Installing Receiver Storefront 1.2 – Standalone, single server

Citrix do love inventing new products!  Even if they then replace ones that work just fine.  Anyway, get used to the fact that Web Interface is going to be retired, because that is the way we’re now going.  Web Interface will not have any new versions – the future is StoreFront!  Or Cloud Gateway Express, I’m a little unclear – to be honest the terms seem to be used interchangeably. 

StoreFront is all new and exciting – and oddly old fashioned.  To be honest it looks oddly like Program Neighborhood!  One word of warning – it does not work at all with Citrix Presentation Server v4.0 because there is no way of disabling launch references, which were only introduced in Presentation Server 4.5.  Just an aside – this test system will be with XenApp 6.0

To be honest, Web Interface is working fine for now, except for the Chromebooks.  Chromebooks do not like Web Interface, they just claim (rightly) they have no Citrix client installed and give you the chance to download an ICA file, which (again rightly) you are informed cannot be opened in Google Docs.  You need StoreFront, and you also need to download the Receiver plug-in from the Google WebStore on your Chromebook.

So this is a quick guide to installing a standalone StoreFront server (just internal in this case, and without any 2 factor authentication) to allow a Chromebook to launch Citrix applications from XenApp.  I should really point out here that should should be just a proof of concept – any serious implementation will have at least two servers and a shared database.  I’m also going to use SQL Express which I would not recommend for live systems if you have full SQL Server available.

Preparation

Login to My Citrix and click Downloads

Choose CloudGateway from the big drop down list.

Select CloudGateway Express from the list.  The other download is the full appliance, and if you have bought that you hopefully know what you are doing!

Choose StoreFront 1.2…

Now you have your installers, prepare the target server:

Install Windows Server 2008 R2 with SP1 – I’ve not tested this on Windows Server 2012.  You might want to save time by installing the Web Server role with the IIS6 management options and ASP.NET as well.

Installing IIS and a secure web site

You can skip this if you wish and go straight to SQL installation, but at this point I am going to get IIS ready. I’ve set up a CNAME record on my internal DNS server called “storefront”, pointing to the server name of this new server. This means I’ll can now use the URL http://storefront, where I see a big graphic saying IIS and wishing me welcome. 

But I want SSL too – StoreFront will have usernames and passwords going through it and really should be secure. I have a Windows Certificate Authority already set up (whose certificates will be trusted by my PCs) so this bit is easy for me. If you don’t have that (and don’t want to put it in place), you could buy a commercial SSL certificate or use a self signed one and make it trusted with Group Policy. But I would consider using SSL somehow.

In my case, I launch “Internet Information Services (IIS) Manager”, then select the server on the left, then SSL Certificates. I created a certificate request (2048-bit), generated a certificate for it on my certificate server, completed the request back on my Storefront box, then added a binding on the default website for https and using my new Certificate. Phew. Now the secure URL https://storefront gives me the nice IIS welcome screen, but with that reassuring “https” in the address bar.

  :-)

Installing SQL Server Express

Unlike the nice simple Web Interface which ran on text files, StoreFront needs a SQL database to work.  Since we are going to install in Standalone mode, the server needs to have an instance of SQL Server on it.  SQL Express 2008 R2 is fine, though SQL Server 2012 is supported as well now.  I’m running SQL Server 2008 R2 Express since I had the installer handy.  Download it (with SP1) and run.  Select “New installation…” to start.

Agree to the License terms when they come up.

On the feature Selection screen, you don’t need the Replication or SDK options. 

Leave it on Named Instance, that should work fine.

Windows Authentication should be okay when it asks about that.  Click the Data Directories tab and make them sensible.  Personally I don’t like the DB files hidden somewhere in Program Files, so I make them like this (but choose whatever you want, this really is about personal preference):

Click Next, Next, Next until it actually installs.

Installing StoreFront 1.2

Extract the installer you downloaded onto your server and run CitrixReceiverStorefront-x64.exe

Agree to .net install if needed

.

Agree to the EULA

And agree to install windows roles if you did not do this earlier and begin the installation

The product should now install ok.

Click Start > Citrix > Citrix Receiver StoreFront

Select Deploy a Single Server.  Note this is greyed out if you don’t have SQL Server running locally.

I put in the URL I previously got working – there, it was worth all the effort after all!

You then get three options: Authentication, Stores, and Receiver for Web.

The only button you can click is Create Service (for authentication), so click it.  You then get three options – here are the explanations from the Citrix Edocs site:

• User name and password : This is explicit authentication. Users enter their credentials when they access their stores.
• Domain pass-through :  This enables pass-through of domain credentials from users' devices. Users authenticate to their domain-joined Windows computers and are automatically logged on when they access their stores. In order to use this option, pass-through authentication must be enabled when Receiver for Windows is installed on users' devices.
• Pass-through from Citrix Access Gateway : With this, users authenticate to Access Gateway and are automatically logged on when they access their stores.

In my case I don’t have an Access Gateway at the moment (though as far as I can tell I am going to need one if I want to use two-factor authentication) and don’t want to use pass-through authentication, so I select User Name and Password to do simple authentication against AD. You might have different needs of course.  It then takes a while creating the service and dumps you back on the first options.  Click Create Store to… well, create the Store.  When prompted, give the store a name:

In this test, I have linked to XenApp, entering a server name and HTTP since this test farm is not using HTTPS.  As it notes, passwords will be send unencrypted.  I have a feeling the security guys are going to encourage me to use HTTPS.

Time to create a site to log into.  Click Create Site…

Lots of stuff appears under the Default Web Site in IIS and I can now go to this URL to access my store:

https://storefront/citrix/StoreWeb/

The first time you go to this it will take an age, though it does speed up.

Very nice.  You seem to get these green bubbles no matter what client you want to use.  I can see a request coming down to customise them at some point though. 

Final configuration of StoreFront

Go back to your server and go into Citrix Receiver StoreFront from the Start Menu again.  You should now see all the options, so clicking Authentication shows you the method you selected.  Feel free to change this if you have changed your mind, or to customise it (by restricting the domains for instance).

Note the option to manage Merchandising Server.  If you have a Merchandising server installed, you can enter its URL here.  If you have no idea what this is, its a virtual appliance (Citrix are obsessed with these at the moment – basically a XenServer or VMware image of a pre-configured Linux VM running an application) which can distribute and update pre-configured clients.  Its a good way to get the new Receiver client out there, which is incidentally a requirement to actually use this on a PC.

Click Stores on the left to look at the Store you created earlier.  The main thing here you might want to do is to configure the server farms which the store will connect to, by selecting Store and clicking Manage Server Farms.  I suppose if you have multiple farms (say, for testing), you might create multiple Store URLs, so the test farms were not connected to the URL your users were logging into.  Note the other options here – an option for configuring Legacy support, so old Agent style clients can connect through the StoreFront system.  You can also connect to Citrix Online and set up Remote Access, which are way beyond this little proof of concept.

Click Receiver for Web and you should see your website.  You probably only need one of these.

Troubleshooting

Just a note in case you are not getting any connections through this, look in the Event Viewer. Under Applications and Services Logs, then Citrix Delivery Services.  If there is lots of errors, panic.

Customising the graphics

You know management will ask about this. 

The jolly green bubbles graphic is here:

c:\inetpub\wwwroot\Citrix\StoreWeb\media\bg_bubbles.jpg

(obviously the path will change depending on the store name and where you based your IIS site, but something like this at least, and there will be one per store).

Feel free to either replace this entirely or to just edit it.  Here, I think this looks perfect…

Hotfix Rollup Pack 1 for XenApp 6 released (finally)

After fixing both killer and smaller bugs on XenApp 6 one at a time for what seems like a year and a half (no, wait, actually its over that…) Citrix has released the first rollup pack of hotfixes for the product. 

This is not a feature pack, so there is nothing “new” as such.  Although if you are running a live XenApp 6 farm with no hotfixes installed the “new” thing will be that it will work.  XenApp 6 had a few new features and importantly was tied to Windows Server 2008 R2 (which was much better for Terminal Services than Server 2008 and a hell of a lot more modern than Server 2003) but frankly was not that stable at release.  There are about 22 public hotfixes out at the moment if you don’t install the Rollup Pack but the hotfix apparently includes all of them.  In fact there are 105 hotfixes listed as being included, many of which were only previously released to those who paid for support and had a specific problem, though since they often replaced each other that overestimates the size of it.  Actually, its only about 28mb but if it has the effect on a XenApp 6 farm that the public hotfixes had it will be essential.

Rollout is per server – every farm server from the Data Collectors down (but not Web Interface, License, etc) needs the install.  Advice from Citrix is to start with the Data Collectors and rollout very quickly from there, and if you have a test server (or better a test farm) you should test there before installing it anywhere else. 

Installation of Hotfixes should be uniform across your farm – the last thing you want is users landing on servers with different patch levels.  Installation Manager is basic but will do just fine as it understands MSP files, which is what you have.

We’re testing now – benchmarking shows no real CPU or Memory difference (positive or negative) between a server with all the public hotfixes vs with the rollup pack – at least on a simple tests of about 50 Office 2010 users.  But experience on XenApp recently would show it is best to take the risk and install patches early – personally I’ll have all servers patches to Rollup Pack 1 in a week.  Just in case.  If you are not convinced, check out the list of fixed issues…

http://support.citrix.com/article/CTX130473

Creating a low disk space alert with EdgeSight

EdgeSight is most useful when it actively alerts you about issues with your farm, rather than keeping it to itself and waiting for someone to notice.  By default it will take in lots of Alerts but not have any useful actions.  If you have not already done this, consider going to Configure > Alerts > Actions and creating an Alert for each event you are bothered about (in Configure > Alerts > Rules), sending an email if nothing else.

By default Edgesight DOES monitor disk space, even in Basic mode.  You can pull off a nice report on free disk space in Browse > System Disk Usage, which is lovely as long as you do this on a regular basis.  If you don’t, and don’t have any other monitoring software, you could have Citrix servers operating with almost no space free. 

This is how to monitor for disk space alerts using the Event Log record a full server will generate anyway:

• In EdgeSight, log in as an Admin and click Alerts (under Company Configuration) > Rules
  
• Click New Alert Rule
• Select System Alerts and click next
• Select Windows Event Log and click Next
  
• Give the rule a name (“Disk Space Alert”?), enter System as the Event Log Name, with Type as “Warning”, Source as “srv” and Event ID as “2013”.  This should match alerts you will get on a Windows system with a full drive.
  
• Click Next and Next (not Finish – you need an Action too), then select the part of the server tree you want to monitor – probably “All” at the top to select everything.  You might need to click this again on the next screen to select it properly.  Do this and click Next again.
• Select “Create a new Alert Action” and click Next. 
• Now you decide what to do – SNMP might be useful here, or sending an alert MS SysOps.  I’m just sending an email, so select “Sent an Email notification”
   
• Enter a name for the Action and a subject, then select an address to send to.  Click Test Action to check you get something.
  
• Click Next and Finish and you should see your new alert under Rules and Actions
• You should now get emails when someone fills your servers up!

Citrix IMA and MFCom services hung at Starting…

Recently we had a bit of a Data Collector Election storm on a XenApp 6 farm, and about the same time noticed that newly built servers joining the farm or being moved from one data centre to another had a problem with the “Citrix MFCOM Service” (MFcom) and “Citrix Independent Management Architecture” (IMAservice) services hung at Starting. 

The initial fix was removing them from the farm and rejoining them, which was a little time consuming.

We later found that if the local host cache (each server has one of these, its a record of the farm it exists in) was recreated, the server should be able to participate in the farm again.  This required the IMA and MFCOM services to be forced to close since they were hung on starting, so we used this script, with an attempt at a graceful stop of the services (with pings to give it time to stop), followed by TASKKILL to make sure the service was over, then a reboot.  Hopefully this will be useful to someone!

Copy the following text into a new batch file and run it (As Administrator, if you use UAC) on a server with hung services, it should sort it out:

sc stop mfcom
ping localhost -n 10 > nul
sc stop CitrixWMIService
ping localhost -n 5 > nul
sc stop imaservice
ping localhost -n 10 > nul
taskkill /IM imasrv.exe /F
taskkill /IM IMAAdvanceSrv.exe /F
taskkill /IM mfcom.exe /F
dsmaint recreatelhc
dsmaint recreaterade
shutdown -r -t 10

 

Thanks to this post for pointing us in the right direction: http://www.szeker.net/2011/02/08/citrix-xenapp-6-0-hotfix-xa600w2k8r2x64003-server-hangs-on-shut-down-problem-mfcom-service-hangs-on-starting/

Creating a Server Monitoring Graph in XenApp 6.0 and 6.5

Knowing what is going on in your Citrix farm is always difficult when there are more than a few users and servers involved.  Edgesight is very useful for this in XenApp, but it does lack a decent Dashboard function so you can tell at a glance what the load is like on your servers.

In previous versions of Citrix I’ve seen people write applications which use MFCOM to find out how many sessions are on each server and write them out to a nice graph – you can then see at a glance whether for instance everyone is on one server, or if a server appears to have rebooted or been left disabled.

 

The way I do this currently is using a PowerShell script, running as a scheduled task.  This then creates image files which I can display in a webpage.

In this earlier article I showed how you could download and install the Citrix components into PowerShell and use it to control the farm.  Its worth doing this, and also using the PowerShell ISE Editor to write your PowerShell scripts.

You should also download something that will let you create graphs from PowerShell.  An easy and free way of doing this is the MS Chart Controls for .NET 3.5 download.  You can download this from here:
http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=14422

The first step is to use Powershell to get a list of the server names that you are interested in, and a list of the active sessions on the farm.  Install the XenApp Powershell SDK from here and run the following from a farm serer. The first line is required to load the Citrix add-ons you just installed to PowerShell:

Add-PSSnapin Citrix*
$filter = 'xen'
$servernames = Get-XAServer | where-object {$_.ServerName -match $filter} | select-object ServerName
$sessionsactive = Get-XASession -Farm | where-object {$_.State -eq "Active" -and $_.ServerName -match $filter}

The value of $filter can be edited to filter on server name – only server names including that string will be measured.  If you set it to just be ‘’, all servers will be used.

This should give you a pair of arrays, $Servernames and $sessionsactive, containing all the names and session details.  Now we can iterate through the server names, finding out the number of active sessions for each on and writing it to another array, then finally sorting that array into alphabetical order by server name:

$servercounts = @{}
foreach ($servername in $servernames)
{
    $countActive = @($sessionsactive | where-object {$_.ServerName -eq $servername.ServerName }| Select-Object SessionId -unique)           
    $servercounts.add($servername.ServerName, $countActive.Count)
}
$servercounts = $servercounts.GetEnumerator() | sort Name

You now have an array called $servercounts.  If you ran it and exported its contents it would look something like this:                      

Name      Value                                                           
----      -----
XEN01     28
XEN02     30
XEN03     31
XEN04     28
XEN05     28
XEN06     29
XEN07     28
XEN08     29
XEN09     27

Finally, time to generate the chart, if that is what you want.  To use the MS Chart Controls (which will need to be installed on the XenApp server too) add these lines to the top of the script:

[void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
[void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms.DataVisualization")

Then add these lines to the end of the script to create the graph and save it to the c: drive as a PNG file.  Note the lines to create a title for it as well, so you know whether the image is out of date:

# create chart object
$Chart = New-object System.Windows.Forms.DataVisualization.Charting.Chart
$Chart.Width = 900
$Chart.Height = 330
$Chart.Left = 10
$Chart.Top = 10

# create a chartarea to draw on and add to chart
$ChartArea = New-Object System.Windows.Forms.DataVisualization.Charting.ChartArea
$Chart.ChartAreas.Add($ChartArea)
[void]$Chart.Series.Add("Data")
foreach ($server in $servercounts)
{
    $dp1 = new-object System.Windows.Forms.DataVisualization.Charting.DataPoint(0, $server.Value)
    $dp1.AxisLabel = $server.Name
    $Chart.Series["Data"].Points.Add($dp1)
}

$title = new-object System.Windows.Forms.DataVisualization.Charting.Title
$Chart.Titles.Add( $title )
$Chart.Titles[0].Text = date
$Chart.SaveImage("c:\Graph\XenAppFarm.png","png")

The script is best being signed (or remove the need for signing in PowerShell scripts) and then needs to be scheduled.  I do this with a scheduled task on a XenApp server, which calls a batch file with contents of:

call powershell -command "& {C:\Graph\Generate.ps1}"

Finally you need a way of viewing the image – I just use a HTML file with an automated refresh, such as this:

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <title>XenApp Farm</title>
    <meta http-equiv="refresh" content="60">
</head>
<body>
    <img src="c:\Graph\XenAppFarm.png">       
</body>
</html>

Just to recap, here’s the whole sample script:

# load the appropriate assemblies
[void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
[void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms.DataVisualization")
Add-PSSnapin Citrix*

# get the server names and sessions
$filter = ''
$servernames = Get-XAServer | where-object {$_.ServerName -match $filter} | select-object ServerName
$sessionsactive = Get-XASession -Farm | where-object {$_.State -eq "Active" -and $_.ServerName -match $filter}

$servercounts = @{}

# count active sessions for each server name
foreach ($servername in $servernames)
{
    $countActive = @($sessionsactive | where-object {$_.ServerName -eq $servername.ServerName }| Select-Object SessionId -unique)           
    $servercounts.add($servername.ServerName, $countActive.Count)
}
$servercounts = $servercounts.GetEnumerator() | sort Name

# create chart object
$Chart = New-object System.Windows.Forms.DataVisualization.Charting.Chart
$Chart.Width = 900
$Chart.Height = 330
$Chart.Left = 10
$Chart.Top = 10

# create a chartarea to draw on and add to chart
$ChartArea = New-Object System.Windows.Forms.DataVisualization.Charting.ChartArea
$Chart.ChartAreas.Add($ChartArea)
[void]$Chart.Series.Add("Data")

# add a data point for each server
foreach ($server in $servercounts)
{
    $dp1 = new-object System.Windows.Forms.DataVisualization.Charting.DataPoint(0, $server.Value)
    $dp1.AxisLabel = $server.Name
    $Chart.Series["Data"].Points.Add($dp1)
}
# set the title to the date and time
$title = new-object System.Windows.Forms.DataVisualization.Charting.Title
$Chart.Titles.Add( $title )
$Chart.Titles[0].Text = date

# save the chart to a file
$Chart.SaveImage("c:\Graph\XenAppFarm.png","png")

Resources used to write the above include:

http://blogs.technet.com/b/richard_macdonald/archive/2009/04/28/3231887.aspx
http://msdn.microsoft.com/en-us/library/system.windows.forms.datavisualization.charting.seriescharttype.aspx

XenApp 6 – Hotfix 068 fixes UI and server capacity issues

Citrix released Hotfix XA600W2K8R2X64068 last week – available here: http://support.citrix.com/article/CTX129741

This interestingly includes several previous hotfixes, including the quite recent public hotfix 056, which improved the stability XenApp 6.0 considerably, especially when combined with Windows 2008 R2 SP1.  This fix therefore now addresses 13 separate issues.

Most interesting in the list of new fixes for me are those relating to screen flickering, windows maximising over the taskbar and poor server performance over about 70 connections:

• Dock bars of published applications might overlap and obscure the local Windows Taskbar. This is the server-side component of the fix. To resolve the issue in its entirety, you must also install a client-side hotfix that contains Fix #206851.
  [From XA600W2K8R2X64068][#210857]

• Certain applications can perform slowly when run in seamless mode.
  [From XA600W2K8R2X64068][#257490]

• The CPU consumption of the winlogon.exe process can be higher than usual and cause new connection attempts to fail once a server hosts 70 connections or more. Eventually, servers can experience a fatal exception and need to be restarted.
  [From XA600W2K8R2X64068][#LA0032]

These issues have been seen on and off since we starting to run large number of user sessions on XenApp 6 servers.  Anecdotally, the issue of the Start Menu being obscured by Citrix sessions is quite widespread (though obviously more of an annoyance than anything).  We know that sessions can flicker when being shadowed using Remote Assistance or SCCM if the client version is older than v12.1 – hopefully this is also fixed now. The last one, servers behaving badly with over about 70 connections, is also just what we have seen, with far less user density (number of user sessions on each server) possible than we expected to be the case from benchmarking. We’ll allow more sessions now and see whether the servers behave better.

Incidentally, the “client-side hotfix that contains Fix #206851” mentioned in some of the issues fixed was included in the Citrix Online Plug-In v11.2 and is presumably in later releases as well.

Installing XenApp 6 Hotfixes

Until Citrix release a proper service pack for XenApp 6 (I’ve heard this might still be months off), having your Citrix hotfixes up to date is really important.  Frankly, there are some killer bugs in the initial release of XenApp 6 – luckily the patching system works well.

Download the Hotfixes from here:

http://support.citrix.com/product/xa/v6.0_2008r2/hotfix/general/public

I build my servers using Altiris, but I have found that using Altiris can be an unreliable way of installing Citrix hotfixes.  Instead I now have a file share with the hotfixes in, together with a batch file that installs them all in one go and then reboots once at the end.  Rebooting after every hotfix is not necessary, although the order they are installed in can be important. 

The script I use is adapted from one written by Paul Johnson which I got from the forum below, so all credit to Paul for sharing this:
http://forums.citrix.com/thread.jspa?threadID=282008

Note that the script I use does not install every hotfix Citrix have released – some fix issues I have not come across yet, others are for other versions or languages only.  Therefore, this might not be a complete script for you – its worth looking at the other hotfixes on the Citrix site.

Anyway, this is the current script!

@echo off
setlocal
Change user /install

echo Installing XenApp6 Hotfix XA600W2K8R2X64002 (CTX126123)...
START /wait msiexec /p \\filesvr01\xenapp$\XenApp6Hotfixes\002-XA600W2K8R2X64002.msp /passive /norestart /Liewa c:\logs\XA600W2K8R2X64002.log
timeout /t 10 /NOBREAK

echo Installing XenApp6 Hotfix XA600W2K8R2X64010 (CTX126490)...
START /wait msiexec /p \\filesvr01\xenapp$\XenApp6Hotfixes\010-XA600W2K8R2X64010.msp /passive /norestart /Liewa c:\logs\XA600W2K8R2X64010.log
timeout /t 10 /NOBREAK

echo Installing XenApp6 Hotfix XA600W2K8R2X64017 (CTX126958)...
START /wait msiexec /p \\filesvr01\xenapp$\XenApp6Hotfixes\017-XA600W2K8R2X64017.msp /passive /norestart /Liewa c:\logs\XA600W2K8R2X64017.log
timeout /t 10 /NOBREAK

echo Installing XenApp6 Hotfix XA600W2K8R2X64029 (CTX127405)...
START /wait msiexec /p \\filesvr01\xenapp$\XenApp6Hotfixes\029-XA600W2K8R2X64029.msp /passive /norestart /Liewa c:\logs\XA600W2K8R2X64029.log
timeout /t 10 /NOBREAK

echo Installing XenApp6 Hotfix XAE600W2K8R2X64020 (CTX127025)...
START /wait msiexec /p \\filesvr01\xenapp$\XenApp6Hotfixes\020-XAE600W2K8R2X64020.msp /passive /norestart /Liewa c:\logs\XAE600W2K8R2X64020.log
timeout /t 10 /NOBREAK

echo Installing XenApp6 Hotfix XA600W2K8R2X64021 (CTX127036)...
START /wait msiexec /p \\filesvr01\xenapp$\XenApp6Hotfixes\021-XA600W2K8R2X64021.msp /passive /norestart /Liewa c:\logs\XA600W2K8R2X64021.log
timeout /t 10 /NOBREAK

echo Installing XenApp6 Hotfix XAE600W2K8R2X64018 (CTX127023)...
START /wait msiexec /p \\filesvr01\xenapp$\XenApp6Hotfixes\018-XAE600W2K8R2X64018.msp /passive /norestart /Liewa c:\logs\XAE600W2K8R2X64018.log
timeout /t 10 /NOBREAK

echo Installing XenApp6 Hotfix XA600W2K8R2X64012 (CTX126679)...
START /wait msiexec /p \\filesvr01\xenapp$\XenApp6Hotfixes\012-XA600W2K8R2X64012.msp /passive /norestart /Liewa c:\logs\XA600W2K8R2X64012.log
timeout /t 10 /NOBREAK

echo Installing XenApp6 Hotfix XA600W2K8R2X64040 (CTX127523)...
START /wait msiexec /p \\filesvr01\xenapp$\XenApp6Hotfixes\040-XA600W2K8R2X64040.msp /passive /norestart /Liewa c:\logs\XA600W2K8R2X64040.log
timeout /t 10 /NOBREAK

echo Installing XenApp6 Hotfix XA600W2K8R2X64056 (CTX128945)...
START /wait msiexec /p \\filesvr01\xenapp$\XenApp6Hotfixes\056-XA600W2K8R2X64056.msp /passive /norestart /Liewa c:\logs\XA600W2K8R2X64056.log
timeout /t 10 /NOBREAK

endlocal
shutdown -r -t 0

I save the script in the same folder as the hotfixes called “installall.bat”.  On a single server I build I’d just run this manually from the console, with a lot of servers to build I would use Citrix’s new Installation Manager (which is basic, but it does work…) to create a new schedule – for instance:

Obviously if a single new update comes out I can then create another batch file to just install that one and reboot, then set Installation Manager to do the whole farm out of hours.

Note that you can then use the Delivery Services Console to find servers which are lacking hotfixes.  To see the servers at a glance…

• Launch the Citrix Services Delivery Console (installed on manually built servers by default)
• Set your farm connection up if needed
• Click your farm name under the XenApp link on the left
• Select the Hotfix Summary tab
• You should now see all your servers, along with a useful count of hotfixes installed

If you then find a server which is missing hotfixes in the Servers section and click its Hotfix Details tab, you should see a list of the installed hotfixes.  So for the server above with only two hotfixes installed, I can go to it and see this is very out of date!

Note if you want to search for a server missing a specific hotfix, Open the DSC, click Search, and select Servers without hotfix:

XenApp 6 and Service Pack 1 for Windows Server 2008 R2

No-one who has had a production XenApp 6 system since mid-last year would claim they have had no issues, but with all the latest hotfixes from MS and Citrix we do seem to be getting closer to stability, and a big part of this is Service Pack 1 for Windows Server 2008 R2. 

This is something of a relief after I tried using the beta of SP1 last year – that broke XenApp altogether!

Citrix have said that they support the use of XenApp 6 with 2008 R2 SP1, and I can confirm that I have SP1 servers in production already and they are working perfectly – well, at least no worse than the non SP1 servers!

Citrix do have a page of known issues with SP1, though they appear to be fixed if you have installed the first XenApp 6 hotfix

Known issues: http://support.citrix.com/article/CTX126711

Hotfix: http://support.citrix.com/article/CTX125388

Apart from any general improvements and security fixes Microsoft have made, there are several which appear to be included in SP1 and are especially useful for XenApp 6 servers:

• KB975777 (delays shutting down systems)
• KB979530 (connections denied during heavy logon and logoff conditions)
• KB980663 (stop error during heavy logon and logoff conditions)
• KB2265716 (server stops randomly if heavily using group policy and SCOM)
• KB2383928 (remote sessions to not completely exit)

I would still install this post-SP1 patch by the way:

• KB2465772 (causes XenApp to stop randomly with lots of 7011 errors about services being unresponsive – a very long standing problem for us)

Personally by the way, I would probably rebuild servers with SP1 installed from the start, rather than add SP1 onto a server which has been in use for a long time.  But then XenApp servers like being rebuilt now and then.

As a note, when I installed Service Pack 1 on a server which was already operational and had the EdgeSight Agent running, I then got an EdgeSight Operational Alert:

Error:  An unrecoverable, fatal database error has occurred.  Shutting down the Citrix System Monitoring Agent.

Nice.  EdgeSight carried on working afterwards though.

Streaming Firefox 3.6 on XenApp 6

This appears to be a surprisingly simple app to stream on XenApp – so far.  My one criticism is that its not very obvious how to customise the application, but after a bit of research it wasn’t too hard.

I’m assuming here you want to turn off any updates (its a stream, so you will need to re-stream it to apply any updates – which given the amount of bugs that are discovered in Firefox is a good idea to do on a regular basis) and you probably want to stop it being the default browser on your systems.  After all, if you DO want it to be the default browser, you are probably not going to stream it – just install it on your XenApp servers properly.

Preparation – getting the files to configure

Step one is to download the latest installer from http://www.mozilla.org/firefox/.  Install it to a PC manually and have it ready to use on your streaming profiler.

Make a copy of this file to edit… C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js
Remember on a 64-bit system this will appear in c:\program files (x86)…

Also get a copy of C:\Program Files\Mozilla Firefox\components\nsBrowserGlue.js

Finally, create a new text file called override.ini.

Put these three text files and the installer together and prepare them before streaming.  Use Notepad++ instead of Notepad so it shows the line breaks properly.

Preparation – disabling the default browser check

Open your firefox.js file in Notepad++ – search for the phrase “checkDefaultBrowser” and change “true” to “false”

pref("browser.shell.checkDefaultBrowser", false);

Preparation – disabling updates

Still editing firefox.js in Notepad++, search for “update”.  Find these lines and change “true” to “false”

pref("browser.search.update", false);

pref("app.update.enabled", false);

pref("extensions.update.enabled", false);

Preparation – pre-configure Proxy settings

Assuming you want to specify Proxy settings, search for “share_proxy_settings” in firefox.js.  Change “true” to “false”

pref("network.proxy.share_proxy_settings",  true);

You now should now add in a load of lines (assuming they are not already in the file) for your proxy settings.  These are just examples – obviously put in your own settings for proxy server address, port and exceptions:

pref("network.proxy.ftp", "192.168.1.10");
pref("network.proxy.ftp_port", 80);
pref("network.proxy.gopher", "192.168.1.10");
pref("network.proxy.gopher_port", 80);
pref("network.proxy.http", "192.168.1.10");
pref("network.proxy.http_port", 80);
pref("network.proxy.socks", "192.168.1.10");
pref("network.proxy.socks_port", 80);
pref("network.proxy.ssl", "192.168.1.10");
pref("network.proxy.ssl_port", 80);
pref("network.proxy.type", 1);
pref("network.proxy.no_proxies_on", "localhost, 127.0.0.1, 192.168.0.0/16");

Preparation – prevent the annoying “Welcome to Firefox version 3.6” home page tab for new users.

By default a user in Citrix running Firefox will see an extra tab when they open it for the first time with a page extolling the virtues of the new version they just installed.  This is not needed!  Add this line to the firefox.js file:

pref("browser.startup.homepage_override.mstone", "ignore");

Preparation – getting rid of the “Do you want to save your tabs” dialog on closing Firefox

You probably want to just want your users to open their home page next time you open the browser, so the functionality to open their old tabs is not needed.  Find and amend these lines in firefox.js to stop these messages:

pref("browser.tabs.warnOnClose", false);
pref("browser.tabs.warnOnOpen", false);
pref("browser.warnOnQuit", true);

// 0 = blank, 1 = home (browser.startup.homepage), 2 = last visited page, 3 = resume previous browser session
// The behavior of option 3 is detailed at: http://wiki.mozilla.org/Session_Restore
pref("browser.startup.page",                1);

Preparation – preventing the “Know your rights” button appearing

By default when you open Firefox it will keep producing a bar under the tabs list with a button called “Know your rights” and some text telling you that this is open source software.  Very annoying, but easy to suppress. 

Edit C:\Program Files\Mozilla Firefox\components\nsBrowserGlue.js in Notepad++ – remove or comment (with “//”) the line:

var rightsBundle = this._bundleService.createBundle("chrome://global/locale/aboutRights.properties");

Preparation – prevent the “Import your settings data data” wizard

The final annoyance, this wizard is launched the first time you open Firefox and isn’t useful in a Citrix environment.  Edit the blank text file called override.ini and add these lines:

[XRE]
EnableProfileMigrator=false

Streaming Firefox

Now you have your installer and your three modified text files (override.ini, firefox.js and nsBrowserGlue.js), install is easy…

1. Open the Citrix Streaming Profiler on your profiler machine.  If you are streaming this to Stream To Server on XenApp 6, this should be a Windows Server 2008 R2 machine
2. Create a new profile
3. Click Next until you get to the Quick or Advanced Install option – choose Advanced
4. Click Next and Next to run an install program
5. Browse to your Firefox installer and select it.  Click next and Launch Installer.
   
   
6. Click Next, Custom, and keep pressing Next until you get to the default web browser checkbox-  uncheck it so its not the default.
   
7. Click Next to install.  Untick the box to Launch Firefox Now and click Finish
8. Click Next and Perform Additional Installations
9. Click Select files and folders and click Next
10. On the left hand side browse to the text files you edited earlier
    
11. Copy firefox.js into the profile at “C:\Program Files (x86)\Mozilla Firefox\defaults\pref”, overwriting the existing file
12. Copy nsBrowserGlue.js into the profile at “C:\Program Files (x86)\Mozilla Firefox\components”, again overwriting the existing file
13. Copy override.ini into the profile at “C:\Program Files (x86)\Mozilla Firefox\” – this should be a new file
14. Click Next and Finish Installations
15. Click Next and run Firefox.  You should now be able to check the settings you specified above on updates, default browser, wizards, etc – it should all be pre-configured if the files are right.
16. Close Firefox and click Next.
17. You can probably delete the entry for “Mozilla Firefox (Safe Mode)
    
18. Click Next and Finish, then save your profile on a network location.
19. Publish an application to your farm, streamed from the profile you just saved – you should get a nice, clean, pre-configured browser.

Shadowing in XenApp 6

The ability of an administrator or helpdesk to shadow their users is about as basic as it gets – a system like XenApp used to distribute applications remotely is unlikely to be serving a group of people in one room.  Yet bizarrely this feature, hardly recent addition to Citrix’s offering, has had quite profound problems in XenApp 6.

Broadly, there are a couple of issues.  The first is the Citrix client – versions 11.2 and 12.0 of the online plug-in had serious problems regarding shadowing which have only just been fixed in v12.1, which I am now recommending for anyone who might shadow a user.  The second is the heady technology that is having two monitors.  Basically, it would appear shadowing was only ever tested on machines with a single monitor – either that or Citrix released XenApp 6 knowing it had a major broken feature.

In my initial test environment when I started evaluating XenApp 6 I was using the v11.2 client on a pair of PCs with two monitors each so you can understand my initial estimate was the shadowing was in fact completely impossible.

The Client bug

The v11.2 and v12.0 online plug-ins do appear to support shadowing – mostly.  But when it connects it often only displays part of the user’s screen, with the image clipped at the sides and no way of scrolling, and sometimes it just closes immediately with an Error 120 messagebox.  This was not limited to XenApp 6, I had it on an old Presentation Server 4.0 farm. Apparently there was a workaround to publish the admin console as a non-seamless application, though the v11.0 client usually worked and the new 12.1 client does too. 

Basically, upgrade the helpdesk users to 12.1 and the clipping issue should go away.

The Dual Monitors bug

Ah, the biggie.  Basically, if the user being shadowed OR the user doing the shadowing has more than one monitor, you cannot shadow their seamless applications.  Pretty basic, really. 

Shadowing from a PC with one monitor to one with two gives the useful error “Error 7044 – The request to control another session remotely was denied”:

This sounds like an access issue, but it isn’t.  Its been denied because its not possible.  If you shadow from a PC with two monitors to one with a single monitor you get the real error - “Error 120 – this function is not supported on this system”.  Because it isn’t.

 

I’ve raised this with Citrix – they say its a Microsoft issue with shadowing on 2008 R2.  I build a Server 2008 R2 Remote Desktop Services server hosting seamless applications through a web interface and it does indeed do exactly the same thing – sessions started on a PC with two monitors cannot be Remotely Controlled – you get told “Access is denied”.

Nice. So I raise it with Microsoft Support who say this is “by design”, not a bug.  Though it might be “redesigned” in the future.  Its actually easy to fix on RDS:

• On each RDS server, open “Remote Desktop Session Host Configuration”
• Right click RDP-Tcp, select Properties
• Select Client Settings
• Change the maximum number of monitors to 1. 

Not much good if you specifically want a two monitor Terminal Services session, but it will work for seamless apps.  Anyway, the same fix does nothing for XenApp I’m afraid.

Enough of this nonsense.  These workarounds suggest themselves for XenApp 6 which will get shadowing possible in most cases:

1. Make sure your admin people have the v12.1 online plug-in
   
2. Publish your XenApp management tools as a Desktop, or even better as a non-seamless application.  This will get around problems caused by your helpdesk and admin staff having two monitors.  You can see instructions on how to force a single published application to be “windowed” rather than seamless here: http://forums.citrix.com/thread.jspa?threadID=265084&tstart=0.  But basically you edit the conf\default.ica file in each site on your web interface box to include some extra lines, starting with the name of the published app in square brackets, such as:
   
   [XenApp Console]
   TWIMode=Off
   ScreenPercent=85
   
3. If a dual monitor user calls up and asks to be shadowed, tell them to close their Citrix applications, disable all but one monitor and launch them again!  Just kidding, though that would work…
   
4. Ask said user to launch a published desktop which you have configured to be of a specific size – say 1024x768 or 90%.  If this has a Citrix client in it, they can launch apps there and you will be able to shadow the desktop and see its contents.
   
5. Alternatively, get them to temporarily change their client to open all apps in a specific window size rather than seamless.  So, if they use the online plug-in, right click its icon, select Options, Session Options and select a Window Size:
   
   …or if they use the Web Interface, get them to go to Preferences, Session Settings and select the Window Size there instead:
   
   

The next session they start you should be able to shadow. 

This is, of course, all a bit rubbish.  Hopefully it will get fixed soon, whether its a Citrix or Microsoft fix.

UPDATE 20/05/2011

Thanks for the comments below – I had meant to update this entry anyway.  We did make some progress on this, though it wasn’t great.  We found that indeed Remote Assistance works fine, so have been using it on clients with two monitors.  We also found that the v12.0 client was rubbish for this as well (the XenApp sessions work initially when shadowed but then start flashing dramatically – this is fixed with a v12.1 upgrade).  At least the users could be shadowed, at least the ones on the network could.  Not much use for someone on a remote PC not on our LAN though.

The comment below about using Remote Assistance to the server session is interesting though.  I’m off to experiment now…

Publishing explorer.exe in XenApp 6

Publishing windows explorer is something that I never thought was a good idea – but some people seem to like it!  It is to be fair a nice, simple alternative a published desktop if people want to just open their documents and then double click on a file.

Its supposed to just be a case of publishing a Hosted application shortcut to c:\windows\explorer.exe, with a parameter of the drive letter or path you want it to default to, like this to start in the h: drive:

It should be that simple.  But it isn’t.  By default this will only stay open if there is another program keeping the session open – if it is launched first (which it would be, logically) it closes after an instant. 

There is a registry fix from Citrix support though for this, which I found on this forum post: http://forums.citrix.com/message.jspa?messageID=1461520.

Create a DWORD (32 bit) setting called LogoffCheckerStartupDelayInSeconds with the value 10 at this location:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI

If you want a reg file to just import to fix this, copy the following text into a text file and save it with a .reg extension:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI]
"LogoffCheckerStartupDelayInSeconds"=dword:00000010

Fixing session reconnect in XenApp 6

Something I had noticed on a XenApp 6 farm I have running with a small number of servers recently was that the sessions were not reconnecting properly, especially when they had been created from different workstations.  This is an issue for us as our users tend to move about, and the ability to migrate sessions is important.  Disconnected sessions also needlessly take up memory on servers.

At first I thought this was just an occasional issue, then I found I could reproduce it by opening an application using the Online Plug-in (the Agent!), then selecting “Disconnect Online Sessions”, then “Reconnect Online Sessions”.  This should obviously give me my sessions back, instead I got the message “There are no sessions available for reconnection”.

This may have been made worse by our using Passthrough Authentication.  Anyway, I checked the web interface cluster and it had lots of this error for all the servers:

Event ID: 30105

Event Description:

Site path: C:\inetpub\wwwroot\Citrix\PNAgent.

The Citrix servers do not trust the server. This message was reported from the XML Service at address http://xensvr02:80 [com.citrix.xml.NFuseProtocol.RequestReconnectSessionData]. 

This is something I remember fixing in Citrix Presentation Server v4.0, only of course the setting in XenApp 6 has moved.

In the Delivery Services Console, I selected Policies, the Computer tab, and the Unfiltered policy, which in my case is still the only policy.  I selected this policy, clicked edit and Next.

First, I checked that Auto Client Reconnect was set to “Allowed”, though since this is the default setting I doubt that made any difference.  Just to be sure I set it to Allowed and clicked OK.

 

The important setting though is the XML service.  Scroll down the list on the left to XML Service and select the policy “Trust XML Requests”.  Click Add and set the policy to Enabled.

The other policy setting – XML Service Port – does not need configuring get this functionality working.

I then ran gpupdate on the servers with disconnected sessions and attempted to reconnect – this worked immediately.

I’m not sure why the default configuration for XenApp 6 appears to be for session reconnection to be essentially broken, at least for users with the Online Plug-in and Passthrough Authentication.  I also have not made any attempt to make sure that “only trusted services communicate with the Citrix XML Service”.  I am assuming here that this would involve making sure only our Web Interface servers could communicate with the XML Service using firewall rules, so that might be something to consider next time we review our firewall policies.

This page does appear to confirm that this is the correct fix for a system with Passthrough Authentication clients who want session roaming…

http://support.citrix.com/proddocs/index.jsp?topic=/xenapp6-w2k8-admin/ps-sf-citrix-xml-service-port-set-v2.html

Notes on PowerShell in XenApp 6

Powershell v2 comes installed by default on Windows Server 2008 R2.  Citrix have followed Microsoft’s example with products such as Exchange in providing a fairly thorough set of commands in Powershell to monitor and administer the farm.  And with the loss of MFCOM as a way of command line farm administration, its become an essential skill.  Personally I have no real need at the moment to use Powershell for actions such as publishing applications as our environment is still small enough to be faster to administer with the Delivery Services Console, but for any mass change to the farm the command line will become far faster and for monitoring, its great.
To easily be able to use PowerShell to administer XenApp 6, first you need to download and install the SDK.  And I like to have my admin tools as published apps, so this is how to create a XenApp 6 PowerShell based management application as a hosted application on your farm:
Publishing the PowerShell console with XenApp commands

• Download the XenApp Powershell SDK : http://community.citrix.com/display/xa/XenApp+6+PowerShell+SDK
• Extract and execute the installer
• Agree to change the execution level to AllSigned
• Publish an application to this server with the following location:
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoExit -File "c:\Program Files\Citrix\XenApp Server SDK\Citrix.XenApp.Sdk.ps1"
• Launch your new editor
• By default it will not be set up to recognise XenApp commands while editing, so use the command:
  Add-PSSnapin Citrix*
  
   

Publishing the PowerShell ISE Editor
You can use Notepad to edit your PowerShell scripts – but that’s not very fun so let’s publish an application “Windows PowerShell Integrated Scripting Environment (ISE)”. This is a very good editor for developing PowerShell scripts, with a nice window to run them in and some basics like automatic colouring of your code.  Of course, you can skip this if you like Notepad…

• Login to your XenApp 6 server
• Go to Command Prompt
• Enter this command: 
  servermanagercmd -install PowerShell-ISE
• It will whinge and then work anyway:
  
• Publish a hosted application on your farm at:
  c:\windows\sysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe
• Again, you will need to run the command “Add-PSSnapin Citrix*” to preload all the commands for XenApp.  In ISE, you can enter quick commands like this in the bottom window, then build up your scripts in the tabbed top window.  The middle window displays any console output.

 

Some useful basic commands for XenApp in PowerShell
I’m planning a much bigger post on this, but in the meantime, here’s some really basic bits of code to show you what you can do with PowerShell…

Display the farm name
$farm = Get-XAFarm   
$farm.FarmName

Display the zone name data collector for a zone (the zone of the XenApp server you run on of course)
$zone = get-XAzone
$zone.ZoneName
$zone.DataCollector
Display counts for the total number of active and disconnected sessions in the farm
Get-XASession -Farm | where-object {$_.State -eq "Active" } | Measure-object
Get-XASession -Farm | where-object {$_.State -eq "Disconnected" } | Measure-object
Display a list of all your farm servers, listed alphabetically, with the number of sessions on each:
$servers = Get-XAServer -full   
$output = "`nServers: `n"
    foreach($server in $servers | sort-object ServerName){
        $output+=$server.ServerName + "  " + $server.SessionCount + "`n"
    }
$output

Remember if you are saving any of these its best to put the command “Add-PSSnapin Citrix*” at the top to make sure it always has the Citrix commands loaded.  You should really consider signing your scripts as well – which is an art in itself!

Installation Manager for XenApp 6 – installing Acrobat Reader

Now we have Installation Manager installed, we should probably use it.  An MSI and MST file combination is a good standard install, so this is rolling out Acrobat reader to your Citrix servers.

Customising Acrobat Reader

• Download Acrobat Reader – I got the latest version (9.3.4) from the Adobe website, after a little searching:
  http://ardownload.adobe.com/pub/adobe/reader/win/9.x/9.3.4/enu/AdbeRdr934_en_US.exe
• Also download the Adobe Customization Wizard 9:
  http://www.adobe.com/support/downloads/detail.jsp?ftpID=3993
• Install the Adobe Customization Wizard on your PC – accept all the defaults.
• Extract the EXE using this command: AdbeRdr910_en_US_Std.exe -nos_ne
• Wait for the window that pops up to do its work…
• You should then find the extracted files in this folder on Vista and Windows 7:
  %LOCALAPPDATA%\Adobe\Reader 9.3\Setup Files
• Run the Adobe Customization Wizard
• Open the AcroRead.msi you just extracted into Setup Files
• Select Installation Options on the left – set to run Silently and Suppress Reboot

• Select Shortcuts.  Remove the desktop shortcut.
• Select EULA and Document Status.  Click the checkbox to suppress the EULA dialog
• Select Online and Acrobat.com Features.  Disable all Acrobat.com features and all updates.
• Exit from the application and it should ask you if you want to save changes to AcroRead.msi.  Say yes, and it will create the file AcroRead.mst in the same folder as the MSI file.  Move the contents of this folder to your shared fileserver ready for Installation Manager to use them.

Distributing Acrobat Reader using Installation Manager

• Open Installation Manager
• Click “Schedule MSI/MSP package…” on the right hand pane
• Enter a name in the Task name box
• In the Target List box, you can just enter the names of the servers to install to, separated by commas (no spaces).  Alternatively, click “Servers…”.  This will bring up a worryingly empty list.

• Select Citrix Server Selector (assuming they are in a farm – otherwise use the Windows Server Selector) and click Add
• Enter the name of a Citrix server (maybe the Data Collector?) in the “Server Address” box and click GO!
• You should get a nice list of your servers and server folders.  Select servers (use CTRL to select multiple) and click “Add >” to select them.
• Put the installation files you prepared earlier in a shared folder on a fileserver.
• Select the MST and MSI files using the Browse buttons (or by just typing of course).
• Enter a time for the install – or leave it as Now.
• Select the checkboxes to log off users or reboot the server as needed.  With this install I am just denying logons.

• Click the Advanced button and change the cache location for this task to the one on the shared file location which holds and MST and MSI.  I don’t know if this is necessary but without this change it seems to have trouble finding the task.  You can also change the retry settings here. By default it will retry every 10 minutes for 1 hour.
• Click OK to schedule your install!
• Right click the task every few seconds and select Refresh.  It should succeed – you also get the PowerShell code that is fired at the servers.

Distributing an MSP update

• Once this is succeeded you should have Acrobat Reader 9.3.0 installed.  To update this to 9.3.4 (currently the latest), create a new task, as before.  This time, when you browse for the MSI file, change the drop down at the bottom to MSP files and you should see a list of MSP files:

• Select (now for the annoying bit) the oldest.  In the case of this upgrade you need to update it to 9.3.2, then 9.3.3, then 9.3.4.  If you go straight for 9.3.4 it will fail with the status “Installation Failed: 1642”.  So select 9.3.2 and carry on.
• You won’t need a transform for this so just select the right servers and change the Shared Folder under Advanced settings to be the one with the MSP in and run it.  It should work and you can check the installed version of Acrobat is upgraded. 
• Repeat the process creating installation tasks for the 9.3.3 and 9.3.4 updates.  At least it will easy when the inevitable 9.3.5 comes along!