program groups, then you will need some other method of creating application shortcuts for each user. Group Policy Preferences Shortcuts is the typical method.

Removing the Run menu also prevents users from entering drive letters in Internet Explorer.

System GPO Settings

• User Configuration | Policies | Administrative Templates |  System
  • Prevent access to registry editing tools = enabled, Disable regedit from running silently = No
  • Prevent access to the command prompt = enabled, Disable command prompt script processing = No

Disabling registry editing tools also disables reg.exe. This is true even if silently is set to No.

Explorer GPO Settings

• User Configuration | Policies | Administrative Templates |  Windows Components | File Explorer (Windows 8+) or Windows Explorer (Windows 7)
  • Hide these specified drives in My Computer = enabled, Restrict A, B, C, and D drives only
  • Hides the Manage item on the File Explorer context menu = enabled
  • Prevent access to drives from My Computer = enabled, Restrict A, B, C, and D drives only. If this setting is enabled, you can’t use Start Menu’s search to find programs.
  • Prevent users from adding files to the root of their Users Files folder = enabled
  • Remove “Map Network Drive” and “Disconnect Network Drive” = enabled
  • Remove Hardware tab = enabled
  • Remove Security Tab = enabled

From Citrix Discussions: To hide specific drive letters:

1. User Configuration => Preferences => Windows Settings => Drive Maps => New Mapped Drive
2. Choose Action Update => Drive Letter Existing C => Hide this drive
3. Common Tab: Run in logged-on users’s Security

Windows Update GPO Settings

• User Configuration | Policies | Administrative Templates |  Windows Components | Windows Update
  • Remove access to use all Windows Update features = enabled, 0 – Do not show any notifications

Additional User Settings

Microsoft recommends (http://www.microsoft.com/en-us/download/details.aspx?id=40799 ) additional user settings for virtual desktops.

Internet Explorer Settings

This section assumes the GPOs have already been created.

Internet Explorer First Run Wizard

When a new user launches Internet Explorer, the first run wizard appears.

To prevent this from occurring, edit the Citrix VDA All Users GPO.

Internet Explorer First Run GPO Settings

• User Config | Policies | Administrative Templates | Windows Components | Internet Explorer
  • Prevent managing SmartScreen Filter = enabled, on
  • Prevent running First Run Wizard = enabled, Go directly to home page
  • Specify default behavior for a new tab page = enabled, Home page
  • Turn on Suggested Sites = disabled
• User Config | Policies | Administrative Templates | Windows Components | Internet Explorer | Compatibility View
  • Include updated Web site lists from Microsoft  = enabled
• User Config | Policies | Administrative Templates | Windows Components | Internet Explorer | Internet Control Panel | Advanced Page
  • Turn on Enhanced Protected Mode  = disabled

Enhanced Protected Mode might disable Internet Explorer add-ons. Read the text to determine if it should be disabled.

Users might see a message that Protected mode is turned off for the Local intranet zone.

To prevent this message, do the following:

1. Edit the Citrix VDA All Users GPO.
2. Go to User Configuration > Preferences > Windows Settings > Registry.
3. Create a new Registry Item.
4. Set the Hive to: HKEY_CURRENT_USER
5. Set the Key Path to: Software\Microsoft\Internet Explorer\Main
6. Set the Value name to: NoProtectedModeBanner
7. Set the Value type to: REG_DWORD
8. Set the Value data to: 1
9. Click OK.
   

Published Internet Explorer Settings – Runonce

If a user launches Internet Explorer as a published application, then Internet Explorer might not be fully configured and thus some websites won’t work. By default, Windows runs per-user configuration (ActiveSetup) of Internet Explorer only when the user connects to a full desktop, which doesn’t happen when only launching published apps. To override this behavior so it works with published IE even if the user never connects to a full desktop, do the following:

1. Edit the Citrix VDA All Users GPO.
2. Go to User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff).
3. Double-click Logon.
   
4. Click Add.
   
5. In the Script Name field, enter runonce.exe.
6. In the Script Parameters field, enter /AlternateShellStartup. Click OK.
   

Windows 8.1/2012 R2 might not run the script at logon. Configure the following GPO computer settings to enable the script (configure these in the Citrix VDA Computer Settings GPO):

Logon Script GPO Settings

• Computer Configuration | Policies | Administrative Templates | System | Group Policy
  • Configure Group Policy Caching = disabled. Windows 8.1/2012 R2 setting
  • Configure Logon Script Delay = enabled, 0 minutes. Windows 8.1/2012 R2 setting.
  • Configure User Group Policy loopback processing mode = Enabled, either Merge or Replace depending on the desired result

Internet Explorer Group Policy Preferences

The Internet Explorer Maintenance settings in group policy (User Configuration > Windows Settings > Internet Explorer Maintenance) have been removed in Internet Explorer 10 and Windows Server 2012.

If you run group policy editor on Windows Server 2008 R2 and try to add an Internet Settings object using Group Policy Preferences, notice there is no option to configure Internet Settings for Internet Explorer 9 or Internet Explorer 10.

If you use group policy editor in Windows 8 or Windows 2012, then Internet Explorer 10 is an option.

If you have access to Windows 8/2012, you can add an Internet Settings object for Internet Explorer 10. When configuring a setting, notice the red or green lines (and red or green circles). Only green settings are applied. To change a setting to green, press F6 on your keyboard. To disable a setting, press F7 on your keyboard.

As you look through the tabs, you’ll see a bunch of green items. These green items will be applied and might not be the behavior you expect. To disable all settings on a particular tab, press F8. To turn them back on, press F5.

On the Common tab you can check the box to Apply once and do not reapply.

Internet Explorer Security Zone Configuration

There is a group policy setting at User Config | Policies | Administrative Templates | Windows Components | Internet Explorer | Internet Control Panel | Security Page |  Site to Zone Assignment List that can be used to put Internet sites in Internet Explorer security zones. However, users cannot add their own sites (the user interface in Internet Explorer is grayed out).

This section details an alternative procedure for administrator-configured zones while allowing users to add their own Trusted Sites.

Note: Zones can’t be configured using a Group Policy Preferences Internet Settings object so instead you’ll need to configure registry keys as detailed below.

1. Run Internet Explorer and configure security zones as desired.
2. If you are using Workspace Control in Receiver for Web or need pass-through authentication, make sure you add StoreFront as a Local Intranet Site.
   
3. Run Group Policy Management Console on the same machine where you have security zones configured.
4. Edit the Citrix VDA All Users GPO.
   
5. Go to User Configuration > Preferences > Windows Settings > Registry and create a new Collection Item. Name it IE Zones or similar.
   
6. Right-click the collection and click New > Registry Item.
   
7. Click the … button next to Key Path.
   
8. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains. Click the key corresponding to the FQDN you’re adding. Then select the registry value on the bottom that corresponds to the protocol (e.g. * or https). Click Select. Note: 1 indicates Local Intranet zone.
   
9. Then click OK. Note: 1 indicates Local Intranet zone.
   
10. Feel free to rename the Registry Item to reflect the actual zone.
    
11. Repeat these steps for additional zones.

Internet Explorer Home Page

If you don’t have access to Windows 8/2012 group policy editor, configure the default home page using a registry key.

1. Run Internet Explorer and configure home page as desired.
   
2. Run Group Policy Management Console on the same machine where you have the home page configured.
3. Edit the Citrix VDA All Users GPO.
   
4. Go to User Configuration > Preferences > Windows Settings > Registry and create a new Registry Item.
   
5. Click the … button next to Key Path.
   
6. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main. On the bottom, select Start Page. Then click Select.
   
7. On the Common tab, you can select Apply once and do not reapply. Then click OK.
   

Proxy Settings

If you don’t have access to Windows 8/2012 group policy editor, configure Proxy Settings using registry keys. Proxy Settings are stored under HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings. Use Group Policy Preferences or similar to distribute the registry keys.

To prevent users from changing proxy settings, also configure the following group policy setting.

Internet Explorer GPO Settings

• User Configuration | Policies | Administrative Templates | Windows Components | Internet Explorer | Internet Control Panel
  • Disable the Connections page = enabled

Office 2013/2016

Office 365 Planning

Citrix Implementation Guide Microsoft Office 365 for Citrix XenApp and XenDesktop 7.x contains:

• Considerations for Outlook Cached Mode
• Group Policy settings for Outlook Cached Mode
• For Lync Audio/Video – various options for delivering the Lync client
• Caveats for OneDrive for Business
• Licensing – shared computer activation

Sven Huisman – How-to configure Office 365 Pro in a non-persistent VDI environment: How to do Shared Computer Activation. ADFS recommended for Single Sign-on during Office activation.

Group Policy Templates

Download the Office 2013 group policy templates or Office 2016 group policy templates.

If you installed the 32-bit version of Office 2013/2016 then you’ll need the 32-bit (x86) version of the templates.

1. Go to the downloaded Office 2013 group policy templates and run AdminTemplates_32.exe. Or for Office 2016, run admintemplates_x86_4286-1000_en-us.exe.
   
   
2. Check the box next to Click here to accept and click Continue.
   
   
3. Specify a folder to place the extracted templates in.
   
   
4. Click OK to acknowledge that files extracted successfully.
   
   
5. Go to the folder where you extracted the files and in the ADMX folder copy all of the .admx files and the en-us folder to the clipboard.
   
   
6. Go to \\domain.com\sysvol\domain.com\Policies\PolicyDefinitions and paste the files.
   
7. If you do not have PolicyDefinitions in your Sysvol then instead go to C:\Windows\PolicyDefinitions and paste the files.
   

Group Policy and Tweaks

This section assumes the Group Policy Objects have already been created.

Edit the Citrix VDA All Users GPO and enable the Group Policy settings shown below. All are located under User Configuration > Policies.

• User Configuration | Policies | Administrative Templates | Microsoft Office 2013 (or 2016) | First Run
  • Disable First Run Movie = enabled
  • Disable Office First Run on application boot = enabled
• User Configuration | Policies | Administrative Templates | Microsoft Office 2013 (or 2016) | Global Options |Customize
  • Allow roaming of all user customizations = enabled
• User Configuration | Policies | Administrative Templates | Microsoft Office 2013 (or 2016) | Miscellaneous
  • Disable Office Animations = enabled
  • Do not use hardware graphics acceleration = enabled
  • Suppress recommended settings dialog = enabled
• User Configuration | Policies | Administrative Templates | Microsoft Office 2013 (or 2016) | Privacy | Trust Center
  • Automatically receive small updates to improve reliability = disabled
  • Disable Opt-in Wizard on first run = enabled
  • Enable Customer Experience Improvement Program = disabled
• User Configuration | Policies | Administrative Templates | Microsoft Office 2013 (or 2016) | Tools | Options | General | Service Options… | Online Content
  • Online Content Options = enabled, Allow Office to connect to the Internet
• User Configuration | Policies | Administrative Templates | Microsoft Outlook 2013 (or 2016) | Account Settings | Exchange | Cached Exchange Mode
  • Use Cached Exchange Mode for new and existing Outlook profiles = disabled

  • If you prefer to use Cached Exchange Mode, see Citrix’s Implementation Guide and add below:

    • Cached Exchange Mode Sync Settings = enabled, time-window of downloaded content
    • Administrative Templates | Microsoft Outlook 2013 | Miscellaneous | PST Settings | Default location for OST files = enabled, UNC path to user home directories
• User Configuration | Policies | Administrative Templates | Microsoft Outlook 2013 (or 2016) | Miscellaneous | PST Settings
  • Default location for PST files = enabled, user’s home directory
• User Configuration | Policies | Administrative Templates\ Microsoft Outlook 2013 (or 2016) | Outlook Options | Other | AutoArchive
  • AutoArchive Settings = enabled, uncheck box next to Turn on AutoArchive
• User Configuration | Policies | Administrative Templates | Microsoft Outlook 2013 (or 2016) | Outlook Options | Preferences | Search Options
  • Prevent installation prompts when Windows Desktop Search component is not present = enabled

Microsoft hotfix 2786932 – Dialog boxes and new windows displayed as blank in Office 2013 RemoteApps on a client computer that is running Windows 7 or Windows Server 2008 R2

From Thomas Koetzing – How to disable Office 2013 shadow border:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI\MSO_BORDEREFFECT_WINDOW_CLASS]
"ClassName"="MSO_BORDEREFFECT_WINDOW_CLASS"
"Type"=dword:00001000

Adobe Reader

Adobe Reader Group Policy

1. Download the Adobe Reader XI Policy Templates from Reader XI Administrative Template
2. Copy the .admx file and the en-us folder.
   
3. Go to \\domain.com\SYSVOL\domain.com\Policies\PolicyDefinitions and paste the files. If this folder doesn’t exist, go to C:\Windows\PolicyDefinitions instead.
   
4. Click Yes when asked to replace files.
5. Now open a group policy that applies to all Citrix users.
6. Go to User Configuration > Administrative Templates > Adobe Reader > Preferences > General.
7. Open the setting Accept EULA and Enable it.
   
8. Then open the Display splash screen at launch setting and Disable it.
   

Disable Repair

In Adobe Reader, users can open the Help menu and click Repair Adobe Reader Installation.

Then users are prompted to reboot. Obviously this is not good. Even non-admins can reboot.

1. In regedit, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Acrobat Reader\11.0\Installer.
2. Add the DWORD DisableMaintenance and set it to 1.
   
3. Now the Repair option is grayed out on the Help menu.
   
   

Disable Updates

For Acrobat Reader DC, you must edit the registry to disable Updates. This also works for Adobe Reader XI.

• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Adobe ARM\Legacy\Reader\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}
  • Mode = 0 (disables updates)

In Adobe Reader XI, there is a GUI method of disabling updates:

1. Run Adobe Reader from the Start Menu.
2. Open the Edit menu and click Preferences.
   
3. On the Updater page, change the selection to Do not download or install updates automatically and click OK.
   

Other Optimizations

Rick van Soest Removing “The Cloud” from Adobe Acrobat Reader DC:

• To remove tools, delete them from C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU
• To remove the welcome screen, add the following registry dword value: HKLM\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown
  • bUsageMeasurement (REG_DWORD) = 0
• To remove the “add account” button, HKLM\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cSharePoint
  • BDisableSharePointFeatures (REG_WORD) = 1
• To remove the “Check for update” button, HKLM\Software\Adobe\Acrobat Reader\DC\Installer
  • DisableMaintenance (REG_DWORD) = 1

Citrix Blog Post Optimizing Adobe Reader in XenApp details the following optimizations:

• Remove toolbar on right side of screen
• Remove links from the Help menu
• Disable Adobe ARM
• Disable Autosave

Adobe.com – Citrix Deployments: Before deployment, the product should be configured as needed. In particular, you will want to disable features and behaviors that should not be accessible to end users in an IT-managed environment. For example:

• The Updater should be disabled as described in this guide and the Preference Reference.
• Accept the EULA on behalf of all users by setting the appropriate registry key.
• For multilanguage installations (MUI), set the preferred language for all users via the SUPPRESSLANGSELECTION property or registry settings described in the Preference Reference.
• Deploy enterprise files to the product’s directories (rather than per-user directories) so they are available to all users.
• There are over 500 documented settings. Refer to the Preference Reference for complete registry and plist details.

Scrolling performance

If scrolling performance is poor in graphic intensive documents, try the following:

• Go toEdit > Preferences > Rendering.
• UncheckSmooth line art and Smooth images. Alternatively, you can set these preferences during pre-deployment configuration:
  • HKCU\Software\Adobe\Adobe Acrobat\10.0\Originals\bAntialiasGraphics: 0x00000000
  • HKCU\Software\Adobe\Adobe Acrobat\10.0\Originals\bAntialiasImages: 0x00000000

Distiller performance

• In some environments, Distiller performance may suffer if the messages.log file becomes too large after a number of Distiller operations. Delete this file periodically. It is located at \Application Data\Adobe\Acrobat\Distiller<version>\messages.log.
• Remove unused fonts from the Windows installation.

ShareFile On-Demand Sync

On most Citrix VDA machines, ShareFile Sync should be configured for On-Demand Sync where files are only downloaded when the user demands them. On-Demand Sync is enabled using group policy.

Citrix Whitepaper Implementing ShareFile On-Demand Sync

ShareFile Sync – Install

1. Go to the downloaded ShareFile On-Demand Sync for Windows 2.15. Download the one with the push install description.
   
2. Run the downloaded ShareFileSync64_2.15.104.0.exe.
   
3. In the Please read the Citrix ShareFile Sync License Agreement page, check the box next to I accept the terms and click Install.
   
4. In the Completed the Citrix ShareFile Sync Setup Wizard page, click Finish.
   

ShareFile Sync Group Policy Templates

1. Find the GPO templates at C:\Program Files\Citrix\ShareFile\Sync\Configuration\PolicyDefinitions. Copy them to the clipboard.
   
2. Go to \\corp.local\sysvol\corp.local\Policies and paste the files in the PolicyDefinitions folder. If you don’t have this folder, then paste them in C:\Windows\PolicyDefinitions.
   
   

ShareFile Sync Group Policy Settings

From Dan Brinkmann at discussions.citrix.com: “There is a known issue with XenDesktop 7.6 when there are no XD policies applied it deletes the ShareFile key.” Also at the same post: “Somehow Sharefile will not use proxy settings when in On-Demand mode.”

Edit the Citrix Computer Settings GPO and enable the Group Policy setting shown below. All are located under Computer Configuration > Policies.

• Computer Configuration\Policies\Administrative Templates\ Citrix\Profile Management\File System
  • Exclusion list – directories = add ShareFile to the list
    
• Computer Configuration\Policies\Administrative Templates\ ShareFile\Enterprise Sync
  • On-demandSyncDiskVolume = enabled, C:\

Edit the Citrix VDA All Users Settings GPO and enable the Group Policy setting shown below. All are located under User Configuration > Policies.

• User Configuration | Policies | Administrative Templates |  ShareFile | Enterprise Sync
  • Account = enabled, enter your account address (e.g. company.sharefile.com)
  • Authentication Type = enabled, and configure as appropriate for your environment. If you use SAML Forms, make sure *.sharefile.com and your gateway.company.com DNS names are added to Trusted Sites in Internet Explorer.
  • LocalSyncFolder = enabled,  enter %userprofile%\ShareFile. Network drive is not supported.
  • On-demandPersonalFolder = enabled, check Sync personal folder
• User Configuration | Policies | Administrative Templates| Windows Components | File Explorer (or Windows Explorer)
  • Turn off the display of thumbnails and only display icons = enabled. This setting prevents Windows from downloading ShareFile files when retrieving thumbnails.

After logging in to Citrix and running ShareFile Sync, if you go to the ShareFile folder it will look like the files have been downloaded.

However, if you browse to the same folder from another machine, you’ll see they haven’t been downloaded yet. They will be downloaded when the user demands them.

File Type Association

James Rankin – Deploying per-user file type associations in Windows 8.1 / Server 2012 R2 and beyond: Microsoft’s new DISM method of changing File Type Associations is done at the machine-level. Use Group Policy Preferences to change the machine registry key but on a per-user basis.

Next Steps

• Citrix Policy Settings
• Citrix Profile Management
• Back to XenApp/XenDesktop