Quantcast
Channel: Carl Stalhood
Viewing all 594 articles
Browse latest View live
↧

Director Load Balancing – NetScaler 11

February 9, 2016, 12:56 am
$
0
0

Navigation

Monitor

  1. On the left, expand Traffic Management, expand Load Balancing, and click Monitors.
  2. On the right, click Add.
  3. Name it Director or similar.
  4. Change the Type drop-down to HTTP.
  5. If you will use SSL to communicate with the Director servers, then scroll down and check the box next to Secure.
  6. Switch to the Special Parameters tab.
  7. In the HTTP Request field, enter GET /Director/LogOn.aspx?cc=true
  8. Click Create.

Servers

  1. On the left, expand Traffic Management, expand Load Balancing, and click Servers.
  2. On the right, click Add.
  3. Enter a descriptive server name. Usually it matches the actual server name.
  4. Enter the IP address of the server.
  5. Enter comments to describe the server. Click Create.
  6. Continue adding Director servers.

Service Group

  1. On the left, expand Traffic Management, expand Load Balancing, and click Service Group.

  2. On the right, click Add.
  3. Give the Service Group a descriptive name (e.g. svcgrp-Director-SSL).
  4. Change the Protocol to HTTP or SSL. If the protocol is SSL, ensure the Director Monitor has Secure enabled.
  5. Scroll down and click OK.
  6. Click where it says No Service Group Member.
  7. If you did not previously create server objects, then enter the IP address of a Director Server. If you previously created a server objects, then change the selection to Server Based and select the server objects.
  8. Enter 80 or 443 as the port. Then click Create.
  9. On the right, under Advanced Settings, click Monitors.
  10. On the left, in the Monitors section, click where it says No Service Group to Monitor Binding.
  11. Click the arrow next to Click to select.
  12. Select the Director monitor and click Select.
  13. Then click Bind.
  14. To verify that the monitor is working, on the left, in the Service Group Members section, click the Service Group Members line.
  15. Highlight a member and click Monitor Details.
  16. The Last Response should be Success – HTTP response code 200 received. Click Close twice.
  17. Then click Done.

Responder

Create a Responder policy to redirect users from the root page to /Director.

  1. Go to AppExpert > Responder and enable the feature if it isn’t already enabled.
  2. Go to AppExpert > Responder > Actions.
  3. On the right, click Add.
  4. Give the Action a name (e.g. Director_Redirect).
  5. Change the Type to Redirect.
  6. In the Expression box, enter "/Director", including the quotes.
  7. Click Create.
  8. Go to AppExpert > Responder > Policies.
  9. On the right, click Add.
  10. Give the Policy a name (e.g. Director_Redirect).
  11. Select the previously created Action.
  12. In the Expression box, enter HTTP.REQ.URL.PATH.EQ("/")
  13. Click Create.

Load Balancing Virtual Server

  1. Create or install a certificate that will be used by the SSL Virtual Server. This certificate must match the DNS name for the load balanced Director servers.
  2. On the left, under Traffic Management > Load Balancing, click Virtual Servers.

  3. On the right click Add.
  4. Name it Director-SSL-LB or similar.
  5. Change the Protocol to SSL.
  6. Specify a new internal VIP.
  7. Enter 443 as the Port.
  8. Click OK.
  9. On the left, in the Services and Service Groups section, click where it says No Load Balancing Virtual Server ServiceGroup Binding.
  10. Click the arrow next to Click to select.
  11. Select your Director Service Group and click Select.
  12. Click Bind.
  13. Click Continue.
  14. Click where it says No Server Certificate.
  15. Click the arrow next to Click to select.
  16. Select the certificate for this Director Load Balancing Virtual Server and click Select.
  17. Click Bind.
  18. Click Continue.
  19. On the right, in the Advanced Settings column, click Persistence.
  20. Select SOURCEIP persistence.
  21. Set the timeout to match the timeout of Director. The default timeout for Director is 245 minutes.
  22. The IPv4 Netmask should default to 32 bits.
  23. Click OK.
  24. On the right, in the Advanced Settings section, add the Policies section.
  25. On the left, in the Policies section, click the plus icon.
  26. Select Responder in the Choose Policy drop-down and click Continue.
  27. Select the previously created Director_Redirect policy and click Bind.
  28. If you haven’t enabled the Default SSL Profile, then perform other normal SSL configuration including: disable SSLv3, bind a Modern Cipher Group, and enable Strict Transport Security. 
    bind ssl vserver MyvServer -certkeyName MyCert

set ssl vserver MyvServer -ssl3 DISABLED -tls11 ENABLED -tls12 ENABLED

unbind ssl vserver MyvServer -cipherName ALL

bind ssl vserver MyvServer -cipherName Modern

bind ssl vserver MyvServer -eccCurveName ALL

bind lb vserver MyvServer -policyName insert_STS_header -priority 100 -gotoPriorityExpression END -type RESPONSE

SSL Redirect

  1. Right-click the Director SSL Load Balancing Virtual Server and click Add.
  2. Change the Name to Director-HTTP-SSLRedirect or something like that.
  3. Change the Protocol to HTTP.
  4. Click OK. This HTTP Virtual Server uses the same VIP as the SSL Load Balancer.
  5. Bind the AlwaysUp service. See SSL Redirect – Responder Method for more information.
  6. Bind the http_to_ssl_redirect_responderpol Responder Policy.
  7. That’s all this LB vServer needs. Click Done when done.

SSL Warning

  1. If you are doing SSL Offload (SSL on front end, HTTP on back end), when connecting to Director it might complain about “You are not using a secure connection”.
  2. To turn off this warning, login to the Director servers and run IIS Manager.
  3. On the left, navigate to Server > Sites > Default Web Site > Director.
  4. In the middle, double-click Application Settings.
  5. Change UI.EnableSslCheck to false.

CLI Commands

Here is a list of NetScaler CLI commands for Director Load Balancing:

add server Director01 10.2.2.18
add server Director02 10.2.2.100
add server 127.0.0.1 127.0.0.1
add service AlwaysUp 127.0.0.1 HTTP 80
add serviceGroup svcgrp-Director-HTTP HTTP
add ssl certKey wildcom -cert WildcardCorpCom_pem -key WildcardCorpCom_pem
add lb vserver Director-SSL-LB SSL 10.2.2.210 443 -persistenceType SOURCEIP -timeout 245
add lb vserver Director-HTTP-SSLRedirect HTTP 10.2.2.210 80 -persistenceType NONE
add responder action Director_Redirect redirect "\"/Director\"" -responseStatusCode 302
add responder action http_to_ssl_redirect_responderact redirect "\"https://\" + HTTP.REQ.HOSTNAME.HTTP_URL_SAFE + HTTP.REQ.URL.PATH_AND_QUERY.HTTP_URL_SAFE" -responseStatusCode 302
add responder policy Director_Redirect "http.REQ.URL.PATH.EQ(\"/\")" Director_Redirect
add responder policy http_to_ssl_redirect_responderpol HTTP.REQ.IS_VALID http_to_ssl_redirect_responderact
bind lb vserver Director-HTTP-SSLRedirect AlwaysUp
bind lb vserver Director-SSL-LB svcgrp-Director-SSL
bind lb vserver Director-SSL-LB -policyName Director_Redirect -priority 100 -gotoPriorityExpression END -type REQUEST
bind lb vserver Director-HTTP-SSLRedirect -policyName http_to_ssl_redirect_responderpol -priority 100 -gotoPriorityExpression END -type REQUEST
add lb monitor Director HTTP -respCode 200 -httpRequest "GET /Director/LogOn.aspx?cc=true" -LRTM DISABLED -secure YES
bind serviceGroup svcgrp-Director-SSL Director01 443
bind serviceGroup svcgrp-Director-SSL Director02 443
bind serviceGroup svcgrp-Director-SSL -monitorName Director
set ssl serviceGroup svcgrp-Director-SSL -tls11 DISABLED -tls12 DISABLED
bind ssl vserver Director-SSL-LB -certkeyName wildcom
bind ssl vserver Director-SSL-LB -eccCurveName P_256
bind ssl vserver Director-SSL-LB -eccCurveName P_384
bind ssl vserver Director-SSL-LB -eccCurveName P_224
bind ssl vserver Director-SSL-LB -eccCurveName P_521
↧
Search

StoreFront 3.5 – Basic Configuration

February 25, 2016, 5:48 am
$
0
0

Navigation

StoreFront Installation / Upgrade

The XenApp/XenDesktop 7.8 ISO comes with StoreFront 3.5.

You can install StoreFront at the same time as installing Delivery Controller. Or you can install StoreFront 3.5 on dedicated servers.

Citrix Blog Post StoreFront 3.0 Scalability recommends StoreFront servers to be sized with 4 vCPU and 8 GB RAM.

Note: You can install Web Interface and StoreFront on the same servers. Make sure Web Interface is installed first.

  1. If upgrading, stop the World Wide Web Publishing Service.
  2. If upgrading, stop all StoreFront services.
  3. Go to the downloaded Citrix StoreFront 3.5 and run CitrixStoreFront-x64.exe.

  4. In the License Agreement page, check the box next to I accept the terms and click Next.
  5. In the Review prerequisites page, click Next.
  6. In the Ready to install page, click Install.
  7. In the Successfully installed StoreFront page, click Finish.

If this is a new install, skip to the Initial Configuration.

After upgrading from StoreFront 2.6 or older, do the following to enable the Receiver X1 theme:

  1. In the StoreFront Console, on the left click the Stores node. Right-click the store and click Manage Receiver for Web Sites.
  2. Click Configure.
  3. On the Receiver Experience page select Disable classic experience.
  4. Once classic experience is disabled, you can now make changes on the Customize Appearance and Featured App Groups pages. Click OK and Close when done.

  5. Go to Stores. Right-click the Store and click Configure Unified Experience.
  6. Check the box next to Set the unified Receiver experience as the default for this store and click OK.
  7. When you propagate changes, the default web page is not replicated to the other nodes. Copy C:\inetpub\wwwroot\web.config manually to each node.

Initial Configuration

If this is a new deployment of StoreFront, do the following to perform the initial configuration:

  1. In PowerShell, run Set-ExecutionMode RemoteSigned.
  2. The management console should launch automatically. If not, launch Citrix StoreFront from the Start Menu.
  3. In the middle, click Create a new deployment.
  4. In the Base URL page, if you installed an SSL certificate on the StoreFront server, then the Hostname should already be filled in. For now, you can leave it set to the server name and then change it later once you setup SSL and load balancing. Click Next.
  5. In the Getting Started page, click Next.
  6. In the Store Name page, enter a name for the store. Note: the name entered here is part of the URL path.
  7. Check the box next to Set this Receiver for Web site as IIS default and click Next.
  8. In the Delivery Controllers page, click Add.
  9. Enter a descriptive name for the XenApp/XenDesktop farm. This name does not need to match the actual farm name. (don’t put spaces or periods in the farm name)
  10. Change the Type to XenDesktop.
  11. Add the two XenDesktop Controllers. Change the Transport Type to HTTP. Click OK.
  12. If you have multiple XenDesktop sites, feel free to add them now. Or you can add older XenApp farms. (don’t put spaces or periods in the farm name) Click Next when done.
  13. In the Remote Access page, don’t check the box and click Next. You can set this up later.
  14. In the Authentication Methods page, check the boxes next to Domain pass-through and Pass-through from NetScaler Gateway. Click Next.
  15. In the XenApp Services URL page, click Create.
  16. In the Summary page, click Finish.

Second StoreFront Server

After installation, NT SERVICE\CitrixConfigurationReplication and NT SERVICE\CitrixClusterService must remain in the Administrators group on both StoreFront servers or propagation will fail.

  1. Install StoreFront on the second server.
  2. Create/Import the SSL certificate and bind it to the Default Web Site.
  3. Login to the first StoreFront server. In the StoreFront management console, right-click Server Group and click Add Server.
  4. Copy the Authorization code. Note: the Please wait message means it is waiting on you to add the 2nd server. You don’t actually have to wait.
  5. Login to the second StoreFront server and launch the management console. In the middle, click Join existing server group.
  6. In the Join Server Group page, enter the name of the first StoreFront server and enter the Authorization code copied earlier. Click Join.
  7. Then click OK.
  8. Go back to the first server. Click OK.
  9. Notice this message. It is good advice.
  10. All changes made on one StoreFront server must be manually propagated to the other StoreFront server.
  11. When you propagate changes, the default web page is not replicated to the other nodes. Copy C:\inetpub\wwwroot\web.config manually to each node.

Store Name – Rename

If you installed StoreFront on your Delivery Controller, it will have a default store named Store. If you don’t like the default Store Name (/Citrix/Store) then you will need to remove the store and re-add it.

  1. In the StoreFront console, on the left click Stores.
  2. Right-click the store and click Remove Store.
  3. Click Yes.
  4. On the left, right-click Stores and click Create Store.
  5. In the Getting Started page, click Next.
  6. In the Store Name page, enter a name for the store. Note: the name entered here is part of the URL path.
  7. Check the box next to Set this Receiver for Web site as IIS default and click Next.
  8. In the Delivery Controllers page, click Add.
  9. Enter a descriptive name for the XenApp/XenDesktop farm. This name does not need to match the actual farm name. (don’t put spaces or periods in the farm name)
  10. Change the Type to XenDesktop.
  11. Add the two XenDesktop Controllers.
  12. Change the Transport Type to HTTP. Click OK.
  13. If you have multiple XenDesktop farms, feel free to add them now. Or you can add older XenApp farms. (don’t put spaces or periods in the farm name) Click Next when done.
  14. In the Remote Access page, don’t check the box and click Next. You can set this up later.
  15. In the Authentication Methods page, check the boxes next to Domain pass-through and Pass-through from NetScaler Gateway. Click Next.
  16. In the XenApp Services URL page, click Create.
  17. In the Created Successfully page, click Finish.

SSL Certificate

StoreFront requires SSL. You will save yourself much heartache if you install valid, trusted certificates. There are two options for StoreFront SSL.

  • SSL Offload: Use NetScaler to do SSL Offload and load balancing. In this scenario, install the SSL certificate on the load balancer. You can leave the StoreFront servers listening on HTTP and no IIS server certificate. The SSL certificate on the NetScaler must match the DNS name that resolves to the load balancing VIP.
  • SSL End-to-end: Install an SSL certificate on each StoreFront server and bind to IIS. This allows you to use SSL protocol between the load balancer and the StoreFront servers.

If your load balancer cannot terminate SSL, then the StoreFront IIS certificate must match the DNS name that resolves to the load balancing VIP.

For load balancers that can terminate SSL (e.g. NetScaler), the StoreFront IIS server certificate should match the StoreFront server name. If StoreFront is installed on the Delivery Controllers, with server-specific certificates you can later enable HTTPS in the StoreFront Store Delivery Controller configuration.

Another option is to create an SSL certificate with Subject Alternative Names for the load balanced DNS name and each of the StoreFront server FQDNs. Then import this one certificate on all StoreFront servers. Or a wildcard certificate could match all of these names.

In either case, be aware that Email-based discovery in Citrix Receiver requires the certificate to not only match the StoreFront load balanced DNS name but the certificate must also match discoverReceiver.email.suffix for every email domain. Usually the only option to match multiple email domains is with Subject Alternative Names. If you have multiple email suffixes then you will need multiple Subject Alternative Names, each beginning with discoverReceiver. If you don’t plan on implementing email-based discovery, then you don’t have to worry about these discoverReceiver Subject Alternative Names.

If the certificate does not match discoverReceiver.email.suffix, then users will see this message when attempting to use email discovery in Citrix Receiver.

When adding Subject Alternative Names to a certificate, the first Subject Alternative Name should be the same as the Load Balancing FQDN. The remaining Subject Alternative Names should be discoverReceiver.email.suffix for every email domain.

When you view a Subject Alternative Name certificate, on the Details tab, click Subject Alternative Name to verify that all names are listed, including the DNS name that resolves to the load balancing VIP.

There are several methods of creating a certificate for StoreFront.

  • If you are implementing Single FQDN for internal and external users, then the certificate for external NetScaler Gateway can also be used for internal StoreFront. Note: Single FQDN has additional Subject Alternative Name certificate requirements including: Internal Beacon FQDN and Callback FQDN.
  • If you will support non-domain-joined machines (e.g. iPads, thin clients) connecting to your internal StoreFront, then the StoreFront certificate should be signed by a public Certificate Authority. You can use IIS to request the certificate. You can then export the certificate from IIS and import it to NetScaler (for Load Balancing and NetScaler Gateway). Public Certificate Authorities (e.g. GoDaddy, Digicert, etc.) let you enter additional Subject Alternative Names when you purchase the certificate.

  • If all internal machines are domain-joined, then you can use an internal Certificate Authority to create the StoreFront certificate. The Certificates MMC snap-in can be used to create an internal certificate signed by a Microsoft Certificate Authority. The MMC method allows you to specify Subject Alternative Names.

Once the certificate is created or imported, you need to bind it to IIS:

  1. In IIS Manager, right-click the Default Web Site and click Edit Bindings.
  2. Click Add.
  3. Change the Type to https and select the SSL certificate. Click OK and then click Close.

Delivery Controllers – SSL

If SSL certificates are installed on the Delivery Controller servers, then you can configure the Store to use SSL when communicating with the Delivery Controllers.

  1. In the StoreFront Console, on the left click Stores.
  2. Right-click the store and click Manage Delivery Controllers.
  3. Highlight the deployment and click Edit.
  4. The Servers list must contain FQDNs that match the certificates installed on those servers.
  5. Change the Transport type to HTTPS.
  6. Click OK twice.

Socket Pooling

Socket pooling is disabled by default in stores. When socket pooling is enabled, StoreFront maintains a pool of sockets, rather than creating a socket each time one is needed and returning it to the operating system when the connection is closed. Enabling socket pooling enhances performance, particularly for Secure Sockets Layer (SSL) connections. To enable socket pooling:

  1. On the left, click the Stores node.
  2. Right-click the store and click Configure Store Settings.
  3. On the Advanced Settings page, check the box for Enable socket pooling.

HOSTS File

Edit the HOSTS file (C:\Windows\System32\Drivers\Etc\HOSTS) on each StoreFront server with the following entries:

  • StoreFront Load Balancing FQDN (e.g. storefront.corp.com) = Load Balancing VIP in the local datacenter.
  • NetScaler Gateway Callback FQDN (e.g. callback.corp.com) = NetScaler Gateway VIP in the local datacenter.

Base URL – Change

  1. Configure load balancing of the StoreFront servers, including SSL certificate.
  2. In the Citrix StoreFront console, right-click Server Group and click Change Base URL.
  3. Enter the StoreFront Load Balancing FQDN as the new Base URL in https://storefront.corp.com format. Note: Receiver requires that the Base URL is https. It won’t accept http. Click OK.
    Note: if you want the StoreFront Base URL to be the same as your Gateway FQDN, then see the Single FQDN instructions.

If the Base URL is https but you don’t have certificates installed on your StoreFront servers (aka SSL Offload) then you’ll need to do the following:

  1. On the left click the Stores node.
  2. Right-click the store and click Manage Receiver for Web Sites.
  3. Click Configure.
  4. On the Advanced Settings page, change Enable loopback communication to OnUsingHttp. Click OK and then click Close.

Default Web Page

After changing the Base URL you’ll need to update the IIS Default Website.

  1. On the left, right-click Stores and click Set Default Website.
  2. Check the box next to Set a Receiver for Web site as the default page in IIS and click OK.
  3. Click Yes to overwrite.
  4. If you go to C:\inetpub\wwwroot and edit the file web.config, you’ll see the redirect.

Authentication Configuration

  1. In the Citrix StoreFront console, on the left, click the Stores node.
  2. Right-click the store and click Manage Authentication Methods.
  3. Check the boxes next to Domain pass-through and Pass-through from NetScaler Gateway.
  4. If you intend to enable pass-through authentication from Receiver Self-Service or from Receiver for Web, go to a XenDesktop Controller and run the command
    Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $True from a Windows PowerShell command prompt.
    In XenApp 6.5, this is a Citrix Policy > Computer > Trust XML Requests.
  5. Click one of the gear icons and then click Configure Trusted Domains.
  6. Select Trusted domains only, click Add, and enter the domain names in DNS format. The DNS suffix is needed if doing userPrincipalName authentication from NetScaler Gateway.
  7. Select one of the domains as the default.
  8. If desired, check the box next to Show domains list in logon page. Click OK.
  9. Click one of the gear icons and then click Manage Password Options.
  10. Make your selection and click OK twice to close Manage Authentication Methods.

  11. Be careful with password changes. Any time somebody changes their password through StoreFront, a profile will be created for that user on the StoreFront server. Use a tool like delpro2.exe to periodically delete these local profiles.
  12. If StoreFront is not in the same domain (or trusted domain) as the users, then you can configure StoreFront 3.5 to push authentication to the Delivery Controllers. See XML service-based authentication at docs.citrix.com. Note: StoreFront must still be a member of domain but the particular domain doesn’t matter.

Citrix Online

  1. StoreFront might be configured to add the Citrix Online icons. To remove them, on the left click the Stores node.
  2. Right-click the store and click Configure Store Settings.
  3. On the Citrix Online Integration page, uncheck all three boxes and click OK.

Receiver for HTML5

  1. On the left click the Stores node.
  2. Right-click the store and click Manage Receiver for Web Sites.
  3. Click Configure.
  4. On the Deploy Citrix Receiver page, change the drop-down to Use Receiver for HTML5 if local Receiver is unavailable.
  5. By default, the HTML5 session opens in a new tab. You can optionally enable Launch applications in the same tab as Receiver for Web. See Configure Citrix Receiver for HTML5 use of browser tabs at docs.citrix.com for more information.
  6. Click OK and then click Close.
  7. To see the installed version of HTML5 Receiver, click the Stores node on the left. In the middle pane, in the bottom half, switch to the Receiver for Web Sites tab.

Citrix Receivers

  1. On the left click the Stores node. Right-click the store and click Manage Receiver for Web Sites.
  2. Click Configure.
  3. On the Deploy Citrix Receiver page, check the box next to Allow users to download HDX engine (plug in).
  4. Change both source drop-downs to Local files on the StoreFront server.
  5. Click both Browse buttons and browse to the downloaded Receiver for Windows 4.4 and the Receiver for Mac 12.1.100.
  6. You can optionally enable Upgrade plug-in at logon.
  7. Click OK when done and Close when done.
  8. When users connect to Receiver for Web, they will be prompted to install or upgrade. Note: this only applies to Receiver for Web. Receiver Self-Service will not receive this prompt.

Receiver for Web Timeout

  1. On the left click the Stores node. Right-click the store and click Manage Receiver for Web Sites.
  2. Click Configure.
  3. On the Session Settings page, set the Session timeout as desired and click OK.
  4. If you are using a NetScaler, you will need to change the Global Session Timeout located at NetScaler Gateway => Global Settings => Change Global Settings => Client Experience => Session Time-out (mins). I changed mine to 720, there is a screenshot below for you to reference:

Receiver for Web Pass-through Authentication

  1. On the left click the Stores node. Right-click the store and click Manage Receiver for Web Sites.
  2. Click Configure.
  3. On the Authentication Methods page, if desired, check the box next to Domain pass-through. Click OK.
  4. If the StoreFront URL is in the browser’s Local Intranet zone, then you’ll see a prompt to automatically Log On. This only appears once.

Unified Receiver Experience

If you did a clean install of StoreFront 3.5 then the newer UI will already be enabled. If you upgraded from a StoreFront 2.6 or older then you can disable the Classic UI.

  1. On the left click the Stores node. Right-click the store and click Manage Receiver for Web Sites.
  2. Click Configure.
  3. On the Receiver Experience page, select Disable classic experience. Click OK and click Close.
  4. On the left, click Stores. Right-click the store and click Configure Unified Experience.
  5. Check the box next to Set the unified Receiver experience as the default for this store and click OK.

Customize Receiver Appearance

If the Unified Receiver appearance is enabled, you can go to Stores > Manage Receiver for Web Sites > Configure > Customize Appearance to change logos and colors. Additional customization can be performed using the SDK.

You can also Manage Featured App Groups.

These Featured App Groups are displayed at the top of the Apps > All page.

By default, Featured App Groups are displayed with continual horizontal scrolling. This is OK if you have several Featured App Groups but doesn’t look right if you only have one Featured App Group.

Michael Bednarek has posted some code at Citrix Discussions to disable the continuous horizontal scrolling.

Default Tab

  1. By default, when a user logs in to StoreFront, the Favorites tab is selected. Users can go to other tabs to add icons to the list of Favorites.



  2. You can completely remove the Favorites tab by going to Stores > Configure Store Settings > User Subscriptions and choose Disable User Subscriptions (Mandatory Store).

  3. You can change the default tab and tab visibility by going to the Stores > Manage Receiver for Web Sites > Configure > Client Interface Settings page.
  4. When publishing applications in Studio, specify a Category so the applications are organized into folders.

Beacons

  1. On the left, right-click Stores and click Manage Beacons.
  2. Configure an Internal Beacon. Receiver Self-Service tries to connect to the Internal Beacon to determine if Receiver is currently internal or not. If the Internal Beacon is reachable then Receiver Self-Service assumes it is internal and thus connects to the StoreFront Base URL. If the Internal Beacon is not reachable then Receiver Self-Service assumes it is external and thus connects to NetScaler Gateway. For this to work properly, the Internal Beacon must not be resolvable externally.
    If you are not doing Single FQDN then the Internal Beacon can be the StoreFront FQDN since the StoreFront FQDN is usually only available internally.
    If you are doing Single FQDN then you can’t use the StoreFront FQDN. Instead, you must use a different internal website for the beacon. If you need to support internal iPads, due to differences in how iPads determine location, the Internal Beacon should be a new FQDN that resolves to the StoreFront Load Balancing VIP thus requiring the StoreFront certificate to match both the Internal Beacon and the Base URL. If internal iPads are not needed, then the Internal Beacon can be any internal website.
    If you want to force internal Receiver Self-Service users to connect through NetScaler Gateway (for AppFlow reporting), you can set the Internal Beacon to a fake URL. Since the Internal Beacon is never resolvable, Receiver Self-Service always uses NetScaler Gateway. Or you can use Optimal Gateway to achieve the same goal.
  3. The External beacons are used by Receiver Self-Service to determine if the Receiver Self-Service has Internet access or not. You can use any reliable Internet DNS name. Click OK when done.

Propagate Changes

Any time you make a change on one StoreFront server, you must propagate the changes to the other StoreFront server.

  1. In the StoreFront console, on the left, right-click Server Group and click Propagate Changes.
  2. You might see a message saying that you made changes on the wrong server.
  3. Click Yes when asked to propagate changes.
  4. Click OK when done.
  5. When you propagate changes, the default web page is not replicated to the other nodes. Copy C:\inetpub\wwwroot\web.config manually to each node.

Export/Import StoreFront Configuration

Use the following PowerShell cmdlets to export StoreFront Configuration into a .zip file (encryption optional) and import to a different StoreFront server group:

  • Export-STFConfiguration
  • Import-STFConfiguration

See Citrix Blog Post Announcing StoreFront 3.5 for details.

Auto-Favorite

To force a published application to be favorited (subscribed), use one of the following keywords in the published application description:

  • KEYWORDS: Auto = the application is automatically subscribed. But users can remove the favorite.
  • KEYWORDS: Mandatory = the application is automatically subscribed and users cannot remove the favorite.

With Mandatory applications there is no option to remove the application from Favorites.

Related Pages

↧
↧

Delivery Controller 7.8

February 25, 2016, 3:40 pm
$
0
0

Navigation

Preparation

Citrix Licensing – If you are going to use an existing Citrix Licensing Server, upgrade it to 11.13.1.2 build 16002.

SQL Database

  • Citrix blog post – Database Sizing Tool for XenDesktop 7
  • Citrix article CTX114501 – Supported Databases for Citrix Products
  • Citrix recommends SQL Mirroring because it has the fastest failover.
    • SQL Mirroring requires two SQL Standard Edition servers and one SQL Express for the witness server.
    • If you try to stretch the mirror across datacenters, the SQL witness must be placed in a third datacenter that has connectivity to the other two datacenters. However, stretching a single XenApp/XenDesktop site/farm and corresponding SQL mirror across datacenters is not recommended.
    • To setup SQL Mirroring, see Adam Shattuck: XenDesktop 7.6 – enterprise level setup guide (SQL server setups)
  • AlwaysOn Availability Groups and SQL Clustering are also supported. However, these features require the much more expensive SQL Enterprise Edition.
  • If you want Studio to create the SQL databases automatically, then the person running Studio must be a sysadmin on the SQL instances. No lesser role will work. As an alternative, you can use Studio to create SQL scripts and then run those scripts on the SQL server. In that case you only need the dbcreator and securityadmin roles.
  • It is possible to create the databases in advance. However, you must use the non-default Latin1_General_CI_AS_KS collation. After creating the database, mirror it. Then use Citrix Studio to configure the database tables.
  • There are typically three databases: one for the site (aka farm), one for Logging (audit log) and one for Monitoring (Director, and formerly known as EdgeSight). Create all three databases in advance and mirror them.
  • The monitoring database name must not have any spaces in it. See CTX200325 – Database Naming Limitation when Citrix Director Accesses Monitoring Data Using OData APIs

Windows Features

  • Installing Group Policy Management on the Delivery Controller lets you edit GPOs and have access to the Citrix Policies node in the GPO Editor. Or you can install Studio on a different machine that has GPMC installed.
  • vSphere Web Client – if you will connect to vSphere Web Client from the Controller machine, Flash Player is only available for IE if you install the Desktop Experience feature. Or you can use Google Chrome.

vSphere

  • Create a role in vSphere Client. Assign a service account to the role at the Datacenter or higher level.

Delivery Controller Install

  1. To setup SQL Mirroring, see Adam Shattuck: XenDesktop 7.6 – enterprise level setup guide (SQL server setups)
  2. A typical size for the Controller VMs is 2-4 vCPU and 8 GB of RAM.
  3. On two Delivery Controllers, install the Delivery Controller software from the XenApp/XenDesktop 7.8 media. Download it from XenApp Enterprise, XenApp Platinum, XenDesktop Enterprise, or XenDesktop Platinum, depending on your license. Go to the downloaded XenDesktop 7.8 ISO and run AutoSelect.exe.
  4. Click Start next to either XenApp or XenDesktop. The only difference is the product name displayed in the installation wizard.
  5. On the left, click Delivery Controller.
  6. You can install all components on one server or on separate servers. Splitting them out is only necessary in large environments or if you want to share the components (e.g. Licensing, StoreFront, Director) across multiple farms.
  7. In the Features page, uncheck the box next to Install Microsoft SQL Server 2012 SP1 Express and click Next.
  8. In the Summary page, click Install.
  9. In the Installation Successful page, click Finish. Studio will automatically launch.
  10. Ensure the two Controller VMs do not run on the same hypervisor host. Create an anti-affinity rule.

Create Site

There are several methods of creating the databases for XenApp/XenDesktop:

  • If you have sysadmin permissions to SQL, let Citrix Studio create the databases automatically.
  • If you don’t have sysadmin permissions to SQL then use Citrix Studio to generate SQL scripts and send them to a DBA.

Database Mirroring

If you are not using database mirroring then skip to the next section.

Citrix CTX127359 – How to Configure XenDesktop for SQL Database Mirroring: To configure a XenDesktop site for use with a mirrored SQL Server database, complete the following steps:

  1. Create an empty database on the principal with the Latin1_General_CI_AS_KS collation sequence.
  2. Configure the mirror and witness to start mirroring. For more information, see: http://technet.microsoft.com/en-us/library/ms189047.aspx.
  3. Use Citrix Studio in one of the following two ways:
    1. Create the database automatically; mirroring is detected without user intervention.
    2. Create the database manually; two scripts are generated: one to be executed on the principal and one to be executed on the mirror. If you are executing the scripts using SQL Server Management Studio, enable the SQLCMD mode before executing the scripts. After executing the scripts, test the database connection by clicking Test connection and continue through the remainder of the wizard.

To verify mirroring after the wizard has completed, run the PowerShell cmdlet get-configdbconnection and ensure that the Failover Partner has been set in the connection string to the mirror.

Use Studio to Create Database Scripts

  1. Launch Citrix Studio. After it loads, click Deliver applications and desktops to your users.
  2. In the Introduction page, select An empty, unconfigured site. This reduces the number of pages in this Setup wizard. The other pages will be configured later.
  3. Enter a Site Name (aka farm name) and click Next. Only administrators see the farm name.
  4. In the Databases page, change the selection to Generate scripts to manually set up databases on the database server.
  5. Change the database names if desired.
  6. If you are building two Controllers, click Select near the bottom of the same page.
  7. Click Add.
  8. Enter the FQDN of the second Controller and click OK. Note: the Delivery Controller software must already be installed on that machine.
  9. Then click Save.
  10. If you hover your mouse over 2 selected, it will show both Controllers. Click Next.
  11. In the Additional Features page, click Next.
  12. In the Summary page, click Generate scripts.
  13. A folder will open with six scripts. Edit each of the scripts.
  14. Near the top of each script are two lines to create the database. Uncomment both lines (including the go line). Then save and close the file.

  15. Once all of the scripts are edited you can send them to your DBA.
  16. On the Principal SQL Server, open the file Site_Principal.sql.

  17. Open the Query menu and click SQLCMD Mode.
  18. Then execute the script.
  19. If SQLCMD mode was enabled properly then the output should look something like this:
  20. If you have a mirrored database, run the second script on the mirror SQL instance. Make sure SQLCMD mode is enabled.


  21. Repeat for the Logging_Pricipal.sql script.
  22. You’ll have to enable SQLCMD Mode for each script you open.


  23. Repeat for the Monitoring_Principal.sql script.
  24. Once again enable SQLCMD Mode.


  25. The person running Citrix Studio must be added to the SQL Server as a SQL Login and granted the public server role.

  26. Back in Citrix Studio, click the Continue database configuration and Site setup button.
  27. In the Database page, enter the SQL server name and instance name and click Next.

  28. On the Licensing page, enter the name of the Citrix License Server and click Connect. . If you installed Licensing with your Delivery Controller, then simply enter localhost.
  29. XenApp/XenDesktop 7.8 requires the newest Licensing Server. If your server isn’t compatible, leave it set to localhost and fix it later.
  30. If the Certificate Authentication appears, select Connect me and click Confirm.
  31. Then select your license and click Next.
  32. In the Additional Features page, click Next.
  33. In the Summary page, make your selection for Customer Experience Improvement Program and click Finish.
  34. It will take some time for the site to be created.

Verify Database Mirroring

If your database is mirrored, when you run get-brokerdbconnection, you’ll see the Failover Partner in the database connection string.

Second Controller

When building the first Delivery Controller the scripts might have already included the second Delivery Controller. Thus no special SQL permissions are needed. If the second Delivery Controller has not already been added to the SQL databases then there are several methods of adding a second Controller to the databases for XenApp/XenDesktop:

  • If you have sysadmin permissions to SQL, let Citrix Studio modify the databases automatically.
  • If you don’t have sysadmin permissions to SQL then do use Citrix Studio to generate SQL scripts and send them to a DBA.

To use Citrix Studio to create the SQL Scripts:

  1. On the first Delivery Controller, if StoreFront is installed, delete the default StoreFront store (/Citrix/Store) and recreate it with your desired Store name (e.g. /Citrix/CompanyStore).
  2. On the 2nd Delivery Controller, install XenDesktop as detailed earlier.
  3. After running Studio, click Connect this Delivery Controller to an existing Site.
  4. Enter the name of the first Delivery Controller and click OK.
  5. If you don’t have elevated SQL permissions, click No when asked if you want to update the database automatically.
  6. Click Generate scripts.
  7. A folder will open with six scripts. If not mirroring, then the top three scripts need to be sent to a DBA. If mirroring, send all six.
  8. On the SQL Server, open open one of the .sql files.

  9. Open the Query menu and click SQLCMD Mode.
  10. Then execute the XenDesktop script.
  11. If SQLCMD mode was enabled properly then the output should look something like this:
  12. Back in Citrix Studio, click OK.
  13. In the Studio, under Configuration > Controllers, you should see both controllers.
  14. You can also test the site again if desired.

Studio – Slow Launch

From B.J.M. Groenhout at Citrix Discussions: The following adjustments can be made if Desktop Studio (and other Citrix management Consoles) will start slowly:

  • Within Internet Explorer, go to Tools – Internet Options – Tab Advanced – Section Security and uncheck the option Check for publisher’s certificate revocation

After adjustment Desktop Studio (MMC) will be started immediately. Without adjustment it may take some time before Desktop Studio (MMC) is started.

Registry setting (can be deployed using Group Policy Preferences):

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
    • “State“=dword:00023e00

Database Maintenance

View Logging Database

To view the contents of the Logging Database, in Studio, click the Logging node. On the right is Create Custom Report. See Citrix article CTX138132 Viewing Configuration Logging Data Not Shown for more info.

Enable Read-Committed Snapshot

The XenDesktop Database can become heavily utilized under load in a large environment. Therefore Citrix recommends enabling the Read_Committed_Snapshot option on the XenDesktop databases to remove contention on the database from read queries. This can improve the interactivity of Studio and Director. It should be noted that this option may increase the load on the tempdb files. See Citrix article CTX137161 How to Enable Read-Committed Snapshot in XenDesktop for configuration instructions.

Change Database Connection Strings

Sometimes the database connection strings need to be modified:

  • When moving the SQL databases to a different SQL server
  • When enabling mirroring after the databases have already been configured in Studio.

CTX140319 How to Migrate XenDesktop Database to New SQL Server has the correctly ordered list of PowerShell commands to change the database connection strings. Make sure PowerShell is running as administrator before running these commands.

Step 5 assumes Site, Monitoring, and Logging are one database so you’ll need to adjust the commands if those databases are split. In particular, change $cs in Set-LogDBConnection -DataStore Logging -DBConnection $cs to the Logging database. And change $cs in Set-MonitorDBConnection -DataStore Monitor -DBConnection $cs to the Monitoring database. The other commands don’t need to be changed.

Director Grooming

If XenDesktop is not Platinum Edition then all historical Director data is groomed at 7 days.

For XenDesktop/XenApp Platinum Edition, by default, most of the historical Director data is groomed at 90 days. This can be adjusted up to 367 days by running a PowerShell cmdlet.

  1. On a Delivery Controller, run PowerShell and run asnp Citrix.*

  2. Run Get-MonitorConfiguration to see the current grooming settings.
  3. Run Set-MonitorConfiguration to change the grooming settings.

Studio Administrators

Full Administrators

  1. In the Studio, under Configuration, click the Administrators node. The first time you access the node you’ll see a Welcome page. Feel free to check the box and then click Close.
  2. On the Administrators tab, right-click and click Create Administrator.
  3. In the Administrator and Scope page, specify a group (e.g. Citrix Admins or Help Desk) that will have permissions to Studio and Director. Click Next.
  4. On the Role page, select a role and then click Next. For example:
    • Full Administrator for the Citrix Admins group
    • Help Desk Administrator for the Help Desk group
    • Machine Catalog Administrator for the desktop team
  5. In the Summary page, click Finish.

Help Desk

  1. In the Studio, under Configuration, click the Administrators node. On the Administrators tab, right-click and click Create Administrator.
  2. In the Administrator and Scope page, specify a Help Desk group that will have permissions to Studio and Director. Click Next.
  3. On the Role page, select the Help Desk Administrator role and then click Next.
  4. In the Summary page, click Finish.
  5. When administrators in the Help Desk role log into Director, all they see is this.

    To jazz it up a little, add the Help Desk group to the read-only role.
  6. Right-click the Help Desk Administrator and click Edit Administrator.
  7. Click Add.
  8. In the Scope page, select a scope and click Next.
  9. In the Role page, select Read Only Administrator and click Next.
  10. In the Summary page, click Finish.
  11. Then click OK. Now Director will display the dashboard.

Provisioning Services w/Personal vDisk

From Considerations: Provisioning Services at Configure and manage Personal vDisk at docs.citrix.com: The Provisioning Services Soap Service account must be added to the Administrator node of Studio and must have the Machine Administrator or higher role. This ensures that the PvD desktops are put into the Preparing state when the Provisioning Services (PVS) vDisk is promoted to production.

vCenter Connection

XenDesktop uses an Active Directory service account to log into vCenter. This account needs specific permissions in vCenter. To facilitate assigning these permissions, create a new vCenter role and assign it to the XenDesktop service account. The permissions should be applied at the datacenter or higher level.

Hosting Resources

A Hosting Resource = vCenter + Cluster (Resource Pool) + Storage + Network. When you create a machine catalog, you select a previously defined Hosting Resource, and the Cluster, Storage, and Network defined in the Hosting Resource object are automatically selected. If you need some desktops on a different Cluster+Storage+Network then you’ll need to define more Hosting Resources in Studio.

  1. In Studio, expand Configuration and click Hosting. Right-click it and click Add Connection and Resources.
  2. In the Connection page, select VMware vSphere as the Connection type.
  3. Enter https://vcenter01.corp.local/sdk as the vCenter URL. The URL must contain the FQDN of the vCenter server. Ensure the entered URL has /sdk on the end.
  4. Enter credentials of a service account that can log into vCenter.
  5. In the Connection name field, give the connection a name. Typically, this matches the name of the vCenter server.
  6. If you are not using Machine Creation Services and instead only need the vCenter connection for machine power management, change the Create virtual machines using selection to Other Tools.
  7. Click Next.
  8. If you see a message about the vCenter certificate, check the box next to Trust certificate and click OK.
  9. Enter a name for the hosting resource. Since each hosting resource is a combination of vCenter, Cluster, Network, and Datastore, include those names in this field (e.g. vCenter01-Cluster01-Network01-Datastore01).
  10. In the Cluster page, click Browse and select a cluster or resource pool.
  11. Select a network and click Next.
  12. On the Storage page, select a datastore for the virtual machines. Maximum flexibility is achievable if you only select one datastore per hosting resource. Create additional hosting resources for each datastore.
  13. If desired, change the selection for personal vDisk to use a different storage. Click Next.
  14. In the Summary page, click Finish.

Citrix Licensing Server

Upgrade

Upgrade Citrix Licensing to 11.13.1.2. 💡

  1. Go to the downloaded Citrix Licensing 11.13.1.2 build 16002 and run CitrixLicensing.exe.
  2. Click Upgrade.
  3. Click Finish.
  4. If you go to Programs and Features, it should now show version 11.1.0.16002.
  5. If you login to the license server web console, on the Administration tab, it shows it as version 11.13.1 build 16002.
  6. You can also view the version in the registry at HKLM\Software\Wow6432Node\Citrix\LicenseServer\Install.

Licensing Server HA using GSLB

From Dane Young – Creating a Bulletproof Citrix Licensing Server Infrastructure using NetScaler Global Server Load Balancing (GSLB) and CtxLicChk.ps1 PowerShell Scripts. Here is a summary of the configuration steps. See the blog post for detailed configuration instructions.

  1. Build two License Servers in each datacenter with identical server names. Since server names are identical, they can’t be domain-joined.
  2. Install identical licenses on all License Servers.
  3. Set the DisableStrictNameChecking registry key on all Citrix Licensing servers.
  4. Synchronize the certificate files located at C:\Program Files (x86)\Citrix\Licensing\WebServicesForLicensing\Apache\conf. They must be identical on all Licensing Servers.
  5. Download CtxLicChk.exe from http://support.citrix.com/article/CTX123935 and place on all Licensing Servers.
  6. Schedule the PowerShell script CtxLicChk.ps1 on all Licensing Servers. Get this script from the blog post linked above.
  7. Configure NetScaler:
    1. Configure GSLB ADNS services.
    2. Add wildcard Load Balancing service for each Citrix Licensing Server.
    3. Configure service TCP monitoring for ports 27000, 7279, 8082, and 8083.
    4. Create Load Balancing Virtual Server for each Licensing Server.
    5. Set one Load Balancing Virtual Server as backup for the other.
    6. Repeat in second datacenter.
    7. Configure GSLB Services and GSLB Monitoring.
    8. Configure GSLB Virtual Servers. Set one GSLB Virtual Server as backup for the other.
  8. Delegate the Citrix Licensing DNS name to the ADNS services on the NetScaler appliances.
  9. Configure Citrix Studio to point to the GSLB-enabled DNS name for Citrix Licensing.

Citrix License Server Monitoring

http://www.jonathanmedd.net/2011/01/monitor-citrix-license-usage-with-powershell.html.

Lal Mohan – Citrix License Usage Monitoring Using Powershell

Jaroslaw Sobel – Monitoring Citrix Licenses usage – Graphs using WMI, Powershell and RRDtool. This script generates a graph similar to the following:

CtxLicUsage-1d_

Remote Desktop Licensing Server

Install Remote Desktop Licensing Server

Do the following on your XenDesktop Controllers:

  1. In Server Manager, open the Manage menu and click Add Roles and Features.
  2. Click Next until you get to the Server Roles page. Check the box next to Remote Desktop Services and click Next.
  3. Click Next until you get to the Role Services page. Check the box next to Remote Desktop Licensing and click Next.
  4. Click Add Features if prompted.
  5. Then finish the wizard to install the role service.

Activate Remote Desktop Licensing

  1. After RD Licensing is installed, in Server Manager, open the Tool menu, expand Terminal Services and click Remote Desktop Licensing Manager.
  2. The tool should find the local server. If it does not, right-click All servers, click Connect and type in the name of the local server. Once the local server can be seen in the list, right-click the server and click Activate Server.
  3. In the Welcome to the Activate Server Wizard page, click Next.
  4. In the Connection Method page, click Next.
  5. In the Company Information page, enter the required information and click Next.
  6. All of the fields on the Company Information page are optional so you do not have to enter anything. Click Next.
  7. In the Completing the Activate Server Wizard page, uncheck the box next to Start Install Licenses Wizard now and click Finish. Since the session hosts will be configured to pull Per User licenses, there is no need to install licenses on the RD Licensing Server.
  8. In RD Licensing Manager, right-click the server and click Review Configuration.
  9. Ensure you have green check marks. If the person installing Remote Desktop Licensing does not have permissions to add the server to the Terminal Server License Servers group in Active Directory, ask a domain admin to do it manually. If you have the proper permissions, click Add to Group.
  10. Click Continue when prompted that you must have Domain Admins privileges.
  11. Click OK when prompted that the computer account has been added.
  12. Click OK to close the window.

Health Check

Andrew Morgan – New Free Tool: Citrix Director Notification Service: The Citrix Director Notification service sits on an edge server as a service (or local to the delivery controller) and periodically checks the health of:

  • Citrix Licensing.
  • Database Connections.
  • Broker Service.
  • Core Services.
  • Hypervisor Connections.

And if any of these items fall out of bounds, an SMTP alert is sent to the mailbox of your choice for action. The tool will also send “All Clear” emails when these items are resolved, ensuring you are aware when the service has resumed a healthy state.

Related Pages

↧

Director 7.8

February 25, 2016, 4:10 pm
$
0
0

Navigation

Director on Standalone Server

If you are installing Director 7.8 on a standalone server, see Citrix CTX142260 Installing or Upgrading to Citrix Director 7.6.200

  1. If you intend to install Director on a standalone server, start with running AutoSelect.exe from the XenApp/XenDesktop 7.8 media.
  2. On the right, click Citrix Director.
  3. It will ask you for the location of one Controller in the farm. Then finish the installation wizard.
  4. In IIS Manager, go to Default Web Site > Director > Application Settings, find Service.AutoDiscoveryAddresses and make sure it points to a Controller and not to localhost.

  5. If you built multiple Director servers, then use NetScaler to load balance them.

Director Single Sign-on

You can configure Director 7.8 to support Integrated Windows Authentication (Single Sign-on). Note: there seem to be issues when not connecting from the local machine or when connecting through a load balancer.

  1. Run IIS Manager. You can launch it from Server Manager (Tools menu) or from the Start Menu or by running inetmgr.
  2. On the left, expand Sites, expand Default Web Site, and click Director.
  3. In the middle, double-click Authentication in the IIS section. 
  4. Right-click Windows Authentication and Enable it.
  5. Right-click Anonymous Authentication and Disable it.
  6. Pass-through auth won’t work from another computer until you set the http SPN for the Director server. See Director 7.7 Windows Authentication not working with NS LB at discussions.citrix.com.
  7. If Director is not installed on a Controller then you’ll need to configure Kerberos delegation.
  8. If you are load balancing Director then additional config is required. See Director 7.7 Windows Authentication not working with NS LB at discussions.citrix.com for more info.
    1. Create an AD service account that will be used as the Director’s ApplicationPoolIdentity.
    2. Create SPN and link it to the service account. 
      setspn -S http/loadbalanced_URL domain\user
    3. Trust the user account for delegation to any service (Kerberos only) (trust the Director servers for delegation is not necessary in this case). You have to create the SPN before you can do this step.
    4. In IIS manager, on the Application Pools (Director), specify the Identity as user we have created in step 1.
    5. In IIS manager, select Default Web Site and open the Configuration Editor.
    6. Use the drop-down to navigate to the following section:
      system.webServer/security/authentication/windowsAuthentication
    7. Set useAppPoolCredentials = True and useKernelMode = False. Click Apply on the top right.

  9. When you connect to Director you will be automatically logged in. You can change the login account by first logging off.
  10. Then change the drop-down to User credentials.

Director – Multiple XenDesktop Sites

  1. Run IIS Manager. You can launch it from Server Manager (Tools menu) or from the Start Menu or by running inetmgr.
  2. On the left, expand Sites, expand Default Web Site, and click Director.
  3. In the middle pane, double-click Application Settings.
  4. Find the entry for Service.AutoDiscoveryAddresses and double-click it.
  5. If Director is installed on a Controller, localhost should already be entered.
  6. Add a comma and the NetBIOS name of one of the controllers in the 2nd XenDesktop Site (farm). Only enter one Controller name. If you have multiple Director servers, you can point each Director server to a different Controller in the 2nd XenDesktop Site (farm).
  7. According to Citrix CTX200543 Desktop Director Access Fails After XenDesktop 7.5 is Upgraded to 7.6, the addresses should be NetBIOS names, not FQDN. Click OK.

Director Alerts and Notifications

Director 7.8 supports alert conditions and email notifications. This feature requires XenApp/XenDesktop to be licensed with Platinum Edition. See Citrix Blog Post Configuring & Managing Alerts and Notifications Using Director for more information.

  1. While logged into Director, at the top of the page click the Alerts button.
  2. Switch to the Email Server Configuration tab.
  3. Enter your SMTP information and click Send Test Message. Then click Save.

  4. Switch to the Citrix Alerts Policy tab.
  5. There are three high-level categories of alerts: Site Policy, Delivery Group Policy, and Server OS Policy. Click whichever one you want to configure.
  6. Then click Create.
  7. Give the alert a name.
  8. On the bottom left, select a condition and enter thresholds.
  9. On the bottom right, in the Notifications preferences section, click Add.
  10. Enter an email address and click Add.
  11. Click Save when done. Feel free to create more alerts and notifications.
  12. Citrix has an experimental Desktop Notification Tool. See Citrix Blog Post Desktop Notification Tool For Citrix XenDesktop. 💡
    ablogpic2

Director – SCOM Integration

Director 7.8 can display alerts from System Center Operations Manager 2012 R2. This feature requires XenApp/XenDesktop Platinum Edition.

  1. See Configure SCOM integration at docs.citrix.com for detailed configuration instructions. Also see Marius Sandbu Integrating Citrix XenDesktop 7.7 and System Center Operations Manager.
  2. If Director server or System Center Operations Manager server is 2008 R2, then login to the 2008 R2 server, open PowerShell and run Enable-PSRemoting. Yes to everything. This is not needed on Windows Server 2012 R2 servers.
  3. On Director 7.8 server, run C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /configscom
  4. FYI, the DirectorConfig.exe /configscom command enables the following features on the Director server: /FeatureName:IIS-NetFxExtensibility45 /FeatureName:IIS-ASPNET45 /FeatureName:WCF-HTTP-Activation45
  5. FYI, the System Center Operations Manager server is listed in IIS Manager at Default Web Site > Director > Application Settings (middle pane) > Connector.SCOM.ManagementServer.
  6. On the System Center Operations Manager server, edit Remote Management Users local group and add Citrix Admins and other Director users.
  7. In System Center Operations Manager Console, go to Administration > User Roles and edit Operations Manager Operators. Add the Citrix Admins and other Director users.
  8. See Citrix Blog Post SCOM Alerts in Citrix Director for information on how to view System Center Operations Manager alerts in Director.

Director Tweaks

Prepopulate the domain field

From http://www.xenblog.dk/?p=33: On the Controllers having the Director role installed, locate and edit the ‘LogOn.aspx’ file. By default you can find it at “C:\inetpub\wwwroot\Director\Logon.aspx”

In line 450 you will have the following. To find the line, search for ID=”Domain”. Note: onblur and onfocus attributes were added in newer versions of Director.

<asp:TextBox ID="Domain" runat="server" CssClass="text-box" onfocus="showIndicator(this);" onblur="hideIndicator(this);"></asp:TextBox>

In the ID=”Domain” element, insert a Text attribute and set it to your domain name. Don’t change or add any other attributes. Save the file.

<asp:TextBox ID="Domain" runat="server" Text="Corp" CssClass="text-box" onfocus="showIndicator(this);" onblur="hideIndicator(this);"></asp:TextBox>

This will prepopulate the domain field text box with your domain name and still allow the user to change it, if that should be required. Note: this only seems to work if Single Sign-on is disabled.

Session timeout

By default the idle time session limit of the Director is 245 min. If you wish to change the timeout, here is how to do it.

  1. Log on to the Director Server as an administrator
  2. Open the ‘IIS Manager’
  3. Browse to ‘SitesDefault Web SiteDirector’ in the left hand pane.
  4. Open ‘Session State’ in the right hand pane
  5. Change the ‘Time-out (in minutes)’ value under ‘Cookie Settings’
  6. Click ‘Apply’ in the Actions list

SSL Check

From http://www.shaunritchie.co.uk/citrix-desktop-director-2-1: If you are not securing Director with an SSL certificate you will get this error at the logon screen.

To stop this:

  1. Log on to the Director Server as an administrator
  2. Open the ‘IIS Manager’
  3. Browse to ‘SitesDefault Web SiteDirector’ in the left hand pane.
  4. Open ‘Application Settings’ in the right hand pane
  5. Set EnableSslCheck to false.

Disable Activity Manager

From Disable the visibility of running applications in the Activity Manager in Advanced Configuration at docs.citrix.com: By default, the Activity Manager in Director displays a list of all the running applications and the Windows description in the title bars of any open applications for the user’s session. This information can be viewed by all administrators that have access to the Activity Manager feature in Director. For Delegated Administrator roles, this includes Full administrator, Delivery Group administrator, and Help Desk Administrator.

To protect the privacy of users and the applications they are running, you can disable the Applications tab from listing running applications.

  • On the VDA, modify the registry key located at HKLM\Software\Citrix\Director\TaskManagerDataDisplayed. By default, the key is set to 1. Change the value to 0, which means the information will not be displayed in the Activity Manager.
  • On the server with Director installed, modify the setting that controls the visibility of running applications. By default, the value is true, which allows visibility of running applications in the Applications Change the value to false, which disables visibility. This option affects only the Activity Manager in Director, not the VDA. Modify the value of the following setting:
    UI.TaskManager.EnableApplications = false

Large Active Directory

From CTX133013 Desktop Director User Account Search Process is Slow or Fails: By default, all the Global Catalogs for the Active Directory Forest are searched using Lightweight Directory Access Protocol (LDAP). In a large Active Directory environment, this query can take some time or even time out.

  1. In Information Server (IIS) Management, under the Desktop Director site, select Application Settings and add a new value called ActiveDirectory.ForestSearch. Set it to False. This disables searching any domain except the user’s domain and the server’s domain.
  2. To search more domains, add the searchable domain or domains in the ActiveDirectory.Domains field.

Site Groups

From Citrix Blog Post Citrix Director 7.6 Deep-Dive Part 4: Troubleshooting Machines:

If there are a large number of machines, the Director administrator can now configure site groups to perform machine search so that they can narrow down searching for the machine inside a site group. The site groups can be created on the Director server by running the configuration tool via command line by running the command:

C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /createsitegroups

Then provide a site group name and IP address of the delivery controller of the site to create the site group.

Director – Saved Filters

From Scott Osborne and Jarian Gibson at Citrix Discussions: In Director, you can create a filter and save it.

The saved filter is then accessible from the Filters menu structure.

The saved filters are stored on each Director server at C:\Inetpub\wwwroot\Director\UserData. Observations:

  • Each user has their own saved filters.
  • The saved filters are not replicated across Director servers. You can schedule a robocopy script to do this automatically.
  • When upgrading Director, the saved filters are deleted?

Director – Custom and Scheduled Reports

The Monitoring database contains more data than is exposed in Director. To view this data, the Monitoring service has an OData Data Feed that can be queried.

You can use Excel to pull data from the OData Data feed. See Citrix Blog Post – Citrix Director – Analyzing the Monitoring Data by Means of Custom Reports. This particular blog post shows how to use an Excel PivotChart to display the connected Receiver versions.

Or for Linqpad, see Citrix Blog Post – Creating Director Custom reports for Monitoring XenDesktop using Linqpad

Go to Citrix Blog Post Obtain XenDesktop Custom report through Citrix Director and download the tool. Once installed you can create custom reports from within Director.

↧

Virtual Delivery Agent (VDA) 7.8

February 25, 2016, 7:11 pm
$
0
0

Navigation

💡 = Recently Updated

Hardware

  1. If vSphere 6, don’t use hardware version 11 unless you have NVIDIA GRID. VMware 2109650 – Video playback performance issue with hardware version 11 VMs in 2D mode
  2. For virtual desktops, give the virtual machine: 2+ vCPU and 2+ GB of RAM
  3. For Windows 2008 R2 RDSH, give the virtual machine 4 vCPU and 12-24 GB of RAM
  4. For Windows 2012 R2 RDSH, give the virtual machine 8 vCPU, and 24-48 GB of RAM
  5. Remove the floppy drive
  6. Remove any serial or LPT ports
  7. If vSphere:
    1. To reduce disk space, reserve memory. Memory reservations reduce or eliminate the virtual machine .vswp file.
    2. The NIC should be VMXNET3.
  8. If this VDA will boot from Provisioning Services:
    1. Give the VDA extra RAM for caching.
    2. Do not enable Memory Hot Plug
    3. For vSphere, the NIC must be VMXNET3.
    4. For vSphere, configure the CD-ROM to boot from IDE instead of SATA. SATA comes with VM hardware version 10. SATA won’t work with PvS.
  9. Install the latest version of drivers (e.g. VMware Tools).
    1. If Windows 7 on vSphere, don’t install the VMware SVGA driver. For more details, see CTX201804 Intermittent Connection Failures/Black Screen Issues When Connecting from Multi-Monitor Client Machines to Windows 7 VDA with VDA 7.x on vSphere/ESXi.  💡

If vSphere, disable NIC Hotplug

  1. Users could use the systray icon to Eject the Ethernet Controller. Obviously this is bad.
  2. To disable this functionality, power off the virtual machine.
  3. Once powered off, right-click the virtual machine and click Edit Settings.
  4. On the VM Options tab, expand Advanced and then click Edit Configuration.
  5. Click Add Row.
  6. On the left, enter devices.hotplug. On the right, enter false.
  7. Then click OK a couple times to close the windows.
  8. The VM can then be powered on.

Windows Preparation

  1. If RDSH, disable IE Enhanced Security Config
  2. Optionally, go to Action Center (Windows 8.1 or 2012 R2) or Security and Maintenance (Windows 10) to disable User Account Control and enable SmartScreen .
  3. Run Windows Update.
  4. If Windows Firewall is enabled:
    1. Enable File Sharing so you can access the VDA remotely using SMB
    2. Enable COM+ Network Access and the three Remote Event Log rules so you can remotely manage the VDA.

  5. Add your Citrix Administrators group to the local Administrators group on the VDA.
  6. The Remote Desktop Services “Prompt for Password” policy prevents Single Sign-on to the Virtual Delivery Agent. Check registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services. If fPromptForPassword = 1 then you need to fix group policy. The following GPO setting will prevent Single Sign-on from working.
    Computer Configuration Policies Administrative templates Windows Components Remotes Desktop Services Remote desktop Session Host Security Always prompt for password upon connection
    Or set the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\PorticaAutoLogon (DWORD) = 0x10.
  7. For Windows 7 VDAs that will use Personal vDisk, install Microsoft hotfix 2614892 – A computer stops responding because of a deadlock situation in the Mountmgr.sys driver. This hotfix solved a Personal vDisk Image update issue detailed at Citrix Discussions.
  8. If this VDA is Windows Server 2008 R2, request and install the Windows hotfixes recommended by Citrix CTX129229. Scroll down to see the list of recommended Microsoft hotfixes for Windows Server 2008 R2. Ignore the XenApp 6.x portions of the article. Also see http://www.carlstalhood.com/windows-server-2008-r2-post-sp1-hotfixes/.
  9. To remove the built-in apps in Windows 10, see Robin Hobo How to remove built-in apps in Windows 10 Enterprise.
  10. For Remote Assistance in Citrix Director, configure the GPO setting Computer Configuration | Policies | Administrative Templates | System | Remote Assistance | Offer Remote Assistance. See Jason Samuel – How to setup Citrix Director Shadowing with Remote Assistance using Group Policy for more details.

Install Virtual Delivery Agent 7.8

  1. For virtual desktops, make sure you are logged into the console. The VDA won’t install if you are connected using RDP.
  2. Make sure 8.3 file name generation is not disabled. If so, see CTX131995 User Cannot Launch Application in Seamless Mode to fix the AppInit_DLLs registry keys.
  3. Make sure .NET Framework 4.5.1 is installed.
  4. Go to the downloaded XenDesktop 7.8 (XenDesktop Platinum, XenDesktop Enterprise, XenApp Platinum, or XenApp Enterprise) .iso file and run AutoSelect.exe. Alternatively, you can download the standalone VDA package and run that instead.
  5. Click Start next to either XenApp or XenDesktop. The only difference is the product name displayed in the installation wizard.
  6. Click Virtual Delivery Agent for Windows Desktop OS or Windows Server OS depending on which type of VDA you are building.
  7. In the Environment page, select Create a Master Image and click Next.
  8. For virtual desktops, in the HDX 3D Pro page, click Next.
  9. In the Core Components page, if you don’t need Citrix Receiver installed on your VDA then uncheck the box. Click Next.
  10. In the Delivery Controller page, select Do it manually. Enter the FQDN of each Controller. Click Test connection. And then make sure you click Add. Click Next when done.
  11. In the Features page, click Next. If this is a virtual desktop, you can leave Personal vDisk unchecked now and enable it later.
  12. In the Firewall page, click Next.
  13. In the Summary page, click Install.
  14. For RDSH, click Close when you are prompted to restart.
  15. After the machine reboots twice, login and installation will continue.
  16. After installation, click Finish to restart the machine again.
  17. If 8.3 file name generation is disabled, see CTX131995 User Cannot Launch Application in Seamless Mode to fix the AppInit_DLLs registry keys.

Controller Registration Port

Some environments will not accept the default port 80 for Virtual Delivery Agent registration. To change the port, do the following on the Virtual Delivery Agent:

  1. Open Programs and Features.
  2. Find Citrix Virtual Delivery Agent and click Change.
  3. Click Customize Virtual Delivery Agent Settings.
  4. Edit the Delivery Controllers and click Next.
  5. On the Configure Delivery Controller page, change the port number and click Next.
  6. In the Features page, click Next.
  7. In the Summary page, click Reconfigure.
  8. In the Finish Reconfiguration page, click Finish.
  9. You must also change the VDA registration port on the Controllers by running BrokerService.exe /VDAPort.

Controller Registration – Verify

  1. If you restart the Virtual Delivery Agent machine or restart the Citrix Desktop Service…
  2. In Windows Logs Application log, you should see an event 1012 from Citrix Desktop Service saying that it successfully registered with a controller. If you don’t see this then you’ll need to fix the ListOfDDCs registry key.

HTML5 App Switcher 2.0.2

This tool is only used by Receiver for HTML5.

  1. .NET Framework 4.0.3 or newer is required.
  2. Go to the downloaded Receiver for HTML5 App Switcher (Citrix_AppSwitcher_2.0.2) and run AppSwitcher.msi.
  3. Check the box next to I accept the terms and click Install.
  4. In the Completed the App Switcher Setup Wizard page, click Finish.

  5. In Programs and Features, it is shown as version 2.0.2.25.

Citrix PDF Printer 7.6.2

This tool is only used by Receiver for HTML5.

  1. Go to the downloaded Receiver for HTML5 Citrix PDF Printer 7.6.2 (Citrix_PDFPrinter_7.6.2) and run CitrixPDFPrinter64.msi.
  2. In the Please read the Citrix PDF printer License Agreement page, check the box next to I accept the terms and click Install.
  3. In the Completed the Citrix PDF Universal Driver Setup Wizard page, click Finish.
  4. In Programs and Features, it is shown as version 7.6.2.9.
  5. Configure a Citrix Policy to enable the PDF printer. The setting is called Auto-create PDF Universal Printer.

Framehawk Configuration

To enable Framehawk, see http://www.carlstalhood.com/citrix-policy-settings/#framehawkconfig

Remote Desktop Licensing Configuration

On 2012 R2 RDSH, the only way to configure Remote Desktop Licensing is using group policy (local or domain). This procedure also works for 2008 R2 RDSH. This procedure is not needed on virtual desktops.

  1. For local group policy, run gpedit.msc.
  2. Go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Licensing.
  3. Double-click Use the specified Remote Desktop license servers. Change it to Enabled and enter the names of the RDS Licensing Servers (typically installed on XenDesktop Controllers). Click OK.
  4. Double-click Set the Remote Desktop licensing mode. Change it to Enabled and select Per User. Click OK.
  5. In Server Manager, open the Tools menu, expand Terminal Services and click RD Licensing Diagnoser.
  6. The Diagnoser should find the license server and indicate the licensing mode. It’s OK if there are no licenses installed on the Remote Desktop License Server.

Several people in Citrix Discussions reported the following issue: If you see a message about RD Licensing Grace Period has expired even though RD Licensing is properly configured, see Eric Verdumen No remote Desktop Licence Server availible on RD Session Host server 2012. The solution was to delete the REG_BINARY in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\GracePeriod only leaving the default. You must take ownership and give admin users full control to be able to delete this value.

C: Drive Permissions

This section is more important for shared VDAs like Windows 2008 R2 and Windows 2012 R2.

The default permissions allow users to store files on the C: drive in places other than their profile.

  1. Open the Properties dialog box for C:.
  2. On the Security tab, click Advanced.
  3. Highlight the line containing Users and Create Folders and click Remove.
  4. Highlight the line containing Users and Special and click Remove. Click OK.
  5. Click Yes to confirm the permissions change.
  6. If you see any of these Error Applying Security windows, click Continue.
  7. Click OK to close the C: drive properties.

Pagefile

If this image will be converted to a Provisioning Services vDisk, then you must ensure the pagefile is smaller than the cache disk. For example, if you allocate 20 GB of RAM to your Remote Desktop Session Host, and if the cache disk is only 15 GB, then Windows will have a default pagefile size of 20 GB and Provisioning Services will be unable to move it to the cache disk. This causes Provisioning Services to cache to server instead of caching to your local cache disk (or RAM).

  1. Open System. In 2012 R2, you can right-click the Start button and click System.
  2. Click Advanced system settings.
  3. On the Advanced tab, click the top Settings button.
  4. On the Advanced tab, click Change.
  5. Either turn off the pagefile or set the pagefile to be smaller than the cache disk. Don’t leave it set to System managed size. Click OK several times.

Direct Access Users

When Citrix Virtual Delivery Agent is installed on a machine, non-administrators can no longer RDP to the machine. A new local group called Direct Access Users is created on each Virtual Delivery Agent. Add your non-administrator RDP users to this local group so they can RDP directly to the machine.

Windows Profiles v3/v4/v5

Roaming Profiles are compatible only between the following client and server operating system pairs. The profile version is also listed.

  • v5 = Windows 10 and Windows Server 2016
  • v4 = Windows 8.1 and Windows Server 2012 R2
  • v3 = Windows 8 and Windows Server 2012
  • v2 = Windows 7 and Windows Server 2008 R2
  • v2 = Windows Vista and Windows Server 2008

Windows 8.1 and 2012 R2 don’t properly set the profile version. To fix this, ensure update rollup 2887595 is installed. http://support.microsoft.com/kb/2890783. After you apply this update, you must create a registry key before you restart the computer.

  1. Run regedit.
  2. Locate and then tap or click the following registry subkey:
    HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\ProfSvc\Parameters
  3. On the Edit menu, point to New, and then tap or click DWORD Value.
  4. Type UseProfilePathExtensionVersion.
  5. Press and hold or right-click UseProfilePathExtensionVersion, and then tap or click Modify.
  6. In the Value data box, type 1, and then tap or click OK.
  7. Exit Registry Editor.

Then, Windows 8.1 creates a user profile and appends the suffix “.v4” to the profile folder name to differentiate it from version 2 of the profile in Windows 7 and version 3 of the profile in Windows 8.

Registry

HDX Flash

From Citrix Knowledgebase article CTX139939 – Microsoft Internet Explorer 11 – Citrix Known Issues: The registry key value IEBrowserMaximumMajorVersion is queried by the HDX Flash service to check for maximum Internet Explorer version that HDX Flash supports. For Flash Redirection to work with Internet Explorer 11 set the registry key value IEBrowserMaximumMajorVersion to 11 on the machine where HDX flash service is running. In case of XenDesktop it would be the machine where VDA is installed.

  • Key = HKLM\SOFTWARE\Wow6432Node\Citrix\HdxMediaStreamForFlash\Server\PseudoServer
    • Value = IEBrowserMaximumMajorVersion (DWORD) = 00000011 (Decimal)

From Citrix Discussions: Add the DWORD ‘FlashPlayerVersionComparisonMask=0′ on the VDA under HKLM\Software\Wow6432Node\Citrix\HdxMediaStreamForFlash\Server\PseudoServer.  This disables the Flash major version checking between the VDA and Client Device.

Published Explorer

This section applies if you intend to publish apps from this VDA.

From Citrix Knoweldgebase article CTX128009 – Explorer.exe Fails to Launch: When publishing the seamless explorer.exe application, the session initially begins to connect as expected. After the loading, the dialog box disappears and the explorer application fails to appear. On the VDA, use the following registry change to set the length of time a client session waits before disconnecting the session:

  • Key = HKLM\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI
    • Value = LogoffCheckerStartupDelayInSeconds (DWORD) = 10 (Hexadecimal)

Mfaphook – 8.3 File Names

  1. Open a command prompt.
  2. Switch to C:\ by running cd /d C:\
  3. Run dir /x program*
  4. If you don’t see PROGRA~1 then 8.3 is disabled. This will break Citrix.
  5. If 8.3 is disabled, open regedit and go to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows.
  6. On the right is AppInit_DLLs. Edit it and remove the path in front of MFAPHOOK64.DLL.


Login Timeout

XenDesktop by default only allows 90 seconds to complete a logon operation. The timeout can be increased by setting the following:

HKLM\SOFTWARE\Citrix\PortICA

Add a new DWORD AutoLogonTimeout and set the value to decimal 240.

More information at http://discussions.citrix.com/topic/350243-machines-in-registered-state-but-vm-closes-after-welcome-screen/.

Receiver for HTML5 Enhanced Clipboard

From About Citrix Receiver for Chrome 1.9 at docs.citrix.com: To enable enhanced clipboard support, set registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\Virtual Clipboard\Additional Formats\HTML Format\Name=”HTML Format”. Create any missing registry keys. This applies to both virtual desktops and Remote Desktop Session Hosts.

4K Monitors

Citrix CTX201696 – Citrix XenDesktop and XenApp – Support for Monitors Including 4K Resolution and Multi-monitors: Up to eight 4K monitors are supported with the Std-VDA and RDS VDA irrespective of underlying GPU support, provided the required policies and/or registry keys are correctly configured. Currently the Std-VDA for XenDesktop and RDS-VDA for XenApp does not support resolutions higher than 4094 in any dimension.

Framehawk currently does not support 4K monitors. At the time of writing, the number of monitors supported is 1, the use of more monitors will cause the graphics mode to change from Framehawk to Thinwire to support multi-monitor.  The maximum resolution supported by Framehawk is currently 2048×2048.

From CTX200257 – Screen Issues Connecting to 4K Resolution Monitors: Symptom: A blank or corrupt screen is displayed when connecting to Windows 7 or 8.1 Standard XenDesktop Virtual Delivery Agents on a client which has one or more 4K resolution monitors.

  1. Calculate the video memory that is required for 4K monitor using the following formula:
    Sum of total monitors (Width * height * 4 * X) where width and height are resolution of the monitor.
    X = 2 if VDA is Windows 7 OR X = 3 if VDA is Windows 88.1
    Suppose a Windows 7 VDA is connecting to a client that has dual 4K monitors (3840×2160), then video buffer should be: (3840 x 2160 x 4 x 2) + (3840 x 2160 x 4 x 2) = ~132MB
  2. Open the registry (regedit) and navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vd3v
  3. Increase the value of “MaxVideoMemoryBytes” REG_DWORD value to the above calculated memory.
  4. Reboot the VDA.

When using Thinwire, Compatibility, Thinwire Plus or Legacy modes, the Display memory Limit policy needs to be configured appropriately for Std-VDA, as per Graphics Policy Settings at docs.citrix.com. The Default value for Display memory Limit is 65536KB and this is sufficient up to 2x4K monitors (2x32400KB). You can find more information on Graphics modes at Citrix Blogs – Site Wide View of HDX Graphics Modes.

Legacy Client Drive Mapping

Citrix Knowledgebase article How to Enable Legacy Client Drive Mapping Format on XenApp: Citrix Client Drive Mapping no longer uses drive letters and instead they appear as local disks. This is similar to RDP drive mapping.

The old drive letter method can be enabled by setting the registry value:

  • Key = HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\UncLinks (create the key)
    • Value = UNCEnabled (DWORD) = 0

When you reconnect, the client drives will be mapped as drive letters (starts with V: and goes backwards).

COM/LPT Port Redirection

To signal Citrix’ intention to deprecate COM and LPT support in a future major release, policy settings for COM Port and LPT Port Redirection have moved from Studio to the registry, and are now located under HKLM\Software\Citrix\GroupPolicy\Defaults\Deprecated on either your Master VDA image or your physical VDA machines. The COM/LPT port registry values are detailed at docs.citrix.com.

Print Driver for Non-Windows Clients

This section applies to Windows 2012 R2, Windows 8.1, and Windows 10 VDAs.

From Mac Client Printer Mapping Fix for Windows 8/8.1 and Windows Server 2012/2012R2. By default, Non-Windows clients cannot map printers due to a missing print driver on the VDA machine.

  1. Requirements:
    • Internet Access
    • Windows Update service enabled
  2. Click Start and run Devices and Printers.
  3. In the Printers section, highlight a local printer (e.g. Microsoft XPS Document Writer). Then in the toolbar click Print server properties.
  4. Switch to the Drivers tab. Click Change Driver Settings.
  5. Then click Add.
  6. In the Welcome to the Add Printer Driver Wizard page, click Next.
  7. In the Processor Selection page, click Next.
  8. In the Printer Driver Selection page, click Windows Update. The driver we need won’t be in the list until you click this button. Internet access is required.
  9. Once Windows Update is complete, highlight HP on the left and then select HP Color LaserJet 2800 Series PS (Microsoft) on the right. Click Next.
  10. In the Completing the Add Printer Driver Wizard page, click Finish.
  11. Repeat these instructions to install the following additional drivers:
    • HP LaserJet Series II
    • HP Color LaserJet 4500 PCL 5

SSL for VDA

If you intend to use HTML5 Receiver internally, install certificates on the VDAs so the WebSockets (and ICA) connection will be encrypted. Internal HTML5 Receivers will not accept clear text WebSockets. External users don’t have this problem since they are SSL-proxied through NetScaler Gateway. Notes:

  • Each Virtual Delivery Agent needs a machine certificate that matches the machine name. This is feasible for a small number of persistent VDAs. For non-persistent VDAs, you’ll need some automatic means for creating machine certificates every time they reboot.
  • As detailed in the following procedure, use PowerShell on the Controller to enable SSL for the Delivery Group. This forces SSL for every VDA in the Delivery Group, which means every VDA in the Delivery Group must have SSL certificates installed.

The Citrix blog post How To Secure ICA Connections in XenApp and XenDesktop 7.6 using SSL has a method for automatically provisioning certificates for pooled virtual desktops by enabling certificate auto-enrollment and setting up a task that runs after the certificate has been enrolled. Unfortunately this does not work for Remote Desktop Session Host.

The following instructions can be found at Configure SSL on a VDA using the PowerShell script at docs.citrix.com.

  1. On the VDA machine, run mmc.exe.
  2. Add the Certificates snap-in.
  3. Point it to Local Computer.
  4. Request a certificate from your internal Certificate Authority. You can use either the Computer template or the Web Server template.
    You can also use group policy to enable Certificate Auto-Enrollment for the VDA computers.
  5. Browse to the XenApp/XenDesktop 7.8 ISO. In the Support\Tools\SslSupport folder, shift+right-click the Enable-VdaSSL.ps1 script and click Copy as path.
  6. Run PowerShell as administrator (elevated).
  7. Run the command Set-ExecutionPolicy unrestricted. Enter Y to approve.
  8. In the PowerShell prompt, type in an ampersand (&), and a space.
  9. Right-click the PowerShell prompt to paste in the path copied earlier.
  10. At the end of the path, type in -Enable
  11. If there’s only one certificate on this machine, press Enter.
  12. If there are multiple certificates, you’ll need to specify the thumprint of the certificate you want to use. Open the Certificates snap-in, open the properties of the machine certificate you want to use, and copy the Thumbprint from the Details tab.
    In the PowerShell prompt, at the end of the command, enter ‑CertificateThumbPrint, add a space, and type quotes (").
    Right-click the PowerShell prompt to paste the thumbprint.
    Type quotes (") at the end of the thumbprint. Then remove all spaces from the thumbprint. The thumbprint needs to be wrapped in quotes.
  13. If this VDA machine has a different service already listening on 443 (e.g. IIS), then the VDA needs to use a different port for SSL connections. At the end of the command in the PowerShell prompt, enter -SSLPort 444 or any other unused port.
  14. Press <Enter> to run the Enable-VdaSSL.ps1 script.
  15. Press <Y> twice to configure the ACLs and Firewall.
  16. You might have to reboot before the settings take effect.
  17. Login to a Controller and run PowerShell as Administrator (elevated).
  18. Run the command asnp Citrix.*
  19. Enter the command: 
    Get-BrokerAccessPolicyRule -DesktopGroupName '<delivery-group-name>' | Set-BrokerAccessPolicyRule ‑HdxSslEnabled $true

    where <delivery-group-name> is the name of the Delivery Group containing the VDAs.

  20. You can run Get-BrokerAccessPolicyRule -DesktopGroupName '<delivery-group-name>' to verify that HDX SSL is enabled.
  21. Also run the following command: 
    Set-BrokerSite –DnsResolutionEnabled $true

You should now be able to connect to the VDA using the HTML5 Receiver from internal machines.

Anonymous Accounts

If you intend to publish apps anonymously then follow this section.

  1. Anonymous accounts are created locally on the VDAs. When XenDesktop creates Anon accounts it gives them an idle time as specified at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\AnonymousUserIdleTime. The default is 10 minutes. Adjust as desired.
  2. You can pre-create the Anon accounts on the VDA by running “C:\Program Files\Citrix\ICAConfigTool\CreateAnonymousUsersApp.exe”. If you don’t run this tool then Virtual Delivery Agent will create them automatically when users log in.
  3. You can see the local Anon accounts by opening Computer Management, expanding System Tools, expand Local Users and Groups and clicking Users.
  4. If you open one of the accounts, on the Sessions tab, notice that idle timeout defaults to 10 minutes. Feel free to change it.

Group Policy for Anonymous Users

Since Anonymous users are local accounts on each Virtual Delivery Agent, domain-based GPOs will not apply. To work around this limitation, you’ll need to edit the local group policy on each Virtual Delivery Agent.

  1. On the Virtual Delivery Agent, run gpedit.exe.
  2. Open the File menu and click Add/Remove Snap-in.
  3. Highlight Group Policy Object Editor and click Add to move it to the right.
  4. In the Welcome to the Group Policy Wizard page, click Browse.
  5. On the Users tab, select Non-Administrators.
  6. Click Finish.
  7. Now you can configure group policy to lockdown sessions for anonymous users. Since this is a local group policy, you’ll need to repeat the group policy configuration on every Virtual Delivery Agent image. Also, Group Policy Preferences is not available in local group policy.

Antivirus

Install antivirus using your normal procedure. Instructions vary for each Antivirus product.

Microsoft’s virus scanning recommendations (e.g. exclude group policy files) – http://support.microsoft.com/kb/822158.

Citrix’s Recommended Antivirus Exclusions

Citrix CTX127030 Citrix Guidelines for Antivirus Software Configuration: Based on Citrix Consulting’s field experience, organizations might wish to consider configuring antivirus software on session hosts with the settings below.

  • Scan on write events or only when files are modified. It should be noted that this configuration is typically regarded as a high security risk by most antivirus vendors. In high-security environments, organizations should consider scanning on both read and write events to protect against threats that target memory, such as Conficker variants.
  • Scan local drives or disable network scanning. This assumes all remote locations, which might include file servers that host user profiles and redirected folders, are being monitored by antivirus and data integrity solutions.
  • Exclude the pagefile(s) from being scanned.
  • Exclude the Print Spooler directory from being scanned.
  • Remove any unnecessary antivirus related entries from the Run key (HKLM\Software\Microsoft\Windows\Current Version\Run).
  • If using the streamed user profile feature of Citrix Profile management, ensure the antivirus solution is configured to be aware of Hierarchical Storage Manager (HSM) drivers. For more information, refer to Profile Streaming and Enterprise Antivirus Products.

Symantec

Symantec links:

Non-persistent session hosts:

After you have installed the Symantec Endpoint Protection client and disabled Tamper Protection, open the registry editor on the base image.

  1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC.
  2. Create a new key named Virtualization.
  3. Under Virtualization, create a key of type DWORD named IsNPVDIClient and set it to a value of 1.

To configure the purge interval for offline non-persistent session host clients:

  1. In the Symantec Endpoint Protection Manager console, on the Admin page, click Domains.
  2. In the Domains tree, click the desired domain.
  3. Under Tasks, click Edit Domain Properties.
  4. On the Edit Domain Properties > General tab, check the Delete non-persistent VDI clients that have not connected for specified time checkbox and change the days value to the desired number. The Delete clients that have not connected for specified time option must be checked to access the option for offline non-persistent VDI clients.
  5. Click OK.

Make the following changes to the Communications Settings policy:

  1. Configure clients to download policies and content in Pull mode
  2. Disable the option to Learn applications that run on the client computers
  3. Set the Heartbeat Interval to no less than one hour
  4. Enable Download Randomization, set the Randomization window for 4 hours

Make the following changes to the Virus and Spyware Protection policy:

  1. Disable all scheduled scans
  2. Disable the option to “Allow startup scans to run when users log on” (This is disabled by default)
  3. Disable the option to “Run an ActiveScan when new definitions Arrive”

Avoid using features like application learning which send information to the SEPM and rely on client state to optimize traffic flow

Linked clones:

To configure Symantec Endpoint Protection to use Virtual Image Exception to bypass the scanning of base image files

  1. On the console, open the appropriate Virus and Spyware Protection policy.
  2. Under Advanced Options, click Miscellaneous.
  3. On the Virtual Images tab, check the options that you want to enable.
  4. Click OK

 

Trend Micro

Citrix CTX136680 – Slow Server Performance After Trend Micro Installation. Citrix session hosts experience slow response and performance more noticeable while users try to log in to the servers. At some point the performance of the servers is affected, resulting in issues with users logging on and requiring the server to be restarted. This issue is more noticeable on mid to large session host infrastructures.

Trend Micro has provided a registry fix for this type of issue. Create the following registry on all the affected servers. Add new DWORD Value as:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TmFilterParameters] “DisableCtProcCheck”=dword:00000001

Trend Micro Links:

Optimize Performance

VDA Optimizer

Installation of the VDA might have already done this but there’s no harm in doing it again. This tool is only available if you installed VDA in Master Image mode.

  1. On the master VDA, go to C:\Program Files\Citrix\PvsVm\TargetOSOptimizer and run TargetOSOptimizer.exe.
  2. Then click OK. Notice that it disables Windows Update.

RDSH

Citrix CTX131577 XenApp 6.x (Windows 2008 R2) – Optimization Guide is a document with several registry modifications that are supposed to improve server performance. Ignore the XenApp 6 content and instead focus on the Windows content.

Citrix CTX131995 User Cannot Launch Application in Seamless Mode in a Provisioning Services Server when XenApp Optimization Best Practices are Applied. Do not enable NtfsDisable8dot3NameCreation

Norskale has Windows 2008 R2 Remote Desktop and XenApp 6 Tuning Tips Update.

Windows 7

Microsoft has compiled a list of links to various optimization guides.

It’s a common practice to optimize a Windows 7 virtual machine (VM) template (or image) specifically for VDI use. Usually such customizations include the following.

  • Minimize the footprint, e.g. disable some features and services that are not required when the OS is used in “stateless” or “non-persistent” fashion. This is especially true for disk-intensive workloads since disk I/O is a common bottleneck for VDI deployment. (Especially if there are multiple VMs with the same I/O patterns that are timely aligned).
  • Lock down user interface (e.g. optimize for specific task workers).

With that said the certain practices are quite debatable and vary between actual real-world deployments. Exact choices whether to disable this or that particular component depend on customer requirements and VDI usage patterns. E.g. in personalized virtual desktop scenario there’s much less things to disable since the machine is not completely “stateless”. Some customers rely heavily on particular UI functions and other can relatively easily trade them off for the sake of performance or standardization (thus enhance supportability and potentially security). This is one of the primary reasons why Microsoft doesn’t publish any “VDI Tuning” guide officially.

Though there are a number of such papers and even tools published either by the community or third parties. This Wiki page is aimed to serve as a consolidated and comprehensive list of such resources.

Daniel Ruiz XenDesktop Windows 7 Optimization and GPO’s Settings –

Microsoft Whitepaper Performance Optimization Guidelines for Windows 7 Desktop Virtualization

Windows 8.1 / 10 / 2012 R2

Optimization Notes:

  • If this machine is provisioned using Provisioning Services, do not disable the Shadow Copy services.
  • Windows 8 detects VDI and automatically disables SuperFetch. No need to disable it yourself.
  • Windows 8 automatically disables RSS and TaskOffload if not supported by the NIC.

Seal and Shut Down

If this session host will be a master image in a Machine Creation Services or Provisioning Services catalog, after the master is fully prepared (including applications), do the following:

  1. Go to the properties of the C: drive and run Disk Cleanup.
  2. On the Tools tab, click Optimize to defrag the drive.
    `
  3. Run slmgr.vbs /dlv and make sure it is licensed with KMS and has at least one rearm remaining. It is no longer necessary to manually rearm licensing. XenDesktop will do it automatically.
  4. Run Delprof2 to clean up local profiles. Get it from http://helgeklein.com/download/.
  5. Machine Creation Services and Provisioning Services require DHCP.

Session hosts commonly have DHCP reservations.

  • Shut down the master image. You can now use Studio or Provisioning Services to create a catalog of linked clones.

Troubleshooting – Graphics

If Windows 7 on vSphere, don’t install the VMware SVGA driver. For more details, see CTX201804 Intermittent Connection Failures/Black Screen Issues When Connecting from Multi-Monitor Client Machines to Windows 7 VDA with VDA 7.x on vSphere/ESXi.

For an explanation of Citrix’s graphics policy settings, see A graphical deep dive into XenDesktop 7 and What’s new with HDX display in XenDesktop & XenApp 7.x?

Citrix Knowledgebase article CTX200370 – How to Determine HDX Display Mode: Use wmic or HDX Monitor as described in the article to determine which of the following display mode options is being used:

  • DCR (Desktop Composition Redirection)
  • H.264 / H.264 Compatibility Mode
  • Legacy Graphics Mode

Citrix Blog Post – Site Wide View of HDX Graphics Modes; PowerShell script to display graphics mode of currently connected sessions.

Citrix Blog post – Optimising the performance of HDX 3D Pro – Lessons from the field

From Citrix Tips – Black Screen Issues with 7.x VDA: Users would make a successful ICA connection but the screen would stay totally black.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vbdenum]

  • “Start”=dword:00000001
  • “MaxVideoMemoryBytes”=dword:06000000
  • “Group”= “EMS”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vd3d]

  • “MaxVideoMemoryBytes”=dword:00000000

From Citrix Knowledgebase article CTX200257 – Screen Issues Connecting to 4K Resolution Monitors in DCR Mode:

  1. Calculate the video memory that is required for 4K monitor using the following formula:
    Sum of total monitors (Width * height * 4 * X) where width and height are resolution of the monitor.
    X = 2 if VDA is Windows 7 OR X = 3 if VDA is Windows 88.110
    Example: Suppose a Windows 7 VDA is connecting to a client that has dual 4K monitors (3840×2160), then video buffer should be: (3840×160 x 4 x 2) + (3840 x 2160 x 4 x 2) = ~115MB
  2. Open the registry (regedit) and navigate to:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vd3d
  3. Increase the value of “MaxVideoMemoryBytes” REG_DWORD value to the above calculated memory.
  4. Reboot the VDA

From Citrix Discussions: To exclude applications from Citrix 3D rendering, create a REG_DWORD registry value “app.exe” with value 0 or a registry value “*” with value 0.

  • XD 7.1 and XD 7.5:
    • x86: reg add hklm\software\citrix\vd3d\compatibility /v * /t REG_DWORD /f /d 0
    • x64: reg add hklm\software\Wow6432Node\citrix\vd3d\compatibility /v * /t REG_DWORD /f /d 0
  • XD 7.6/7.7/7.8 both x86 and x64:
    • reg add hklm\software\citrix\vd3d\compatibility /v * /t REG_DWORD /f /d 0

Wildcards are not supported. The asterisk * here has a special meaning “all apps” but is not a traditional wildcard. To blacklist multiple apps e.g. both appa.exe and appb.exe must be done by creating a registry value for each app individually.

This is most problematic in Remote PC since most physical PCs have GPUs. I recently had to blacklist Internet Explorer to prevent lockup issues when switching back to physical.

Related Pages

↧
↧

StoreFront 3.5 Configuration for NetScaler Gateway

February 27, 2016, 5:24 am
$
0
0

Navigation

Contained on this page are the following topics:

StoreFront Config for Gateway

  1. See the NetScaler 10.5 page or NetScaler 11 page for instructions on configuring NetScaler Gateway for StoreFront.
  2. In the StoreFront Console, right-click the Store and click Manage Authentication Methods.
  3. Ensure Pass-through from NetScaler Gateway is selected and click OK.
  4. If you need the SmartAccess feature, then you need to configure StoreFront to perform an authentication callback to a NetScaler Gateway Virtual Server on the same appliance that authenticated the user.
    1. If you need SmartAccess and are doing Single FQDN then the Callback FQDN must be different than the Single FQDN.
    2. If you need SmartAccess and are doing different FQDNs for Gateway and StoreFront, then the Callback FQDN is usually the same as the Gateway FQDN.
    3. Make sure the StoreFront server can resolve the Callback FQDN to a Gateway VIP (with matching certificate). One option is to edit the C:\Windows\System32\drivers\etc\hosts file and add an entry for the Callback FQDN.
    4. After configuring the HOSTS file, on the StoreFront server, open a browser and navigate to the DNS name. Make sure the Gateway vServer logon page appears.
  5. In the StoreFront Console, right-click Stores and click Manage NetScaler Gateways.
  6. Click Add.
  7. In the General Settings page, enter a display name. This name appears in Citrix Receiver so make it descriptive.
  8. Enter the NetScaler Gateway Public URL. This can be a GSLB-enabled DNS name. Click Next.

  9. In the Secure Ticket Authority page, click Add.
  10. Enter the URL to a XenDesktop Controller. This can be http or https.
  11. Continue adding Secure Ticket Authorities (XenDesktop Controllers). Whatever Secure Ticket Authorities you add here must also be added to the NetScaler Gateway Virtual Server on the NetScaler appliance. Click Next.
  12. In the Authentication Settings page, if you have multiple Gateways (on separate appliance pairs) connecting to one StoreFront server then then you’ll need to enter the vServer IP address (VIP) of the NetScaler Gateway Virtual Server so StoreFront can differentiate one NetScaler Gateway from another. If there’s only one Gateway communicating with this StoreFront server group, then leave the VServer IP address field empty.
  13. If you need SmartAccess, then enter the Callback URL.
    • The Callback URL must resolve to any NetScaler Gateway VIP on the same appliance that authenticated the user. For multi-datacenter, edit the HOSTS file on the StoreFront server so it resolves to NetScaler appliances in the same datacenter.
    • The Callback URL Gateway Virtual Server must have a trusted and valid (matches the FQDN) certificate.
    • The Callback URL Gateway Virtual Server must not have client certificates set to Mandatory.
  14. If you don’t need SmartAccess then leave the Callback URL field empty.
  15. If you enabled two-factor authentication (LDAP and RADIUS) on your NetScaler, change the Logon type to Domain and security token. Otherwise leave it set to Domain only.
  16. Click Create.
  17. Then click Finish.
  18. Right-click a store and click Configure Remote Access Settings.
  19. Check the box next to Enable Remote Access.
  20. Leave it set to No VPN tunnel.
  21. Check the box next to the NetScaler Gateway object you just created and then click OK.
  22. Then in the StoreFront console, right-click Server Group and click Propagate Changes.

Single FQDN

Docs.citrix.com – Create a single Fully Qualified Domain Name (FQDN) to access a store internally and externally

Traditionally Receiver required separate FQDNs for StoreFront Load Balancing (internal) and NetScaler Gateway (external). Recently Citrix made some code changes to accept a single FQDN for both. This assumes that external users resolve the Single FQDN to a NetScaler Gateway VIP and internal users resolve the same FQDN to StoreFront Load Balancing VIP.

Single FQDN has the following requirements:

  • Receiver for Windows 4.2 or newer
  • Receiver for Mac 11.9 or newer
  • StoreFront 2.6 or newer
  • Split DNS – different DNS resolution for internal vs external
  • NetScaler 10.1 or newer

This section assumes NetScaler Gateway is in ICA Proxy mode. Different instructions are needed for when ICA Proxy is off. See docs.citrix.com for more information.

If you don’t care about email-based discovery then the configuration of Single FQDN is fairly simple. Sample DNS names are used below. Make sure the certificates match the DNS names.

  1. Internal DNS name = the Single FQDN (e.g. storefront.corp.com). Resolves to internal Load Balancing VIP for StoreFront. Set the StoreFront Base URL to this address.
  2. External DNS name = the Single FQDN (e.g. storefront.corp.com). Resolves to public IP, which is NAT’d to NetScaler Gateway VIP on DMZ NetScaler. Set the NetScaler Gateway object in StoreFront to this FQDN.
  3. If you need SmartAccess, then the Callback URL = any DNS name (e.g. callback.corp.com) that resolves to a NetScaler Gateway VIP on the same DMZ NetScaler appliance that authenticated the user.
    • Callback is optional if you don’t need SmartAccess features.
    • The callback DNS name must be different than the Single FQDN.
    • Your external NetScaler Gateway certificate could match both the Single FQDN and the Callback FQDN. Or you can create separate NetScaler Gateway Virtual Servers on the same appliance with separate certificates that match these FQDNs.
  4. Internal Beacon = any internal website URL that is not externally accessible. You can’t use the Single FQDN as the Internal Beacon. Ideally, the Internal Beacon should be a new DNS name that resolves to the StoreFront Load Balancing VIP. However, this requires the StoreFront Load Balancing Virtual Server to have a certificate that matches both the Single FQDN and the Internal Beacon.
    • If are using Receiver for iOS internally then be aware that Receiver for iOS handles the Internal Beacon differently than Receiver for Windows. Receiver for iOS will append /Citrix/Store/discovery to the Internal Beacon and thus it only works if the Internal Beacon DNS name resolves to the StoreFront server. Since you can’t use the StoreFront Base URL as the Internal Beacon you’ll need a different DNS name that resolves to the StoreFront servers and matches the StoreFront certificate. Note: if you are not allowing internal iOS devices then this isn’t needed.
  5. Make sure the DMZ NetScaler resolves the Single FQDN to the internal StoreFront Load Balancing VIP. You typically add internal DNS servers to the NetScaler. Or you can create a local Address Record for the Single FQDN.
  6. In the NetScaler Gateway Session Profile, set the Web Interface Address and the Account Services Address to the Single FQDN.
  7. That’s all you need to implement Single FQDN. If you made changes to an existing StoreFront deployment, then you might have to remove accounts from Receiver and re-add the account.

If you need email-based discovery then here’s an example configuration for ICA Proxy NetScaler Gateway:

  • External DNS:
    • Storefront.corp.com resolves to public IP, which is NAT’d to NetScaler Gateway VIP on DMZ NetScaler.
    • If email-based discovery, SRV record for _citrixreceiver._tcp.email.suffix points to StoreFront.corp.com.
  • External publicly-signed certificate for NetScaler Gateway:
    • One option is wildcard for *.corp.com. Assumes email suffix is also corp.com.
    • Another option is the following Subject Alternative Names:
      • Storefront.corp.com
      • Callback.corp.com – for callback URL. Only accessed from internal.
        • Or you can create a separate Gateway vServer for callback with a separate certificate.
      • If email-based discovery, discoverReceiver.email.suffix
  • Internal DNS:
    • Storefront.corp.com resolves to Load Balancing VIP for StoreFront
    • Callback.corp.com – resolves to NetScaler Gateway VIP on DMZ NetScaler. For authentication callback.
    • For the internal beacon, FQDN of any internal web server. Make sure this name is not resolvable externally.
    • If email-based discovery, SRV record for _citrixreceiver._tcp.email.suffix points to StoreFront.corp.com.
  • Internal certificate for StoreFront Load Balancing: publicly-signed recommended, especially for mobile devices and thin clients. Also can use the external certificate.
    • One option is wildcard for *.corp.com. Assumes email suffix is also corp.com.
    • Another option is the following Subject Alternative Names:
      • Storefront.corp.com
      • If email-based discovery, discoverReceiver.email.suffix

StoreFront Configuration:

  • Base URL = https://storefront.corp.com
  • Internal beacon = https://InternalBeacon.corp.com. Or FQDN of internal web server. Make sure it’s not resolvable externally.
  • Gateway object:
    • Gateway URL = https://storefront.corp.com
    • Callback URL = https://Callback.corp.com

Receiver for Web session policy (basic mode or ICA Only is checked):

  • Policy expression = REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiver
  • Client Experience tab:
    • Home page = https://storefront.corp.com/Citrix/StoreWeb
    • Session Timeout = 60 minutes
    • Clientless Access = Off
    • Clientless Access URL Encoding = Clear
    • Clientless Access Persistent Cookie = Deny
    • Plug-in Type = Windows/Mac OS X
    • Single Sign-on to Web Applications = checked
  • Security tab:
    • Default authorization = ALLOW
  • Published Applications tab:
    • ICA Proxy = On
    • Web Interface address = https://storefront.corp.com/Citrix/StoreWeb
    • Web Interface Portal Mode = Normal
    • Single Sign-on Domain = Corp

Receiver Self-Service session policy (basic mode or ICA Only is checked):

      • Policy expression = REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver
      • Client Experience tab:
        • Session Timeout = 60 minutes
        • Clientless Access = Off
        • Clientless Access URL Encoding = Clear
        • Clientless Access Persistent Cookie = Deny
        • Plug-in Type = Java
      • Security tab:
        • Default authorization = ALLOW
      • Published Applications tab:
        • ICA Proxy = On
        • Web Interface address = https://storefront.corp.com
        • Web Interface Portal Mode = Normal
        • Single Sign-on Domain = Corp
        • Account Services address = https://storefront.corp.com

Multiple Datacenters / Farms

If you have StoreFront (and NetScaler Gateway) in multiple datacenters, GSLB is typically used for the initial user connection but GSLB doesn’t provide much control over which datacenter a user initially reaches. So the ultimate datacenter routing logic must be performed by StoreFront.

StoreFront chooses datacenters at the farm level. Thus StoreFront assumes that each datacenter has a separate XenApp/XenDesktop farm.

  • Citrix is beginning to add more zone-based features to support single farms stretched across datacenters, but this functionality is not yet fully realized. The current challenge with stretched farms is that SQL is in only one datacenter.

StoreFront can enumerate icons from multiple farms. If there are identical icons in multiple farms, then the icons can be aggregated so that only a single icon is displayed to the user. When the user clicks the icon, StoreFront then needs to select a datacenter (select a farm). This is typically done based on the user’s Active Directory group membership. Farms can be prioritized (active/passive). Or farms can be active/active load balanced.

After the datacenter (farm) is selected, Optimal Gateway directs the ICA connection through the NetScaler Gateway that is closest to the destination VDA. Optimal Gateway requires datacenter-specific DNS names for NetScaler Gateway.

There are two methods of configuring icon aggregation in StoreFront:

  • The StoreFront Console can do simple configurations – The console supports a single aggregation group and active/passive configurations for multiple Active Directory user groups. One Active Directory user group could have Farm A as active and Farm B as passive. A different Active Directory user group could have Farm B as active and Farm A as passive. This is also known as “Home Sites”
  • Complex configurations can be performed in XML files – For example, you can load balance connections across two identical farms (active/active). See Docs.citrix.com – Set up highly available multi-site store configurations

To configure icon aggregation using the StoreFront Console:

  1. In StoreFront Console, go to Stores, right-click your Store and click Manage Delivery Controllers.
  2. Add multiple farms. Typically, each datacenter is a separate farm.
  3. After adding multiple farms, the Configure button becomes available. Click it.
  4. If you are publishing identical resources from multiple farms, click the link to Aggregate resources.
  5. Select the farms with identical resources and click Aggregate. Click OK when done.
  6. Click Map users to controllers.
  7. If you want the same farm failover (active/passive) settings for everyone, then leave the User Groups page set to Everyone. Or if you intend to have different home sites for different users, add a user group that contains the users that will be homed to a particular datacenter. You can run this wizard multiple times to specify different home sites for different user groups. Click Next.
  8. In the Controllers page, click Add.
  9. Select the farms that these users will have access to and click OK.
  10. Use the up and down arrow buttons to put the active site on top. The lower priority sites will only be accessed if the primary site is down. You can run this wizard multiple times to specify different active sites for different users. Notice there is no Load Balancing across identical farms. Click Create.
  11. You can click Add to add more user mappings. If you add multiple user groups, you can assign different primary farms to each Active Directory group. This is how you configure “home sites”. Click OK twice when done.

Shaun Ritchie Citrix StoreFront High Availability and Aggregation – A dual site Active Active design has a sample multi-site configuration using XML Notepad and explains how to use the Primary and Secondary keywords to override farm priority order.

Citrix Blogs StoreFront Multi-Site Settings: Some Examples has example XML configurations for various multi-datacenter Load Balancing and failover scenarios.

When Citrix Receiver switches between StoreFront servers in multiple datacenters, it’s possible for each datacenter to be treated as a separate Receiver site. This can be prevented by doing the following. From Juan Zevallos at Citrix Discussions: To have multiple StoreFront deployments across a GSLB deployment, here are the StoreFront requirements:

  • Match the SRID – in StoreFront, if you use the same BaseURL in the 2 separate installations, then the SRID should end up being identical. If the BaseURL is changed after the initial setup, the SRID doesn’t change. The SRID can be safely edited in the \inetpub\wwwroot\Citrix\Roaming\web.config file. It will be replicated into the discovery servicerecord entry in the Store web.config which can be edited as well or refreshed from the admin console by going into Remote Access setup for the store and hitting OK. Make sure to propagate changes to other servers in the group.
  • Match the BaseURL
  • Match the Delivery Controller names under “Manage Delivery Controllers” – The XML brokers can be different, but the actual name of the Delivery Controller/Farm must be identical. Here’s the exact setting I’m referring to: https://citrix.sharefile.com/d/sa562ba140be4462b

If you are running XenApp / XenDesktop in multiple datacenters, you must design roaming profiles and home directories correctly.

Optimal Gateway

The Optimal Gateway feature lets you override the NetScaler Gateway used for ICA connections. Here are some scenarios where this would be useful:

  • Multi-site Load Balancing. If the icon selected by the user is published from XenApp/XenDesktop in Datacenter A, then you probably want the ICA connection to go through a NetScaler Gateway Virtual Server in Datacenter A. If the main DNS name for accessing NetScaler Gateway is GSLB load balanced across datacenters, then you need additional datacenter-specific DNS names so you can control which datacenter the ICA connection goes through. Note: Optimal Gateway is applied at the farm/site level or zone level (for stretched 7.7+ farms).
  • NetScaler Gateway for internal connections (AppFlow). If you want to force internal users to go through NetScaler Gateway so AppFlow data can be sent to Citrix Insight Center then you can do that using Optimal Gateway even if the user originally connected directly to the StoreFront server. See CTX200129 How to Force Connections through NetScaler Gateway Using Optimal Gateways Feature of StoreFront for more information.
  • The NetScaler Gateway Virtual Server requires user certificates. If ICA traffic goes through a NetScaler Gateway Virtual Server that requires user certificates (e.g. Smart Card), then each session launch will result in a PIN prompt. To prevent these extra prompts, build a separate NetScaler Gateway Virtual Server that doesn’t have user certificates as Mandatory. Use Optimal Gateway to force ICA connections through the other NetScaler Gateway Virtual Server. Note: SmartAccess Callback URL also cannot use a NetScaler Gateway Virtual Server where client certificates are set to Mandatory so the extra NetScaler Gateway Virtual Server would be useful for that scenario too.

Optimal Gateway can be configured in the StoreFront Console:

  1. Right-click Stores and click Manage NetScaler Gateways.
  2. Add more Gateways.
  3. When adding a Gateway, you can designate a Usage or role. The Gateway accessed through GSLB should be set to Authentication and HDX routing. The gateways for Optimal Routing should be set to HDX routing only.

  4. Go to Stores, right-click a store and click Configure Store Settings.
  5. Go to the Optimal HDX Routing page.
  6. Highlight one of the datacenter-specific Gateways and click Manage Delivery Controllers.
  7. Select the farms that are accessible through this gateway and click OK.
  8. Repeat for the other datacenter-specific Gateways. The Gateway for the GSLB-enabled DNS name doesn’t need any farms associated with it.
  9. If you only want the Gateways to be used for external users, check the boxes for External only. Otherwise the Gateway routing will be used for both internal and external connections.
  10. Another option for Optimal Gateway selection is zones. In XenApp/XenDesktop 7.7 and newer, you can stretch a farm across datacenters (zones) and use a different Gateway for each zone. Highlight a Gateway. Click Manage Zones and add the zone name. This assumes the zone name has also been specified in the Manage Delivery Controllers dialog box > Advanced Settings.
  11. Click OK when done.
  12. In summary, users will connect to the GSLB-enabled Gateway and login. After clicking an icon, HDX will be routed through one of the datacenter-specific Gateways based on the farm the icon was launched from.

Multiple Gateways (GSLB) to One StoreFront

This section applies to SmartAccess and the Callback URL. If you don’t need SmartAccess then skip this section.

The Callback URL must go to the same appliance that authenticated the user. If you have multiple appliance pairs communicating with a single StoreFront server, then StoreFront needs to identify which NetScaler appliance pair the request came from so it can perform a callback to that appliance pair.

If each of the NetScaler Gateways uses the same DNS name (GSLB), then you can’t use the DNS name to distinguish one appliance from the other. Instead, StoreFront can use the Gateway VIP to distinguish appliances so the callback goes to the correct appliance.

  1. Create datacenter-specific callback DNS names. For example: callbackprod.corp.com and callbackdr.corp.com.
  2. The datacenter-specific callback DNS name must match the certificate on the NetScaler Gateway Virtual Server. Here are some options to handle the certificate requirement:
    • On the main NetScaler Gateway Virtual Server, assign a wildcard certificate that matches both the GSLB name and the datacenter-specific callback name.
    • On the main NetScaler Gateway Virtual Server, assign an SSL certificate with Subject Alternative Names for both the GSLB name and the datacenter-specific callback name.
    • Create an additional NetScaler Gateway Virtual Server on the appliance. Bind a certificate that matches the datacenter-specific name.
  3. In the StoreFront console, create multiple NetScaler Gateway appliances, one for each datacenter.
  4. Give each of the gateway objects unique names.
  5. Enter the same NetScaler Gateway URL in all of the gateway appliances.
  6. In the VServer IP address field, enter the Gateway VIP for this particular appliance pair. StoreFront will use this VIP to distinguish one NetScaler appliance from another.
  7. The callback URL must be unique for each NetScaler appliance pair (e.g. callbackdr.corp.com). The callback URL must resolve to a NetScaler Gateway VIP on the same appliance pair that authenticated the user.
  8. Configure name resolution for the datacenter-specific callback DNS names. Either edit the HOSTS file on the StoreFront servers or add DNS records to your DNS servers.
  9. When enabling Remote Access on the store, select both Gateway appliances. Select one as the default appliance.

Related Pages

↧

StoreFront 3.5 Tweaks

February 28, 2016, 4:20 am
$
0
0

Navigation

Here is a collection of optional StoreFront configurations.

CRL Checking – Disable

When the StoreFront server checks certificate revocation for its locally signed files, a delay can occur before the StoreFront logon page is displayed.

  1. Run the following PowerShell commands: 
    Add-PSSnapin Citrix.DeliveryServices.Framework.Commands
Set-DSAssemblyVerification $false
  2. Run Notepad as administrator.
  3. Open the file C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet.config. You’ll need to change the bottom right selection to All Files.
  4. In the runtime element, add the <generatePublisherEvidence enabled="false" /> line as shown below:
  5. Save the file.
  6. Repeat for the 64-bit aspnet.config file located at C:\Windows\Microsoft.NET\Framework64\v4.0.30319.
  7. Another potential tweak to speed up StoreFront is to disable NetBIOS. Right-click the Start Menu and click Network Connections.
  8. Right-click the NIC and click Properties.
  9. Highlight Internet Protocol Version 4 and click Properties.
  10. Click Advanced.
  11. On the WINS tab, change the selection to Disable NetBIOS over TCP/IP and click OK twice and Close once.
  12. Repeat on the other StoreFront servers.

Receiver Shortcuts

You can use StoreFront to control placement of shortcuts on Receiver machines.

  1. Run Notepad elevated (as administrator).
  2. Edit the file C:\inetpub\wwwroot\Citrix\Roaming\web.config.
  3. Search for <account. Find the Store name in the name attribute.
  4. Scroll down to the first <properties> section located under <annotatedServices>.
  5. See Using StoreFront account settings to customize app shortcut locations at docs.citrix.com for a list of properties. Add the properties as detailed at docs.citrix.com. The properties should be added after the clear tag.
  6. Note: if subscriptions are enabled in StoreFront then only Favorites are added to the Start Menu and Desktop. If subscriptions are disabled then all applications are placed on the Start Menu or Desktop.
  7. Close and save the file.
  8. Then Propagate Changes.

PNAgent Authentication

Single Sign-on

From Configure authentication for XenApp Services URLs at docs.citrix.com: XenApp Services URLs support explicit, domain pass-through, and pass-through with smart card authentication. Explicit authentication is enabled by default. You can change the authentication method, but only one authentication method can be configured for each XenApp Services URL. To enable multiple authentication methods, create separate stores, each with a XenApp Services URL, for each authentication method. To change the authentication method for a XenApp Services URL, you run a Windows PowerShell script.

  1. On the primary StoreFront server in your deployment, use an account with local administrator permissions to start Windows PowerShell.
  2. At a command prompt, type the following command to configure the user authentication method for users accessing the store through the XenApp Services URL.
    & "C:\Program Files\Citrix\Receiver StoreFront\Scripts\EnablePnaForStore.ps1" –SiteId 1 -ResourcesVirtualPath /Citrix/Store –LogonMethod sson
  3. Propagate changes.

Remember my password

If you leave PNAgent authentication set to Prompt, you can enable the Remember my password box by doing the following:

  1. Run Notepad as Administrator and edit the file C:\inetpub\wwwroot\Citrix\Store\Views\PnaConfig\Config.aspx.
  2. Near line 74 is EnableSavePassword. Change it to true.
  3. When PNAgent connects, there should now be a Remember my password checkbox.

Hide Applications

You can hide all icons of a particular type (Applications, Desktops, Documents). Or you can hide icons with a specific keyword.

Go to Stores > MyStore > Configure Store Settings > Advanced Settings and look for the Filter options.

 

Once the ExcludeKeyword has been defined, add the keyword to a published application description and that application will no longer display in Receiver. This works for both Receiver for Web and Receiver Self-Service (non-browser).

Desktop Autolaunch

By default, if only a single desktop is published to the user, Receiver for Web will auto-launch it. You can change this behavior by going to Stores > MyStore > Manage Receiver for Web Sites > Configure > Client Interface Settings and uncheck the box next to Auto launch desktop.

Full Screen Desktop

Citrix CTX139762 How to Configure StoreFront to Start Published Desktops in Full Screen Mode: This article describes how to configure StoreFront to start published desktops in Full Screen Mode.

  1. Open the file C:\inetpub\wwwroot\Citrix\Store\App_Data\default.ica on the StoreFront server(s) with notepad (as Administrator)
  2. Add the line: 
    [Application]
DesktopViewer-ForceFullScreenStartup=On
  3. In older versions of StoreFront, it should be true instead of On.
  4. Save the file.
  5. Open the command prompt (cmd) and run iisreset.

Autolaunch Application

See the script.js code posted by Michael Bednarek at discussions.citrix.com.

Store for Anonymous

If you intend to publish applications to anonymous users then you can create a StoreFront store that does not require authentication. Note: anonymous stores only work internally (no NetScaler Gateway).

  1. On the VDAs, create and configure anonymous accounts.
  2. In Citrix Studio, configure a Delivery Group to accept unauthenticated (anonymous) users.
  3. In the StoreFront Console, right-click Stores and click Create Store.
  4. In the Store Name and Access page, enter a new store name.
  5. Check the box next to Allow only unauthenticated users to access this store.
  6. Then click Next and finish the wizard like normal.
  7. Anonymous stores are hidden by default. When performing discovery in Receiver you’ll need to enter the full path to the store (e.g. https://storefront.corp.com/Citrix/Anon/discovery).

Workspace Control

Workspace Control is configurable for both Receiver for Web and for Receiver Self-Service.

Receiver for Web

Go to Stores > MyStore > Manage Receiver for Web Sites > Configure > Workspace Control page.

 

Receiver Self-Service

Citrix Blog Post – How to Disable Workspace Control Reconnect: For Receiver for Windows, workspace control can be managed on client devices by modifying the registry. Please see this Knowledgebase Article for how to implement it. This can also be done for domain-joined client devices using Group Policy.

In StoreFront Console, go to Stores > MyStore > Configure Store Settings > Advanced Settings and there’s a setting for Allow session reconnect.

 

Treat Desktops as Applications

From Treating All Desktops as Applications at Citrix Blog Post What’s New in StoreFront 3.0: Desktops are treated differently from applications in StoreFront/Receivers. They are placed in a separate Desktop tab and in the case of Receiver for Web, they are not reconnected with workspace control. In some use cases, it is desirable to treat desktops as applications so that they are placed together with applications and get reconnected as part of workspace control. With StoreFront 2.x, you have to add the TreatAsApp keyword to all published desktops to achieve this effect. StoreFront 3.0 enables you to configure treating all desktops as applications at the store level without the need of adding the TreatAsApp keyword to all the published desktops. This is configurable using a PowerShell cmdlet.

& "C:\Program Files\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"

Set-EnhancedEnumerationOptions -siteId 1 -storeVirtualPath /Citrix/Store `
-treatDesktopsAsApps $true

Special Folder Redirection

From Configure special folder redirection at docs.citrix.com: With Special Folder Redirection configured, users can map Windows special folders for the server to those on their local computers. Special folders refer to standard Windows folders, such as \Documents and \Desktop.

In StoreFront Console, go to Stores > Configure Store Settings > Advanced Settings and there’s an option for Allow special folder redirection.

Receiver Self-service – Disable “Remember My Password”

By default, when Receiver Self-Service connects internally to StoreFront, the user is able to check the box next to Remember my password. Note: When connecting through NetScaler Gateway, this checkbox is never available.

This can be disabled by making a change on the StoreFront server. This procedure is documented by John Ashman at Citrix Discussions and Prevent Citrix Receiver for Windows from caching passwords and usernames at docs.citrix.com.

  1. Note that this procedure seems to prevent Receiver for iOS from adding accounts.
  2. On the StoreFront server, run a text editor elevated (as administrator).
  3. Open the file C:\inetpub\wwwroot\Citrix\StoreAuth\App_Data\Templates\UsernamePassword.tfrm.
  4. Go to line 20, which should start with @SaveCredential.
  5. To comment out the line, wrap it in @* and *@. Save the file when done.

  6. Now the Remember My Password checkbox is gone.

“Activate” Option in Web Page – Disable

From Citrix Discussions: to disable the “activate…”; function for Citrix receiver for windows that is visible when a user clicks their username in the upper right hand corner of Receiver for Web, in StoreFront Console, go to Stores > MyStore > Manage Receiver for Web Sites > Configure > Client Interface Settings page. There’s a checkbox for Enable Receiver configuration.

HTML5 Receiver Getting Started Tour

The first time a user connects to HTML5 Receiver, the user is prompted to tour the interface.

The Getting Started Tour can be disabled by doing the following:

  1. Edit the file C:\Inetpub\wwwroot\Citrix\StoreWeb\custom\script.js.
  2. At the bottom of the file, add Feng Huang’s code from First time user tutorial at discussions.citrix.com. Make sure the quotes are straight quotes and not curly quotes. 
    localStorage["showFtu"] = false;

Customize Receiver UI in StoreFront 3.x

StoreFront 3.x customizations are visible in both Receiver for Web and in Receiver Self-Service.

If you are load balancing StoreFront and want to put the server name on the webpage, see Nicolas Ignoto Display server name with Citrix StoreFront 3.
Server name is displayed

Citrix Blog Post Citrix Customization Cookbook contains a collection of customizations including:

  • Add Static or dynamic (read from file) text to the header and/or footer of the login page.
  • Click-through disclaimer before or after login page
  • Footer for every page
  • Default to Folder view when visiting the Apps tab
  • Change default text
  • Change background images for featured categories
  • Background image

Citrix Blog Post Storefront 3 Web Customization: Branding Your Deployment describes the following how to modify CSS to customize the appearance of StoreFront 3.x:

  • Background images
  • Logon button
  • Colors for page and text
  • How to view the mobile version of the page
  • CSS for mobile pages

Jason Samuel Upgrading Citrix StoreFront 2.6 to StoreFront 3.0 – Things to Know details how to change the StoreFront logo to a Receiver logo.

Citrix Blog Post StoreFront 3.0: Message Customization describes how to add a scrolling message to the top of the screen. This is displayed in both Browsers and Receivers.

Migrate Web Interface features to StoreFront at Docs.citrix.com details how to configure Web Interface features in StoreFront. This includes:

  • Enable return to last folder
  • Header logo
  • Pre-logon welcome message
  • Logon screen customization
  • Footer text

StoreFront 3.0 Receiver Customization APIs are detailed at Citrix Developer. Use the Receiver Customization API to brand or customize your end users’ app and desktop selection experience beyond capabilities provided in the StoreFront admin console. Customizations apply to latest Web, Chrome, Windows, Mac and Linux clients, and will be extended to mobile devices in future releases.

An example use case for the StoreFront 3.0 APIs is Citrix Blog Post Citrix Recipe Box: StoreFront Approvals. This is code for StoreFront that requires workflow approval when a user subscribes to an app.

Citrix Blog Post Receiver X1 APIs describes the following:

  • Overview of the CSS classes that can be customized.
  • Override Citrix’s JavaScript functions to modify behavior – exclude or restyle apps, change a sort order, add a warning message etc.
  • How to force X1 UI to display in either phone or larger mode.

Citrix Blog Post X1 Customization: Going deeper with CSS describes the following:

  • Use CSS (/custom/style.css) to style the three custom regions (#customTop, #customBottom, #customScrollTop). Shown below in red, blue, and pink.
  • Marker classes for showing/hiding or highlighting parts of the UI: large display, small display, high DPI, Favorites view, Desktops view, Apps view, appinfo view.

Citrix Blog Post Scripting X1 describes the following:

  • JavaScript code to display an Acceptance dialog box before users can login.
  • Use JQuery to add HTML code to custom regions (e.g. #customScrollTop) including using CSS to hide the HTML code unless a specific tab is selected by the user.

Citrix Blog Post – Rewriting the Session ClientName from StoreFront: I would like to offer the following customisation DLL which can apply client name rewrites based on a template. The customisation template can be any string, but where that string contains a particular token, the token will be replaced by some information from the User Context. If the intent was just to replace the ClientName with the user name, the template is then just “$U”. More details and the .dll file are in the blog post.

StoreFront Store Customization SDK at Citrix Developer: The Store Customization SDK allows you to apply custom logic to the process of displaying resources to users and to adjust launch parameters. For example, you can use the SDK to control which apps and desktops are displayed to users, to change ICA virtual channel parameters, or to modify access conditions through XenApp and XenDesktop policy selection. Key Customization Points:

  • Post-Enumeration
  • Post-Launch ICA File
  • Post-Session Enumeration
  • Access Conditions (pre-launch and pre-enumeration)
  • Provider List
  • Device information

Citrix Blog Post Adding a Language to StoreFront 3.0: A new language pack is comprised of a culture definition file, a string bundle file and a custom string bundle file. See the Blog Post for more details.

To change the StoreFront page title, see Sam Jacobs How to Change the Page Title in Citrix Receiver 3.x at mycugc.org.  💡

StoreFront SDK

Use the Store Customization SDK to apply custom logic to the process of displaying resources to users and to adjust launch parameters.  For example, you can use the SDK to control which apps and desktops are displayed to users, to change ICA virtual channel parameters, or to modify access conditions through XenApp and XenDesktop policy selection.

Requires Visual Studio to create .dll files that replace the ones bundled with StoreFront.

https://www.citrix.com/downloads/storefront-web-interface/sdks/storefront-customization-software-development-kit

StoreFront 3.0 Portal Theme for NetScaler 11

See NetScaler Gateway 11 > Portal Themes. Build 62 and newer have a built-in X1 theme.

StoreFront 3.0 Theme for NetScaler 10.5

You can make the NetScaler Gateway 10.5 logon page look like the Receiver for Web in StoreFront 3.0. Visit Citrix Blog Post X1 Skin for NetScaler Gateway to download an already developed theme package. Or see Daniel Ruiz NetScaler Gateway front page à la StoreFront 3.0 for instructions to manually edit the NetScaler Gateway theme to match StoreFront 3.0.

  1. Download the theme from the Citrix Blog post.
  2. WinSCP to the NetScaler and switch to /var/netscaler/gui/themes.
    1. On the right, rename the existing receivertheme.tar.gz file.

  3. Upload the theme that was downloaded from the Citrix Blog post.
  4. In NetScaler GUI, go to NetScaler Gateway > Global Settings > Change Global Settings.
  5. Switch to the Client Experience tab.
  6. At the bottom, if the current UI Theme is Green Bubble, change it to Default. Then go back into the screen and change it back to Green Bubble. This causes the theme to reload. Click OK.
  7. The logon page should now look more like Receiver for Web in StoreFront 3.0.

Related Pages

↧

AppDisks

March 5, 2016, 8:41 am
$
0
0

Navigation

Planning

AppDisks are available in all editions of XenApp/XenDesktop 7.8 and newer. AppDNA is only available in Platinum Edition.

AppDisks can be created on vSphere (5.1 and newer) and XenServer only. No support for Hyper-V.

Delivery Groups used with AppDisks can contain machines from Pooled Random Machine Catalogs containing Server OS or Desktop OS machines. You cannot use AppDisks with machines from other catalog types, such as pooled static or dedicated (assigned).

In Provisioning Services environments, AppDisks are stored on hypervisor storage, not Provisioning Services storage. Also, additional data might be written to the write cache.

AppDisk must be on the same hosting resource as the linked clones it is attached to. If you have multiple hosting resources, then you’ll need to import the AppDisk to each hosting resource containing linked clones that you want to attach the AppDisk to.

According to the AppDisk FAQ, Citrix has tested up to 16 AppDisks attached to a single virtual machine. To minimize the number of AppDisks, you should combine multiple applications into a single AppDisk.

AppDisks are stored on a datastore with a GUID in the folder name, thus it’s difficult to know what’s in the .vmdk file. Use PowerShell commands (Get-AppLibAppDisk) to determine the AppDisk-to-.vmdk mapping. If you intend to backup and recover these files, periodically run the PowerShell commands and export to a file so you can know which disk is which. Or, when you import the AppDisk, Studio will tell you which applications are installed in the AppDisk and you can then rename the imported AppDisk.

Links:

AppDNA Preparation

  1. If you intend to use AppDNA to analyze your AppDisks, build a separate AppDNA server.
  2. In Studio, go to Configuration, right-click AppDNA, and click Create AppDNA connection before creating an AppDisk.
  3. The dialog box has an example for the Connection address. It should be in http://appdnaserver:8199/appdna format.
  4. Enter the AppDNA SQL server name and database name. Click Save.

Create AppDisk

  1. You need a Machine Creation Services or Provisioning Services catalog of type Random. Make sure at least one machine in the catalog is not assigned to any Delivery Group.


  2. For Provisioning Services, the machine must boot from a Maintenance (Private Image) version. After the AppDisk is created, the Maintenance version can be discarded.
  3. In Studio, right-click AppDisks and click Create AppDisk.
  4. In the Getting started with AppDisks page, click Next.
  5. In the Create AppDisk page, select a size for the disk. These are thin provisioned so size probably doesn’t matter. Just make sure it’s big enough to hold the application. Click Next.
  6. In the Preparation Machine page, select an MCS or PVS random catalog that has an available machine not assigned to a Delivery Group. Click Next.
  7. In the Summary page, give the AppDisk a name. Include the datastore or hosting resource name since you need different AppDisks for each hosting resource. Click Finish.
  8. The new AppDisk is prepped. This takes a while.
  9. If you look in your hypervisor storage, you’ll see a new folder named AppDisk-VirtualID. It’s not obvious which AppDisk this .vmdk file belongs to. You can run a PowerShell command like get-applibappdisk | ? virtualdiskid -eq 0cac15d0-55db-4931-848e-de6ee79dddf8 to determine the AppDisk name.
  10. Once prep is done, Studio says Ready to install applications. If you look on the bottom it will show you which machine was used for AppDisk preparation.
  11. You can also right-click the AppDisk, click Install Applications, and it will tell you which machine should be used for application installation.

  12. Access the console of the prep machine and install the application(s).
  13. When done, go back to Studio, right-click the AppDisk, and click Seal AppDisk.
  14. Click Yes to seal it. This will cause the prep machine to reboot.
  15. Preparation will take some time. If it seems stuck, you might have to login to the prep machine so it continues the process.

  16. Windows Defender might interfere with the sealing process. In that case, turn off Defender’s Real-time protection.
  17. If you added AppDNA to Studio, then it will ask AppDNA to analyze the AppDisk.
  18. When done you can View report.
  19. Once the AppDisk is created and sealed, you can click the Applications tab in the bottom half of the window to see what the AppDisk contains.

Import AppDisk

AppDisks can only be attached to machines on the same hosting resource the AppDisk is located on. You can easily copy/import the AppDisk to multiple hosting resources (datastores).

Also, if you added AppDNA after creating AppDisks, then you can only analyze them by re-importing them.

To import an AppDisk:

  1. You will need an available prep machine in a MCS or PvS Random Catalog that is not assigned to any Delivery Group. The Catalog must be on the same Hosting Resource where the imported AppDisk will be placed.


  2. When you look at a datastore containing AppDisks, it’s not obvious which .vmdk goes with which AppDisk. Run the PowerShell command Get-AppLibAppDisk <AppDiskName> to see the VirtualDiskId.
  3. In vSphere Web Client, edit a non-linked clone virtual machine. Any non-MCS/PVS machine should work. This import machine is different than the linked clone machine that Studio will use to prepare the AppDisk.
  4. Make sure the import machine is currently powered off. If the machine is powered on, then vSphere might complain about the disk being currently in use.
  5. Add an Existing Hard Disk (AppDisk).

  6. When browsing the datastore with the existing AppDisk, select the folder name that matches the VirtualDiskId and then select the disk that’s in the folder.
  7. In Studio, right-click AppDisks and click Create AppDisk.
  8. In the Create AppDisk page, select Import existing AppDisk.
  9. Select a Hosting Resource where you want to copy the AppDisk to. Studio always copies the AppDisk, even if to the same datastore as the source.
  10. In the Import Disk page, browse to the virtual machine and click the arrow to expand it.
  11. Then select the attached AppDisk and click Next.
  12. In the Preparation machine page, select a random linked clone catalog with a machine that hasn’t been added to any Delivery Group and click Next.
  13. In the Summary page, give the AppDisk a name. Include the hosting resource (datastore) name. Click Finish.
  14. The AppDisk will be copied to the new datastore and analyzed if AppDNA is configured.
  15. You can then assign the imported AppDisk to Delivery Groups.
  16. Once the AppDisk is imported, click the Applications tab in the bottom half of the Windows to see what’s in the AppDisk.
  17. You can rename the AppDisk by right-clicking it and clicking Properties.

Assign to Delivery Group

AppDisks are assigned to Delivery Groups, not Catalogs.

  1. If you want to assign an AppDisk to an existing Delivery Group, right-click the Delivery Group and click Manage AppDisks.
  2. Or you can create a new Delivery Group.
  3. On the AppDisks page, click Add.
  4. Select one or more AppDisks and click OK. Notice that you can only select AppDisks on the same hosting resource as the Catalog.
  5. You can prioritize the AppDisks by using the arrow buttons on the right. Or click Auto Order to let AppDNA do it for you.
  6. If you are changing AppDisks assigned to an existing Delivery Group, choose a Rollout Strategy (reboot schedule). This is identical to Machine Creation Services Rollout Strategy. Then finish the wizard.
  7. If you chose Auto Order when assigning the AppDisks then AppDNA will need to do some analysis.
  8. If you highlight a Delivery Group, the AppDisks tab on the bottom shows the currently assigned AppDisks.

Update AppDisk

  1. In Studio, right-click an AppDisk and click Create New Version.
  2. Give the new version a name.
  3. Select a linked clone machine that is not currently in a Delivery Group.
  4. Click Create new version. This copies the AppDisk and links it to the prep virtual machine.
  5. Proceed through the normal Create AppDisk process. This includes installing applications and sealing the AppDisk.
  6. Then assign the new AppDisk to a Delivery Group. This process will include removing the old AppDisk and assigning the new AppDisk.

↧
Search

NetScaler Gateway 11 – SSL VPN

March 5, 2016, 2:50 pm
$
0
0

Navigation

Overview

NetScaler Gateway supports five different connection methods:

  • ICA Proxy to XenApp/XenDesktop – client is built into Citrix Receiver
  • SSL VPN – requires NetScaler Gateway plug-in
  • Clientless – browser only, no VPN client, uses rewrite
  • Secure Browse – from MDX-wrapped mobile applications (XenMobile), uses rewrite
  • RDP Proxy – only RDP client is needed

If Endpoint Analysis is configured, then an Endpoint Analysis plug-in is downloaded to the Windows or Mac client.

Users use SSL to connect to NetScaler Gateway Virtual Servers.

  • NetScaler Gateway prompts the user for authentication.
  • Once the user is authenticated, NetScaler Gateway uses Session Policies to determine what happens next.

You can configure NetScaler Gateway Session Policies to only use one of the connection methods. Or NetScaler Gateway can be configured to let users choose between ICA Proxy, Clientless, and SSL VPN connection methods. Here’s a sample Client Choices screen using the X1 theme:

Enable SSL VPN in a Session Policy as detailed later. Then configure additional NetScaler Gateway objects including the following:

  • DNS Servers and Suffix – enable DNS resolution across the VPN tunnel
  • NetScaler Gateway Universal Licenses – all VPN users must be licensed.
  • Intranet IP addresses – give IP addresses to VPN clients. If no client IP, then VPN clients use NetScaler SNIP to communicate with internal resources. Requires routing changes on internal network.
  • Intranet Applications – if split tunnel is enabled, configure this object to dictate what traffic goes across the tunnel and which traffic stays local.
  • Authorization Policies – if default authorization is DENY, use Authorization Policies to dictate what resources can be accessed across the NetScaler Gateway connection. These Authorization Policies apply to all NetScaler Gateway connections, not just VPN.
  • Bookmarks – displayed on the built-in NetScaler Gateway portal page. Users click bookmarks to access resources across the VPN tunnel or clientless access (rewrite).
  • Endpoint Analysis Scans – block endpoints that fail security requirements. Configured in Session Policies or Preauthentication Policies.
  • Traffic Policies – Single Sign-on to internal web applications
  • AAA Groups – bind Session Policies, Authorization Policies, Intranet Applications, Intranet IPs, Bookmarks, and Traffic Policies to one or more Active Directory groups. Allows different Active Directory groups to have different NetScaler Gateway configurations.

Prerequisites

Except for ICA Proxy, all NetScaler Gateway connection methods require a NetScaler Gateway Universal License for each concurrent session. Go to System > Licenses and make sure NetScaler Gateway User licenses are installed.

Also make sure the maximum AAA users equals the number of licenses. Go to NetScaler Gateway > Global Settings > Change authentication AAA settings.

DNS usually needs to function across the VPN tunnel. Go to Traffic Management > DNS > Name Servers to add DNS servers.

Create Session Profile

You can create multiple Session Policy/Profiles, each with different settings. Then you can bind these Session Policies to different AAA groups or different NetScaler Gateway Virtual Servers. You can also bind Endpoint Analysis expressions to a Session Policy so that the Session Policy only applies to machines that pass the Endpoint Analysis scan.

If multiple Session Policies apply to a particular connection, then the settings in the policies are merged. For conflicting settings, the Session Policy with the highest priority (lowest priority number) wins. Session Policies bound to AAA groups only override Session Policies bound to NetScaler Gateway Virtual Servers if the AAA group bind point has a lower priority number. In other words, priority numbers are evaluated globally no matter where the Session Policy is bound. You can run the command nsconmsg –d current –g pol_hits to see which Session Policies are applying to a particular connection.

Do the following to enable SSL VPN. First create the Session Profile. Then create a Session Policy.

  1. On the left, expand NetScaler Gateway, expand Policies, and click Session.
  2. On the right, switch to the Session Profiles tab and click Add.
  3. Name the profile VPN or similar.
  4. In Session Profiles, every line has an Override Global checkbox to the right of it. If you check this box next to a particular field, then the field in this session profile will override settings configured globally or in a lower priority session policy.
  5. Switch to the Network Configuration tab and check the box next to Advanced Settings.
  6. You will find a setting that lets you select a DNS Virtual Server. Or if you don’t select anything then the tunnel will use the DNS servers configured under Traffic Management > DNS > Name Servers.
  7. Configure the behavior when there are more VPN clients than available IPs in the address pool. This only applies if you are configuring Intranet IPs.
  8. There are also a couple timeouts lower on the page.
  9. Switch to the Client Experience tab. This tab contains most of the NetScaler Gateway VPN settings.
  10. Override Plug-in Type and set it to Windows/Mac OS X.
  11. Whenever NetScaler firmware is upgraded, all users will be prompted to upgrade their VPN clients. You can use the Upgrade drop-downs to disable the automatic upgrade.
  12. By default, if Receiver and NetScaler Gateway Plug-in are installed on the same machine, then the icons are merged. To see the NetScaler Gateway Plug-in Settings, you right-click Receiver, open Advanced Preferences and then click NetScaler Gateway Settings.

  13. You can configure the Session Policy/Profile to prevent NetScaler Gateway Plug-in from merging with Receiver. On the Client Experience tab, scroll down and check the box next to Advanced Settings.
  14. Check the box next to Show VPN Plugin-in icon with Receiver. This causes the two icons to be displayed separately thus making it easier to access the NetScaler Gateway Plug-in settings.

  15. On the Client Experience tab, override Split Tunnel and make your choice. Setting it to Off will force all traffic to use the tunnel. Setting it to On will require you to create Intranet Applications so the NetScaler Gateway Plug-in will know which traffic goes through the tunnel and which traffic goes directly out the client NIC (e.g. to the Internet).
  16. On the Client Experience tab, Client Idle Time-out is an idle timer. Session Time-out, is a total session timer (doesn’t care if user is working or not). There are default timers in Global Settings so you should probably override the defaults and increase the timeouts.
  17. By default, once the VPN tunnel is established, a 3-page interface appears containing bookmarks, file shares, and StoreFront. An example of the three-page interface in the X1 theme is shown below.
  18. On the Client Experience tab, the Home Page field lets you override the 3-page interface and instead display a different webpage (e.g. Intranet or StoreFront). This homepage is displayed after the VPN tunnel is established (or immediately if connecting using Clientless Access).
  19. On the Client Experience tab, there are more settings that control the behavior of the NetScaler Gateway plug-in. Hover your mouse over the question marks to see what they do.
  20. Additional VPN settings can be found by clicking Advanced Settings near the bottom of the Client Experience tab.
  21. Under Client Experience > Advanced Settings, on the General tab, there are settings to run a login script at login, enable/disable Split DNS, and enable Local LAN Access. Use the question marks to see what they do. Reliable DNS occurs when Split DNS is set to Remote.
  22. Under Client Experience > Advanced Settings, on the General tab, is a checkbox for Client Choices. This lets the user decide if they want VPN, Clientless, or ICA Proxy (StoreFront). Without Client Choices, the VPN will launch automatically
  23. On the main Client Experience tab, if you enabled Client Choices, you can set Clientless Access to Allow to add Clientless to the list of available connection methods.
  24. An example of Client Choices is shown below:
  25. The Client Experience > Advanced Settings section has additional tabs for controlling the NetScaler Gateway Plug-in. A commonly configured tab is Proxy so you can enable a proxy server for VPN users.
  26. Back in the main Session Profile, switch to the Security tab.
  27. Set the default authorization to Allow or Deny. If Deny (recommended), you will need to create authorization policies to allow traffic across the tunnel. You can later create different authorization policies for different groups of users.
  28. On the Published Applications tab, set ICA Proxy to Off. This ensures VPN is used instead of ICA Proxy.
  29. Configure the Web Interface Address to embed StoreFront into the 3-pane default portal page. Note: additional iFrame configuration is required on the StoreFront side as detailed below.
  30. Click Create when you’re done creating the Session Profile.

Create Session Policy

  1. In the right pane, switch to the Session Policies tab and click Add.
  2. Give the policy a descriptive name.
  3. Change the Action to the VPN Profile you just created.
  4. Add a policy expression. You can enter ns_true, which applies to all connections.
  5. Or you can add Endpoint Analysis scans. If the Endpoint Analysis scan succeeds, then the session policy is applied. If the Endpoint Analysis scan fails, then this session policy is skipped and the next one is evaluated. This is how you can allow VPN if EPA scan succeeds but all failed EPA scans will get a different session policy that only has ICA Proxy enabled.
  6. To add an Endpoint Analysis scan, use one of the Editor links on the right.
  7. Configure OPSWAT scans in the OPSWAT EPA Editor.
  8. Configure Client Security Expressions in the Expression Editor.
  9. You can combine multiple Endpoint Analysis scan expressions using Booleans (&&, ||, !). Click Create when done.

Bind Session Policy

Most of the NetScaler Gateway objects can be bound to NetScaler Gateway Virtual Server, AAA Group, or both. This section details Session Policies, but the other NetScaler Gateway objects (e.g. Authorization Policies) can be bound using similar instructions.

  1. Bind the new session policy to a NetScaler Gateway Virtual Server or a AAA group. If you bind it only to a AAA group, then only members of that Active Directory group will evaluate the expression.
  2. To bind to a NetScaler Gateway Virtual Server, edit a NetScaler Gateway Virtual Server (or create a new one), scroll down to the Policies section and click the Plus icon.
  3. In the Choose Type page, select Session, Request and click Continue.
  4. Select one or more session policies. This is where you specify a priority.
  5. To bind to a AAA Group, go to NetScaler Gateway > User Administration > AAA Groups.
  6. Add a group with the same name (case sensitive) as the Active Directory group name. This assumes your LDAP policies/server are configured for group extraction.
  7. Edit the AAA Group.
  8. On the right, in the Advanced Settings column, add the Policies section.
  9. Click the plus icon to bind one or more Session Policies.
  10. If you want these Session Policies to override the Session Policies bound to the NetScaler Gateway Virtual Server then make sure the Session Policies bound to the AAA Group have lower priority numbers.

NetScaler Gateway Plug-in Installation

Here is what the user sees when launching the VPN session for the first time.


And then the 3-pane interface is displayed.

Only administrators can install the NetScaler Gateway Plug-in. You can download the Gateway plug-in from the NetScaler at /var/netscaler/gui/vpns/scripts/vista and push it to corporate-managed machines. Or you can download VPN clients from Citrix.com. The VPN client version must match the NetScaler firmware version.

Authorization Policies

If your Session Profile has Security tab > Default Authorization set to Deny (recommended), then create Authorization Policies to allow access across the tunnel.

  1. On the left, under NetScaler Gateway, expand Policies and click Authorization.
  2. On the right, click Add.
  3. Name the Authorization Policy.
  4. Select Allow or Deny.
  5. NetScaler Gateway requires you to Switch to Classic Syntax. The other syntax option is for AAA.
  6. Enter an expression. Use the Expression Editor link to build an expression. You can specify destination IP subnets, destination port numbers, etc.
  7. Click Create when done.
  8. Authorization Policies are usually bound to AAA groups. This allows different groups to have different access across the tunnel.
  9. On the right, in the Advanced Settings column, add the Authorization Policies section.
  10. Then click where it says No Authorization Policy to bind policies.

Intranet Applications

If you enabled Split Tunnel, then you’ll need to create Intranet Applications to specify which traffic goes through the tunnel.

  1. On the left, under NetScaler Gateway, expand Resources and click Intranet Applications.
  2. On the right, click Add.
  3. Enter a name for the Internal subnet.
  4. Change the Interception Mode to TRANSPARENT.
  5. Enter an IP subnet. Only packets destined for this network go across the tunnel.
  6. Then click Create.
  7. Create additional Intranet applications for each internal subnet.
  8. Intranet Applications are usually bound to the Gateway Virtual Server but you can also bind them to AAA Groups.
  9. On the right, in the Advanced Settings column, add the Intranet Applications section.
  10. On the left, click No Intranet Application to bind Intranet Applications.

DNS Suffix

Specify a DNS Suffix for Split DNS to function with single label DNS names.

  1. On the left, under NetScaler Gateway, expand Resources and click DNS Suffix.
  2. On the right, click Add.
  3. Enter the DNS Suffix and click Create. You can add multiple suffixes.

Bookmarks

Bookmarks are the links that are displayed in the 3-pane interface. They can point to file shares or websites.

  1. Under NetScaler Gateway, expand Resources, and click Bookmarks.
  2. On the right, click Add.
  3. Give the bookmark a name and display text.
  4. Enter a website or file share. For file shares you can use %username%.
  5. The other fields are for Single Sign-on through Unified Gateway. Click Create.
  6. Bookmarks (aka Published Applications > Url) are usually bound to AAA groups so different groups can have different bookmarks. But it’s also possible to bind Bookmarks to NetScaler Gateway Virtual Servers.
  7. If NetScaler Gateway Virtual Server, add the Published Applications section to bind Bookmarks.
  8. For AAA Group, it’s the Bookmarks section.
  9. On the left, find the Published Applications section and click No Url to bind Bookmarks.

VPN Client IP Pools (Intranet IPs)

By default, NetScaler Gateway VPN clients use NetScaler SNIP as their source IP when communicating with internal resources. To support IP Phones or endpoint management, you must instead assign IP addresses to VPN clients.

Any IP pool you add to NetScaler must be reachable from the internal network. Configure a static route on the upstream router. The reply traffic should be routed through a NetScaler SNIP. Or the NetScaler can participate in OSPF.

When a client is assigned a client IP, this IP address persists across multiple sessions until the appliance reboots or until the appliance runs out of IPs in the pool.

  1. Edit a NetScaler Gateway Virtual Server or a AAA group.
  2. On the right, in the Advanced Settings section, click the plus icon next to Intranet IP Addresses.
  3. On the left, click where it says No Intranet IP.
  4. Enter a subnet and netmask. Click Bind.
  5. To see the Client IP address, on the client side, right-click the NetScaler Gateway Plug-in and click Configure NetScaler Gateway.
  6. Switch to the Profile tab to see the Client IP address.
  7. To see the client IP on the NetScaler, go to NetScaler Gateway and on the right is Active user sessions.
  8. Select one of the views and click Continue.
  9. The right column contains the Intranet IP.

StoreFront in Gateway Portal

  1. If you want to enable StoreFront to integrate with NetScaler Gateway’s default portal, edit the file C:\Inetpub\wwwroot\Citrix\StoreWeb\web.config.
  2. On the bottom, there are three sections containing frame options. Change all three of them from deny to allow.
  3. Also change frame-ancestors from none to self.
  4. In NetScaler, go to NetScaler Gateway > Global Settings and click Configure Domains for Clientless Access.
  5. Change the selection to Allow Domains, enter your StoreFront FQDN and click the plus icon.
  6. Click OK.
  7. In a Session Policy/Profile, on the Client Experience tab, make sure Single Sign-on to Web Applications is enabled.
  8. On the Published Applications tab, configure the Web Interface Address to point to the StoreFront Receiver for Web page.
  9. Configure the Single Sign-on domain to match what’s configured in StoreFront.
  10. The Applications page of the 3-page portal should automatically show the StoreFront published icons.

Related Pages

↧
↧

Citrix SCOM Management Pack – NetScaler

March 20, 2016, 8:12 am
$
0
0

Navigation

Requirements

  • NetScaler Platinum Edition
  • NetScaler 9.3 or newer
  • System Center Operations Manager 2012 or newer

NetScaler Pack

Full documentation at http://docs.citrix.com/en-us/scom-management-packs/scom-management-pack-for-netscaler.html.

Install Citrix NetScaler Pack

  1. On the System Center Operations Manager server, go to the downloaded Citrix SCOM Management Pack for NetScaler and run Citrix_SCOM_Management_Pack_for_NetScaler.exe.
  2. In the Welcome to the InstallShield wizard for Citrix SCOM Management Pack for NetScaler page, click Next.
  3. In the View Relevant Product Configuration page, click Next.
  4. In the Customer Information page, enter a company name and click Next.

  5. In the License Agreement page, click Yes.
  6. In the Choose Destination Location page, click Next.
  7. In the Start Copying Files page, click Next.
  8. In the InstallShield Wizard Complete page, click Finish.

MP Agent Installation Account

Configure the MP Agent Installation Account as detailed for the XAXD Pack.

NetScaler Monitoring Account

On the NetScaler appliances, run the following commands to add a local account and bind it to a restrictive cmdPolicy. Replace the password with a secure password. If you leave the password off the command, then NetScaler will prompt you.

add system cmdPolicy polNetScalerMonitoring ALLOW (^show\s+system\s+\S+)|(^show\s+system\s+\S+\s+.*)|(^show\s+configstatus)|(^show\s+configstatus\s+.*)|(^shell\s+nsconmsg\s+-K\s+\S+\s+.*)

add system user usrNetScalerMonitoring MyPassword

bind system user usrNetScalerMonitoring read-only 1

bind system user usrNetScalerMonitoring polNetScalerMonitoring 1

show system user usrNetScalerMonitoring

SCOM Device Discovery

  1. System Center Operations Manager uses SNMP to communicate with NetScaler. If Windows Firewall is enabled on the SCOM server, enable some Inbound and Outbound rules.
  2. Inbound Rule: Operations Manager Ping Response.
  3. Inbound Rule: Operations Manager SNMP Response.
  4. Inbound Rule: Operations Manager SNMP Trap Listener.
  5. Outbound Rule: Operations Manager Ping Request.
  6. Outbound Rule: Operations Manager SNMP Request.
  7. Make sure the NetScaler is configured with an SNMP community string at System > SNMP > Community.
  8. If you have SNMP Managers configured, then make sure SCOM is in the list.
  9. In SCOM Console, go to the Administration workspace, right-click, and click Discovery Wizard.
  10. Select Network devices and click Next.
  11. In the General Properties page, give the discovery rule a name. Select a SCOM server and resource pool to run the discovery rule. Then click Next.
  12. In the Discovery Method page, select Explicit discovery and click Next.
  13. In the Default Accounts page, if you are using SNMPv2 (instead of SNMPv3) to connect to NetScaler, then you can add the community string now. Click Create Account.
  14. In the General Properties page, give the community string a display name and click Next.
  15. In the Credentials page, enter the community string and click Create.
  16. Then click Next.
  17. In the Devices page, click Add.
  18. Enter the hostname of the device.
  19. Select the SNMP version.
  20. If SNMPv2, select the community string. If SNMPv3, you can add the user account now.
  21. Click OK when done.
  22. Add more devices. Then click Next.
  23. In the Schedule Discovery page, select how often you want this rule to run and click Next.
  24. In the Summary page, click Save.
  25. Click Yes to distribute the accounts.
  26. In the Completion page, click Close.

Install Citrix NetScaler Agent

The Citrix SCOM Agent for NetScaler must be installed on the same SCOM server that is running the device discovery rule.

  1. On the SCOM server, go to \\scom01\CitrixMPShare\NetScaler MP and run mpns_x64.msi.
  2. In the Welcome to the InstallShild Wizard for Citrix SCOM Management Pack Agent for NetScaler page, click Next.
  3. In the Ready to Install the Program page, click Install.
  4. In the InstallShield Wizard Completed page, click Finish.

Import Management Packs

  1. In SCOM Console, go to Administration workspace, right-click Management Packs and click Import Management Packs.
  2. Click Add and then click Add from disk.
  3. Connecting to the online catalog is not required.
  4. Browse to C:\Program Files (x86)\Comtrade\NetScaler MP\Management Packs and select all of the .mp files.  Click Open.
  5. Click Install.
  6. Click Close when done.

NetScaler Monitoring RunAs Account

  1. In SCOM console, go to Administration workspace, right-click and click Create Run As Account.
  2. In the Introduction page, click Next.
  3. In the General Properties page, change the account type to Basic Authentication.
  4. Give the account a display name and click Next.
  5. In the Credentials page, enter the credentials of the local monitoring account on the NetScalers and click Next.
  6. In the Distribution Security page, best practice is to select More secure. But you’ll need to manually specify every agent that should receive these credentials. Click Create.
  7. In the Completion page, click Close.
  8. In the Administration workspace, go to Run As > Profiles.
  9. Double-click Citrix NetScaler Appliance Action Account.
  10. In the Introduction page, click Next.
  11. In the General Properties page, click Next.
  12. In the Run As Accounts page, click Add.
  13. Select the previously created NetScaler monitoring account.
  14. Change the selection to A selected class, group, or object. Then click Select > Object.
  15. Search for the NetScaler appliances these credentials apply to, click Add, and then click OK.
  16. Then click OK.
  17. Click Save.
  18. In the Completion page, if the Run As account is configured for Secure Distribution then click the link to specify Agents to receive the credentials.

Use Management Pack

In the Monitoring workspace, under Citrix NetScaler, your appliance should eventually show up. These views should give you an inventory of the NetScaler configuration, current health status, etc.

Related Pages

↧

VMware Horizon 7 Composer

March 26, 2016, 6:02 am
$
0
0

Navigation

Planning

vCenter Server planning:

  • A single vCenter Server can handle 10,000 VMs. However, this is a single point of failure. VMware recommends separate vCenter servers for each 2,000 VMs. More vCenter Servers means more concurrent vCenter operations, especially if your pools are configured for Refresh on Logoff.
  • Each ESXi cluster is managed by one vCenter Server.
  • Don’t use existing vCenter servers. Build separate vCenter servers for the vSphere clusters that host Agent VMs. Horizon licenses includes vCenter licenses so there’s no excuse to not use separate vCenter servers.

Horizon Composer server planning:

  • Each vCenter Server requires its own View Composer. There’s a one-to-one mapping.
  • View Composer cannot be installed on a Horizon 7 Connection Server.
  • View Composer server with 2vCPU, 4 GB RAM can support up to 2,000 virtual machines with up to 1,000 per pool.
  • View Composer server with 4 vCPU, 10 GB RAM can support up to 10,000 virtual machines with up to 2,000 per pool.

A remote SQL Server is needed for databases:

  • vCenter database
  • Horizon Composer database
  • Horizon Events database
  • Supported SQL versions are listed at pubs.vmware.com.

SQL Server Preparation

Only SQL Authentication is supported.

  1. Open the properties of the SQL Server.
  2. On the Security page, make sure SQL Server authentication is enabled.
  3. Create a new SQL database for View Composer.
  4. Call it VMwareViewComposer or similar. Then switch to the Options page.
  5. Select your desired Recovery model and click OK.
  6. View Composer only supports SQL authentication on remote SQL servers. Expand Security, right-click Logins and click New Login to create a new SQL login.
  7. Name the new account.
  8. Select SQL Server authentication.
  9. Enter a password for the new account.
  10. Uncheck the box next to Enforce password policy.
  11. Then switch to the User Mapping page.
  12. On the User Mapping page, check the Map box for VMwareViewComposer.
  13. On the bottom, check the box for the db_owner role and click OK.

.NET Framework 3.5.1

  1. Composer requires .NET Framework 3.5.1, which is not installed by default on Windows Server 2012 R2. In Server Manager, open the Manage menu and click Add Roles and Features.
  2. In the Before You Begin page, click Next.
  3. In the Select installation type page, click Next.
  4. In the Select destination server page, click Next.
  5. In the Select server roles page, click Next.
  6. In the Select features page, expand .NET Framework 3.5 features and select .NET Framework 3.5. Click Next.
  7. In the Confirm installation selections page, click Specify an alternate source path. Note: you will need the Windows Server 2012 R2 media.
  8. Enter the path to the \sources\sxs folder on the Windows Server 2012 R2 media and click OK.
  9. Then click Install.
  10. In the Results page, click Close.

SQL Native Client

  1. On the View Composer server, run sqlncli.msi.
  2. In the Welcome to the Installation Wizard for SQL Server 2012 Native Client page, click Next.
  3. In the License Agreement page, select I accept and click Next.
  4. In the Feature Selection page, click Next.
  5. In the Ready to Install the Program page, click Install.
  6. In the Completing the SQL Server 2012 Native Client installation page, click Finish.

ODBC

  1. On the View Composer server, run ODBC Data Sources (64-bit).
  2. On the System DSN tab, click Add.
  3. Select SQL Server Native Client and click Finish.
  4. Enter the name ViewComposer for the DSN and enter the SQL server name. Click Next.
  5. Change the selection to With SQL Server authentication and enter the credentials of the new ViewComposer SQL account. Then click Next.
  6. Check the box next to Change the default database and select the VMwareViewComposer database. Then click Next.
  7. Click Finish.
  8. Click OK twice.

Install – Composer

  1. Don’t install on Horizon Connection Server: View Composer cannot be installed on the Horizon Connection Server. They must be separate machines. View Composer is typically installed on vCenter server if less than 1,000 linked clones.
  2. Extra Memory for vCenter: If you install View Composer on a vCenter server, VMware recommends adding 8 GB of RAM to the server. See VMware 2105261 Intermittent provisioning issues and generic errors when Composer and vCenter Server are co-installed
  3. vCenter Service Account: if you install View Composer on a vCenter server, login as the same account that was used to install vCenter. See VMware 2017773 Installing or upgrading View Composer fails with error: The wizard was interrupted before VMware View Composer could be completely installed
  4. Internet access for CRL checking: If the View Composer server does not have Internet access, see VMware 2081888 Installing Horizon View Composer fails with the error: Error 1920 Service VMware Horizon View Composer (svid) failed to start
  5. Install: Go to the downloaded View Composer 7.0 and run VMware-viewcomposer-7.0.0.exe.
  6. In the Welcome to the Installation Wizard for VMware Horizon 7 Composer page, click Next.
  7. In the License Agreement page, select I accept the terms and click Next.
  8. In the Destination Folder page, click Next.
  9. In the Database Information page, enter the name of the ODBC DSN.
  10. Enter the SQL account credentials (no Windows accounts) and click Next. For remote SQL databases, only SQL accounts will work. The SQL account must be db_owner of the database.
  11. In the VMware Horizon 7 Composer Port Settings page, click Next.
  12. In the Ready to Install the Program page, click Install.
  13. In the Installer Completed page, click Finish.
  14. Click Yes when asked to restart the computer.
  15. If you encounter installation issues, see VMware 2087379 VMware Horizon View Composer help center

Administrator Permissions

If View Composer is installed on a standalone server (not on vCenter), Horizon 7 Connection Server will need a service account with administrator permissions on the View Composer server. Add your View Composer Service Account to the local Administrators group.

Composer Certificate

  1. Stop the VMware Horizon 7 Composer service.
  2. Open the MMC Certificates snap-in. Open your Certificate Authority-signed certificate and on the Details tab note the Thumbprint.
  3. Run Command Prompt as Administrator
  4. Change the directory to C:\Program Files (x86)\VMware\VMware View Composer.
  5. Run sviconfig -operation=replacecertificate -delete=false.
  6. Select your Certificate Authority-signed certificate. Use the thumbprint to verify.
  7. Then restart the VMware Horizon 7 Composer service.

SQL Database Maintenance

SQL password: The password for the SQL account is stored in C:\Program Files (x86)\VMware\VMware View Composer\SviWebService.exe.config. To change the password, run SviConfig ‑operation=SaveConfiguration as detailed at VMware 1022526 The View Composer service fails to start after the Composer DSN password is changed.

Database Move: To move the database to a new SQL server, you must uninstall Composer and reinstall it. See VMware 2081899 VMware Horizon View Composer fails to work properly after migrating the Composer database to a new SQL server

Related Pages

↧

VMware Horizon 7 Connection Server

March 26, 2016, 6:05 am
$
0
0

Navigation

💡 = Recently Updated

Windows Features

  1. It’s probably helpful to install some administration tools on the Horizon Connection Servers. In Server Manager, open the Manage window and click Add Roles and Features.
  2. Click Next until you get to the Features page.
  3. Check the box next to Group Policy Management and scroll down.
  4. Check the box next to Telnet Client.
  5. If you need Flash Player (e.g. to connect to the vSphere Web Client or View Administrator), then expand User Interfaces and Infrastructure and check the box next to Desktop Experience.

  6. Click Add Features when prompted.
  7. Expand Remote Server Administration Tools > Role Administration Tools > AD DS and AD LDS Tools > AD DS Tools. Check the box next to Active Directory Administrative Center. Click Add Features when prompted. Then click Next .
  8. Then click Install.
  9. You will see a message prompting you to reboot. Right-click the Start button to reboot the server. it will reboot twice.

Install Standard Server 7.0.0

The first Horizon Connection Server must be a Standard Server. Subsequent Horizon Connection Servers are Replicas. Once Horizon Connection Server is installed, there is no difference between them.

A production Horizon Connection Server should have 10 GB of RAM and 4 vCPU. Each Horizon Connection Server can handle 2,000 virtual desktops.

  1. Ensure the Horizon Connection Server has 10 GB of RAM and 4 vCPU.
  2. View Composer cannot be installed on the Horizon Connection Server.
  3. Go to the downloaded Horizon 7 Connection Server and run VMware-viewconnectionserver-x86_64-7.0.0.exe.
  4. In the Welcome to the Installation Wizard for VMware Horizon 7 Connection Server page, click Next.
  5. In the License Agreement page, select I accept the terms and click Next.
  6. In the Destination Folder page, click Next.
  7. In the Installation Options page, select Horizon 7 Standard Server and click Next.
  8. In the Data Recovery page, enter a password and click Next.
  9. In the Firewall Configuration page, click Next.
  10. In the Initial Horizon 7 Administrators page, enter an AD group containing your Horizon administrators and click Next.
  11. In the User Experience Improvement Program page, uncheck the box and click Next.
  12. In the Ready to Install the Program page, click Install.
  13. In the Installer Completed page, uncheck the box next to Show the readme file and click Finish.

Install Replica Server 7.0.0

Additional internal Horizon Connection Servers are installed as Replicas. After installation, there is no difference between a Replica server and a Standard server.

A production Horizon Connection Server should have 10 GB of RAM and 4 vCPU. Each Horizon Connection Server can handle 2000 virtual desktops.

  1. Ensure the Horizon Connection Server has 10 GB of RAM and 4 vCPU.
  2. Go to the downloaded Horizon 7 Connection Server and run VMware-viewconnectionserver-x86_64-7.0.0.exe.
  3. In the Welcome to the Installation Wizard for VMware Horizon 7 Connection Server page, click Next.
  4. In the License Agreement page, select I accept the terms and click Next.
  5. In the Destination Folder page, click Next.
  6. In the Installation Options page, select Horizon 7 Replica Server and click Next.
  7. In the Source Server page, enter the name of another Horizon Connection Server in the group. Then click Next.
  8. In the Firewall Configuration page, click Next.
  9. In the Ready to Install the Program page, click Install.
  10. In the Installer Completed page, click Finish.
  11. If you are adding this Replica server to a Pod that is already enabled for Global Entitlements, see Setting up the Cloud Pod Architecture feature on a replicated View Connection Server instance.

Horizon Connection Server Certificate

  1. Run mmc, add the Certificates snap-in and point it to Computer > Local Machine. Or run certlm.msc.
  2. Request a new certificate with a common name that matches the FQDN of the Connection Server or import a wildcard certificate.
  3. Note: the private key must be exportable. If using the Computer template, click Details then click Properties.
  4. On the Private Key tab, click Key options to expand it and check the box next to Mark private key as exportable.
  5. In the list of certificates, look for the one that is self-signed. The Issuer will be the local computer name instead of a Certificate Authority. Right-click it and click Properties.
  6. On the General tab, clear the Friendly name field and click OK.
  7. Right-click your Certificate Authority-signed certificate and click Properties.
  8. Note: the private key of the certificate you use for Horizon Connection Server must be exportable. To verify, try exporting the certificate. If the option to export the private key is grayed out then this certificate will not work.
  9. On the General tab, in the Friendly name field, enter the text vdm and click OK. Note: only one certificate can have vdm as the Friendly name.
  10. Then restart the VMware Horizon View Connection Server service. It will take several seconds before you can connect to View Administrator.
  11. If the VMware Horizon View Security Gateway Component won’t start then your certificate doesn’t have an exportable private key. The private key must be exportable.

SSL Ciphers

If you are running Horizon 6 or older, see Sven Huisman: Secure your Horizon View security server: from rating F to A-.

If this Horizon Connection Server or Horizon Security Server is publicly accessible, check it at ssllabs.com.

Horizon Portal – Client Installation Link

If you point your browser to the Horizon Connection Server, the Install VMware Horizon Client link redirects to the VMware.com site for downloading of Horizon Clients. You can change it so that the Horizon Clients can be downloaded directly from the Horizon Connection Server.

  1. On the Horizon Connection Server, go to C:\Program Files\VMware\VMware View\Server\broker\webapps. Create a new folder called downloads.
  2. Copy the downloaded Horizon Clients to the new C:\Program Files\VMware\VMware View\Server\broker\webapps\downloads folder.

  3. Run Notepad as administrator.
  4. Open the file C:\ProgramData\VMware\VDM\portal\portal-links-html-access.properties file with a text editor (as Administrator).
  5. Go back to the downloads folder and copy the Horizon Client filename.
  6. In Notepad, modify link.win32 and link.win64 by specifying the relative path to the Horizon Client executable under /downloads. The following example shows a link for Horizon Client for Windows x64:
    link.win64=/downloads/VMware-Horizon-Client-x86_64-4.0.1-3698521.exe
    Then Save the file.
  7. Restart the VMware Horizon View Web Component service.

It will take a few seconds for the ws_TomcatService process to start so be patient. If you get a 503 error then the service is not done starting.

Now when you click the link to download the client it will grab the file directly from the Horizon Connection Server.

LDAP Edits

Mobile Client – Save Password

If desired, you can configure Horizon Connection Server to allow mobile clients (iOS, Android) to save user passwords.

  1. On the Horizon Connection Server, run ADSI Edit.
  2. Right-click ADSI Edit and click Connect to…

  3. Change the first selection to Select or type a Distinguished Name and enter dc=vdi,dc=vmware,dc=int.
  4. Change the second selection to Select or type a domain or server and enter localhost. Click OK.
  5. Navigate to Properties > Global. On the right, double-click CN=Common.
  6. Scroll down, click to highlight pae-ClientCredentialCacheTimeout and click Edit.
  7. Enter a value in minutes. 0 = no saving of credentials. -1 = no timeout. Click OK.

iOS TouchID

vDelboy – How to Enable Touch ID in VMware Horizon 6.2

  1. On the Horizon Connection Server, run ADSI Edit.
  2. Right-click ADSI Edit and click Connect to…
  3. Change the first selection to Select or type a Distinguished Name and enter dc=vdi,dc=vmware,dc=int.
  4. Change the second selection to Select or type a domain or server and enter localhost. Click OK.
  5. Navigate to Properties > Global. On the right, double-click CN=Common.
  6. Find the attribute pae-ClientConfig and double-click it.
  7. Enter the line BioMetricsTimeout=-1 and click Add. Click OK. The change takes effect immediately.

Disallow Non-empty Pool Deletion

Configure View to Disallow the Deletion of a Desktop Pool That Contains Desktop Machines at pubs.vmware.com.

  1. On the Horizon Connection Server, run ADSI Edit.
  2. Right-click ADSI Edit and click Connect to…
  3. Change the first selection to Select or type a Distinguished Name and enter dc=vdi,dc=vmware,dc=int.
  4. Change the second selection to Select or type a domain or server and enter localhost. Click OK.
  5. Navigate to Properties > Global. On the right, double-click CN=Common.
  6. Find the attribute pae-NameValuePair and double-click it.
  7. Enter the line cs-disableNonEmptyPoolDelete=1 and click Add. Click OK. The change takes effect immediately.

Load Balancing

See Carl Stalhood’s Horizon View Load Balancing using NetScaler 11.

Remote Desktop Licensing

If you plan to build RDS Hosts, then install Remote Desktop Licensing somewhere. You can install it on your Horizon Connection Servers by following the procedure at http://www.carlstalhood.com/delivery-controller-7-8/#rdlicensing.

Horizon Toolbox 2

Install the Horizon Toolbox Fling on your View Connection Servers. This is a web-based tool that adds the following functionality:

  • Auditing of user sessions
  • Auditing of virtual machine snapshots
  • Auditing of Horizon Client Versions
  • Remote Assistance – users request assistance from administrators
  • Virtual Machine Remote Console
  • Power Policy for pools

To use the Toolbox, make sure the following are enabled in your View Connection Server pod:

  • Events database
  • Customer Experience Improvement Program

.NET Framework 3.5 and Remote Assistance

  1. On the View Connection Server, in Server Manager, open the Manage menu and click Add Roles and Features.
  2. In the Features page, select .NET Framework 3.5.
  3. Scroll down, select Remote Assistance and click Next. This feature is only needed if you will respond to Remote Assistance requests directly from the View Connection Server.
  4. In the Confirmation page, click Specify an alternate source path.
  5. Mount or extract the Windows Server 2012 R2 ISO.
  6. Enter the path to the sources folder on the Windows Server 2012 R2 ISO and click OK. Then click Install.

Toolbox Installer

  1. Download the Fling. Check the box next to I have read and agree and click Download.
  2. Run the downloaded VMWARE-Horizon-Toolbox-x64-2.1.0.msi.
  3. In the Welcome to the HorizonToolbox Setup Wizard page, click Next.
  4. In the Select Installation Folder page, select Everyone and click Next.
  5. In the Confirm Installation page, click Next.
  6. In the Installation Complete page, click Close.

Firewall

  1. Run Windows Firewall with Advanced Security.
  2. Create a new Inbound Rule for port 18443.
  3. Select Port and click Next.
  4. Enter TCP 18443 as the local port and click Next.
  5. Allow the connection and click Next.
  6. Name the rule Horizon Toolbox or something like that. Click Finish.

Toolbox Certificate

Horizon Toolbox comes with a self-signed certificate. It can be replaced by doing the following:

  1. Copy a certificate .pfx file to C:\Program Files\VMware\HorizonToolbox\HorizonToolbox2.1.0\conf.
  2. Edit the file server.xml that’s in the same conf folder.
  3. Scroll down to the <Connector port=”18443″ section (near line 85).
  4. Change the keystoreFile attribute to the name of your .pfx file.
  5. Change the keystorePass attribute to the password for your .pfx file.
  6. Add a new attribute keystoreType=”PKCS12″
  7. Close and save the file.
  8. Restart the Apache Tomcat 8.0 Tomcat8 service.
  9. Point your browser to https://view.corp.local:18443/toolbox.
  10. Login using View Administrator credentials.

Toolbox Remote Assistance

  1. On the Horizon Agent machine, navigate to the View Connection Server Horizon Toolbox folder \\vcs01\c$\Program Files\VMware\HorizonToolbox\HorizonToolbox2.1.0\webapps\toolbox\static\ra and run Horizon_Remote_Assistance_Installer_v1035.exe.
  2. You might be prompted to install .NET Framework 3.5.
  3. Click Install for End User.
  4. Click OK to launch Remote Assistance.
  5. Close Remote Assistance.
  6. When done, click Finish.
  7. Users can initiate a request by clicking the Horizon Remote Assistance icon on the desktop.
  8. Click OK to submit a request.

  9. Support people can see support requests in the Toolbox interface on the Remote Assistance tab.
↧

VMware Horizon 7 Configuration

March 26, 2016, 6:08 am
$
0
0

Navigation

Preparation

Horizon Service Account

  1. Create an account in Active Directory that View will use to login to vCenter. This account can also be used by Composer to create computer accounts in Active Directory.
  2. Make sure the password does not expire.
  3. Domain User is sufficient. Permissions will be delegated where needed.

vCenter Role for View Composer

This role has all permissions needed for both full clones and linked clones.

  1. Create an account in Active Directory that View will use to login to vCenter.
  2. In vSphere Web Client, on the Home screen, click Roles.
  3. Click the plus icon to add a Role.
  4. Name the role View or similar.
  5. Expand Datastore and enable Allocate space, Browse datastore, and Low level file operations.
  6. Expand Folder and enable Create folder, and Delete folder.
  7. Expand Global and enable Act as vCenter Server, Disable Methods, Enable Methods, and Manage custom attributes.
  8. Scroll down and enable Set custom attribute and System tag.
  9. Expand Host, expand Configuration and enable Advanced Settings.
  10. Scroll down and enable System Management.
  11. Enable Network and everything under it.
  12. For Virtual SAN, enable Profile-driven storage and everything under it. VMware 2094412 – When attempting to deploy linked clones using VMware Virtual SAN (VSAN) you receive the error: Unable to connect to PBM sub system PB may be down

  13. Expand Resource and enable Assign virtual machine to resource pool and Migrate powered off virtual machine.
  14. Expand Virtual Machine and enable everything under Configuration, Inventory, and Snapshot Management (or State).
  15. Expand Virtual Machine > Interaction and enable Power Off, Power On, Reset, and Suspend.
  16. Expand Virtual Machine > Provisioning. Enable Allow disk access, Clone virtual machine, Customize, and Deploy template.
  17. Scroll down and enable Read customization specifications. Click OK when done.
  18. Browse to the vCenter object. Permissions must be assigned at the vCenter level. It won’t work at any lower level.
  19. On the right, switch to the Manage tab and select the Permissions sub-tab.
  20. Click the plus icon to add a permission.
  21. Under Users and Groups click Add.
  22. Find the Active Directory account that View will use to login to vCenter, click Add and then click OK.
  23. On the right, under Assigned Role, change it to View Composer Administrator. Then click OK.
  24. The service account is now listed on the Permissions sub-tab.
  25. The service account also must be a local administrator on the vCenter server. In Server Manager, go to Tools > Computer Management.
  26. Go to System Tools > Local Users and Groups > Groups. Double-click Administrators. Add the View service account and click OK.

Active Directory Delegation

View Composer uses an Active Directory account to create computer objects in Active Directory. This service account must be granted permission to create computer objects.

  1. Create an OU in Active Directory where the virtual desktop computer objects will be stored.
  2. In Active Directory Users & Computers, right-click the OU where the computer objects will be stored and click Delegate Control. This wizard is not included in Active Directory Administrative Center.
  3. In the Welcome to the Delegation of Control Wizard page, click Next.
  4. In the Users or Groups page, add the Active Directory service account for View Composer. Then click Next.
  5. In the Tasks to Delegate page, select Create a custom task to delegate and click Next.
  6. In the Active Directory Object Type page, click Next.
  7. In the Permissions page, check the three boxes under Show these permissions.
  8. In the Permissions section, check the boxes next to Read All Properties and Write All Properties.

  9. In the Permissions section, scroll down and check the boxes next to Create Computer objects and Delete Computer objects. Click Next.
  10. In the Completing the Delegation of Control Wizard page, click Finish.

Events SQL Database

A new empty SQL database is needed for storage of View Events. Only SQL authentication is supported.

  1. In SQL Server Management Studio, create a new database.
  2. Name it VMwareViewEvents or similar. Switch to the Options tab.
  3. Select your desired Recovery model and click OK.

  4. Add a SQL login if one does not exist already. Windows authentication is not supported.
  5. Right-click a SQL login and click Properties.
  6. On the User Mapping page, check the Map box next to the VMwareViewEvents database.
  7. On the bottom, add the user to the db_owner database role. Click OK when done.

Licensing

  1. Run the Horizon Administration Console by double-clicking the desktop shortcut. Or, go to https://FQDN/admin.
  2. If Flash is not installed, you are prompted to install it. This won’t work on Windows Server 2012 unless you have the Desktop Experience feature installed. To avoid this, use Chrome.
  3. Login using a Horizon administrator account.
  4. On the left, under View Configuration, click Product Licensing and Usage.
  5. On the top left of the right pane, click Edit License.
  6. In the Edit License window, enter your license serial number and click OK.
  7. The license expiration is now displayed. Note that only Horizon Advanced and above have Application Remoting (published applications).

Administrators

  1. On the left, expand View Configuration and click Administrators.
  2. On the right, click Add User or Group near the top.
  3. In the Add Administrator Or Permission page, click Add.
  4. Enter the name of a group that you want to grant permissions to and click Find.
  5. After the group is found, click it to highlight it and click OK.
  6. Then click Next.
  7. Select the role (e.g. Administrators) and click Next.
  8. Select an access group to which the permission will be applied and click Finish. Note: If you intend to integrate with VMware Identity Manager, then only pools in the root Access group will sync with Identity Manager. Other Access Groups won’t work.

Help Desk

None of the built-in roles are useful for Help Desk. Create a new role.

  1. On the right, switch to the Roles tab and click Add Role.
  2. Name the role Help Desk or similar.
  3. Check the box next to Console Interaction and scroll down.
  4. Check the box next to Manage Machine and click OK.
  5. To further restrict Help Desk permissions, on the Access Groups tab, create an Access Group. Pools can be placed in an Access Group and if an administrator only has permission to one Access Group then pools in other access groups cannot be managed. Note: If you intend to integrate with VMware Identity Manager, then only pools in the root Access group will sync with Identity Manager. Other Access Groups won’t work.

  6. Switch back to the Administrators and Groups tab and click Add User or Group.
  7. In the Add Administrator Or Permission window, click Add, find your Help Desk group and click Next.
  8. Click the Help Desk role to highlight it and click Next.
  9. Check the box next to an Access Group to which the permissions will be applied and click Finish. Note: If you intend to integrate with VMware Identity Manager, then only pools in the root Access group will sync with Identity Manager. Other Access Groups won’t work.
  10. The group is added to the list and the role is shown on the right.

vCenter and View Composer

If you are adding multiple vCenter servers, make sure each vCenter Server has a Unique ID. In vSphere Web Client, go to the vCenter Server > Manage > Settings > General > Edit > Runtime Settings and confirm that the ID is unique for each vCenter server.

  1. On the left, expand View Configuration and click Servers.
  2. In the right pane, in the vCenter Servers tab, click Add.
  3. In the Server address field, enter the FQDN of the vCenter server.
  4. In the User Name field, enter the Active Directory account that View will use to login to vCenter as detailed earlier in this post. Also enter the password.
  5. Click Next.
  6. If you see a message regarding invalid certificate, click View Certificate.
  7. Then click Accept.
  8. In the View Composer page, select Standalone View Composer Server. Enter the FQDN of the server and the credentials of an account to access the View Composer server. The service account must be a local administrator on the View Composer Server. Click Next.
  9. If you see an invalid certificate, click View Certificate.
  10. Then click Accept.
  11. In the View Composer Domains page, click Add.
  12. Enter the Full domain name of where the virtual desktop computer objects will be created.
  13. Enter the Active Directory service account credentials that has permission to create computer objects and click OK. Then click Next.
  14. In the Storage page, check the box to Enable View Storage Accelerator and increase the host cache size to 2048.
    1. View Storage Accelerator is required for Instant Clones.
    2. View Storage Accelerator causes digest files to be created thus increasing disk space requirements.
  15. Reclaim VM disk space requires IOPS during its operation. It is not needed for Instant Clones. Click Next.
  16. In the Ready to Complete page, click Finish.

Instant Clone Domain Admins

If you plan to use Instant-Clone to create non-persistent virtual desktops, add an administrator account that can join machines to the domain.

  1. On the left, expand View Configuration and click Instant Clone Domain Admins.
  2. On the right, click Add.
  3. Select the domain.
  4. Enter credentials of a service account that can join machines to the domain. Click OK.

Disable Check Origin

Horizon 7 might not accept your load balanced DNS name unless it’s the same name configured in the Connection Server’s Secure Tunnel configuration. You can change this behavior by disabling Origin Check as detailed at VMware 2144768 Accessing the Horizon View Administrator page displays a blank error window in Horizon 7.

Disable Secure Tunnel

By default, Horizon Clients connect to virtual desktops by tunneling through a Horizon Connection Server. It would be more efficient for the Horizon Clients to connect directly to the virtual desktops.

  1. In View Administrator, on the left, expand View Configuration and click Servers.
  2. On the right, switch to the Connection Servers tab.
  3. Click the Connection Server and click Edit.
  4. On the General tab, uncheck the box next to HTTP(S) Secure Tunnel. Also, make sure the other Secure Gateways are not enabled. Click OK. Note: if you are using Blast internally then disabling the gateway will cause Blast connections to go directly to the Agent and the Agent certificate is probably not trusted.

Event Database and Syslog

  1. On the left of Horizon Administrator, expand View Configuration and click Event Configuration.
  2. On the right, under Event Database, click Edit.
  3. Enter the name of the SQL server.
  4. Select Microsoft SQL Server as the Database type.
  5. Enter the name of the database.
  6. Enter the SQL credentials (no Windows authentication).
  7. Optionally, enter VE_ (or similar) for the Table prefix. This allows you to use the same Events database for multiple View installations.
  8. Click OK.
  9. The View Administrator now shows it configured. You can change the age of events shown in View Administrator.
  10. To add a syslog server, look on the right side of the page.
  11. You can go to Monitoring > Events to view the events in the database.

Event Database SQL Index

VMware Knowledgebase article – The Event database performance in VMware View 6.0.x is extremely slow (2094580): Symptoms:

  • The Event database performance in VMware View 6.0.x is extremely slow when browsing within View
  • High CPU usage on the SQL server, hosting the Event database
  • The larger the Event database becomes, the slower the queries run.

To resolve this issue, create an index. Run this command on your SQL Event database:

CREATE INDEX IX_eventid ON dbo.VDIevent_data (eventid)

Substitute VDIevent_data for the table name using your Event database prefix.

Event Queries

VMware Fling – Horizon View Event Notifier: collects and sends the alerts via email (SMTP) to users that are specified during the configuration process. It allows aggregation of alerts across multiple Horizon View Pods and for near real-time alerting of Horizon View alerts that are otherwise very difficult to be notified on.

Chris Halstead – VMware Horizon View Events Database Export Utility: this utility allows administrators to easily apply very detailed filtering to the data and export it to .csv. You can filter on time range,  event severity, event source, session type (Application or Desktop), Usernames and Event Types.  The application allows for extremely granular export of data.   The exported columns can also be customized and the application will export data from both the live and the historical tables in the View Events Database.

VMware Knowledgebase article – Creating SQL views to retrieve the top 50 maximum number of concurrent desktop sessions over a period: This article provides steps to create database views to retrieve the maximum number of concurrent desktop sessions over a period from the event_historical table.

To retrieve the top 50 maximum number of concurrent desktop sessions over a period time from the event_historical table, run this query:

select Count, Time from(select top 50 DOB.<prefix>_data_historical.IntValue as 'Count', DOB.<prefix>_historical.Time as 'Time' from DOB.<prefix>_historical.DOB.<prefix>_data_historical where DOB.<prefix>_historical.EventID = DOB.<prefix>_data_historical.EventID and DOB.<prefix>_data_historical.Name = 'UserCount' and DOB.<prefix>_historical.EventType='BROKER_DAILY_MAX_DESKTOP order by DOB.<prefix>_historical.Time DESC) A Order by Time

Where <prefix> is the prefix for the event table. You can find the prefix that you must use by examining other view definitions, such as user_events.

Global Settings

  1. On the left, under View Configuration, click Global Settings.
  2. On the right, under Global Settings, in the General section, click Edit.
  3. Set the View Administrator Session Timeout. This applies to administrators and help desk. 4320 minutes (72 hours) is the maximum.
  4. Forcibly disconnect users is an active session timeout. It is not an idle timeout in that it doesn’t care if the user is working or not. The default is 10 hours so consider increasing it. Note: this timer does not log the user out of Windows. Instead it merely disconnects the user and requires the user to logon to Horizon Connection Server again.
  5. Under Client-dependent settings, you can set an idle timeout. This is new in Horizon 6. The idle timeout applies to applications only (not desktops). An additional disconnect timeout is configurable in each pool’s settings.
  6. Enable automatic status updates enables automatic updating of the table displayed in the top-left corner of View Administrator.
  7. Make other changes as desired. Click OK when done.
  8. To configure an idle timeout for desktop sessions, use the instructions in http://myvirtualcloud.net/?p=872. Or create a screensaver. http://communities.vmware.com/message/1756450?tstart=0

Global Policies

  1. By default, Multimedia Redirection is disabled. You can enable it by going to Policies > Global Policies.
  2. On the right, click Edit Policies.
  3. Set Multimedia redirection to Allow and click OK. Notice that Multimedia redirection is not encrypted.

Authentication

How to Set Up 2-Factor Authentication in Horizon View with Google Authenticator:

  1. Linux box with Likewise joined to Active Directory.
  2. Google Authenticator software installed on Linux
  3. Freeradius installed on Linux
  4. Configure View to authenticate with RADIUS
  5. Installation and configuration of Google Authenticator client

Backups

  1. On the left, expand View Configuration and click Servers.
  2. On the right, in the Connection Servers tab you can select a Horizon Connection Server and click Backup Now. Backups can be found in C:\ProgramData\VMware\VDM\backups.
  3. If you Edit the Horizon Connection Server, on the Backup tab you can schedule automatic backups. This also backs up the View Composer database but not the vCenter database. VMware 1008046 – Performing an end-to-end backup and restore for VMware View Manager.

Related Pages

↧
↧

VMware Horizon 7 Security Server

March 26, 2016, 6:13 am
$
0
0

Navigation

Preparation

Security Servers are intended to be deployed in the DMZ.

Horizon View Security Server is installed on Windows. If you prefer a Linux appliance, see VMware Access Point.

Security Considerations for Horizon View 5.2 – http://www.vmware.com/resources/techresources/10371

Firewall Ports

If there is only one Security Server in the DMZ, create a NAT’d public IP to the Security Server. Create a public DNS entry that resolves to this IP address.

If there are two Security Servers and you intend to load balance them, create three public IPs:

  • Public IP NAT’d to the load balancer IP. Create a public DNS entry that resolves to this IP address. This is the DNS name that users will enter into their Horizon Clients.
  • Public IP NAT’d to each of the Security Servers. Each Security Server must be exposed directly to the Internet. Create public DNS names that resolve to these public IPs. When installing Security Server, specify these public DNS names and not the load balanced DNS name.

Note: your load balancer might be able to provide persistence across multiple port numbers and thus there’s no need for the server-specific public IPs. For example, in NetScaler this is called Persistency Groups.

Firewall Rules for View Connection Server at pubs.vmware.com.

Open these ports from any device on the Internet to all Security Server and Load Balancer public IPs:

  • TCP 80
  • TCP and UDP 443
  • TCP and UDP 4172. UDP 4172 must be opened in both directions.
  • TCP and UDP 8443 (for Blast Extreme)

Open these ports from the Security Servers to internal:

  • If IPSec is enabled in View Administrator (Global Settings > Security > Edit), open ISAKMP Protocol (UDP 500) and ESP. Or if there is NAT between the Security Server and the Connection Server, open NAT-T ISAKMP (UDP 4500). Configuring a Back-End Firewall to Support IPsec at pubs.vmware.com.
  • TCP 8009 (AJP13) to the paired internal Horizon 6 Connection Server.
  • TCP 4001 (JMS) to the paired internal Horizon 6 Connection Server.
  • TCP and UDP 4172 (PCoIP) to all internal Horizon View Agents. UDP 4172 must be opened in both directions.
  • TCP 32111 (USB Redirection) to all internal Horizon View Agents.
  • TCP and UDP 22443 (HTML Blast) to all internal Horizon View Agents.
  • TCP 9427 (MMR) to all internal Horizon View Agents.
  • TCP 4002 for Enhanced Messaged Security – Change the JMS Message Security Mode to Enhanced at pubs.vmware.com

Pairing Password

  1. In View Administrator, on the left, expand View Configuration and click Servers.
  2. On the right, switch to the Connection Servers tab.
  3. Select the Horizon Connection Server to which the Security Server will be paired. Then click More Commands and click Specify Security Server Pairing Password.
  4. Enter a password and click OK.

Install – Security Server

  1. Ensure the Horizon Security Server has 10 GB of RAM and 4 vCPU.
  2. Login to the Horizon Security Server.
  3. Go to the downloaded Horizon 7 Connection Server and run VMware-viewconnectionserver-x86_64-7.002.exe.
  4. In the Welcome to the Installation Wizard for VMware Horizon 7 Connection Server page, click Next.
  5. In the License Agreement page, select I accept the terms and click Next.
  6. In the Destination Folder page, click Next.
  7. In the Installation Options page, select Horizon 7 Security Server and click Next.
  8. In the Paired Horizon 7 Connection Server page, enter the name of the internal Horizon Connection Server that this Security Server will be paired with. If using a hostname, it must be resolvable (edit the local HOSTS file) to the correct IP. Also, the correct firewall ports are required. Click Next.
  9. In the Paired Horizon 7 Connection Server Password page, enter the pairing password specified earlier and click Next.
  10. In the Horizon 7 Security Server Configuration page, edit the URLs as appropriate. These URLs must be externally accessible. The top URL is a FQDN while the middle URL is an IP address. These can be changed later. Click Next.
  11. In the Firewall Configuration page, click Next.
  12. In the Ready to Install the Program page, click Install.
  13. In the Installer Completed page, click Finish.

SSL

Security Server Certificate

  1. Run mmc, add the Certificates snap-in and point it to Computer > Local Machine. Or run certlm.msc.
  2. Request a new certificate with a common name that matches the FQDN of the HTTPS Secure Tunnel URL or import a wildcard certificate. If using a load balancer, the FQDN must match the load balancer FQDN, not the Security Server FQDN. Also, the private key must be exportable.
  3. Note: the private key must be exportable. You can either click Details to mark the key as exportable or use IIS to create the certificate.
  4. After creating the certificate, try exporting it. If the option to export the private key is grayed out then this certificate will not work.
  5. In the list of certificates, look for the one that is self-signed. The Issuer will be the local computer name instead of a Certificate Authority. Right-click it and click Properties.
  6. On the General tab, clear the Friendly name field and click OK.
  7. Right-click your Certificate Authority-signed certificate and click Properties.
  8. On the General tab, in the Friendly name field, enter the text vdm and click OK. Note: only one certificate can have vdm as the Friendly name.
  9. Then restart the VMware Horizon 7 Security Server service.
  10. If the VMware Horizon View Security Gateway Component won’t start then your certificate doesn’t have an exportable private key. The private key must be exportable.

Global Accepted Ciphers

VMware 2121183 Response to CVE-2015-4000 (a.k.a., Logjam) for Horizon View and Horizon 6 products: The default global acceptance and proposal policies are defined in View LDAP attributes. These policies apply to all Horizon Connection Server instances in a replicated group and all security servers paired with them. To change a global policy, you can edit View LDAP on any Horizon Connection Server instance.

For details about how to navigate to the correct View LDAP attributes, see the topics called Global Acceptance and Proposal Policies Defined and Change the Global Acceptance and Proposal Policies in the View Security guide. Note that although these links point to the 6.2 version of the guide, the topics are the same as those in the 5.2/5.3 and 6.0 versions of the guide.

  • Change the pae-ClientSSLSecureProtocols attribute and the pae-ServerSSLSecureProtocols attribute as follows: 
    pae-ClientSSLSecureProtocols = "\LIST:TLSv1.2,TLSv1.1,TLSv1"

pae-ServerSSLSecureProtocols = "\LIST:TLSv1.2,TLSv1.1,TLSv1"

    This setting enables TLSv1.2 by default, to make use of the new cipher suites you will be adding when you set the next attributes.

  • Change the pae-ClientSSLCipherSuites attribute and the pae-ServerSSLCipherSuites attribute as follows: 
    pae-ClientSSLCipherSuites = "\LIST:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA,
SSL_RSA_WITH_RC4_128_SHA"

pae-ServerSSLCipherSuites = "\LIST:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA,
SSL_RSA_WITH_RC4_128_SHA"

Note that although these cipher suites are shown on separate lines to improve readability, when you edit this attribute, enter the cipher suites on one line with no spaces after the commas.

Also note that the last cipher suite shown in the list, SSL_RSA_WITH_RC4_128_SHA, should be omitted if all connecting clients support AES cipher suites.

To add 256-bit versions of the cipher suites, follow the instructions in the topic JCE Policy Files to Support High-Strength Cipher Suites in the View Security guide.

SSL Ciphers – Horizon Security Server

This probably only applies to Horizon 6 and older. Sven Huisman: Secure your Horizon View security server: from rating F to A-: see the blog post for detailed instructions.

If this Horizon Security Server is publicly accessible, check it at ssllabs.com.

Disable RC4 – Blast Secure Gateway

VMware 2122359 Disable RC4 on Blast Secure Gateway: RC4 is already disabled in Horizon 6.2 and newer. Follow this procedure for older versions of Horizon View.

  1. Run an elevated text editor and open the file C:\Program Files\VMware\VMware View\Server\appblastgateway\lib\absg-config.js.
  2. Scroll down to line 111 and change :RC4: to :!RC4:.

Load Balancing

See Carl Stalhood – Horizon View Load Balancing

Enable PCoIP Secure Gateway

  1. In View Administrator, on the left, expand View Configuration and click Servers.
  2. On the right, switch to the Connection Servers tab.
  3. Click the Connection Server that is paired with the Security Server and click Edit. Note: you can’t configure this directly on the Horizon 6 Security Server and instead must configure it on the paired Horizon 6 Connection Server.
  4. On the General tab, check the box next to Use PCoIP Secure Gateway for PCoIP connections to desktop. Also, make sure Secure Tunnel and Blast Secure Gateway are enabled. Click OK.

Related Pages

↧

VMware Horizon 7 – Master Virtual Desktop

March 26, 2016, 6:21 am
$
0
0

Use this post to build a virtual desktop that will be used as the parent image or source image for additional virtual desktops.

Navigation

💡 = Recently Updated

Hardware

  1. The virtual desktop pools will use the same hardware specs (e.g. vCPUs, memory size, network label) specified on the master virtual desktop. Adjust accordingly.
  2. Set Memory as desired.
  3. For New Hard disk, consider setting Thin provision.
  4. Make sure the virtual desktop is using a SCSI controller.
  5. The master virtual desktop should be configured with a VMXNET 3 network adapter.
  6. When building the master virtual desktop, you will probably boot from an ISO.
  7. Before using View Administrator to create a pool, ensure the CD/DVD drive points to Client Device and is not Connected. The important part is to make sure ISO file is not configured.
  8. There’s no need for the Floppy drive so remove it.
  9. If you have any Serial ports, remove them.
  10. In Device Manager, after installing VMware Tools, make sure the video driver is VMware SVGA 3D.
  11. If not, you can use the driver at C:\Program Files\Common Files\VMware\Drivers\video_wddm.

Windows

Preparation

  • Partition Alignment. For Windows XP, make sure the partition is aligned. You’ll need to create and partition the disk in advance on another virtual machine and set the partition offset. create partition primary align=1024. Windows 7 doesn’t have this problem.
  • VMware Tools. Install the latest version of VMware Tools and Guest Introspection (formerly known as vShield Endpoint) Driver prior to installing the Horizon 6 Agent.
  • Teradici Audio Driver – https://techsupport.teradici.com/link/portal/15134/15164/Article/1434/Teradici-Virtual-Audio-Driver-1-2-0-Release-Details-15134-1434
  • For the AppVolumes Agent and Imprivata OneSign agent (if applicable), don’t install them until Horizon 6 Agent is installed.

Windows 7 Networking Hotfix

  1. Ensure the vSphere network port group allows a sufficient number of connected virtual machines.
  2. Make sure Windows 7 Service Pack 1 is installed.
  3. Download hotfix 2550978 from http://support.microsoft.com/kb/2550978.
  4. Run Windows6-1-KB2550978.msu.
  5. Click Yes when asked to install the hotfix.
  6. Click Restart Now.

Follow http://support.microsoft.com/kb/315539 to delete ghost NICs

For desktop VMs using VMXnet3 NICs, you can significantly improve the peak video playback performance of your View desktop by simply setting the following registry setting to the value recommended by Microsoft:

HKLM\System\CurrentControlSet\Services\Afd\Parameters\FastSendDatagramThreshold to 1500

[As discussed in a Microsoft KB article http://support.microsoft.com/kb/235257]

Black Screen Hotfix

VMware 2073945 – Reconnecting to the VDI desktop with PCoIP displays a black screen: Request and Install Microsoft hotfix 2578159: The logon process stops responding in Windows.

Power Options

  1. Run Power Options. In Windows 8 and newer, right-click the Start Menu to access Power Options.
  2. Click the arrow to show more plans and select High performance.
  3. Next to High performance, click Change plan settings.
  4. Change the selection for Turn off the display to Never and click Save changes.

System Settings

  1. Domain Join. For linked clones, join the machine to the domain.
  2. In System control panel applet (right-click the Start Menu > System), click Remote settings.
  3. Enable Remote Desktop.
  4. Activate Windows with a KMS license if not already activated. Note: only KMS is supported with View Composer.

Windows Profiles v3/v4 Hotfix

Roaming user profiles are tied to the operating system version so profiles on Windows 8.1-based, Windows 10-based, or Windows Server 2012 R2-based computers are incompatible with roaming user profiles in earlier versions of Windows.

Profiles are compatible only between the following client and server operating system pairs:

  • Windows 10 and Windows Server 2016
  • Windows 8.1 and Windows Server 2012 R2
  • Windows 8 and Windows Server 2012
  • Windows 7 and Windows Server 2008 R2
  • Windows Vista and Windows Server 2008

If Windows 8, install hotfix http://support.microsoft.com/kb/2887239.

If Windows 8.1, ensure update rollup 2887595 is installed. http://support.microsoft.com/kb/2890783

After you apply this update, you must create a registry key before you restart the computer.

  1. Run regedit.
  2. Locate and then tap or click the following registry subkey:
    HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\ProfSvc\Parameters
  3. On the Edit menu, point to New, and then tap or click DWORD Value.
  4. Type UseProfilePathExtensionVersion.
  5. Press and hold or right-click UseProfilePathExtensionVersion, and then tap or click Modify.
  6. In the Value data box, type 1, and then tap or click OK.
  7. Exit Registry Editor.

After you configure the UseProfilePathExtensionVersion registry entry, you have to restart the computer. Then, Windows 8.1 creates a user profile and appends the suffix “.v4” to the profile folder name to differentiate it from version 2 of the profile in Windows 7 and version 3 of the profile in Windows 8. Then, Windows 8.1-based computers that have update rollup 2887595 installed and the UseProfilePathExtensionVersion registry entry configured use version 4 of the profile.

Windows 8 creates a new copy of the user profile and appends the suffix “.v3” in the profile folder name to differentiate it from the original version 2 profile for Windows 7. After that, Windows 8-based computers that have this hotfix installed and the UseProfilePathExtensionVersion registry entry configured use the version 3 profile for users.

Install Applications

Install applications locally if you want them to be available on all virtual desktops created based on this master virtual desktop.

Or you can use a Layering product (e.g. VMware App Volumes, Unidesk) or App Streaming (e.g. ThinApp, Microsoft App-V).

Antivirus

Microsoft’s virus scanning recommendations (e.g. exclude group policy files) – http://support.microsoft.com/kb/822158.

Anti-Virus Practices for VMware View

Sophos

Best Practice for running Sophos on virtual systems

Sophos Anti-Virus for Windows 2000+: incorporating current versions in a disk image, including for use with cloned virtual machines

Symantec

Virtualization best practices for Endpoint Protection 12.1.2 and later

Virtualization best practices for Endpoint Protection 12.1.1 (RU1) and earlier

Symantec Endpoint Protection 12.1 – Non-persistent Virtualization Best Practices

How to prepare a Symantec Endpoint Protection 12.1 client for cloning

Non-persistent desktops:

After you have installed the Symantec Endpoint Protection client and disabled Tamper Protection, open the registry editor on the base image.

  1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\.
  2. Create a new key named Virtualization.
  3. Under Virtualization, create a key of type DWORD named IsNPVDIClient and set it to a value of 1.

To configure the purge interval for offline non-persistent VDI clients:

  1. In the Symantec Endpoint Protection Manager console, on the Admin page, click Domains.
  2. In the Domains tree, click the desired domain.
  3. Under Tasks, click Edit Domain Properties.
  4. On the Edit Domain Properties > General tab, check the Delete non-persistent VDI clients that have not connected for specified time checkbox and change the days value to the desired number. The Delete clients that have not connected for specified time option must be checked to access the option for offline non-persistent VDI clients.
  5. Click OK.

Make the following changes to the Communications Settings policy:

  1. Configure clients to download policies and content in Pull mode
  2. Disable the option to Learn applications that run on the client computers
  3. Set the Heartbeat Interval to no less than one hour
  4. Enable Download Randomization, set the Randomization window for 4 hours

Make the following changes to the Virus and Spyware Protection policy:

  1. Disable all scheduled scans
  2. Disable the option to “Allow startup scans to run when users log on” (This is disabled by default)
  3. Disable the option to “Run an ActiveScan when new definitions Arrive”

Avoid using features like application learning which send information to the SEPM and rely on client state to optimize traffic flow

Linked clones:

To configure Symantec Endpoint Protection to use Virtual Image Exception to bypass the scanning of base image files

  1. On the console, open the appropriate Virus and Spyware Protection policy.
  2. Under Advanced Options, click Miscellaneous.
  3. On the Virtual Images tab, check the options that you want to enable.
  4. Click OK

Trend Micro

Trend Micro Virtual Desktop Support

VDI Pre-Scan Template Generation Tool

Best practice for setting up Virtual Desktop Infrastructure (VDI) in OfficeScan

Frequently Asked Questions (FAQs) about Virtual Desktop Infrastructure/Support In OfficeScan

Horizon Agent

Horizon Agent Installation

Install Horizon Agent on the master virtual desktop:

  1. Only install Horizon Agent after VMware Tools. If you need to update VMware Tools, uninstall Horizon Agent first, upgrade VMware Tools, and then reinstall Horizon Agent.
  2. Check the video driver to make it is VMware SVGA 3D.
  3. Go to the downloaded Horizon 7 Agent and run VMware-viewagent-x86_64-7.0.0.exe.
  4. If you want the URL Content Redirection feature then you must run the Agent installer with the the following switches: /v URL_FILTERING_ENABLED=1
  5. In the Welcome to the Installation Wizard for VMware Horizon Agent page, click Next.
  6. In the License Agreement page, select I accept the terms and click Next.
  7. In the Network protocol configuration page, select IPv4 and click Next.
  8. In the Custom Setup page, there are several features not enabled. Feel free to enable them.
  9. You can install Instant Clone Agent, or View Composer Agent, but not both.
  10. If you want Scanner Redirection then enable that feature. Do the same for USB Redirection. Note: Scanner Redirection will impact host density. Click Next when done making selections.
  11. Click OK to acknowledge the message regarding USB redirection security.
  12. In the Ready to Install the Program page, click Install.
  13. In the Installer Completed page, click Finish.
  14. Click Yes when asked to restart.
  15. To verify installation of the URL Content Redirection feature, check for the presence of C:\Program Files\VMware\VMware View\Agent\bin\UrlRedirection.
  16. There’s also a new IE add-on.
  17. URL Content Redirection is configured using group policy.

User Environment Manager Engine

If you are licensed for User Environment Manager (Horizon Enterprise Edition), install the User Environment Manager Engine.

  1. Make sure Prevent access to registry editing tools is not enabled in any GPO. This setting prevents the FlexEngine from operating properly.
  2. In Windows 8 and newer, open Programs and Features (right-click the Start Menu) and click Turn Windows features on or off.
  3. Select .NET Framework 3.5 and click OK.
  4. Click Download files from Windows Update.
  5. Go to the extracted User Environment Manager 9.0 folder and run VMware User Environment Manager 9.0 x64.msi.
  6. In the Welcome to the VMware User Environment Manager Setup Wizard page, click Next.
  7. In the End-User License Agreement page, check the box next to I accept the terms and click Next.
  8. In the Destination Folder page, click Next.
  9. The Choose Setup Type page appears. By default, the installer only installs the engine. You can click Custom or Complete to also install the console.

  10. In the Choose License File page, if installing on a View Agent then no license file is needed.
  11. Otherwise, Browse to the license file. Then click Next.
  12. In the Ready to install VMware User Environment Manager page, click Install.
  13. In the Completed the VMware User Environment Manager Setup Wizard page, click Finish.

Unity Touch

With the Unity Touch feature, tablet and smart phone users can quickly navigate to a Horizon View desktop application or file from a Unity Touch sidebar. Although end users can specify which favorite applications appear in the sidebar, for added convenience, administrators can configure a default list of favorite applications.

In the Unity Touch sidebar, the favorite applications and favorite files that users specify are stored in the user’s profile. For non-persistent pools, enable Roaming Profiles.

To set the default list of favorite applications:

  1. Navigate to HKLM\Software\Wow6432Node\VMware, Inc.\VMware Unity
  2. Create a string value called FavAppList.
  3. Specify the default favorite applications using format: path-to-app-1|path-to-app-2|path-to-app-3|…. For example:
Programs/Accessories/Accessibility/Speech Recognition.lnk|Programs/VMware/VMware vSphere Client.lnk|Programs/Microsoft Office/Microsoft Office 2010 Tools/Microsoft Office 2010 Language Preferences.lnk

Unity Touch can be disabled by setting HKEY_LOCAL_MACHINE\Software\VMware,Inc.\VMware Unity\enabled to 0.

For more information, see the Feature Pack Installation and Administration guide at http://www.vmware.com/support/pubs/view_pubs.html.

Direct-Connection Plugin

If you wish to allow direct connections to the Horizon 6 Agent, install the Direct-Connection Plugin. This is not a typical configuration since it allows users to bypass the Horizon 6 Connection Servers but is useful if you need to restrict a Horizon 6 Agent to only one Horizon Client.

  1. Run the downloaded Direct-Connection Plugin (VMware-viewagent-direct-connection-6.2-xxx-exe.
  2. In the Welcome to the Installation Wizard for View Agent Direct-Connection Plugin page, click Next.
  3. In the End-User License Agreement page, select I accept the terms and click Next.
  4. In the Configuration Information page, click Next.
  5. In the Ready to install View Agent Direct-Connection Plugin page, click Install.
  6. In the Completed the View Agent Direct-Connection Plugin Setup Wizard page, click Finish.
  7. When running the Horizon Client, enter the FQDN or IP address of the Horizon 6 Agent (virtual desktop).

Composer – Rearm

By default, when View Composer creates linked clones and runs QuikPrep, one of the tasks is to rearm licensing. You can prevent this by setting the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vmware-viewcomposer-ga

SkipLicenseActivation  DWORD           0x1

Dynamic PCoIP Policies

If you wish to change PCoIP Policies (e.g. clipboard redirection, client printers, etc.) based on how the user connects, see VMware Blog Post VMware Horizon View Secret Weapon. The article describes configuring VMware Horizon View Script Host service to run a script to change PCoIP configuration based on the Connection Server that the user connected through. Full script is included in the article.

VMware OS Optimization Tool

  1. Download the VMware OS Optimization Tool VMware fling.
  2. Run the downloaded VMwareOSOptimizationTool_1050.msi.
  3. On the Analyze tab, on the bottom left, click Analyze.
  4. Check both boxes and click Continue to Analyze.
  5. Review the optimizations and make changes as desired. Then on the bottom left click Optimize.
  6. Click the FAILED links for more information.
  7. The History tab lets you rollback the optimizations.
  8. The Templates tab lets you edit the optimizations. You can create your own template or edit an existing template.
  9. Also see VMware 2100337 Improving log in time for floating desktops on DaaS and Horizon View for deletion of ActiveSetup registry keys that slow down 1st login. These optimizations do not appear to be included in VMware’s OS optimization tool.  💡

Snapshot

  1. Make sure the master virtual desktop is configured for DHCP.
  2. If connected to the console, run ipconfig /release.
  3. Run antivirus sealing tasks:
  4. Shutdown the master virtual desktop.
  5. Edit the Settings of the master virtual machine and disconnect the CD-ROM. Make sure no ISO is configured in the virtual machine.
  6. Take a snapshot of the master virtual desktop. View Composer requires a snapshot.

Related Pages

↧
Search

VMware Horizon 7 – Virtual Desktop Pools

March 26, 2016, 6:24 am
$
0
0

This topic details Horizon configuration for Virtual Desktop Agents. RDS Farms are detailed at http://www.carlstalhood.com/vmware-horizon-7-rds-farmspools/.

Navigation

Non-Persistent – Instant Clone vs Composer

In general, use Instant Clone, if possible. Here are some advantages of Instant Clone over Composer:

  • No Composer server needed
  • Faster provisioning and recompose – lower IOPS during these operations
  • Instant Clones are always non-persistent. Composer can be mis-configured to not refresh or delete on logoff.
  • If multiple datastores, rebalance is automatic. With Composer, rebalance is a manual operation.
  • Confusing Composer features like Persistent Disks, Disposable Disks, disk space reclamation, etc. are not needed with Instant Clones. Replica Storage Tiering is still an option for Instant Clone.

Requirements for Instant Clones:

  • Horizon Enterprise licenses
  • ESXi 6 Update 1 or newer
  • Virtual Machine hardware version 11 or newer
  • View Storage Accelerator must be enabled

Limitations of Instant Clones:

  • Virtual Desktops only – RDSH is not supported
  • Floating Pools only – Dedicated pools are not supported
  • No 3D Rendering
  • Like Composer, the master VM snapshot is copied to every LUN containing linked clones. Unlike Composer, an additional machine called the “parent” machine is created on each host and each datastore. These “parent” machines are powered on and consume CPU/Memory/Disk resources.
  • The Master VM and the snapshot used by the Instant Clones cannot be deleted.

Infrastructure Prep

  • Each pool points to one vSphere cluster. 32 hosts maximum. If Virtual SAN, 20 hosts maximum.
  • Ensure vSwitch has sufficient ports for the new virtual desktops.
  • Ensure the VLAN has enough DHCP addresses for the desktop pool.
    • Lower the DHCP lease time too.
  • KMS Licensing is required for Windows 7+ and/or Office 2010+
  • The virtual desktop pools will use the same hardware specs (e.g. vCPUs, memory size, network label) specified on the master virtual desktop. Adjust accordingly.
  • The parent image should be in the same cluster where the linked clone virtual desktops will be created.
  • If Instant Clone:

Disk space:

  • One or more LUNs for storage of the virtual desktops. Maximum of 140 desktops per VMFS5 LUN. 250+ desktops per NFS LUN.
  • By default, Replicas are copied to each LUN that contains virtual desktops. It’s possible to place the Replica and the linked clones on separate LUNs. If you use a dedicated Replica LUN, then there is only one copy of the Replica no matter how many LUNs are used for storing virtual desktops. Note: NFS VAAI requires Replica to be copied to each virtual desktop LUN.
    • If Instant Clone, the “parent” VM on each datastore is powered on and consumes CPU, Memory, and disk space (.vmdk and .vswp).
  • If Composer:
    • Persistent disks can be used to store the user’s profile (but not user-installed applications). To enable Persistent disks, the pool must be Dedicated Assignment. You can place the persistent disks on a LUN that is separate from the linked clones LUN. A better option is to use View Persona or User Environment Manager instead of Persistent disks.
    • Disposable disks. In Dedicated Assignment pools, you have the option of creating Disposable Disks. These disks are always stored with the virtual desktop (you can’t choose a dedicated disposable disk LUN). If you’re planning to frequently refresh the desktops, there’s no point in using Disposable disks.
  • .vswp files. Allocate disk space for memory swap and graphics memory overhead. Any unreserved memory will result in a .vswp file. For example, if the master virtual desktop has 2 GB of RAM configured and none of it is reserved then each linked clone will have a 2 GB .vswp file.

Floating (Non-Persistent) Automatic Desktop Pool

  1. Make sure the master VM is configured for DHCP and is joined to the domain. KMS Licensing is also required.
  2. Ensure Horizon Agent has the imaging component you intend to use. You can install Instant Clone or Composer but not both.
  3. Take a new snapshot of your master image if you haven’t already.
  4. In View Administrator, on the left, expand Catalog and click Desktop Pools.
  5. On the right, you can clone an existing pool. This copies many of the settings from the existing pool into the new pool.
  6. Or just click Add.
  7. In the Type page, select Automated Desktop Pool and click Next.
  8. In the User Assignment page, select Floating and click Next.
  9. In the vCenter Server page, select either View Composer linked clones or Instant clones. Select the vCenter server and click Next.

  10. In the Desktop Pool Identification page, enter a name for the pool. A VM folder with the Pool ID as the name will be created in vCenter. Also, assign the pool to an Access group to restrict delegated administration. Note: If you intend to integrate with VMware Identity Manager, then make sure you select the root Access group. Other Access Groups won’t work. Click Next.
  11. In the Pool Settings page do the following:
    1. Change the selection for Automatically logoff after disconnect to After and specify a disconnect timer.
    2. If View Composer, change the selection for Delete or refresh desktop on logoff to Refresh Immediately. Instant Clones always refresh after logoff.
    3. Scroll down.
    4. Select a default display protocol. New in Horizon 7 is VMware Blast.
    5. If View Composer, enable 3D Rendering if desired.
    6. Increase the number of monitors and resolution. This causes more video memory to be allocated to the VMs.
    7. Check the box next to HTML Access.
    8. Click Next.
  12. In the Provisioning Settings page, enter a naming pattern. You can use {n:fixed=3} to specify the location for the incremented numerals. Make sure the naming pattern does not conflict with any existing machines.
  13. Enter the maximum number of desktops to create. You can create all of them now or wait to create them as users connect. When a user connects to one of these desktops, View immediately creates another desktop (up to the maximum) and powers it on.
  14. Enter the number of spare (idle, unassigned, unused) desktops you want powered on. View maintains this number up to the maximum number of desktops. If Instant Clone, # of spare machines is only used if Timing is set to on demand.
  15. In Horizon 6.2 and newer, the maximum number of desktops per pool is 2,000. Ensure that the DHCP scope has enough addresses for the Max number of desktops specified here. Click Next.
  16. If View Composer, in the Disposable File Redirection page, select Do not redirect disposable files and click Next. Since we’re refreshing the desktops on logoff, there’s no need for a separate disposable disk.
  17. In the Storage Optimization page, if you want to use storage tiering, check the box for Select separate datastores for replica and OS disk. Click Next.
  18. In the vCenter Settings page, most of these are self-explanatory. Click Browse next to each option and make your selection.
  19. If the Parent VM is not showing up in the list then check the box next to Show all parent VMs and click the … next to the VM to see the issue.
  20. For Linked clone datastores, select one or more datastores on which the virtual desktops will be placed. Select your Storage Overcommit preference. Since you are refreshing desktops on every logoff, they should stay small so Unbounded is probably acceptable. VMware recommends no more than 140 virtual desktops per VAAI-enabled LUN. If the LUN is not VAAI enabled, 64 is the maximum. Click OK when done.
  21. For Select Replica Disk Datastores, select one datastore for the replica and then click OK.
  22. Then click Next.
  23. If Instant Clone, View Storage Accelerator and Transparent Page Sharing are enabled by default and can’t be disabled. Storage reclamation doesn’t make sense for Instant Clone.
  24. If View Composer, in the Advanced Storage Options page, be aware of the following:
    • View Storage Accelerator creates digest files, which consumes disk space. Creation of the digest files requires IOPS. Make sure to set the blackout times so that this digest creation does not happen during peak hours.
    • Reclaim VM disk space is not useful for non-persistent desktops.
  25. If you scroll down, there’s a new Transparent Page Sharing Scope. The default is no sharing. Use one of the other options to enable sharing. Click Next.
  26. In the Guest Customization page, next to AD container, click Browse and select the OU where virtual desktop computer objects will be placed.
  27. If View Composer, consider checking the box next to Allow reuse of pre-existing computer accounts. Click Next.
  28. In the Ready to Complete page, you may entitle users now or later. Click Finish.
  29. To check the status of the virtual desktops, go to Catalog > Desktop Pools.
  30. Double-click the pool name.
  31. If you scroll down, the vCenter Server section has a State field.
  32. vSphere Client shows recent tasks.
  33. On the Inventory tab, click Machines (View Composer or InstantClone Details). There’s a refresh button.
  34. You can also view the status of the desktops by looking at the Dashboard.
  35. Your VMs should eventually have a status of Available.
  36. If you encounter issues with View Composer, see VMware 2087379 VMware Horizon View Composer help center
  37. If Instant Clone, the Master VM and the snapshot used by the Instant Clones must not be deleted.

vEffort explains how to use PowerCLI to create a desktop pool:

  1. Run Get-Pool > C:\Temp\Get-Pool1.txt to get IDs.
  2. Then run something like the following. 
    Add-AutomaticLinkedClonePool -Pool_id UAT1 -NamePrefix "UAT1-{n:fixed=2}" -Vc_id 40263e00-123e-43481-9a05-99afg09732c3 -Persistence NonPersistent -VmFolderPath /Datacenter1/vm/Desktop Pools" -ResourcePoolPath "/Datacenter1/host/Cluster1/Resources" -ParentVmPath "/Datacenter1/vm/Reference Desktops/GOLD01" -ParentSnapshotPath "Snapshot1/Snapshot2/Snapshot3"-DatastoreSpecs "[Aggressive,OS,data]/Datacenter1/host/Custer1/Storage1" -Composer_ad_id 474cdee0-60dd-447f-bdfr-692rg3f83dbe -UseUserDataDisk $false -organizationalUnit "OU=UAT,OU=,OU=Virtual,OU=Clients" -NetworkLabelConfigFile "C:/Temp/label1.txt" -UseTempDisk $false -MinimumCount 10 -MaximumCount 10 – HeadroomCount 1 -PowerPolicy RemainOn -deletePolicy RefreshOnUse -SuspendProvisioningOnError $false -defaultProtocol PCOIP -allowProtocolOverride $false
  3. For -NetworkLabelConfigFile, see Deploy a Desktop Pool That Uses Multiple Network Labels at pubs.vmware.com.

Entitle Virtual Desktops

To make a pool accessible by a user, it must be entitled.

  1. Go to Catalog > Desktop Pools.
  2. Double-click the pool name.
  3. On the Summary tab, click Entitlements and then Add entitlement.
  4. In the Add Entitlements window, click Add.
  5. Find a group that will have permission to log into these desktops and click OK.
  6. Then click OK.
  7. For a Persistent pool, go to the Inventory tab to see the desktops. Select a desktop and under More Commands click Assign User.
  8. Find the user and click OK. Repeat to assign users to additional desktops.

Add Machine to Pool

  1. On the left, expand Catalog and click Desktop Pools.
  2. On the right, highlight an existing Automated Desktop Pool and click Edit.
  3. Switch to the Provisioning Settings tab and change the Max number of machines. Then click OK.
  4. With Instant Clones, this won’t take very long.
  5. With Composer, it might take a few minutes for the machine to boot a couple times while running QuickPrep.
  6. The pool now has new machines.

Update a Pool

  1. Power on the master/parent virtual desktop.
  2. After making your changes, shut down the master virtual desktop.
  3. Right-click the virtual machine and take snapshot. You must create a new snapshot.
  4. Name the snapshot and click OK.
  5. If you do this often, you’ll need to periodically delete the older snapshots. Right-click the master VM and click Manage Snapshots.
  6. Delete one or more of the snapshots.
  7. In View Administrator, go to Inventory > Pools.
  8. Double-click a pool name.
  9. On the Summary tab, click Push Image and then click Schedule.
  10. Or if Composer, click View Composer and then click Recompose.
  11. In the Image page, select the new snapshot and click Next.
  12. In the Scheduling page, decide when to apply this new image and then click Next.
  13. In the Ready to Complete page, click Finish.
  14. On the Inventory tab, you can click Machines (InstantClone Details) or Desktops (View Composer Details) to check on the status of the push/recompose task. Notice the Pending Image.
  15. For both provisioning methods, the snapshot is copied to each datastore.
  16. For Instant Clone, the snapshot is attached to a Replica, powered on, then powered off. Digest is then computed. Then the Replica is attached to a parent, and the parent is powered on. This takes a bit of time. But the Instant Clones remain accessible until the Replica preparation is complete.
  17. Once Replicas are prepared, for Instant Clones, each machine is rebooted once. While with Composer, each virtual machine is rebooted three times, which can be painful. Composer consumes considerable IOPS and time during Recompose operation. To speed up Recompose, switch to Instant Clones.
  18. Eventually the Pending Image field will be cleared and the desktops are available again.

Host Maintenance – Instant Clones

Since Instant Clones requires parent VMs to be running on every host, you can’t simply put a host in maintenance mode. See VMware 2144808 Entering and exiting maintenance mode for an ESXi host that has Horizon instant clones for instructions to remove a Parent VM from a host. One option is the IcMaint.cmd script included in Horizon 7 Connection Server.

Related Pages

↧

VMware Horizon 7 – Master RDS Host

March 26, 2016, 1:34 pm
$
0
0

Navigation

Use this post to build a Windows Server Remote Desktop Session Host that will be used as the source image for additional cloned Remote Desktop Session Hosts. Or you can build each Remote Desktop Session Host manually using the steps detailed in this post.

Hardware

  • The session host pools will use the same hardware specs (e.g. vCPUs, memory size, network label) specified on the master session host. Adjust accordingly.
  • For 2012 R2, set the vCPUs to 8. For 2008 R2, set the vCPUs to 4. Two is the minimum. See VMware whitepaper for more information.
  • Typical memory for an 8 vCPU session host is 24 – 48 GB (e.g. 32 GB).
  • For New Hard disk, consider setting Thin provision. And increase the size so it can store the locally cached profiles (C:\Users).
  • The session host should be configured with a VMXNET 3 network adapter.
  • When building the master session host, you will probably boot from an ISO. When you are ready to create the pool (RDS farm), ensure the CD/DVD drive points to Client Device and is not Connected. The important part is to make sure ISO file is not configured.
  • There’s no need for the Floppy drive so remove it.
  • If you have any Serial ports, remove them.

NIC Hotplug – Disable

  1. Users could use the systray icon to Eject the Ethernet Controller. Obviously this is bad.
  2. To disable this functionality, power off the virtual machine.
  3. Once powered off, right-click the virtual machine and click Edit Settings.
  4. On the VM Options tab, expand Advanced and then click Edit Configuration.
  5. Click Add Row.
  6. On the left, enter devices.hotplug. On the right, enter false.
  7. Then click OK a couple times to close the windows.
  8. The VM can then be powered on.

VMware Tools

VMware Tools includes the Shared Folders feature, which prevents roaming profiles from being deleted properly. When installing VMware Tools, make sure you deselect Shared Folders so it is not installed.

After installing VMware Tools, open Registry Editor and go to HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order. Look in the ProviderOrder value on the right and ensure that vmhgfs is not listed. If it is, remove it.

Windows

Disable Internet Explorer Enhanced Security Config

  1. In Server Manager, switch to the Local Server page.
  2. On the far right, click the link for On next to IE Enhanced Security Configuration.
  3. Click Off for both Administrators and Users. Click OK.

User Account Control and SmartScreen

This section is optional.

  1. Right-click the flag icon by the clock and click Open Action Center. Or launch it from the Start Menu.
  2. On the left click Change User Account Control settings.
  3. To disable UAC, move the slider down to Never Notify and click OK. Or you can leave it enabled if your security standards require it.
  4. Back in Action Center, on the left, click Change Windows SmartScreen settings.
  5. Make your selection regarding SmartScreen and click OK.

Windows Update

Whenever you deploy a virtual machine from a template and SysPrep is executed during the cloning process, all Windows Update settings are reset. You must reconfigure Windows Update on every new virtual machine (or use group policy).

  1. In Server Manager, click Local Server on the left. Then on the right click the link for Last checked for updates.
  2. On the left, click Change settings.
  3. Check the box next to Give me updates for other Microsoft products when I update Windows and click OK.
  4. Windows Update will automatically start checking for updates.
  5. Install any updates it recommends.

Windows Server 2008 R2 Hotfixes

If this is a Windows Server 2008 R2 session host, at a minimum, request and install the Windows hotfixes listed at Citrix CTX129229 Recommended Hotfixes for XenApp 6.x on Windows Server 2008 R2. Scroll down to the Microsoft Hotfixes section.

Microsoft 2483177 You cannot play back an H.264 video file or an AAC audio file on a computer that is running Windows Server 2008 R2 with the Desktop Experience feature enabled. From the hotfix description: the Desktop Experience feature in Windows Server 2008 R2 does not include decoders for the H.264 and AAC formats.

The following file is available for download from the Microsoft Download Center:

Download the Desktop Experience Decoder Update for Windows Server 2008 R2 package now.

File Sharing

By default on Windows 2012, if Windows Firewall is enabled, then all file shares are blocked. You can’t even connect to C$ from a different machine. To facilitate remote management, consider enabling file sharing.

  1. To enable sharing, by the clock, right-click the network icon and click Open Network and Sharing Center.
  2. On the left, click Change advanced sharing settings.
  3. Select Turn on file and printer sharing.
  4. Select Tun on network discovery.

Windows Firewall – Remote Management

By default, Windows Server 2012 blocks remote management tools. For example, you can’t use Event Viewer on server 1 to access the event logs on server 2.

  1. Run Windows Firewall with Advanced Security.
  2. On the left, click Inbound Rules.
  3. On the right, right-click COM+ Network Access (DCOM-In) and click Enable Rule.
  4. Highlight all three Remove Event Log rules, right-click, and click Enable Rule.

Local Administrators Group

If the Horizon Administrators and members of the Domain Admins group are the same people, then there is nothing to change. Otherwise, add your Horizon Admins group to the local Administrators group.

  1. In Server Manager, open the Tools menu and click Computer Management. Or launch it by right-clicking the Start Button.
  2. Add the Horizon Admins group to the local Administrators group.

Remote Desktop Session Host

Role and Features – Windows Server 2012

If this session host is Windows Server 2008 R2 then skip to the next section.

  1. In Server Manager, open the Manage menu and click Add Roles and Features.
  2. Click Next until you get to the Server Roles page.
  3. Check the box next to Remote Desktop Services and click Next.
  4. Check the box next to Group Policy Management and scroll down.
  5. Expand User Interfaces and Infrastructure and check the box next to Desktop Experience. This adds a bunch of features like Themes, Windows Media Player, Flash, etc.
  6. Check the box next to Telnet Client and scroll up.
  7. Expand Remote Server Administration Tools > Role Administration Tools > AD Delivery Services and AD LDS Tools > AD DS Tools. Check the box next to Active Directory Administrative Center.
  8. To verify Remote Desktop Services licensing, expand Remote Desktop Services Tools and check the box next to Remote Desktop Licensing Diagnoser Tool. Click Next when done.
  9. In the Select role services page, check the box next to Remote Desktop Session Host and click Next.
  10. If desired, click the Restart box, then click Install. Restart is required.

Windows Roles – Windows Server 2008 R2

If this session host is running Windows 2008 R2 then the instructions are slightly different.

  1. In Server Manager, right-click Roles and click Add Roles.
  2. In the Before You Begin page, click Next.
  3. In the Select Server Roles page, check the box next to Remote Desktop Services and click Next.
  4. In the Introduction to Remote Desktop Services page, click Next.
  5. In the Select Role Services page, check the box next to Remote Desktop Session Host and click Next.
  6. In the Uninstall and Reinstall Applications for Compatibility page, click Next.
  7. In the Specify Authentication Method for Remote Desktop Session Host page, select Do not require Network Level Authentication and click Next.
  8. In the Specify Licensing Mode page, select Per User and click Next.
  9. In the Select User Groups Allowed Access to this RD Session Host Server page, click Add. Browse for Authenticated Users (on the local machine) and click Next.
  10. In the Configure Client Experience page, check the boxes for Audio and video playback and Desktop composition. This causes Desktop Experience to be installed. Click Next.
  11. In the Confirm Installation Selections page, click Install.
  12. In the Installation Results page, click Close.
  13. Click Yes when you are prompted to restart now.
  14. Login to the server. Then click Close.

Remote Desktop Licensing Configuration

The only way to configure Remote Desktop Licensing in Windows Server 2012 is using group policy (local or domain). This also works for Windows Server 2008 R2.

  1. For local group policy, run gpedit.msc.
  2. Go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Licensing.
  3. Double-click Use the specified Remote Desktop license servers. Change it to Enabled and enter the names of the RD Licensing Servers. Click OK.
  4. Double-click Set the Remote Desktop licensing mode. Change it to Enabled and select Per User. Click OK.
  5. In Server Manager, open the Tools menu, expand Terminal Services and click RD Licensing Diagnoser.
  6. The Diagnoser should find the license server and indicate the licensing mode. It’s OK if there are no licenses installed on the Remote Desktop License Server.

C: Drive Permissions

The default permissions allow users to store files on the C: drive in places other than their profile.

  1. Open the Properties dialog box for C:\.
  2. On the Security tab, click Advanced.
  3. Highlight the line containing Users and Create Folders and click Remove.
  4. Highlight the line containing Users and Special and click Remove. Click OK

  5. Click Yes to confirm the permissions change.
  6. If you see any of these Error Applying Security windows, click Continue.
  7. Click OK to close the C: drive properties.

Installs

VMware Horizon Agent 7.0.0

View Agent for RDS Hosted Apps Desktops is missing a few features:

  • No Generic USB Redirection. USB Flash Drives and hard drives are supported.
  • No Real-Time Audio Video
  • No serial port redirection
  • No Persona. Instead use VMware User Environment Manager (Horizon Enterprise) or Microsoft’s roaming profiles
  • No Instant-Clones

To install View Agent on Remote Desktop Services, do the following:

  1. Go to the downloaded Horizon 7 Agent x64 7.0.0 and run VMware-viewagent-x86_64-7.0.0.exe.
  2. If you want the URL Content Redirection feature then you must run it from the command line and add the switches: /v URL_FILTERING_ENABLED=1
  3. In the Welcome to the Installation Wizard for VMware Horizon Agent page, click Next.
  4. In the License Agreement page, select I accept the terms and click Next.
  5. If you see a message about Desktop OS Configuration then you need to cancel the installer and install the Remote Desktop Session Host role.
  6. In the Network protocol configuration page, select IPv4 and click Next.
  7. In the Custom Setup page, several features are disabled by default. Feel free to enable them.
  8. If you are building a pool of Remote Desktop Session Hosts then install the VMware Horizon View Composer Agent feature. Note: if you are not building linked clones then don’t select this option or else you won’t be able to select the machine in a Manual RDS Farm in View Administrator.
  9. Click Next when done making selections.
  10. Click OK to acknowledge the USB redirection message.
  11. If you see the Register with Horizon 7 Connection Server page, enter the name of a Horizon Connection Server and click Next. You only see this page if not installing the View Composer Agent.
  12. In the Ready to Install the Program page, click Install.
  13. In the Installer Completed page, click Finish.
  14. Click Yes to restart the server.
  15. To verify installation of the URL Content Redirection feature, check for the presence of C:\Program Files\VMware\VMware View\Agent\bin\UrlRedirection.
  16. There’s also a new IE add-on.
  17. URL Content Redirection is configured using group policy.

User Environment Manager Engine

If you are licensed for User Environment Manager (Horizon Enterprise Edition), install the User Environment Manager Engine.

  1. Make sure Prevent access to registry editing tools is not enabled in any GPO. This setting prevents the FlexEngine from operating properly.
  2. In Server Manager, open the Manage menu and click Add Roles and Features.
  3. In the Features page, select .NET Framework 3.5 and click Next.
  4. In the Confirmation page, click Specify an alternate source path.
  5. Mount or extract the Windows Server 2012 R2 ISO.
  6. Enter the path to the sources folder on the Windows Server 2012 R2 ISO and click OK. Then click Install.
  7. Go to the extracted User Environment Manager 9.0 files and run VMware User Environment Manager 9.0 x64.msi.
  8. In the Welcome to the VMware User Environment Manager Setup Wizard page, click Next.
  9. In the End-User License Agreement page, check the box next to I accept the terms and click Next.
  10. In the Destination Folder page, click Next.
  11. The Choose Setup Type page appears. By default, the installer only installs the engine. You can click Custom or Complete to also install the console.

  12. In the Choose License File page, if installing on a View Agent then no license file is needed. Click Next.
  13. Otherwise, Browse to the license file and then click Next.
  14. In the Ready to install VMware User Environment Manager page, click Install.
  15. In the Completed the VMware User Environment Manager Setup Wizard page, click Finish.

Horizon Agent Load Balancing Script

If you have multiple identical Remote Desktop Services Hosts in a single RDS Farm, by default, VMware Horizon uses a least connections Load Balancing algorithm. You can change this to performance-based Load Balancing by configuring scripts on each RDS Host. See Configuring Load Balancing for RDS Hosts at pubs.vmware.com.

There are only three levels of load: HIGH, MED, and LOW. Within a load level, Horizon selects an RDS server at random.

Do the following to configure the Load Balancing script:

  1. The script must be placed at C:\Program Files\VMware\VMware View\Agent\scripts on every RDS Host. VMware provided a couple sample scripts that you can use. One script only looks at CPU and the other script only looks at Memory. If you write your own script, make sure it exists in this folder on every RDS Host in the RDS Farm.
  2. Open Services and configure the VMware Horizon View Script Host service to run automatically.

  3. Then start the service.
  4. In regedit, go to HKLM\Software\VMware, Inc.\VMware VDM\ScriptEvents\RdshLoad.
  5. Create a new String Value. It doesn’t matter what you name it but the script name is recommended.
  6. Modify the String Value and enter cscript.exe “PathToScript”. For example: cscript.exe "C:\Program Files\VMware\VMware View\Agent\scripts\cpuutilisation.vbs"
  7. After setting the registry value, restart the VMware Horizon View Agent service.
  8. After you later add this RDS Host to a farm, in View Administrator, click the Dashboard view.
  9. Expand RDS Farms, expand the farm and click the RDS Host.
  10. Make sure the Server load is reported.

Antivirus

Install antivirus using your normal procedure. Instructions vary for each Antivirus product.

Microsoft’s virus scanning recommendations (e.g. exclude group policy files) – http://support.microsoft.com/kb/822158.

Symantec

Symantec has a document at Citrix and terminal server best practices for Endpoint Protection detailing best practices when deploying Symantec Endpoint Protection to session hosts.

Virtualization best practices for Endpoint Protection 12.1.2 and later

Virtualization best practices for Endpoint Protection 12.1.1 (RU1) and earlier

Install Applications

Install applications that will be executed on these machines.

VMware OS Optimization Tool

  1. Download the VMware OS Optimization Tool VMware fling.
  2. Run the downloaded VMwareOSOptimizationTool_1050.msi.
  3. On the Analyze tab, on the bottom left, click Analyze.
  4. Check both boxes and click Continue to Analyze.
  5. Review the optimizations and make changes as desired. Then on the bottom left click Optimize.
  6. Click the FAILED links for more information.
  7. The History tab lets you rollback the optimizations.
  8. The Templates tab lets you edit the optimizations. You can create your own template or edit an existing template.

Citrix has published a document with several registry modifications that are supposed to improve server performance. You can access it at http://support.citrix.com/article/CTX131577.

Another list of optimizations can be found at http://www.citrixtools.net/Resources/Articles/articleType/ArticleView/articleId/5610/Windows-2008-R2-Remote-Desktop-and-XenApp-6-Tuning-Tips-Update.aspx.

Seal and Snapshot

  1. Go to the properties of the C: drive and run Disk Cleanup.
  2. On the Tools tab, click Optimize to defrag the drive.
  3. Run slmgr.vbs /dlv and make sure it is licensed with KMS and has at least one rearm remaining.
  4. Run Delprof2 to clean up local profiles. Get it from http://helgeklein.com/download/.
  5. Make sure the master session host is configured for DHCP.
  6. Session hosts commonly have DHCP reservations.

  7. Run antivirus sealing tasks:
    1. Symantec: Run a full scan and then run the Virtual Image Exception tool – http://www.symantec.com/business/support/index?page=content&id=TECH173650
    2. Symantec: run the ClientSideClonePrepTool –http://www.symantec.com/business/support/index?page=content&id=HOWTO54706
  8. Shutdown the master session host.
  9. Edit the Settings of the master virtual machine and disconnect the CD-ROM. Make sure no ISO is configured in the virtual machine.
  10. Take a snapshot of the master session host. View Composer requires a snapshot.

  11. Use can now use Horizon View Administrator to create RDS Farms.

Full Clone Post-Cloning Tasks

If you used vCenter to clone the machine instead of using Horizon Composer, then after the machine is cloned, do the following on the cloned machine:

  1. Static IP – Configure a static IP address (or DHCP reservation).
  2. Windows Update – Run Windows Update. SysPrep always disables Windows Update so you must run it at least once to re-enable it.
  3. Join domain – Join the machine to the domain if SysPrep didn’t do it for you.
  4. Active Directory OU – Move the Active Directory computer object to the correct OU.
  5. Horizon Agent – uninstall the Horizon Agent and reinstall it so it registers with a Horizon Connection Server.
  6. Antivirus – Re-configure antivirus. Instructions vary based for each product. Go to the antivirus vendor’s website and search for a cloning procedure.
  7. Firewall rules – Add the new machine to any firewall rules (PCoIP, Blast) between the Horizon Security Server and Horizon Agents.
  8. View Administrator – In View Administrator, add the new machine to a Remote Desktop Services farm.

 

↧
↧

VMware Horizon 7 – RDS Farms/Pools

March 26, 2016, 3:04 pm
$
0
0

Navigation

Overview

Before following this procedure, build a master RDS Session Host.

This post details VMware Horizon configuration for Remote Desktop Session Host Horizon View Agents. Virtual Desktops are detailed elsewhere.

Before you can publish applications or desktops, you must create an RDS Farm. An RDS Farm is a collection of identical (cloned) Remote Desktop Session Hosts. Applications must be installed identically on every machine in the farm. If you have different applications on different Remote Desktop Session Hosts then these are different RDS Farms.

Horizon supports up to 200 RDS farms, each with up to 200 RDS hosts.

Once the RDS Farms are created, you publish resources from them by either creating a Desktop Pool or an Application Pool or both. When creating a Desktop Pool or Application Pool, all members of the RDS Farm are selected. It is not possible to select a subset of Farm members.

RDS Farms – Linked Clones

You can use View Composer to create RDS linked clones. Here are some missing features and other notes:

  • No Instant Clones.
  • No QuickPrep. Uses SysPrep with Customization Specifications instead. SysPrep is slower than QuickPrep. SysPrep is also performed during Recompose operations.
  • No View Storage Accelerator.
  • No Rebalance.
  • No Refresh. The machines are persistent until you Recompose the farm.
    • The delta disks continue to grow until you Recompose the farm.
    • You can enable Space Reclamation to shrink the delta disks as files are deleted.
  • DHCP is required.

Customization Specification

If you want to use View Composer then SysPrep requires a Customization Specification in vCenter. QuickPrep is not supported with RDS farms.

  1. In vCenter, from the Home page, click Customization Specification Manager.
  2. Click the icon to create a new Customization Specification.
  3. In the Specify Properties page, give the spec a name and click Next.
  4. In the Set Registration Information page, enter your normal settings and click Next.
  5. In the Set Computer Name page, select Use the virtual machine name and click Next.
  6. In the Enter Windows License page, select Per seat and click Next.
  7. In the Set Administrator Password page, enter the local administrator password and click Next.
  8. In the Time Zone page, select the time zone and click Next.
  9. In the Run Once page, click Next.
  10. In the Configure Network page, leave it set to Use standard network settings. Horizon requires the VMs to be configured for DHCP. Click Next.
  11. In the Set Workgroup or Domain page, enter credentials that can join the machines to the domain and click Next.
  12. In the Set Operating System Options page, leave the box checked and click Next.
  13. In the Ready to complete page, click Finish.

Create an Automatic Farm

To create a farm of linked clones, do the following:

  1. Make sure your RDS View Agents have the VMware Horizon View Composer Agent feature installed.
  2. Shut down the master image and take a snapshot.
  3. In View Administrator, on the left, expand Resources and click Farms.
  4. On the right, click Add.
  5. In the Type page, select Automated Farm and click Next.
  6. In the vCenter Server page, select the vCenter Server and View Composer and click Next.
  7. In the Identification and Settings page, enter a name for the Farm. A folder with the same name will be created in vCenter.
  8. Set Default Display protocol to VMware Blast.
  9. For Empty session timeout, set it to 1 minute. For When timeout occurs, set it to Log off. You usually want the session to end when users close all of their applications.
  10. For Log off disconnected sessions, specify a disconnect timer. This is in addition to the idle timer configured in View Configuration > Global Settings.
  11. Check the Enabled box next to Allow HTML Access and click Next.
  12. In the Provisioning Settings page, enter a naming pattern. Make sure the name includes {n:fixed=3} or something like that.
  13. Enter the number of machines to create and click Next.
  14. In the Storage Optimization page, click Next.
  15. In the vCenter Settings page, click Browse next to each option and make a selection.
  16. When selecting a datastore, set the Storage Overcommit to Unbounded. Click OK and then click Next.
  17. In the Advanced Storage Options page, decide if you want space reclamation or not. Space reclamation does reduce disk space but increases IOPS while the operation is occurring. If space reclamation is enabled, also configure a Blackout window so the increased IOPS does not affect production usage. Scroll down.
  18. If you scroll down you’ll see an option for Transparent Page Sharing. By default it is disabled. You can enable it by setting it to Global. This should reduce some memory consumption. Click Next.
  19. In the Guest Customization page, select an OU.
  20. Select a customization specification and click Next.
  21. In the Ready to Complete page, click Finish.
  22. If you double-click the farm, on the RDS Hosts tab, you can see the progress of the farm creation operation.
  23. Since RDS Farms use SysPrep, it will take some time before they become available.
  24. Once the RDS Hosts are created, you publish resources from them by either creating a Desktop Pool or an Application Pool or both.

Add RDS Host to Automatic Farm

  1. On the left, expand Resources and click Farms.
  2. On the right, highlight an existing Automated Farm and click Edit.
  3. Switch to the Provisioning Settings tab and change the Max number of machines. Then click OK.
  4. Since this is based on SysPrep, it will take a while to add the virtual machine. The new VMs reboot several times during the provisioning and customization process.
  5. The farm now has new RDS host(s).

Update an Automatic Farm

  1. Power on the master session host.
  2. After making your changes, shut down the master session host.
  3. Right-click the virtual machine and take snapshot. You must create a new snapshot.
  4. Name the snapshot and click OK.
  5. You’ll need to periodically delete the older snapshots. Right-click the master VM and click Manage Snapshots.
  6. Delete one or more of the snapshots.
  7. In View Administrator, go to Resources > Farms.
  8. Double-click a farm name.
  9. Before beginning the Recompose operation, edit the Farm and on the Provisioning Settings tab consider specifying a minimum number of ready machines during View Composer maintenance operations. If you leave this set to 0 then all machines will be in maintenance mode and nobody can connect until Recompose is complete.
  10. On the Summary tab, click Recompose.
  11. In the Image page, select the new snapshot and click Next.
  12. In the Scheduling page, decide when to apply this new image and then click Next.
  13. In the Ready to Complete page, click Finish.
  14. On the RDS Hosts tab, you can check on the status of the recompose task. Since RDS Farms use SysPrep, this will take a while.

RDS Farms – Manual

To create a manual RDS Farm, do the following:

  1. Make sure the View Composer Agent is not installed on your RDS servers and make sure you saw the screen to register the Agent with a Horizon Connection Server.
  2. In View Administrator, expand View Configuration and click Registered Machines. Make sure your manually-built RDS Host is registered and listed on the RDS Hosts tab.

  3. In View Administrator, on the left, expand Resources and click Farms.
  4. On the right, click Add.
  5. In the Type page, select Manual Farm and click Next.
  6. In the Identification and Settings page, enter a name for the Farm.
  7. Set the Default display protocol to VMware Blast.
  8. For Empty session timeout, set it to 1 minute. For When timeout occurs, set it to Log off. You usually want the session to end when users close all of their applications.
  9. For Log off disconnect sessions, specify a disconnect timer. This is in addition to the idle timer configured in View Configuration > Global Settings.
  10. Check the Enabled box next to Allow HTML Access and click Next.
  11. In the Select RDS Hosts, select one or more identical Remote Desktop Session Hosts. Click Next.
  12. In the Ready to Complete page, click Finish.

Add RDS Host to Manual Farm

  1. On the left, expand Resources and click Farms.
  2. On the right, double-click an existing Farm.
  3. On the right, switch to the RDS Hosts tab and click Add.
  4. Select the new RDS host and click OK.
  5. The farm now has a new RDS host.

Published Desktop

To publish a desktop from an RDS farm, do the following:

  1. In View Administrator, on the left, expand Catalog and click Desktop Pools.
  2. On the right, click Add.
  3. In the Type page, select RDS Desktop Pool and click Next.
  4. In the Desktop Pool Identification page, enter an ID and name. They can be different. Click Next.
  5. In the Desktop Pool Settings page, click Next.
  6. In the Select an RDS farm page, select a farm and click Next.
  7. In the Ready to Complete page, check the box next to Entitle users after this wizard finishes and click Finish.
  8. In the Entitlements window, click Add.
  9. Browse to an Active Directory group and click OK.
  10. Then click Close.
  11. If you go to Resources > Farms, double-click your farm and switch to the RDS Pools tab, you can see which Desktop Pool is associated with this farm.

Published Applications

  1. In View Administrator, on the left, expand Catalog and click Application Pools.
  2. On the right, click Add.
  3. The purpose of this wizard is to publish applications from an RDS Farm and entitle them. The entitlements will apply to all of the applications you select on this page. If you want different entitlements for different applications, run this wizard multiple times and select different applications. Once the applications are published, you can change their entitlements individually. Click Next after selecting one or more applications.
  4. Or you can add an application manually by changing the radio button to Add application pool manually. Notice that Explorer is not one of the listed applications so that one will need to be done manually.
  5. Notice the Entitle users box is checked by default. All of the applications in this list will receive the same entitlements. Click Finish.
  6. Then click Add to select a group that can see these icons. Click OK when done.
  7. You can run the wizard again to publish more applications with different entitlements.
  8. If you double-click one of the application pools, on the Entitlements tab you can change the entitlements.
  9. If you go to Resources > Farms, double-click your farm, and switch to the RDS Pools tab, you can see which Application Pools (published applications) are associated with this farm. Notice you can’t really do anything from here.

Anti-affinity

You can configure Horizon to restrict the number of instances of an application running on a particular RDS host. Here are some limitations:

  • If the user already has a session then anti-affinity is ignored.
  • If the application is launched from within an RDS Desktop then anti-affinity is ignored.
  • Not recommended for Horizon Mobile clients.

See Configure an Anti-Affinity Rule for an Application Pool at pubs.vmware.com.

Do the following to configure Anti-Affinity:

  1. On the left, expand Catalog and click Application Pools.
  2. On the right, edit an existing app/pool.
  3. In the Anti-Affinity Patterns field, enter process names to match. Wildcards are supported. Each match is counted.
  4. In the Anti-Affinity Count field, enter the maximum number of matches that can run on a single RDS Host.

Related Pages

↧

VMware Horizon 7 – Cloud Pod Architecture

March 27, 2016, 8:26 am
$
0
0

Navigation

Planning

Cloud Pod Architecture lets you publish a single icon that load balances connections across multiple pools in multiple pods in multiple sites (datacenters).

  • Global Entitlements – Entitlements are the same thing as icons. When you create an entitlement (local or global), you are publishing an icon from a pool.
    • For local entitlement, the icon is only published from one pool.
    • For global entitlement, the icon can be published from multiple pools. The pools can be in one pod or from multiple pods.
    • Don’t configure both global and local entitlements for the same pool.
    • A single pool can only belong to one global entitlement.
    • Horizon 6.2 and newer supports Global Entitlements for applications. However, it’s one application per global entitlement.
  • Pod Federation – Global entitlements can’t be created until a Pod Federation is created. This federation could be one pod or multiple pods.
    • The pods can be separated into sites. A site can contain multiple pods.
  • Global Load Balancing – Use NetScaler GSLB or F5 GTM to connect Horizon Clients to a globally available Horizon Connection Server. The connected Horizon Connection Server then uses Global Entitlements to select a site/pod/pool.
    • When a user launches a Global Entitlement, the Connection Server selects a pod based on the Global Entitlement Scoping, which can be All Sites, Within site, or Within Pod. This is from the perspective of the Connection Server the user is currently connected to. Horizon will prefer the local pod if possible.
    • Users or groups can be assigned to Home Sites. Global Entitlements can be configured to prefer Home Sites over the normal site/pod selection criteria.
  • Dedicated Assignment – For Dedicated Assignment pools, global entitlement only helps with the initial connection. Once the user is assigned to a desktop then that desktop is always selected. Users are not automatically provided with a desktop from another site if the site containing their dedicated desktop has gone down. The desktop request will fail because the dedicated desktop isn’t available. The administrator could configure a separate Global Entitlement for the users to provide a floating desktop until such time the original site recovers. That floating entitlement should be arranged to deliver desktops from other sites as required.
  • Firewall Ports – The Horizon Connection Servers participating in Cloud Pod Architecture communicate with each other over TCP 22389, TCP 22636, and TCP 8472. Make sure these ports are open.
  • RBAC – View Administrator includes a new administrator privilege: Manage Global Sessions. The regular Administrators role has access to multiple pods. The new Local Administrators role can only manage the local pod.

Limits:

  • Max users = 50,000
  • Max Pods = 25
  • Max Sites = 5
  • Max Horizon Connection Servers = 125

Traffic flow (Rob Beekmans – VMware Horizon View Cloud Pod – unwanted routing?):

  • Use F5 GTM or NetScaler GSLB to connect users to a Horizon Connection Server in any pod. If active/active, use proximity load balancing to control which pod is initially accessed.
  • The Horizon Connection Server looks up the Global Entitlements to determine the destination pod for the Pool.
  • User’s PCoIP session goes through the initially connected Horizon Connection Server and across the DCI (Datacenter Interconnect) circuit to the remote pod. There’s no way to re-route Blast/PCoIP through a Horizon Connection Server in the remote pod. In fact, the Horizon Connection Servers in the remote pod are never accessed. You need sufficient DCI bandwidth to handle this Blast/PCoIP traffic.

Initialize First Pod

  1. In View Administrator, on the left, expand View Configuration and click Cloud Pod Architecture.
  2. On the right, click Initialize the Cloud Pod Architecture feature.
  3. Click OK to initialize.
  4. A status page is displayed.
  5. Click OK to reload the client.
  6. On the left, expand View Configuration and click Cloud Pod Architecture.
  7. On the right, feel free to rename the federation by clicking the Edit button.

  8. On the left, expand View Configuration and click Sites.
  9. On the right, click the Edit button to rename the Default First Site to be more descriptive.

  10. If you click the site to highlight it, you can Edit the Pod in the lower half to make the name more descriptive.

  11. If you add a Replica server after global entitlements are enabled, see Setting up the Cloud Pod Architecture feature on a replicated View Connection Server instance.
  12. See Restoring View Connection Server instances in a Cloud Pod Architecture pod federation.

Additional Pods – Join Federation

  1. Connect to View Administrator in the 2nd pod.
  2. On the left, expand View Configuration and click Cloud Pod Architecture.
  3. On the right, click Join the pod federation.
  4. Enter the name of an existing Horizon Connection Server that is already joined to the federation.
  5. Enter credentials and click OK.
  6. The Join status is displayed.
  7. Click OK to reload the client.
  8. On the left, expand View Configuration and click Sites.
  9. If this pod is in a different site then click Add to create a new site.
  10. Give the site a name and click OK.
  11. Highlight the 1st site.
  12. On the bottom, highlight the new pod and click Edit.
  13. Rename the pod and put it in the 2nd site. Click OK.

Global Entitlements

Do not create both global and local entitlements for the same pool otherwise users might see two icons. Create the local pool, but don’t entitle it. Instead, create a Global Entitlement and add the local pool to it.

  1. In View Administrator, on the left, expand Catalog and click Global Entitlements.
  2. On the right, click Add.
  3. In the Type page, select Desktop Entitlement or Application Entitlement and click Next.
  4. In the Name and Policies page, give the entitlement (icon) a name. For Application Entitlements, it’s one entitlement per application so include the application name.
  5. The Use home site checkbox tells the global entitlement to respect user home sites.
  6. Change the Default display protocol to VMware Blast.
  7. Check the box next to HTML Access.
  8. Make other selections. Click Next.
  9. If creating a Desktop Entitlement then there are more options.
  10. In the Users and Groups page, add users that can see the icon. Click Next.
  11. In the Ready to Complete page, click Finish.
  12. Double-click the new global entitlement.
  13. On the Local Pools tab, click Add.
  14. Select the pools you want to add and click Add. Remember, only one app per Global Entitlement.
  15. Go to another pod and view the Global Entitlements.
  16. On the right, double-click the Global Entitlement.
  17. On the Local Pools tab, click Add to add pools from this pod.

Monitoring

  1. Once Global Entitlements are enabled, a new Search Sessions node is added to View Administrator. This allows you to search for sessions across federated pods.
  2. The Dashboard shows the health of remote pods.

Home Sites

Horizon 7 lets you configure Home Sites from within View Administrator. For Global Entitlements, Horizon will prefer pools in the user’s Home Site before looking for pools in remote sites.

  1. On the left, click Users and Groups.
  2. On the right, switch to the Home Site tab and click Add.
  3. Find a user or group for this home site and click Next.
  4. Select the site to assign the users to and click Finish.
  5. Home Sites can be assigned to both users and groups. User assignments override group assignments.
  6. Each Global Entitlement can have its own Home Site configuration. Double-click a Global Entitlement, switch to the Home Site Override tab, and click Add.
  7. Since you could have a combination of default Home Site for user, default Home Site for group, and Global Entitlement-specific Home Sites, it’s helpful to know which Home Site is effective for each user and Entitlement. On the Users and Groups page, on the Home Site tab, if you switch to the Resolution sub-tab, you can find a user name, click Look Up and see which Home Site is assigned to the user for each entitlement.

Related Pages

↧

EUC Weekly Digest – April 16, 2016

April 16, 2016, 6:53 am
$
0
0

Here are some EUC items that interested me last week.

Citrix

VMware

Other

↧
Viewing all 594 articles
Browse latest View live
Search