xenapp – Carl Webster https://www.carlwebster.com The Accidental Citrix Admin - The site for those who find themselves supporting Citrix involuntarily or accidentally Sat, 29 May 2021 13:57:49 +0000 en hourly 1 https://wordpress.org/?v=6.8.2 42228915 Where to Get Copies of the Various Scripts https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/ https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/#comments Fri, 30 Sep 2011 19:00:16 +0000 http://webster.skyrocket.ltd/?p=3741 NOTE:  All current scripts require PowerShell Version 3 or later. 

All current documentation scripts create a Microsoft Word 2010,  2013, or 2016/2019/O365 document.

Word 2016, Word 2019 and the Office 365 version of Word have the same version number of 16. All documentation scripts will work with Word 2019 and Word Office 365 with no changes.

*****All the scripts run best on PowerShell Version 5*****

Many people have asked me where they can get copies of the various PowerShell documentation scripts. To make it easier to find, I have linked to all of them in this one article.

All scripts have been moved to the new Downloads page.

I am leaving this landing page here so I don’t break all the existing links people have to this page.

Thanks

Webster

]]> https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/feed/ 333 3741 How To Hide Additional Drive Letters On A Server https://www.carlwebster.com/how-to-hide-additional-drive-letters-on-a-server/ https://www.carlwebster.com/how-to-hide-additional-drive-letters-on-a-server/#comments Tue, 16 Jun 2009 15:58:12 +0000 http://webster.skyrocket.ltd/?p=1088 When Creating a Server Management Group Policy on Windows Server 2003, there are two options that can be set to either Hide or Prevent users from working with the server’s drives:

  • Hide these specified drives in My Computer
  • Prevent access to drives from My Computer

When these options are enabled, there is a drop-down box that allows the selection of various drive combinations.  What if the drives you need hidden are not on the list?  This article will show you three ways to add any combination of drive letters to be hidden or denied access:

  1. Modify System.adm
  2. Create a new ADM file
  3. Use the ICAClient.adm file provided by Citrix

Why bother with either manual process when there is a 3rd Party utility called GPDrivesOptions that automates the creation of the necessary information?  There are places that do not allow 3rd Party utilities to be run on Domain Controllers or Management Stations.  Also, if Change Management is used, it may take longer to go through the approval process to modify System.adm than it takes to create a new ADM file and use it for your Group Policy.

Update February 26, 2015: The GPDrivesOptions article no longer exists on Petri.com.

Microsoft has KB article 231289 that explains the process to add custom drive letter combinations.  Using KB231298, if you wanted to hide access to drives A, B, D, E, G, P, and R:

The 26-bit string of drive letters is represented as:

11111111111111111111111111
ZYXWVUTSRQPONMLKJIHGFEDCBA

If you prefer to not work in Binary, the decimal value for each drive letter is:

Drive Letter Decimal Value Binary Value
Z

33554432

10000000000000000000000000
Y

16777216

1000000000000000000000000
X

8388608

100000000000000000000000
W

4194304

10000000000000000000000
V

2097152

1000000000000000000000
U

1048576

100000000000000000000
T

524288

10000000000000000000
S

262144

1000000000000000000
R

131072

100000000000000000
Q

65536

10000000000000000
P

32768

1000000000000000
O

16384

100000000000000
N

8192

10000000000000
M

4096

1000000000000
L

2048

100000000000
K

1024

10000000000
J

512

1000000000
I

256

100000000
H

128

10000000
G

64

1000000
F

32

100000
E

16

10000
D

8

1000
C

4

100
B

2

10
A

1

1

Putting “0”s for the drives to not be hidden results in:

00000000101000000001011011
ZYXWVUTSRQPONMLKJIHGFEDCBA

The binary string is 101000000001011011.  Converted to decimal is 163,931.

If you prefer to work with decimal, add up the value for each drive letter:

A

1
B

2
D

8
E

16
G

64
P

32768
R

131072

163931

Method 1 — Modify System.adm:

To change System.adm, go to a command prompt and type in the following commands:

  • CD %SYSTEMROOT%\INF and press Enter
  • COPY SYSTEM.ADM SYSTEM_BACKUP.ADM and press Enter
  • Notepad system.adm

With Notepad open, press Ctrl-F and Find [strings].  Add this line to the [strings] section:

ABDEGPR_Only=”Restrict A, B, D, E, G, P and R drives only”

Press Ctrl-Home to return to the top, then press Ctrl-F and Find !!NoDrives.  Add this entry in the ITEMLIST section for !!NoDrives:

NAME !!ABDEGPR_Only                  VALUE NUMERIC                  163931

Scroll down just a little until you see the !!NoViewOnDrive Policy.  Add this entry in the ITEMLIST section for !!NoViewOnDrive  Save the System.adm file and exit Notepad.

NAME !!ABDEGPR_Only                  VALUE NUMERIC                  163931

See Figures 1 and 2 for system.adm before changes and Figures 3 and 4 for system.adm after changes.

Figure 1 (system.adm before changes)
Figure 1 (system.adm before changes)
Figure 2 (system.adm before changes)
Figure 2 (system.adm before changes)
Figure 3 (system.adm after changes)
Figure 3 (system.adm after changes)
Figure 4 (system.adm after changes)
Figure 4 (system.adm after changes)

Save the System.adm file, exit Notepad and exit the command prompt.  In the Group Policy Object Editor, right-click Administrative Templates in the User Configuration section and select Add/Remove Templates… (Figure 5).

Figure 5
Figure 5

Click system and then the Remove button (Figure 6).

Figure 6
Figure 6

Click the Add… button, scroll to find system.adm, click system.adm, and then click Open (Figure 7).

Figure 7
Figure 7

Click Close (Figure 8).

Figure 8
Figure 8

Expand Administrative Templates, expand Windows Components, click Windows Explorer and double-click Hide these specified drives from My Computer (Figure 9).

Figure 9
Figure 9

Click the Dropdown box, the new drive restriction selection is now available (Figure 10).

Figure 10
Figure 10

Select the new drive restriction and repeat for the Prevent access to drives from My Computer policy setting (Figure 11).

Figure 11
Figure 11

Exit editing the GPO and the new drive restrictions have been added to your GPO.

Method 2 — Create a new ADM file:

Why use Method 2?  If changes are not allowed to be made or Change Control processes must be followed to make changes to files installed by the Operating System, then Method 2 is an easy option.  It should take less than five minutes to complete Method 2.

To create a new ADM file, go to a command prompt and type in the following commands:

  • CD %SYSTEMROOT%\INF and press Enter
  • Notepad HideDrives.adm
  • Answer Yes to the Do you want to create a new file? popup

Enter, or copy and paste, the following text into the new HideDrives.adm file:

#if version >= 3
CLASS USER
CATEGORY !!WindowsComponents
	CATEGORY !!WindowsExplorer
		KEYNAME "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
		POLICY !!NoDrives
			EXPLAIN !!NoDrives_Help
			PART !!NoDrivesDropdown       DROPDOWNLIST NOSORT REQUIRED
			VALUENAME "NoDrives"
				ITEMLIST
					NAME !!ShowAll       VALUE NUMERIC       0
					NAME !!HideAll       VALUE NUMERIC       67108863 DEFAULT
					NAME !!ABDEGPR_Only       VALUE NUMERIC       163931
				END ITEMLIST
			END PART
		END POLICY
		POLICY !!NoViewOnDrive
			EXPLAIN !!NoViewOnDrive_Help
			PART !!NoViewOnDriveDropdown       DROPDOWNLIST NOSORT REQUIRED
			VALUENAME "NoViewOnDrive"
				ITEMLIST
					NAME !!ShowAll       VALUE NUMERIC       0
					NAME !!HideAll       VALUE NUMERIC       67108863 DEFAULT
					NAME !!ABDEGPR_Only       VALUE NUMERIC       163931
				END ITEMLIST
			END PART
		END POLICY
	END CATEGORY ; WindowsExplorer
END CATEGORY ; WindowsComponents
#endif
[strings]
NoDrives="Show only certain drives in My Computer"
NoDrives_Help="Removes the icons representing all but selected hard drives from My Computer"
NoDrivesDropdown="Pick one of the following combinations"
NoViewOnDrive="Prevent access to drives from My Computer."
NoViewOnDrive_Help="Prevents users from using My Computer to gain access to the content of selected drives."
NoViewOnDriveDropdown="Pick one of the following combinations"
WindowsComponents="Windows Components"
WindowsExplorer="Windows Explorer"
ShowAll="Show all drives"
HideAll="Hide all drives"
ABDEGPR_Only="Restrict A, B, D, E, G, P and R drives only"

Save the HideDrives.adm file, exit Notepad, and exit the command prompt.  In the Group Policy Object Editor, create a New Group Policy Object (GPO), name it Hide Server Drives. Edit the Hide Server Drives GPO, right-click Administrative Templates in the User Configuration section, and select Add/Remove Templates… (Figure 12).

Update 10-Jan-2014.  To keep you from having weird characters placed in your text file by Copy & Paste, I have placed a copy of HideDrives.adm here.

Figure 12
Figure 12

In this GPO, the only policies used are:

  • Hide these specified drives in My Computer
  • Prevent access to drives from My Computer

To remove excess policies for this single purpose group policy, remove the other five Policy Templates (Figure 13):

  • conf
  • inetres
  • system
  • wmplayer
  • wuau
Figure 13
Figure 13

Click Add…, click HideDrives.adm, and then click Open (Figure 14).

Figure 14
Figure 14

Click Close (Figure 15).

Figure 15
Figure 15

Expand Administrative Templates, expand Windows Components, click Windows Explorer and double-click Hide these specified drives from My Computer (Figure 16).

Figure 16
Figure 16

Click Enabled and from the drop-down box select the new Restrict A, B, D, E, G, P and R drives only option (Figure 17).

Figure 17
Figure 17

Repeat for the Prevent access to drives from My Computer policy setting (Figure 18).

Figure 18
Figure 18

Exit editing the GPO and the new drive restrictions have been added to your GPO.

Method 3 — Use the ICAClient.adm file provided by Citrix:

If you are using Citrix XenApp and are also using the ICA Client version 10.x or higher than Citrix (akes available ICAClient.adm.  Using this ADM file allows you to specify any combination of drive letters with no math involved.  Also, this ADM file is fully supported by Citrix if it has not been altered.  Citrix recommends using ICAClient.adm as the preferred way of controlling drives.  This GPO, in conjunction with the client-side XenApp plug-in, controls access to the specified drive letters.

Either download ICAClient.adm.zip and extract the ICAClient.adm file to c:\Windows\inf or copy the file from C:\Program Files\Citrix\ICA Client\Configuration.  In the Group Policy Object Editor, create a New Group Policy Object (GPO), name it ICAClient Hide Server Drives. Edit the Hide Server Drives GPO, right-click Administrative Templates in the User Configuration section, and select Add/Remove Templates… (Figure 19).

Figure 19
Figure 19

In this GPO, the only policy that will be used is Client drive mapping.

To remove excess policies for this single purpose group policy, remove the other five Policy Templates (Figure 20):

  • conf
  • inetres
  • system
  • wmplayer
  • wuau
Figure 20
Figure 20

Click Add…, click icaclient.adm, and then click Open (Figure 21).

Figure 21
Figure 21

Click Close (Figure 22).

Figure 22
Figure 22

Expand Administrative Templates, expand Citrix Components, expand Presentation Server Client, click Remoting client devices, and double-click Client drive mapping (Figure 23).

Figure 23
Figure 23

Click Enabled, make sure Enable client drive mapping is checked and enter ABDEGPR in the box for Do not map drives: and click OK (Figure 24).

Figure 24
Figure 24

Exit editing the GPO and the new drive restrictions have been added to your GPO.

In this article, you learned three methods of adding additional drive letters to hide or prevent access for use on your Terminal or XenApp Servers.

Thanks

Webster

]]> https://www.carlwebster.com/how-to-hide-additional-drive-letters-on-a-server/feed/ 6 1088 Will a Citrix License Server in a Workgroup Supply Licenses to XenApp Servers in Multiple Directory Services? https://www.carlwebster.com/will-a-citrix-license-server-in-a-workgroup-supply-licenses-to-xenapp-servers-in-multiple-directory-services/ Mon, 22 Dec 2008 18:04:52 +0000 http://webster.skyrocket.ltd/?p=196 This article was updated on January 5, 2009.

Will a stand-alone Citrix License Server running in a Workgroup service the licensing requests for XenApp Servers running in multiple farms in multiple directory service systems?  Someone asked me this question and my first thought was yes it would.  But would it?

NOTE:  Most people believe that XenApp can only be installed on a network that uses either Active Directory or eDirectory.  That is not true.  XenApp can be installed on a stand-alone workgroup computer, as well as UNIX versions for Solaris, AIX, and HP-UX.

This test will need five servers running Windows Server 2003 R2 x86 with all Windows Updates.  The License Server will be a stand-alone server in a Workgroup.  Microsoft Active Directory will be used for the Directory Service.  Two Forests, each with one domain, will be built.  One XenApp Server will be in each Domain as domain members.

Two server Virtual Machines (VM) were built for the first Forest/Domain.  The Forest/Domain is called DomainA.com, with a Domain Admin account named AdminA with a password of P@$$w0rdA.

Two server VMs were built for the second Forest/Domain.  The Forest/Domain is called DomainB.net, with a Domain Admin account named AdminB with a password of P@$$w0rdB.

The License Server was built as a stand-alone server in a Workgroup named Citrix with a local administrator account named AdminC with a password of P@$$w0rdC.  The License Server is version 11.5.

Figure 1
Figure 1

Different user names and passwords were used to verify that the license server does no authentication of user credentials when checking out licenses.

The XenApp Server in DomainA is named CitrixA and the server in DomainB is named CitrixB.

A DNS “A” record was created in each domain for the name of the Citrix License Server, CitrixONE.

Figure 2
Figure 2
Figure 3
Figure 3

When XenApp is installed, one of the questions asked is the hostname of the license server.

Figure 4
Figure 4

The installer needs to be able to resolve the name to an IP address.  If there is no DNS record for the license server, name resolution fails and you receive an error message that the license server cannot be contacted.

Figure 5
Figure 5

The Citrix Farm in DomainA is named FarmA, the Farm in DomainB is named FarmB.  Both XenApp servers are running XenApp 5 for Server 2003 – Platinum Edition with Hotfix Rollup Pack #3.

On CitrixA the Notepad text editor was published and on CitrixB, Microsoft Paint was published.

To begin the test both CitrixA and CitrixB were powered off.

Figure 6
Figure 6

This screen shows no Server Start-up licenses or Citrix XenApp Platinum licenses checked out.

CitrixA in DomainA.com was then powered on.

Figure 7
Figure 7

This shows that one Citrix Start-up License has been checked out.

CitrixB in DomainB.net was then powered on.

Figure 8
Figure 8

This shows that two Citrix Start-up licenses have now been checked out.  Click the box next to the number 2 in the In Use column to get a detailed usage report on the checked out licenses.

Figure 9
Figure 9

Here you see the Fully Qualified Domain Names of the two XenApp servers.

Program Neighborhood was used to run the Notepad published application on CitrixA.

Figure 10
Figure 10

This shows that one Citrix XenApp Platinum Concurrent User license has been checked out.

Program Neighborhood was used to run the Paint published application on CitrixB.

Figure 11
Figure 11

This shows that two Citrix XenApp Platinum Concurrent User licenses have been checked out.

Will a stand-alone Citrix License Server running in a Workgroup service the licensing requests for XenApp Servers running in multiple farms in multiple directory service systems?  Yes.

It does not matter what user accounts were used in installing the Citrix License Server or XenApp 5.  It does not matter what user accounts are set up on the license server or used to run the published applications.  The Citrix License Server simply listens, by default, on TCP Port 27000 for license requests.  If the license server has the licenses for the Citrix product being requested and has available user licenses, a license is checked out.

]]> 196 What is “Citrix”? https://www.carlwebster.com/what-is-citrix/ https://www.carlwebster.com/what-is-citrix/#comments Mon, 17 Nov 2008 23:17:08 +0000 http://webster.skyrocket.ltd/?p=271 The first question usually asked by the Accidental Citrix Admin is “what is Citrix?”.  There are two ways the term “Citrix” is used: as a specific product or as the name of a company that provides that product.  Usually, when “Citrix” is mentioned, the term is referring to software used to allow multiple user access to one or more applications hosted on another computer (normally a server).  The company, Citrix, refers to that capability as Application Virtualization. The product which provides that capability is now called Citrix Virtual Apps, and it was rebranded to that name in May 2018.  Before then it was called:

  • XenApp (2008)
  • Presentation Server (2005)
  • MetaFrame XP Presentation Server (2003)
  • MetaFrame XP (2001)
  • MetaFrame (1998)
  • MultiWin (1997)
  • WinFrame (1995)
  • WinView (1993)
  • Citrix Multi-User (1991)
  • Citrix MULTIUSER OS/2 (1990)

Citrix, the company, was founded in 1989 and I started working with MULTIUSER OS/2 in late 1989 or early 1990.  There were still vertical market application vendors using that product as late as the summer of 2003.  Citrix has primarily been known for their Application Virtualization product Citrix Virtual Apps but there are 15 distinct product families listed on the Citrix.com web page:

  • Citrix Workspace
  • Citrix Virtual Apps and Desktops
  • Citrix Content Collaboration
  • Citrix Endpoint Management
  • Citrix Managed Desktops
  • Citrix Hypervisor
  • ShareFile
  • Citrix ADC
  • Citrix Application Delivery Management
  • Citrix Gateway
  • Citrix Intelligent Traffic Management
  • Citrix SD-WAN
  • Citrix Web App Firewall
  • Citrix Analytics for Security
  • Citrix Analytics for Performance

What is Citrix?  Citrix is a company that offers a wide range of products to serve almost any application delivery needs a business may have.  From the smallest business to the largest global spanning corporations, Citrix has products to help deliver your applications to your users in the most cost-efficient manner possible.

]]> https://www.carlwebster.com/what-is-citrix/feed/ 2 271