• No changes

Computer XenDesktop Settings:

• No changes

User XenApp Settings:

• Browser Content Redirection Blacklist Configuration – Blank
• Enable session watermark – Disabled
• Include client IP address – Disabled
• Include connection time – Disabled
• Include logon user name – Enabled
• Include VDA host name – Enabled
• Include VDA IP address – Disabled
• Session watermark style – Multiple
• Watermark custom text – Blank
• Watermark transparency – 17

User XenDesktop Settings:

• Browser Content Redirection Blacklist Configuration – Blank
• Enable session watermark – Disabled
• Include client IP address – Disabled
• Include connection time – Disabled
• Include logon user name – Enabled
• Include VDA host name – Enabled
• Include VDA IP address – Disabled
• Session watermark style – Multiple
• Watermark custom text – Blank
• Watermark transparency – 17

Thanks

Webster

I am sure I may have missed something, so if I did, please let me know.

You can always find the most current Excel file by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

I am sure I may have missed something, so if I did, please let me know.

You can always find the most current Excel file by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

David McSpadden works for a financial institution and uses almost every documentation script available on this site. When he tests a script, he tests every output option and just about every possible combination of parameters. David emails me a copy of every report he runs for every script he tests. Currently, I have over 1,000 sample reports from David.

OK, on to the process David uses to run the Active Directory Health Check script as a scheduled task. The only things I have changed from the email David sent me is blacking out his employer’s name and letting Grammarly do its thing.

Note: In David’s text, CW is me and MS is my PowerShell mentor Michael B. Smith.

Ok, First off you must have the PowerShell working first. Get all bugs worked out so you can manually execute the ps1 a million times with no errors.

To do this, I have created a scripting environment.  C:\tmp\Scripts

In this example, I will show the AD Health Schedule.

Create a batch or dos command script in the c:\tmp\Scripts\AD_Health_Check folder called for lack of a better name pc-adHealth.bat.

This bat file will be used in the scheduled task later.

The bat file is simple and only has the following reference in it:

echo on
powershell.exe -NoLogo -File "c:\tmp\scripts\AD_Health_Check\ad health check v2 parms.ps1"

You can see this is calling Webster’s admin script.

The reference PowerShell is as follows:

(I have tested 1 million times to make sure it is still working.)

cd c:\tmp\scripts\"AD_Health_Check"\
.\"ADHealthCheck_v2.ps1" -CP "Sideline" -CN "David's Employer" -UN "David McSpadden" -All -Log -CSV -Mgmt -Folder \\localhost\c$\tmp\scripts\"AD_Health_Check"\foldertest -PDF

This PowerShell script puts a copy of the PDF output in a static location. I have a script that runs on my SharePoint the goes around and picks up all these admin script outputs and places them in the correct location on the SharePoint server for all the admins to reference.

Now to schedule this, I am only scheduling the bat file we created previously, and I am running the task under my user profile.

Trying to run it under admin remotely did not place nice with me so after much reflection and a big thick bat from MS and CW I went with my user profile.  (Also a KB article I cannot find again. But MS and CW reviewed it as well.)

I am running these once a week and they haven’t failed yet.

**side note

For that matter, can now use my Enterprise Scheduling software SMA Opcon by executing “c:\tmp\scripts\AD_Health_Check\ps-adhealth.bat” as [David’s AD Account] in the context of the Windows machine where the .bat file is hosted.  (SMA has a hook on the machine that allowed running in the context of a signed-on user.)

[end of David’s email]

If you have another method for running any of the scripts as a scheduled task, send me an email of how you handle the process and I will add it to this article.

Thanks

Webster and David

• Added: Browser Content Redirection – Allowed
• Added: Enable XenApp Optimization – Disabled
• Added: Large File Handling List – Files to be created as symbolic links – Blank
• Changed: NTUSER.DAT backup – Enabled was Disabled
• Added: Path to XenApp optimization definitions: – Blank

Computer XenDesktop Settings:

• Added: Browser Content Redirection – Allowed
• Added: Enable XenApp Optimization – Disabled
• Changed: HDX Adaptive Transport – Preferred was Off
• Added: Large File Handling List – Files to be created as symbolic links – Blank
• Added: Logon Exclusion Check – Enabled
• Changed: NTUSER.DAT backup – Enabled was Disabled
• Added: Path to XenApp optimization definitions: – Blank

User XenApp Settings:

• Added: Browser Content Redirection ACL Configuration – https://www.youtube.com/.*
• Added: Browser Content Redirection Proxy Configuration – Blank
• Added: Display lossless indicator – Disabled
• Added: Optimize for 3D graphics workload – Disabled

User XenDesktop Settings:

• Removed: Automatic installation of in-box printer drivers
• Added: Browser Content Redirection ACL Configuration – https://www.youtube.com/.*
• Added: Browser Content Redirection Proxy Configuration – Blank
• Added: Display lossless indicator – Disabled
• Added: Optimize for 3D graphics workload – Disabled
• Added: Tablet Mode Toggle – Allowed

Thanks

Webster

I am sure I may have missed something, so if I did, please let me know.

You can always find the most current Excel file by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

I am sure I may have missed something, so if I did, please let me know.

You can always find the most current Excel file by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

Something most IT Pros do not know is that if anything is configured on the Profile tab in ADUC (Figure 1), Group Policy optimization is disabled for that user.

A few years ago, I did not know this either until a very long discussion took place on the NTSysAdmin mailing list. Microsoft describes this in Understand the Effect of Fast Logon Optimization and Fast Startup on Group Policy.

The synopsis is this:

Fast Logon Optimization and Group Policy processing

By default in Windows 8.1, Windows 8, Windows 7, Windows Vista, and Windows XP, the Fast Logon Optimization feature is set for domain and workgroup members. Policy settings apply asynchronously when the computer starts and when the user signs in. As a result, these operating systems do not wait for the network to be fully initialized at startup and sign-in. Existing users are signed in by using cached credentials. This results in shorter sign-in times. Group Policy is applied after the network becomes available.

Bullet points 2 and 3 are what you see in the Profile tab in ADUC. This also applies to all versions of Windows 10.

Bottom line, do not configure any of these items in ADUC, use Group Policy. Setting any of these items in ADUC forces the user to use legacy (NT4) logon processes.

The PowerShell you can use to find these users is:

Get-ADUser -Filter 'HomeDrive -ne "$Null"' `
-Property Name,CanonicalName,CN,DisplayName,DistinguishedName,HomeDirectory,`
HomeDrive,SamAccountName,UserPrincipalName | `
export-csv -path (Join-Path $pwd HomeDrive.csv) -encoding ascii -NoTypeInformation

You may not need all those properties. SamAccountName, HomeDirectory, and HomeDrive should be enough for you.

The Get-ADUser cmdlet will automatically add several other properties like Enabled, GivenName, ObjectClass, ObjectGUID, SID, and Surname.

Figure 2 shows the results of running the one-liner and Figure 3 shows the contents of the CSV file.

Once you have the CSV, you can open the CSV in Excel and analyze the data any way you choose.

Now you can clean up all those home drive users and move the home drive setting to a Group Policy and get back your Group Policy logon optimizations.

But what about Profile path and Logon script? Don’t those also disable the optimizations? Yes, they do. A simple adjustment to the one-liner will find users with those settings.

 
Get-ADUser -Filter 'ProfilePath -ne "$Null"' `
-Property Name,CanonicalName,CN,DisplayName,DistinguishedName,ProfilePath,`
SamAccountName,UserPrincipalName | `
export-csv -path (Join-Path $pwd ProfilePath.csv) -encoding ascii -NoTypeInformation 

 
Get-ADUser -Filter 'ScriptPath -ne "$Null"' `
-Property Name,CanonicalName,CN,DisplayName,DistinguishedName,ScriptPath,`
SamAccountName,UserPrincipalName | `
export-csv -path (Join-Path $pwd ScriptPath.csv) -encoding ascii -NoTypeInformation 

Or combine all three searches into one one-liner.

Get-ADUser -Filter {HomeDrive -ne "$Null" -or ProfilePath -ne "$Null" -or ScriptPath -ne "$Null"}`
-Property Name,CanonicalName,CN,DisplayName,DistinguishedName,`
HomeDirectory,HomeDrive,ProfilePath,ScriptPath,SamAccountName,UserPrincipalName | `
export-csv -path (Join-Path $pwd ADUC.csv) -encoding ascii -NoTypeInformation

Hope these one-liners help.

Thanks

Webster

[Updated 8-Mar-2021: My friends at Ferroque Systems tell me they tested this on a current version of CVAD and the process in this article still works.]

What is a Private Desktop? Citrix explains it this way:

Private desktops are automatically created when a machine is added to a desktop group with a DesktopKind of ‘Private’, and these inherit default properties.

For this article, I created two Machine Catalogs each with three persistent machines with changes saved on the local disk as shown in Figure 1.

I also created two Delivery Groups as shown in Figure 2.

Some people believe that published private desktops use the Delivery Group’s name as the name the user sees in StoreFront and Receiver but that is not always the case. If no user assignment has been made, published private desktops, by default, use the Display name value from the Desktop Assignment Rule in StoreFront and Receiver as shown in Figures 3, 4, and 5.

As you can see from Figure 5, the Delivery Group’s name is NOT used in StoreFront and it is also not used in Receiver. Why? Because no user assignment has been made, as shown in Figures 6 and 7.

If a user assignment has been made (Figure 8), then the Delivery Group’s Published Name property value is used in StoreFront and Receiver (Figure 9).

Where did the Delivery Group’s Published Name value come from?

When you create a Delivery Group, the Published Name property gets its initial value from the Delivery Group’s Name property. If you later rename the Delivery Group, the Published Name property’s value is not changed. You can set the Delivery Group’s Published Name value to whatever value you want using the Set-BrokerDesktopGroup cmdlet.

Back to the Private Desktop name shown in StoreFront and Receiver.

If you just want the desktop’s name to show or if you allow users to use more than one desktop in a Delivery Group, then you can change the Published Name value using the Set-BrokerPrivateDesktop cmdlet.

If you have more than one Delivery Group with Private Desktops and only want this change made to a single Delivery group, that is very simple.

For this article, I only want one Delivery Group changed. One Delivery Group uses the naming scheme Persistent-## and the other uses testp-##. I want the testp desktops changed.

First, I will get all the private desktops showing only the DNSName, HostedMachineName, MachineName, and PublishedName properties as shown in Figure 10.

Get-BrokerPrivateDesktop | select dnsname,hostedmachinename,machinename,publishedname

This shows that none of the private desktops have a value for PublishedName.

Note: I removed the desktop assignment I made earlier.

If I launch all three desktops from StoreFront, Sign out from the desktop, and rerun the previous cmdlet, we get what is shown in Figure 11.

My experience is that even if I change the Published Name property’s value BEFORE I first launch a desktop, the Assignment Rule’s Display Name value is written in for the value of the private desktop’s Published Name.

I found I had to launch the private desktop FIRST and then I could change the Publish Name property.

To change the Published Name property, use the following two lines of PowerShell code as shown in Figure 12.

Note: To change the Published Name property for all private desktops, use $Pattern = “*”

$Pattern = "testp*"
$Desktops = Get-BrokerPrivateDesktop -filter {HostedMachineName -like $Pattern} ; ForEach($Desktop in $Desktops) {Set-BrokerPrivateDesktop -MachineName $Desktop.MachineName -PublishedName $Desktop.HostedMachineName}

All the forum posts and blogs I have read on this want the Published Name property changed AFTER users have launched their private desktops. Please take note, if you changed the Published Name property BEFORE users launch their private desktop(s) for the FIRST time, the Published Name property’s value WILL get overwritten. Apparently, Citrix didn’t put in a safety check to see if the Published Name property has a value before they just blatantly overwrote whatever value was there. Bad job Citrix.

Thanks

Webster

• When -WhatIf or -Confirm with No or -Confirm with No to All is used, do not log non-actions as failures

You can always find the most current script by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

“There is currently an active background action”

ARGH!!! What to do?

Previously, I wrote about my issues with removing a hosting connection because of a mysterious active background task. In that article, I stated, “If this were a common occurrence, I would write a script to do all this…”.  Much to my dismay, this has become a common occurrence with you and your customers. It was time to create a script to automate this tedious process.

This is the first script I am creating that makes changes to a XenDesktop Site. Because of this, I try to do as much error checking as possible and stop the script from running if I find anything even slightly wrong.  There are several places where I have code similar to:

If(Some Condition)
{
     #we should never get here
     Write-Host "Unable to <do some process>. You shouldn't be here! Script will close."
     Write-Host "If you get this message, please email webster@carlwebster.com" -ForegroundColor Red
     $error
     Exit
}

If there are no active tasks for the hosting connection selected,  then NOTHING is removed from the Site. The script will state there were no active tasks found and end.

Here are examples of hosting and resource connections and the script in action.

I also added support for -WhatIf and -Confirm thanks to the clear and simple articles from Adam Bertram.

This will allow you to be safe and verify the script’s actions.

You can always find the most current script by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

Fellow CTP, Esther Barthel (the CTP’s favorite Minion), updated all the ADMX file worksheets. She also split the three ShareFile ADMX files into their own worksheet.

If you find any errors or omissions, please send an email to webster@carlwebster.com.

We hope you find the Excel file with all the policy settings and Citrix related ADMX files useful.

You can always find the most current Excel file by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster, Esther, Markus, Carl and Jon

I am sure I may have missed something, so if I did, please let me know.

You can always find the most current Excel file by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

I am sure I may have missed something, so if I did, please let me know.

You can always find the most current Excel file by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

Let me set a stage for configuration:

There are multiple XenDesktop Sites for your environment.  Either Citrix Provisioning Services (PVS) or Machine Creation Service (MCS) is being used for image deployment.  Whether your Sites are Active/Active or Active/Passive doesn’t matter.  The only difference between the images will be the Citrix Profile Management (CPM) store that the image points to.  As we all know, using the Distributed File System (DFS) for profiles is against Microsoft’s best practices.  Using DFS for profiles is a terrible, as well as an unsupported, practice.  (Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario).

Now with that said, you are using the policies for CPM configuration in any scenario (GPO, Studio, WEM, etc…).  The policies have the CPM store as the only change for each site.  My thought was let’s set the CPM service to “Delayed Start”.  Citrix has made that an impossible task.  That service must be set to Automatic to start correctly.  An old standby that I have used, restart the CPM service after the GPO has applied.  This works as far as the CPM service.  It will now log in and download users’ profiles from the correct store.

Now for the interesting twist.  If the CPM service crashes or is restarted, Citrix Director components break.  The Logon Duration and Personalization parts of the User Session Details will become unavailable as shown in Figure 1.

What is happening, is that the WMI calls being made by Director to the VDA are broken.  You can see this by running the following PowerShell command:

Get-<u>wmiobject</u> -Class "session" -Namespace "Root\Citrix\profiles\metrics"

This PowerShell command will show results for the users that have logged in before the CPM service fails.  Any user logging in after the CPM service has been restarted will not be tracked by the WMI counters, which means Citrix Director is broken.

Here are the workarounds attempted:

1. Changing the CPM service to Automatic Delayed – This is not allowed by Citrix programming
2. Changing the CPM service to Manual – Starting the service via a script after the CPM policy applied. This acts as a restart of the service and breaks the WMI session data.
3. System Variable – Setting a system variable to be used by the policy. This would dynamically change the server name but not change the policy.  This has the same effect as statically setting a server name and then trying to change it during boot.

I have tried many scenarios to try and get this to work.  Citrix has been working on a fix for this as well.  This is an issue for changing CPM stores dynamically as well as the CPM service crashing.

The resolution that I have found so far, to be able to keep one image and change CPM stores dynamically by Site is to use a Host entry.  I set the policy to a server name that will never exist (e.g. MultiCPMServer.company.com).  I then set a policy/scheduled task to add this server to the host file with the IP of the server that I am trying to use for the CPM store.

Example Host file for Site A:
<IP of File Server for Site A>        MultiCPMServer.company.com

Example Host file for Site B:
<IP of File Server for Site B>         MultiCPMServer.company.com

While this is not the most elegant solution, it is very functional and has worked at every client that needs this.  Again….  This will only be used until Citrix resolves the issues with the CPM service breaking WMI.

Now, back to learning what else is broken.

If you have any questions, please send me an email.

Thanks

Hal Lange

I was working with a customer that was an original Norskale customer.  They were running VUEM 3.1   I started the process of upgrading to Citrix Workspace Environment Management (WEM).  I upgraded all the components and it seemed to have no issues.  I started trying to connect the clients and weird issues started to appear.  The client would keep saying unable to connect to the broker environment.  The logs showed errors regarding the VUEM Agent Monitor Sync is erroring.  When running the AgentCacheUitlity, it would produce an error regarding VUEM Agent Monitor Cache failed.  The cache would show that things were being downloaded and the agent performance optimizations would still apply and work.

The brokers were giving no indication of any errors.  After further analysis, it looks like the DB is not fully upgraded.  I restored the DB to the 3.1 version and began the upgrade process again.  This time I started by upgrading to 3.5.2 first, then testing.  After upgrading to 3.5.2, I tested the client after reinstalling the 3.5.2 client.  Everything is working at this point.  At this point, I upgraded to 4.0.2 and had no issues.

What I have learned from this exercise is that the DB needs to be at the schema level for 3.5.2 before upgrading to the Citrix version of WEM.

Here is a list of other known upgrade issues from the Norskale error.

Prior to version 3.0:
All components must be uninstalled completely, reboot the system, and then install the new version.  At this point, the DB can be upgraded and brokers and clients will work accordingly.

Version 2.x to 3.x
Must uninstall version 2 and then upgrade to 3.0 before continuing to upgrade to 3.5.2

Version 3.x
Each component can be upgraded without the uninstall process without issues.

Version 3.x to Citrix WEM 4.x (excluding 4.3)
Must upgrade the VUEM components to VUEM 3.5.2 before continuing to the WEM versions.

*To get to Citrix WEM 4.3 you must upgrade to a lower version of 4 first

Version 4.x
Each component can be upgraded without the uninstall process without issues.

If you have any questions, please send me an email.

Thanks

Hal Lange

I am sure I may have missed something, so if I did, please let me know.

You can always find the most current Excel file by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

I am sure I may have missed something, so if I did, please let me know.

You can always find the most current Excel file by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

If you find any errors or omissions, please send an email to webster@carlwebster.com.

We hope you find the Excel file with all the policy settings and Citrix related ADMX files useful.

You can always find the most current Excel file by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster, Esther, Markus, Carl and Jon

Updated 28Feb2019 to remove App Layering version info. The process documented works for 4.x, 18xx, and 19xx versions.

After importing the appliance, I logged into the CentOS console and configured the basic networking stuff, as shown in Figure 1.

Next, I used Internet Exploder, I mean Explorer (IE), to start the rest of the configuration steps.

After setting the passwords for the three management accounts, the next item was the HTTP Certificate Settings.

One of the awesome benefits of being a CTP is that DigiCert gives the CTPs almost unlimited SSL certificates. Thank you very much, DigiCert.

The first thing I needed to do was generate a CSR file to give to DigiCert for my certificate request. Since the ELM is based on CentOS Linux, it has OpenSSL included. I found a helpful article from DigiCert support that automatically generates the required OpenSSL command, as shown in Figure 2.

I use PuTTY to log on to the console as root and pasted in the OpenSSL command that DigiCert supplied, as shown in Figure 3.

Note: There is a bug in a fresh import of the 4.2 appliance where the wizard used to change the three account’s passwords does not change the password for root. To login as root, use the default password.

Next, I used WinSCP to download the two files created, as shown in Figure 4.

I used the CSR file to request my SSL certificate from DigiCert.

Once I received my ZIP file, I extracted the certificate files to the same folder I placed the CSR and KEY files downloaded from the ELM appliance, as shown in Figure 5.

Using Notepad++, I opened the CRT and KEY files and created a new blank unidesk_labaddomain_com.pem file. I then copied the KEY file contents first into the PEM file and then added the CRT file to the bottom of the PEM file, as shown in Figure 6.

Back in the browser interface for the ELM appliance, click Edit for HTTP Certificate Settings, as shown in Figure 7.

Click Upload as shown in Figure 8.

Browse to the PEM file created earlier, select it and click Open, as shown in Figure 9.

Verify the Uploaded Certificate information is correct. If it is, click Save, as shown in Figure 10. If the information is not correct, you may need to recreate the PEM file or receive a new SSL certificate.

Click Yes to restart the webserver, as shown in Figure 11.

I created a DNS A record to match the SSL certificate, as shown in Figure 12.

Once the browser window refreshes, exit IE, restart IE, and browse to https://FQDN of the ELM appliance as shown in Figure 13.

Notice there are no SSL certificate errors even though the PEM file did not contain any Intermediate or Root certificate information.

I want to give a shout-out to Kyle at DigiCert support for all the time he spent with me working through this process.

Thanks

Webster