Citrix Online Plug-in v12.1.44.1 brings IE9 support

Citrix have released a minor upgrade for their now pretty aged v12.1 of the Citrix Online Plug-in, which has been the current version of the client since November 2010.  This is to fix issues which some users had in launching applications after they upgraded to Internet Explorer 9.

IE9 is a little annoying at the best of times with Citrix’s Web Interface as it now often asks you to download and open an ICA file instead of just launching your application, but some users have reported that they don’t even get the option to open the ICA file with the old version, v12.1.0.30, due to a sharing violation. The problem was certainly not seen by everyone – I have been using IE9 with more than one Web Interface site for over a month without issue.  Users on the same sites and same browser and OS versions reported issues to me.

The new client has no other fixes listed than support for IE9 (which can still display the ICA download popup message – but it actually works now) so a major rollout of this client would probably be unnecessary.  Citrix even state on the notes for this release “Any known issues in Version 12.1 of the product, except for the specific issues resolved in this private online plug-in, still apply.”  Those known issues can be seen here: http://support.citrix.com/article/CTX126965

Oddly, the old broken 12.1.0.30 client is still the main plug-in to download – you need to logon to MyCitrix to download the working version. 

Full details here:

http://support.citrix.com/article/CTX126653

Hosting the Internet Explorer 9 Beta in XenApp 6

Installing beta software on your XenApp farm might sound like a bad idea – because it probably is actually.  Still, if you have a server that you can use to host test applications for a while before being wiped it could be a good way of satisfying the curiosity of some users without them trying to install it on their main desktops.

This took a lot more messing about than I was expecting, I thought it might be worth sharing this in case anyone else is trying the same thing.  I’d be very interested in how other people felt IE9 Beta worked on XenApp as well.

Pre-requisites and the Beta Service Pack

To install IE9 on your XenApp 6 2008 R2 server, first you need the pre-requisites:

The pre-reqs for IE9 Beta are generally on this page: http://support.microsoft.com/kb/2399238

You should just need the one in near the end of the list for Windows Server 2008 R2.  Personally I could not get the IE9 beta to recognise that it was installed though and had to go even further into Beta territory by installing the Windows Server 2008 R2 Service Pack 1 beta!

Download from this site: http://technet.microsoft.com/en-gb/evalcenter/ff183870.aspx (click the second green Get Started Now button…)

After a reboot I had an upgraded Windows 2008 R1 SP1 beta server!  I’m really not going to put this into live service without a rebuild…

You are now ready to install the IE9 pre-req update.  Go to this site: http://support.microsoft.com/kb/2399238

and click the link “download the x64 SP1 beta package now”

Install and reboot.

Installing IE9 Beta

You should then be able to download the IE9 beta – get the x64 version from here:

http://windows.microsoft.com/en-GB/internet-explorer/download/ie-9/worldwide

Scroll to the bottom of the screen to the server section and download the version for Windows Server 2008 R2 64-bit

And run the executable!  Follow the installation through, with the above updates it should succeed.  Reboot at the end of the install.

 

Publishing IE9 Beta to the farm

After a reboot I did indeed have IE9 installed locally…

Finally, I published an IE9 as a Hosted Application on my XenApp 6 farm (launching from "C:\Program Files (x86)\Internet Explorer\iexplore.exe").  I put a start page on the end of the address as well to give the users something nice to look at.

Fixing the server!

Sadly, when I came to test the application as a Citrix app I found it would not work.  I tried publishing both IE9 x86 and x64 and even tried Notepad with the same impact – when it connected my server would drop all its external connections and become unmanageable until rebooted.  Also, Windows was worryingly claiming that Remote Desktop Services was unlicensed.  I assume this is all because SP1 is not ready for launch yet. I went into Control Panel and into Programs and Features and Installed Updates then removed the beta Service Pack then rebooted again!

 

I then removed the update KB2259539 that I installed earlier and installed the one for 2008 R2 without the beta service pack and rebooted.  Again.

And it works!  I have IE9 published on the Citrix farm, from a server which I still wouldn’t trust with anything else but that is more stable than when it had SP1 beta (which is NOT ready for a XenApp Server trial!). 

A quick test revealed that HDX MediaStream for Flash still works in the IE9 beta, which is a bonus.  Seems very fast and stable.  And a bit like Chrome…

Disabling IE ESC – Internet Explorer Enhanced Security Configuration on Windows Server 2008 R2 for XenApp 6

IEESC (IE Enhanced Security Mode) is a very good feature on most servers – you shouldn’t be doing much web surfing from your server’s desktop anyway and this helps protect you from malware, which is the last thing you want on a Windows Server system.

Of course if Microsoft had any guts IE would be disabled by default, but I digress.

On a Citrix server of course IEESC is a pain in the neck since general web surfing is exactly what you want to do.  There are manual ways (below), but you don’t want to do this on every server, so Microsoft provided a way on Windows 2003 Server to set it via group policy.  There does not appear to be an equivalent on Server 2008 and R2 but oddly the 2003 way still works! 

Turning off IE ESC via Group Policy for Windows Server 2008 R2 (and R1 and 2003)

• First, download the Windows Server 2003 Resource Kit Tools (yes, I know you are not using Server 2003 anymore…) from here:
  http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en
• Install them somewhere temporary, go to that folder and find the file “inetesc.adm”.
• Load the GPMC (Group Policy Management Console) on a Windows Server 2008 R2 server.
• Expand your Forest, your domain and find the OU your XenApp servers are within.
• Edit or create a group policy that will apply Computer settings to that OU and its contents.
• Expand Computer Configuration and Policies and right click on Administrative Templates

• Click Add/Remove Templates
• Click Add and find your inetesc.adm template.  Import it.
• Expand Computer Configuration, Policies, Administrative Templates, Classic Administrative Templates, Windows Components, Internet Explorer, Enhanced Security Configuration.

 

• Set the two policies to be disabled.  When you reboot your servers in that OU (any servers of course, not just XenApp ones…) will have Internet Explorer fully enabled.

Just in case you just want to do this once, here’s how to do it on each individual server…

 

Turning off IE ESC Manually

On Windows 2003 Server it was easy – just open up Add/Remove Programs and remove the component from the server – IE becomes fully opened up.

 

 

Windows Server 2008 and 2008 R2 had a nice easy way to do this as well.  Just load up Server Manager (you know, that annoying screen that pops up every time you log in… okay, its in Administrative Tools if you have never used a computer before).  About a third down, see the Configure IE ESC link. 

Click it and you should see this box – by default a XenApp 6 server will have IE ESC turned off the users (cleverly) but on for administrators (annoyingly, especially if you are an administrator and you actually use Citrix).  Configure as you see fit – personally its Off for both for me on all Citrix servers.