Citrix on Remko's Blog

Change NetScaler Password Hash from SHA1 to SHA512

Wed, 13 Dec 2017 13:53:08 +0000

This morning I wanted to install the NetScaler patch for the TLS padding vulnerability and of course I made a backup before deploying it.

Note: If you haven’t installed this patch yet I would recommended to do so: see CTX230238 and check out the ROBOT attack -Return Of Bleichenbacher’s Oracle Threat page to check which other products you may have that are vulnerable.

Upon checking the backups (I always download the backup and verify that the archive is intact) I noticed that one of my NetScaler’s uses SHA1 for the password hash whilst the other one uses SHA512:

I thought that this was a little strange as both NetScaler's are running the exact same build. However one of them (the one that uses SHA512) was reinstalled recently whilst the one using SHA1 has been upgraded.

Where does the Citrix Linux VDA store settings?

Thu, 23 Mar 2017 17:02:44 +0000

I recently (well today really) started playing with the Citrix Linux VDA. I took Ubuntu to test because I happen to like Ubuntu.

I didn’t get it to work correctly right away though and during troubleshooting I wanted to know where the VDA is storing it’s settings.

I found the following file /etc/xdl/ctx-vda.conf with the following contents:

Google Earth fix for XenApp, RDSH & Horizon

Mon, 20 Feb 2017 20:26:51 +0000

Both Google Earth and Google Earth Enterprise do not work correctly for multiple users on shared Hosted Shared Desktops (I still prefer to call it Server Based Computing but that’s likely because I’m an oldtimer).

Problem summary
So let’s look at the actual issue: the first user on a server is able to launch Google Earth but for any subsequent users on the same server Google Earth fails silently.

Problem details
Google Earth uses various synchronization objects such as Events and Mutexes but registers those in the \Global namespace instead of the \Local namespace.

Citrix Receiver Unknown client error 1110

Tue, 07 Feb 2017 15:08:27 +0000

Citrix Receiver and StoreFront error messages are sometimes confusing or lacking details so I decided to make little blog notes about common issues when I see them. So without further ado here’s #1:

In Citrix Receiver I tried to logon remotely via NetScaler Gateway and got the following error message: “Cannot get your apps from the store”

Citrix Receiver

Citrix PVS RAM cache size Performance Counters

Wed, 30 Mar 2016 14:58:54 +0000

There has long been a debate about how to accurately view the size of your Citrix Provisioning Services ram cache size. SO much so that even Citrix clarified on how to view this detail using yet another tool

The thing is, this is all fine and well, but it’s a bit of a pig to actually get this data when you need it, or in an automated way. Wouldn’t it be better if we could have something easier?

Lately, Andrew Morgan and I decided to sit down and create an easy to use, Windows performance counter for the key metrics in a PVS cache and provide them to the community for use.

These counters turned out to be fascinating, as they really show how the cache works.

Our latest counters (which can be downloaded below) provide the following counters for easy access:

PVS Ram cache size (MB)
PVS metadata size (MB)
PVS Write Cache VHD disk size (MB)
PVS Ram Cache Percent used.

As there is no accurate way to detect how much ram is assigned to cache via Citrix Provisioning services, this value must be provided or this performance counter is missing.

Synchronizing Citrix ShareFile with PowerShell

Wed, 28 Jan 2015 11:39:17 +0000

The Citrix ShareFile Sync application is quite limited in functionality, one of those limitations is that you can only synchronize to a single (one) local folder.

As Helge Klein wrote in his excellent article "Configuring Citrix ShareFile Sync from PowerShell" this is simply a GUI restriction and not a restriction in the actual ShareFile sync engine.

Helge describes that you can easily do this in PowerShell with the following example:

Add-SyncJob example powershell Download

Add-SyncJob -ApplicationId 1 -ApplicationName "PowerShell" -Account helgeklein.sharefile.com
-RemoteFolderName "foc86c19-d904-434a-9d67-xxxxxxxxxxxx" -LocalFolderPath "D:\Daten\Sync to ShareFile"
-AuthType 4 -UserName xxxxxx@helgeklein.com -SyncDirection 2 -Password "MY SHAREFILE PASSWORD"

While the command was accepted, nothing was synchronized.

Convert Citrix License Server VPX to OVF

Fri, 27 Sep 2013 16:41:54 +0000

I wanted to run a virtual Citrix License server in my LAB.

Unfortunately Citrix only provides the VPX License Server in XenServer format (.xva). If you want to run the VPX on VMware ESX or Microsoft Hyper-V you need to convert it first.

The option to convert a Xen Virtual Appliance to OVF format was removed in XenConvert 2.4.1. So for a conversion you need version 2.3.1.

Here are the direct download links:

However when I tried to convert the downloaded VPX (Citrix_License_Server_VPX_v11.10.0_Build_12002.xva) I got the error "Failed to decode tar header record":

Run a Process when Citrix Receiver Exits

Tue, 24 Sep 2013 16:11:59 +0000

A while ago I was doing some research for Magic Filter when I stumbled upon something interesting within Receiver.

Inside wfica32.exe is a function called _Eng_RunExecutableOnExit. That name caught my interest, I’ve made it a little more readable with Ida Pro:

PNAgent Icon Data Algorithm

Thu, 08 Aug 2013 17:34:05 +0000

Some time ago I wrote about the PNAgent data that is stored in the registry in XML format.

After that post Andrew Morgan asked me if I could extract the PNAgent icons from the XML data.

That got me interested so let’s look at this data!

If you look at XML from PNAgent the icondata as in the AppData.Details.Icon node you’ll see something like this:

Seems like the icon data is stored/encrypted in a proprietary format.

ClickOnce Applications in Enterprise Environments

Mon, 05 Aug 2013 16:51:21 +0000

ClickOnce is a Microsoft technology that enables an end user to install an application from the web without administrative permissions.

That's great isn't it?
While ClickOnce may sound great to developers it's actually a nightmare for Enterprise administrators because they try to prevent users from installing software themselves.

ClickOnce also incorporates an Automatic Updates mechanism which means that users might run different or not tested/approved versions...

Virtual Environments
It get's even worse in virtual environments such as VDI and SBC where machines are often non-persistent. Each time the users starts the application they will see a screen similar to the one below while they actually download and install it over and over again:

If the environment is persistent, it's not guaranteed that the user works on the same machine each day. This means that the application will be installed on every box the user ever logs onto...

How does it work?
In order to understand how we can best treat ClickOnce applications we need to understand how they work since MSDN documentation does not describe this in detail.

Redirect Registry by Modifying .NET Executable

Thu, 30 May 2013 16:18:23 +0000

Yesterday I was troubleshooting an application that was migrated to Citrix XenApp.

The application is able to use a high precision scale which is attached to the client pc's com port. This com port is redirected to XenApp.

While testing users reported several issues, let's have a look at them.

Error configuring COM Port
Within the application the comport to which the scale is connected must be configured:

After pressing "Registreer" to register the new com port the following error message was shown

Application Compatibility Fixing to the Extreme?

Thu, 23 May 2013 16:48:36 +0000

Today's blog is about an application that was migrated to Citrix XenApp. During testing the users reported that several application menu's were missing.

An example is the settings menu where the System tab is missing:

Fat Client:	XenApp:

I suspected a permissions issue so I added the account to the Local Administrator group to verify that. And indeed the System tab was visible.

Process Monitor
I removed the account from the Administrators group and fired up Process Monitor. I set a filter on the process name (ra60.exe) and on Result (ACCESS DENIED):

Scriptable Citrix Password Encoder

Tue, 19 Mar 2013 16:27:49 +0000

A while ago I published a tool to Encode and Decode Citrix passwords. Today I am publishing a small update to this tool that makes it scriptable by adding a COM interface.

If you start the tool without parameters you will get the GUI, just like before:

To use the COM interface you first need to register the executable with the /regserver switch:

After the registration you can call it using any language that supports COM. To get you started I wrote a few examples

The case of the COM Port Redirection

Mon, 11 Mar 2013 14:53:44 +0000

One of my colleagues asked me to assist in troubleshooting an application called SmartWare FM running on Citrix XenApp.

This application reads data from an external device called SECUTEST.

The device is connected to a COM port which is redirected to the XenApp session. In contrast to Microsoft Remote Desktop Services COM ports are not automatically redirected in XenApp but need to be mapped via eg a logonscript (NET USE COM1: \\Client\COM1:) or using UEM.

In my case the COM port was mapped with RES Workspace Manager:

The case of the missing audio

Fri, 25 Jan 2013 16:07:06 +0000

Yesterday I was asked to investigate a problem with a presentation pc. Even though the volume was set maximal there was not audio output.

The machine was used to connect to a Citrix XenApp desktop and RES Workspace Extender was used to integrate local applications in the XenApp desktop.

The local sound volume control was published as a subscribed application so I launched that and verified that the volume was set to Maximum:

I decided to launch the local explorer shell and noticed that there were two volume control icons in the Traybar:

Return username instead of computername in a ThinApp

Tue, 15 Jan 2013 11:50:07 +0000

One of the lesser known features of VMware ThinApp is that you can supply a Virtual Computer name.

This is documented as follows in the package.ini reference guide:

VirtualComputerName Parameter
The VirtualComputerName parameter determines whether to rename the computer name, to avoid naming conflicts between the capture process and the deployment process.

License Check fails on Citrix XenApp

Fri, 07 Dec 2012 16:30:07 +0000

Today I was asked to assist in getting an Excel Add-In to work on Citrix XenApp.

The application was packaged into a Thinapp by one of our package engineers.

However when testing the Add-In on Citrix XenApp the following message appeared:

Apparently this application does a license check that fails when run from another server (how bad).

Disclaimer
Before we go on: I would like to make clear that my goal is not to be able to use an application without license. I am just trying to make it work within the customer’s environment.

Application Hangs when Scanning in Citrix XenApp

Thu, 06 Dec 2012 16:10:50 +0000

Another interesting issue today with an application that runs on Citrix XenApp.

Environment
Customer has a Citrix XenApp 5 environment running on Windows Server 2003. Clients are all Windows XP and run the Citrix Online Plugin 12.3 full screen.

RES Workspace Extender is used to integrate locally installed application into the XenApp Session. Users have no access to the local desktop.

Symptoms
This particular application scans invoices using a USB scanner attached to the client and runs them trough a workflow.
Whenever the Start scan button was pressed the application froze.

Return username instead of computername to Applications

Thu, 06 Dec 2012 10:45:40 +0000

Some applications use the computer's name as a unique identifier, rather than using the user name. In a single-user-per-computer environment, this strategy works well.

However, in a Multi User environment such as Citrix XenApp or Microsoft's Remote Desktop Services (Terminal Server), all connected users report the same computername.

If the application relies on unique computernames to handle tasks such as file and record locking, then the application will fail.

We can however set an Application Compatibility Flag in the registry to return the username instead of the computername.

To demonstrate this behaviour I wrote a small Test Application called TestAppCompatFlags.exe.

File not found error when scanning using Twain Redirection in Citrix XenApp

Tue, 04 Dec 2012 15:07:10 +0000

Scanners attached to client machines can be used from within a Citrix XenApp session via a mechanism called Twain Redirection.

For this mechanism to work correctly the file twain_32.dll must be present in the Windows directory.

On Windows 2008 this dll should be copied from winsxs (side by side) to the windows directory as described in CTX123981.

On Windows 2003 the dll is already in the correct directory, however applications that are not Terminal Server Aware cannot find this dll because the Windows directory is redirected to the user profile. Citrix recommends copying twain_32.dll to each user’s profile directory but this will take up unnecessary space.

So what alternatives do we have?

Screen flickering with PowerPoint 2010 on Citrix XenApp

Fri, 30 Nov 2012 14:18:22 +0000

Within half an hour of writing the article "Application causes Screen Flickering in Citrix XenApp Session" I got a message that the hotfix in that article also fixes a similar problem in PowerPoint 2010.

Office 2010 uses hardware acceleration for displaying images and when this is enabled (which is the default) you will see constant screen flicker when you try to display a presentation with Images on Citrix XenApp (Server 2003):

Screen Flickering when running WPF Applications on Citrix XenApp

Application causes Screen Flickering in Citrix XenApp Session

Fri, 30 Nov 2012 13:28:54 +0000

Yesterday I was asked to troubleshoot an interesting issue with an application running on Citrix XenApp.

Environment
This customer is running Citrix XenApp 5 on Windows Server 2003 (x86). On the Client Side the Online Plugin version 12.3 is used.

The Problem
When this particular application was active the screen was flickering and black blocks appeared at seemingly random places. Further more it was not possible to resize the window:

My experience is that display issues are often related to either HDX Flash Redirection (offloading flash to the client) or the Multi Monitor hook.

Citrix License Server Crash

Thu, 23 Aug 2012 15:29:40 +0000

After updating a Citrix License server from 11.6.1 to 11.10 the Citrix Licensing Service crashed immediately after startup.

In the Event Log the following error was shown:

I suspected that there was a corrupt licensing file in the MyFiles folder (Default C:\Program Files\Citrix\Licensing\MyFiles).

Modify VB Executable to force Taskbar Button

Sat, 04 Aug 2012 11:07:18 +0000

I had to troubleshoot an application that was published with Citrix XenApp. The problem with this application was that it didn't have an button/icon in the taskbar and the window would sometimes disappear.

I noticed that this (cr)application was written in Visual Basic, so I decided to run it through a decompilation tool.

The decompiler was able to list the forms used in the Application:

Decoding Citrix IMA Datastore Password

Tue, 29 May 2012 21:46:30 +0000

This morning Arjan Beijer sent me an interesting link to a youtube video about obtaining the Citrix IMA Datastore password using Windbg.

The video shows a method, discovered by Denis Gundarev to obtain the IMA Datastore password. Basically he uses DSMaint.exe and set’s a breakpoint on the call to CryptUnprotectData and then reads the password from memory.

I tried to call the CryptUnprotectData API with the data read from the registry directly but this failed with error NTE_BAD_KEY_STATE, this is defined in winerror.h and it means “Key not valid for use in specified state”.

Citrix Launcher Progress Update 1

Thu, 17 May 2012 23:19:12 +0000

After figuring out how to encode and decode the Citrix passwords my next step for the upcoming Citrix Launcher is experiment with config.xml and authenticating to the Citrix Web Interface.

I imported the NFuse.dtd from the Citrix Web Interface into Delphi with the XML Data Binding Wizard. The results in an NFuse Unit so I can easily create the XML data.

To create an authentication packet I use the following code:

Encoding and Decoding Citrix Passwords

Sun, 13 May 2012 21:55:02 +0000

I am working on a launcher tool for Citrix XenApp that can not only connect to a published application or published desktop but can also leverage Citrix Workspace Control to reconnect to disconnected and/or active sessions.

There doesn't seem to be any sdk that exposed the data we need so I am trying to reproduce what the Citrix online plugi-in does.

I used a HTTP monitoring tool to capture the traffic between the Online plug-in and the Web Interface. First the online plug-in will retrieve the config.xml from the server specified via the Change Server option:

Cookie Error on Citrix XenApp

Thu, 29 Mar 2012 10:02:10 +0000

A user reported that the following error while visiting a website on a Citrix XenApp server:

I tried adding the site to the Trusted Sites List and adding the url to the Per Site Privacy list:

But this didn't work, but I noticed that the site was "flickering" a lot so I suspected that HDX Flash Acceleration was the problem.

Edit Document requires a Windows SharePoint Services-compatible application

Fri, 09 Mar 2012 14:23:11 +0000

Today I was troubleshooting a message that appeared when a user tries to edit a document from SharePoint on a Citrix XenApp server.

The user browsed to a word document on Sharepoint and selected “Edit in Microsoft Office Word” from the Combobox:

This would present the following error message to the user:

Convert MCli output into PowerShell Objects

Wed, 29 Feb 2012 21:35:49 +0000

I was experimenting today with the PowerShell cmdlets for Citrix Provisioning Server. I was surprised to learn that the output of these cmdlets are not PowerShell types such as collections and objects with methods and properties but just plain text output.

A google search for a method to quickly convert the garbage output to objects led me to this blog post by Frank Peter. He describes a clever use of the switch statement with regular expressions with the Get-DiskInfo cmdlet.

Using Frank's code as a basis I wrote a generic function that converts Mcli output to an array of objects.

Where to download TraceView

Wed, 22 Feb 2012 13:57:29 +0000

Various Citrix knowledge base articles refer to a tool called TraceView.exe to view the output of diagnostic traces.

CTX106233 describes where to download traceview but this article is outdated because it describes an older version of the DDK (the Windows Driver Development).

The current DDK version (7.1.0) can be downloaded here and has the filename "GRMWDK_EN_7600_1.ISO".

Session freeze when starting Excel

Mon, 20 Feb 2012 15:42:25 +0000

Environment
Windows 2003 Enterprise (32 bit), Citrix XenApp 5, RES Workspace Manager 2011, McAfee VirusScan Enterprise 8.7.0i.

Problem
When a opening an Excel workbook from Sharepoint the whole session freezes.

I asked the user to open an Excel workbook from Sharepoint and I noticed the following popup:

So my first thought was that the user somehow clicked this message to the background and IE was waiting for a response.

Scripting Citrix Online Plugin Settings

Mon, 13 Feb 2012 13:55:45 +0000

The Citrix Online Plugin has a number of settings that can be changed. This includes things as Window Size and Color Depth:

In my case I wanted to preset the Window size to Full Screen so using Process Monitor I checked where the Online Plugin writes this setting. I Used a Filter that includes only the Online Plugin (PNAMain.exe) and the RegSetValue Operation:

Harmony Client crashes upon exit

Tue, 31 Jan 2012 16:37:08 +0000

Today I was troubleshooting the application "Harmony Client" which crashed upon exiting:

The application had been thinapped and the error only appeared when starting the thinapped version.

Bypassing RES/Appsense Application Security

Fri, 27 Jan 2012 16:15:38 +0000

The video below shows a Proof of Concept of bypassing Application Security in RES Workspace Manager .

Please note that at this time the code is not publicly available so please don’t ask for it.

EDIT 2: I added a video that I received from someone who tried my Excel Sheet with AppSense Application Manager.

EDIT: I wanted to clarify a couple of things regarding this post.

First of all I would like to explain why I wrote this code and why I choose to test it with RES WM.

I had the idea about this approach a long time ago but I never got around to actually do it. The main reason was that I needed to convert Delphi code to VBA and especially converting some Windows headers was a lot of work. Then suddenly I noticed that someone had already converted the headers, so I all I had to do was rewrite the code that used it to VBA.

The choice for RES was made because of two reasons:

If you want to beat something, you want to beat the best and I most certainly consider RES WM to be one of the top products.
At the time I wrote the POC code I had access to an enviroment with RES in it.

I would like to emphasize that RES contacted me very quickly after publishing this blog. I've had contact with RES and they showed a very constructive approach with their primary goal being a fix or guidance for their customers. Hats of to RES taking a constructive approach and I will be working together with RES on this issue.

Finally I would like to state that I didn’t expect this post to draw this much attention, if I did I would have probably taken another approach.

The case of the Slow Xerox Universal Print Driver

Wed, 04 Jan 2012 22:54:29 +0000

Earlier this week I was asked to investigate a problem with the Xerox Universal Printer Driver. Users complained that printing to a Xerox printer was much slower than printing to an HP printer.

I received a reference document from a user, a rather complex Excel sheet. When selecting multiple tabs it took almost a minute to generate a print preview in Excel 2007 running on Windows 2003 with XenApp 5.

I was aware of a bug in the Xerox Universal Driver where almost 9.000 files were copied into the user's profile directory (I wrote about that in an earlier post). But this seemed to be another problem.

NTVDM encountered a hard error

Wed, 14 Dec 2011 21:41:22 +0000

Today I troubleshooted an old DOS application that needed to run on a 32 bit Citrix XenApp Server. The last time I saw an actual DOS application in a production environment must be years ago.

When starting the application, the WOW subsystem (NTVDM) crashed with the message: "NTVM encountered a hard error.":

After spending some time troubleshooting I remembered a similar issue from a few years ago where a DOS application worked fine from the Console but refused to work from an RDP or ICA session.

Citrix online plug-in received a corrupt ICA File

Tue, 13 Dec 2011 10:58:24 +0000

I was testing a Script I wrote to launch a Citrix XenApp session using the Ica Client Object. Typical code to do this may look like this:

vbnet Download

Const cHttpBrowser = "someurl.local"
Const cColorDepth = 4

' Create the ICA Client Object
Dim objIca : Set objIca = CreateObject("Citrix.IcaClient.2")

' Set Credentials
objIca.Username = "JohnDoe"
objIca.SetProp "ClearPassword", "Secret01"
objIca.Domain = "CONTOSO"

' Connection Settings
objIca.BrowserProtocol = "HTTPonTCP"
objIca.TransportReconnectEnabled = True
objIca.HttpBrowserAddress = cHttpBrowser

' Session Settings
objIca.Address = "MyApp"
objIca.Application = "MyApp"
objIca.DesiredColor = cColorDepth
objIca.ScreenPercent = 0 ' Full Screen
objIca.DesiredHRes = 0
objIca.DesiredVRes = 0
objIca.Launch = True

' Connect
objIca.Connect

On my testmachine it ran nicely but on a customer machine the script failed with the error 2312 "The Citrix online plug-in received a corrupt ICA File. The ICA File has no [ApplicationServer] section":

Extremely slow Virtual Machines on HP Smart Array P410

Mon, 02 May 2011 14:15:50 +0000

I was deploying virtualized Citrix XenApp Servers on HP BL460c G6 servers and somehow the storage (direct attached) responded very slowly.

I had expected reduced performance (see my earlier post) since I didn't have the Battery Backed Write Cache module installed.
I did order them but had to start deployment before they arrived.

I did not however expect such an extreme bad performance. Deployment took ages or sometimes failed completely and when logging in to a VM it responded very sluggish.

Disk Latency

I looked in the vSphere console what the Disk Latency was. Latency under 10ms is usually considered good while a latency between 10 and 20ms is a potential performance problem.

I was shocked to notice that the Disk Latency was much higher with peaks toward 2.000 ms (2 seconds!):

The Case of the Citrix Ready Printer Driver

Tue, 08 Feb 2011 21:47:44 +0000

I had a very interesting issue today on a new Citrix XenApp 5 farm. We went into production yesterday and we noticed a number of issues:

Printing in general was slow, especially when a user connects to a printer for the first time.
User Profiles were rapidly growing in size (from the expected 1-2 MB to over 40 MB).
Logons took much longer then in the testing period (and since we use a Full Screen Desktop the user doesn't see any progress).
Performance monitoring showed CPU spikes in Word, Excel and IE processes.

I took a look at the profiles first and noticed that the size growth was due to a Xerox subfolder in %APPDATA%:

PowerShell Script to add reboot scheduled task for Citrix

Mon, 31 Jan 2011 22:53:47 +0000

I wanted to create a Scheduled Task on my Citrix Servers to have the reboot every other night.

The idea is that half of the servers will reboot in a night and the other half the following night.

The TSSHUTDN tool is handy since it can issue a warning to logged on users, log them out after a certain period and finally issue the reboot.

Since I needed to add a scheduled task to many servers I wanted to do this with a script.

WMI Exposes the Win32_ScheduledJob Class and it’s Create Method.

PowerShell Script to raise Citrix Video Memory

Fri, 28 Jan 2011 15:23:08 +0000

On a Citrix XenApp 5 environment a user reported that he was unable to start a Full Screen session on a Dual Monitor Configuration.

He received this error message:

Script to install all print drivers on Citrix or Terminal Server

Tue, 25 Jan 2011 15:24:14 +0000

I wrote a PowerShell script to install all printer drivers on a Citrix or Terminal Server.

Actually the script isn’t specific to Citrix or Terminal Server but on such environments we need to preload all drivers because users do not have the permissions to do that.

I have chosen for PowerShell because you can do it in a one-liner which makes it easy to run this script from my Altiris server on all Citrix Servers.

The idea is that we enumerate all the shared printers on a Printer Server and make a connection to each printer. This will make sure that the driver is installed if it wasn’t already present.

The script could even be scheduled to enforce that newly added printer drivers are added to each Citrix Server.

The case of the UPS discovery not working

Mon, 24 Jan 2011 15:22:03 +0000

I am doing a project involving a Citrix Xenapp environment running on VMWare vSphere.

The physical machines are powered by two Eaton Uninterruptable Power Supplies that both a network card.

I received some documentation that describes how to implement automatic shutdown in a VMWare vSphere environment.

This documentation describes that a vSphere Management Assistant (vMA) must be deployed in which we need to install some software from Eaton.

I followed the documentation that even described the needed iptables rules needed for their software.

In the last step a discovery is done and the UPS is supposed to be found. And you have probably guessed by now: it didn’t!

At first I figured that maybe the iptables configuration was still too tight so I stopped the iptables service but that didn’t help.

SasLibEx Screencast

Wed, 19 Jan 2011 22:36:44 +0000

I just recorded a SasLibEx Screencast, it shows some of the very powerfull features of SasLibEx.

The following features are shown:

Simulate Ctrl Alt Del (Secure Attention Sequence)
Cancel Ctrl Alt Del
Lock Workstation
Unlock Workstation (without credentials)
Disable Ctrl Alt Del
Enable Ctrl Alt Del again
Cancel pending UAC request
Is Desktop Locked

SasLibEx Feature Demo #1

1 Comments

Tweets die vermelden SasLibEx Screencast | Remko Weijnen's Blog (Remko's Blog) -- Topsy.com Jan 20, 2011
[...] Dit blogartikel was vermeld op Twitter door Remko Weijnen, Remko Weijnen. Remko Weijnen heeft gezegd: First #SasLibEx ScreenCast! showing simulate ctrl alt del, unlock workstation without credentials, disable cad and more http://bit.ly/fFM8wB [...]

Self Signing Word Macro’s

Wed, 12 Jan 2011 15:45:51 +0000

Today I noticed that a recently added Application to the Citrix Test environment added a Macro to the Office Startup directory.

When a user launches Word he will get a popup because the Template (.dot file) was not signed:

It would have been a lot easier if Application Vendors sign their stuff because in that case I could have just added the certificate using Group Policy (yesterday’s post describes how to do this).

Application Vendors usually tell you that you should lower the Macro security in Office (or Word in this case) to Low to get rid of this message. But I think there’s a better solution: we will sign the .dot file ourselves!

Java Webapplication, certificates and Citrix

Tue, 11 Jan 2011 15:23:47 +0000

Yesterday I created an Unattended Installation of a webapplication. Of course it was “just a web link” and the application vendor usually says: you don’t need to install it just go the URL and that’s it.

The reality is usually that you go to the URL and need to install several (ActiveX) components and maybe other dependencies such as Java.

While a user may have the permissions for this on his own pc, on a Citrix or Terminal Server environment this is highly unlikely.

So we need to package and pre-install this for the users.

Nothing special so far but this particular application had some special things that were interesting enough to blog about.

So let’s start with what happened, I visited the URL of an application called Centric Key 2 Financien.

First I got a few popups with Certificates that needed to be accepted:

The application’s instructions say that the user must accept this and set the “Always trust content from this publisher” checkbox.

Paging file and Memory Dump

Fri, 07 Jan 2011 13:45:55 +0000

I often hear that people configure the Paging File (on Citrix or Terminal Servers) on a seperate volume but, the reasons is either performance or the chance that the Paging File might corrupt the volume.

However if at some point you would like to create a Memory Dump you must have a paging file on the boot volume.

Default User Profile: Remko’s solution

Tue, 04 Jan 2011 15:46:18 +0000

If you are implementing a Citrix, Terminal Server or even just a plain Client-Server environment you will need to create a Default User Profile at some point.

The Default User Profile can be thought of as the initial registry settings that are used when a new profile is created.

Many people think that the Default User Profile is available in regedit via HKEY_USERS.Default but this is NOT the Default User Profile.

Citrix Online Plugin could not launch the requested published application

Wed, 22 Dec 2010 14:10:31 +0000

After doing an unattended installation of the Citrix Online Plugin it was not possible to launch a Published Application.

It would just give the error mesage: "citrix online plugin could not launch the requested published application".

Even though the installation finished without errors and the logfiles indicated no failure at all I was able to fix it by using 2 steps described in CTX123761.

Default Explorer View

Sun, 19 Dec 2010 14:40:40 +0000

As you probably know there are several different Folder Views in Windows Explorer:

The Explorer keeps tracks of the last used View per Folder in the registry in the key HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags. This KB article sort of desribes this functionality.

Writing Environment Variables to the Registry from a Script

Mon, 13 Dec 2010 20:52:59 +0000

I usually change the text below the “This Computer” icon to reflect the current username and servername:

This is an ancient trick, just set the the LocalizedString Value of the following key:

batch Download

HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}

to “%USERNAME% on %COMPUTERNAME%”.

It get’s a little more complicated if you want to set this from a script, because the environment variables are replaced with the actual value BEFORE they are entered in the Registry.

Cross-Site Scripting Vulnerability in Citrix Web Interface

Thu, 09 Dec 2010 09:40:59 +0000

from CTX127541:

A cross-site scripting vulnerability has been identified in specific versions of Citrix Web Interface.

This vulnerability could potentially be used to execute malicious client-side script in the same context as legitimate content from the web server; if this vulnerability is used to execute script in the browser of an authenticated user then the script may be able to gain access to the authenticated user’s session or other potentially sensitive information.

Citrix Web Interface starts very slowly

Fri, 26 Nov 2010 15:07:45 +0000

I remembered from a previous project that when the Citrix Web Interface this is caused by a setting called generatePublisherEvidence in the Aspnet.config file.

This behaviour has been documented by Citrix in CTX117273.

If you read it carefully you will see the note that you need to fix it in 2 places for an x64 system.

Citrix and Java JRE Versions

Mon, 15 Nov 2010 22:41:33 +0000

If you have ever installed Citrix Presentation Server/XenApp or one of the management consoles then you have probably dealt with Java versions.

Citrix is very picky about the Java version so it’s usually best to initially install the Jre version that is delivered with the product.

In my case however I needed to install the CMC for Xenapp 5 on Windows 2003, it requires JRE 5.0 Update 9 but this version was undesirable.

So I tried to install the CMC with the current JRE version (1.6.0_22 at this time) but it makes the Installer exit immediately:

Removing Single Sign on Node from the Delivery Services Console

Fri, 12 Nov 2010 15:51:53 +0000

When installing the Citrix Delivery Services Console with an unattended install (using CtxInstall.exe) the Citrix Password Manager gets automatically installed as well.

You can see this in the Console where you will get an additional node called "Single Sign On".

The case of the missing XenApp Node in the Delivery Services Console

Fri, 12 Nov 2010 12:37:44 +0000

After having successfully tested the Unattended install jobs for my Citrix XenApp 5 environment I went on to testing the install.

The install itsself and the msi logs that my jobs created all indicated that the install was successfull.

So I went on and launched the install jop for the Delivery Services Console. This job succeeded nicely but when I opened the console the XenApp node was missing:

The resolution is described in CTX125827 but Resolution 2 is a lot of manual labour :-(

So what do we do? We script it!

Automatically Accept Shadow Request

Fri, 22 Oct 2010 17:04:00 +0000

When you request Shadow (Remote Control) of a Remote Desktop (Terminal Server) or Citrix session the user gets a Dialog where he can Accept or Deny the Shadow Request.

It looks something like this:

It’s possible to change the default settings and remove the need for this permission but I think this is a bad idea since it violates the user’s privacy.

But sometimes it would be convenient to automatically accept, for instance for when a user is away or when you want to shadow a session that is “yours” but runs under another account.

I wrote a tool to do just that :D

Detecting a Citrix Published Application

Mon, 05 Jul 2010 21:48:28 +0000

While browsing through my old projects folder I found a little commandline tool that I wrote about a year ago. I needed to detect a certain published application on a Citrix environment in the loginscript.

The tool detect the current Citrix published applicationname or if you are running Terminal Server aka Remote Desktop Services the Initial Program name and stores this in an environment variable (APPNAME).

Citrix Workspace Control not working on HP t5540

Thu, 03 Dec 2009 09:33:58 +0000

Yesterday I was troubleshooting why Workspace Control was not available on an HP t5540 (Windows CE) Thin Client. This was a Citrix Xenapp 5 environment on Server 2008. When logging in through the Web Interface from the Thin Client's browser we noticed two things: Client Detection failed and the Reconnect and Disconnect buttons were not available: I looked into the files in the webinterface folder (wwwroot/Citrix/XenApp)and searched for workplace and reconnect. I determined that the Client Detection is done in the nativeClientDetect.js (app_data/clientDetection/clientscripts). But what I saw was very strange:

text Download

// Detect whether ICA Client is available.
<%
if ((sClientInfo.osWinCE() && sClientInfo.isIE()) || sClientInfo.osSymbian() ) {
%>
 // It is difficult to reliably detect processor type for WinCE and Symbian Devices
 // and therefore to choose the right flavour of the ICA client.
 // Also, it is not possible to simply download and install ICA client for some of these devices,
 // e.g. WBTs. Therefore, we assume that ICA client is always available.

 function detectNativeClient() {
 return true;
 }

Removing the Uninstall or change a program button from the Explorer Command Bar

Wed, 25 Nov 2009 10:52:13 +0000

Windows Vista introduced the Command Bar in Explorer which is sometimes also referred to as the Folder Band or the Task Band. The Command Bar is of course also present in Windows 7 and Server 2008 (R2).

This Command Bar shows possible tasks or actions depending on the active folder. I wanted to remove the “Uninstall or change a program” (in Dutch this is called “Een programma verwijderen of wijzigen”) button from the Computer view:

Unattended Install of the Citrix Xenapp WebInterface 5.2

Tue, 17 Nov 2009 08:55:44 +0000

I noticed that XenApp 5 Feature Pack comes with a new version of the Web Interface (5.2) (it is also available as standalone download). The parameters to install it in silent mode have changed but there’s no documentation at all on the Citrix Site:

Adding a Printer Connection with an alternative driver

Mon, 16 Nov 2009 10:59:13 +0000

I needed to add a printer connection to a Citrix server but the problem was that this printer had a buggy driver. I wanted to use an alternative driver such as the Citrx Universal Printer driver but on Terminal Server you might want to use the Terminal Services Easy Print driver.

So I decided to make something that could be used in both situations, the result is a small commandline tool called AddPrinter2 (sorry I am not good in finding original names).

It takes 2 parameters: the printername as unc path and the driver name. An example would be:

AddPrinter2 “\server\printer” “Citrix Universal Printer”.

Slow Installation because of Certificate Checks

Fri, 06 Nov 2009 21:29:15 +0000

A few days ago I noticed that an unattended installation of Citrix XenApp 5 was installing very slowly. When I looked at the various jobs and their installation time in the (Altiris) Deployment Server I saw that it was the Citrix Access Management Console that took almost 45 minutes to install:

It was clear that this wasn’t normal since the install job is taking installing OS components like IIS and all subcomponents, activating Application Server and reboot in around 9 minutes. The installation of Citrix XenApp itsself takes only 14 minutes.

I searched with Google and one of the first links was this knowledge base article from Citrix: Slow Access Management Console Installation on XenApp 5.0. The article clearly describes that the delay is occurred by failing checks for Publisher’s and Server Certificate Revocation (because there’s no Internet Connection) and suggests to turn these checks off. Indeed my servers do not have a direct internet connection so the cause and solution were clear.

And actually I had seen similar issues before in other (non Citrix) installations, some examples are Exchange 2007 (here and here) and SQL Server 2008 (the SQL Installer actually checks if there’s an internet connection in the prerequisites check).

The suggested, manual way, of turning of these checks is to clear the following checkboxes in Internet Explorer’s advanced settings Dialog:

But since I had to do this on many servers I decided it would be better to do it with a little VBS script.

Windows Installer proxy information not correctly registered

Thu, 05 Nov 2009 22:11:06 +0000

I was deploying an unattended installation of Citrix XenApp 5.0 with Altiris Deployment Server. The installation consists of several prerequisites, the installation of XenApp and finally the Citrix Management Consoles.

The installation is performed with a special account and not the Local System account because the install packages are located on the network.

When testing the deployment on a Windows Server 2008 I noticed that sometimes MSI based installations would fail with error code 1603 or 1601.

Delegated Management Console

Fri, 12 Jun 2009 21:40:20 +0000

In this topic I just want to show(case) you something I created in the past. It is a management console that enables delegated management in a Terminal Server or Citrix environment.

The console is launched by a small executable that check credentials (based on group membership) and then launches an RDP session with the actual console in it. The logic behind it is that the RDP session runs with an account with delegated permissions in Active Directory and the actual user account that logs in here doesn’t have any permissions at all.

This is the login screen:

If you’ve passed the login screen you enter the Main Console which consists of a Treeview on the left with possible options and a work area on the right:

Citrix Desktop Switcher

Fri, 12 Jun 2009 12:40:09 +0000

A while ago I wrote a small tool to assist in switching between a Full Screen Citrix Desktop and the local desktop. By default the Citrix client can switch from full screen to windowed mode (with the SHIFT F2 hotkey) but it doesn’t minimize the window automatically. So this always requires manually minimizing, do your local work, give focus to the Citrix client again and press the hotkey again to return to full screen.

My idea was really simply: we write a little exe that runs locally and registers the SHIFT F2 hotkey. When the Hotkey is pressed we determine if we are in full screen or in windowed mode and reverse that. When going from Full Screen to Windowed we minimize the Citrix Client and notify the user (by balloon tip) that he is on the local desktop. I called it the Citrix Desktop Switcher (sorry I couldn’t come up with a more original name)

So let’s see it in action!

When you start the Citrix Desktop Switcher you are notified that the tool is running (it doesn’t matter when you start the Switcher, you can start if even if the Citrix Session is already running).

Modifying Microsoft Updates and/or hotfixes

Tue, 12 May 2009 13:53:34 +0000

As you might know Microsoft distributes updates and hotfixes with in installer, update.exe. When you run update.exe it looks into the supplied .inf files to see what it has to install. It’s not possible to make changes to the inf files however because that will invalidate it’s signature (and update.exe checks the signature that is stored in an accompanying .cat file).

In my case I wanted to deploy the MUI pack for Internet Explorer 7 to be able to support multiple languages. By default this pack installs 35 (!) languages and I wanted to install only Dutch language on top of existing English.

Unable to get System PTE individual lock consumer information error when using !sysptes 4 in WinDbg

Thu, 16 Apr 2009 16:07:07 +0000

A few days ago I was troubleshooting some strange problems on a Citrix Server. After some investigation (I will write about that later) it was clear to me that there was a shortage of System Page Table Entries (PTE’s). Using perfmon you can see how many free System PTE’s are available:

Any value below 5000 is not good, values below 2000 are critical. In my case it wasn’t possible to view processes with Task Manager anymore.

Next I used WinDbg and attached to the Kernel (you can do that with File | Kernel Debug | Local | OK) and issued the !vm command:

WinDbg shows us a warning that a lot of PTE allocations have failed, we can also see that there’s enough Paged Pool and Non Paged Pool available.

So how do we find the guilty driver (usually it’s a driver)?

Sending Ctrl-Alt-Del / Simulate SAS in Windows Vista

Mon, 30 Mar 2009 21:51:48 +0000

Existing code to simulate the Secure Attention Sequence (SAS),which most people refer to as control alt delete or ctrl-alt-del, no longer works in Windows Vista. It seems that Microsoft offers a library that exports a function called SimulateSAS(). It is not public and one is supposed to request it by sending a mail to saslib@microsoft.com. Mails to this address remain unanswered though.

TSAdminEx Features Part 3

Wed, 25 Feb 2009 13:08:31 +0000

Beta Release

Part 1

Part 2

This is part 3 of the TSAdminEx Features series. Today I will discuss the Process View. As usual we will start by comparing TSAdmin to TSAdminEx again. So let's look at TSAdmin Process View:

And the one from TSAdminEx:

TSAdminEx Features Part 2

Tue, 24 Feb 2009 10:17:07 +0000

Part1

Now that a TSAdminEx beta is ready I will be showing you some features. In this part I will show the Sessions View.

Let’s start again with a compare of TSAdmin and TSAdminEx:

As you can see TSAdminEx shows more details, it shows the following extra columns:

TSAdminEx Features Part 1

Mon, 23 Feb 2009 16:18:28 +0000

Part 2

Now that a TSAdminEx beta is ready I will be showing you some features. In this part 1 I will be comparing the Users view to TSAdmin.

Let’s start TSAdmin, this tool is present by default on Windows 2003. If you use Windows XP or Windows Vista you can get it by installing the Administration Pack. Please note that TSAdmin does not work on Vista RTM due to a bug that was corrected in Vista SP1 (TSAdminEx works fine on both RTM as well as SP1)

Now let’s open TSAdminEx and start comparing…

TSAdminEx Beta release

Fri, 20 Feb 2009 17:59:06 +0000

Over the last months I have been working hard on TSAdminEx and now, finally, I can now present a first beta release.

If you don’t know what TSAdminEx is let me briefly introduce it. TSAdminEx is a tool that combines functionality of several existing tools: it has the power of task manager combined with the details of Process Explorer and the Terminal Server support of TSAdmin. On top of that it fully supports remote systems out of the box without installing any agents or services. It also has some unique features that neither of the mentioned tools can do!

Several new features have been implemented since the last time I talked about TSAdminEx and I will show you the most exciting ones here:

Globally disable Flash Player autoupdate

Fri, 19 Dec 2008 09:06:16 +0000

On a Citrix or Terminal Server you will want to disable autoupdate notifications of the flash player.

This can be done by creating a file mm.cfg in the folder where the flash ActiveX control is installed (normally C:\Windows\System32\Macromed\Flash).

Place the following line in this file (with a text editor like Notepad):

Applications tab in taskmanager is empty #2

Tue, 02 Sep 2008 09:05:25 +0000

As a followup to the previous article:

It might be better to just Exclude taskmanager because settings the Flag value to 0 might disable multi monitor support. To do this Create a new REG_SZ (string) under HKEY_LOCAL_MACHINE\Software\Citrix\CtxHook\AppInit_Dlls\Multiple Monitor Hook and name it Exclude. It's value should be taskmgr.exe (case sensitive!).

Applications tab in taskmanager is empty

Mon, 01 Sep 2008 16:46:21 +0000

Today I noticed something strange: on a Citrix (Presentation Server 4.5) server taskmanager does not show anything in the applications tab.

I tested this on the other Citrix Servers in the farm and they all had the same problem (and non Citrix servers did not). As you might know taskmanager fills the applications tab by enumerating all top level windows. That's why I suspected Citrix because it places several hooks (multi monitor support, speedscreen etc.).

Unattended Citrix Installation: Could not Access the datastore using the DSN file

Mon, 23 Jun 2008 22:11:21 +0000

I was working on an unattended installation of Citrix Presentation Server 4.5 or rather Citrix Xenapp. I was creating the dsn file for the installation by a script that uses the echo command and output this to a file.

This is a part of the script:

Terminal Server Ping Tool

Fri, 13 Jun 2008 13:34:46 +0000

A while ago I included a new undocumented API into my JwaWinsta unit which is called WinStationServerPing. This API “pings” a Terminal or Citrix server and verifies that Terminal Server is up and running. It is not the same as a regular networking ping! This API actually makes a connection to a (remote) Terminal Server and verifies that Terminal Server runs and accepts connections.

I wrote a small cmdline tool that uses this API to ping a Terminal Server which can be used to quickly determine if a Terminal Server is up and running. I named it WTSPing.

So how does it work? Open up a command prompt (Start -> Run -> cmd) and type WTSPing /? to see the help:

TSAdminEx Progress

Sun, 27 Jan 2008 23:04:07 +0000

I just wanted to show some of the progress that I made in development of TSAdminEx. I thought the best way would be to show some screenshots. Which reminds me I installed a nice Javascript to enlarge the thumbnails, click to see it…

Using WTSWaitSystemEvent

Fri, 25 Jan 2008 18:02:13 +0000

If you develop an application for Terminal Server you might want to react on session events. This means that your application is notified when a user logs on, logs off or becomes idle. This can be done with the WTSWaitSystemEvent function. Implementing it is rather simple and could look something like this:

Undocumented API's from Utildll

Sun, 09 Dec 2007 11:05:04 +0000

Several of Microsoft’s Terminal Server tools use undocumented API’s from Utildll.dll. For instance Terminal Server Admin uses it to get a localised connect state string and to format time strings like idle time, logon time etc.

Functions below seems to be the most usefull ones, I will add those to the JwaWinsta unit:

Delphi and Terminal Server Aware

Sat, 24 Nov 2007 23:21:37 +0000

When an application is not Terminal Server aware (also known as a legacy application), Terminal Server makes certain modifications to the legacy application to make it work properly in a multiuser environment. For example, Terminal Server will create a virtual Windows folder, such that each user gets a Windows folder instead of getting the system’s Windows directory. This gives users access to their own INI files. In addition, Terminal Server makes some adjustments to the registry for a legacy application. These modifications slow the loading of the legacy application on Terminal Server and require up to 8 MegaBytes extra memory. This behaviour can be avoided if the TSAware flag is present in the PE header of an executable as can be read here at MSDN.

More undocumented Terminal Server API's

Fri, 09 Nov 2007 22:42:58 +0000

I added some more undocumented API’s to my Jwawinsta unit, the unit is now becoming a collection of the undocumented API’s in winsta.dll.

These are the functions I added:

WinStationDisconnect
WinStationGetProcessSid
CachedGetUserFromSid (exported by utildll.dll)

I also added some more parts of the undocumented structure returned by WinStationQueryInformationW, it now contains:

Session State
WinStationName
SessionId
ConnectTime
DisconnectTime
LastInputTime
LogonTime
OutgoingFrames
OutgoingBytes
OutgoingCompressedBytes
IncomingCompressedBytes
IncomingFrames
IncomingBytes
Domain
Username
CurrentTime

2 Comments

Chris Dec 3, 2007
I would like know how it is possible to access WindowStation and Desktops from a service.
CreateDesktop and similar only works for the current session of the process.
I know there exists NTQueryObject and similar but they are hard to understand and only query kernel objects.
However creating a desktop from a service into another session is a mystery.

Citrix Solutions Conference 2007

Thu, 08 Nov 2007 15:01:24 +0000

Yesterday I attended the Citrix Solutions Conference in Antwerp. Brad Pedersen (Chief Architect and Senior Fellow at Citrix Systems) held an interesting speech about The End User Experience. I liked especially liked the part about the history of Citrix and the early versions of their products like Wincredible and Winframe. Since Brad wrote the original code for Citrix and thus Terminal Server (the stuff that is in winsta.dll now) I hoped he could share some info with me on the undiscovered parts of winsta.dll. Unfortunately Brad could not do this because of a non disclosure agreement with Microsoft. He did tell me that Citrix is pushing Microsoft to make more Terminal Server API’s public. I presume that’s why Vista and Windows 2008 offer some new API’s which I wrote about earlier.

How to launch a process in a Terminal Session #2

Thu, 08 Nov 2007 13:48:18 +0000

A little while ago I wrote an article on launching a process in another Terminal Session (/2007/10/20/how-to-launch-a-process-in-a-terminal-session/).

The article didn’t have a demo app yet so I’ve attached it here.

RDP Clipboard Fix

Thu, 25 Oct 2007 17:45:57 +0000

Did you ever loose Clipboard functionality (copy/paste) while working with several Terminal Server sessions? I think everyone that works a lot with Terminal Server has experienced this from time to time.

It’s caused by badly behaving applications. Dimitry Vostokov wrote a tool to fix this issue for Citrix (RepairCBDChain.exe), he explains the issue very well on his blog:

Windows has a mechanism to notify applications about clipboard changes. An application interested in such notifications has to register itself in the so called clipboard chain. Windows inserts it on top of that chain and that application is responsible to propagate changes down the chain:

If 3rd-party application forgets to forward notifications down then we have a broken clipboard chain and clipboard changes are not sent via ICA protocol:

Read more at Dimitry’s Blog: http://citrite.org/blogs/dmitryv/2006/12/09/clipboard-issues-explained/

So how can we fix this for Terminal Server then?