Citrix on Remko's Blog

Change NetScaler Password Hash from SHA1 to SHA512

Wed, 13 Dec 2017 13:53:08 +0000

This morning I wanted to install the NetScaler patch for the TLS padding vulnerability and of course I made a backup before deploying it.

Note: If you haven’t installed this patch yet I would recommended to do so: see CTX230238 and check out the ROBOT attack -Return Of Bleichenbacher’s Oracle Threat page to check which other products you may have that are vulnerable.

Upon checking the backups (I always download the backup and verify that the archive is intact) I noticed that one of my NetScaler’s uses SHA1 for the password hash whilst the other one uses SHA512:

I thought that this was a little strange as both NetScaler's are running the exact same build. However one of them (the one that uses SHA512) was reinstalled recently whilst the one using SHA1 has been upgraded.

Where does the Citrix Linux VDA store settings?

Thu, 23 Mar 2017 17:02:44 +0000

I recently (well today really) started playing with the Citrix Linux VDA. I took Ubuntu to test because I happen to like Ubuntu.

I didn’t get it to work correctly right away though and during troubleshooting I wanted to know where the VDA is storing it’s settings.

I found the following file /etc/xdl/ctx-vda.conf with the following contents:

Google Earth fix for XenApp, RDSH & Horizon

Mon, 20 Feb 2017 20:26:51 +0000

Both Google Earth and Google Earth Enterprise do not work correctly for multiple users on shared Hosted Shared Desktops (I still prefer to call it Server Based Computing but that’s likely because I’m an oldtimer).

Problem summary
So let’s look at the actual issue: the first user on a server is able to launch Google Earth but for any subsequent users on the same server Google Earth fails silently.

Problem details
Google Earth uses various synchronization objects such as Events and Mutexes but registers those in the \Global namespace instead of the \Local namespace.

Show Client IP Address when using NetScaler as a Reverse Proxy

Fri, 10 Feb 2017 14:10:45 +0000

Recently I switched over my blog from a hoster to a self hosted VM. In my setup I am using Citrix NetScaler as a reverse proxy.

Simular to when you’re using a 3rd party reverse proxy such as CloudFlare you will see the IP address from the reverse proxy instead of the actual Client IP Address on your webserver.

This means that your logging will all show the same, internal, IP address and that IP Based Access Rules will not work.

Fortunately this is easy to solve by having NetScaler add the Client IP Address in the headers and rewriting the address on your webserver.

Citrix Receiver Unknown client error 1110

Tue, 07 Feb 2017 15:08:27 +0000

Citrix Receiver and StoreFront error messages are sometimes confusing or lacking details so I decided to make little blog notes about common issues when I see them. So without further ado here’s #1:

In Citrix Receiver I tried to logon remotely via NetScaler Gateway and got the following error message: “Cannot get your apps from the store”

Citrix Receiver

Shodan, search engine for IoT or hackers delight?

Sat, 14 May 2016 15:36:22 +0000

Today I stumbled upon Shodan, a search engine for devices and services.

I decided to search for Citrix and this was the first page of results:

It's interesting to see that we get details such as the name of published applications. But it's possible to get even more details:

Citrix PVS RAM cache size Performance Counters

Wed, 30 Mar 2016 14:58:54 +0000

There has long been a debate about how to accurately view the size of your Citrix Provisioning Services ram cache size. SO much so that even Citrix clarified on how to view this detail using yet another tool

The thing is, this is all fine and well, but it’s a bit of a pig to actually get this data when you need it, or in an automated way. Wouldn’t it be better if we could have something easier?

Lately, Andrew Morgan and I decided to sit down and create an easy to use, Windows performance counter for the key metrics in a PVS cache and provide them to the community for use.

These counters turned out to be fascinating, as they really show how the cache works.

Our latest counters (which can be downloaded below) provide the following counters for easy access:

PVS Ram cache size (MB)
PVS metadata size (MB)
PVS Write Cache VHD disk size (MB)
PVS Ram Cache Percent used.

As there is no accurate way to detect how much ram is assigned to cache via Citrix Provisioning services, this value must be provided or this performance counter is missing.

Synchronizing Citrix ShareFile with PowerShell

Wed, 28 Jan 2015 11:39:17 +0000

The Citrix ShareFile Sync application is quite limited in functionality, one of those limitations is that you can only synchronize to a single (one) local folder.

As Helge Klein wrote in his excellent article "Configuring Citrix ShareFile Sync from PowerShell" this is simply a GUI restriction and not a restriction in the actual ShareFile sync engine.

Helge describes that you can easily do this in PowerShell with the following example:

Add-SyncJob example powershell Download

Add-SyncJob -ApplicationId 1 -ApplicationName "PowerShell" -Account helgeklein.sharefile.com
-RemoteFolderName "foc86c19-d904-434a-9d67-xxxxxxxxxxxx" -LocalFolderPath "D:\Daten\Sync to ShareFile"
-AuthType 4 -UserName xxxxxx@helgeklein.com -SyncDirection 2 -Password "MY SHAREFILE PASSWORD"

While the command was accepted, nothing was synchronized.

Convert Citrix License Server VPX to OVF

Fri, 27 Sep 2013 16:41:54 +0000

I wanted to run a virtual Citrix License server in my LAB.

Unfortunately Citrix only provides the VPX License Server in XenServer format (.xva). If you want to run the VPX on VMware ESX or Microsoft Hyper-V you need to convert it first.

The option to convert a Xen Virtual Appliance to OVF format was removed in XenConvert 2.4.1. So for a conversion you need version 2.3.1.

Here are the direct download links:

However when I tried to convert the downloaded VPX (Citrix_License_Server_VPX_v11.10.0_Build_12002.xva) I got the error "Failed to decode tar header record":

Run a Process when Citrix Receiver Exits

Tue, 24 Sep 2013 16:11:59 +0000

A while ago I was doing some research for Magic Filter when I stumbled upon something interesting within Receiver.

Inside wfica32.exe is a function called _Eng_RunExecutableOnExit. That name caught my interest, I’ve made it a little more readable with Ida Pro:

Magic Filter Preview

Sat, 10 Aug 2013 16:34:26 +0000

In Enterprise environments users are often working on a remote (virtual) desktop such as when using SBC or VDI.

They typically get a full screen session, perhaps on a thin client, and have not idea that they are using a remote desktop.

The Problem
However when they press Ctrl-Alt-Delete they get either the local Security Attention Screen / Task Manager or nothing at all if it has been blocked.

Clever users know they can use alternative key combinations such as Shift-F2 for Citrix or Ctrl-Alt-End for RDS.

But that's not the seamless experience we want to give our users, is it?

PNAgent Icon Data Algorithm

Thu, 08 Aug 2013 17:34:05 +0000

Some time ago I wrote about the PNAgent data that is stored in the registry in XML format.

After that post Andrew Morgan asked me if I could extract the PNAgent icons from the XML data.

That got me interested so let’s look at this data!

If you look at XML from PNAgent the icondata as in the AppData.Details.Icon node you’ll see something like this:

Seems like the icon data is stored/encrypted in a proprietary format.

Redirect Registry by Modifying .NET Executable

Thu, 30 May 2013 16:18:23 +0000

Yesterday I was troubleshooting an application that was migrated to Citrix XenApp.

The application is able to use a high precision scale which is attached to the client pc's com port. This com port is redirected to XenApp.

While testing users reported several issues, let's have a look at them.

Error configuring COM Port
Within the application the comport to which the scale is connected must be configured:

After pressing "Registreer" to register the new com port the following error message was shown

Scriptable Citrix Password Encoder

Tue, 19 Mar 2013 16:27:49 +0000

A while ago I published a tool to Encode and Decode Citrix passwords. Today I am publishing a small update to this tool that makes it scriptable by adding a COM interface.

If you start the tool without parameters you will get the GUI, just like before:

To use the COM interface you first need to register the executable with the /regserver switch:

After the registration you can call it using any language that supports COM. To get you started I wrote a few examples

The case of the COM Port Redirection

Mon, 11 Mar 2013 14:53:44 +0000

One of my colleagues asked me to assist in troubleshooting an application called SmartWare FM running on Citrix XenApp.

This application reads data from an external device called SECUTEST.

The device is connected to a COM port which is redirected to the XenApp session. In contrast to Microsoft Remote Desktop Services COM ports are not automatically redirected in XenApp but need to be mapped via eg a logonscript (NET USE COM1: \\Client\COM1:) or using UEM.

In my case the COM port was mapped with RES Workspace Manager:

Change Tab Order in an Executable

Wed, 02 Jan 2013 15:03:14 +0000

An application called Cardiology PACS was recently packaged for a Citrix XenApp environment. The functional tester reported a strange problem at the logon screen: after entering the username it was not possible to go to the password field with the TAB key.

This was a strange observation since I cannot imagine XenApp interfering with tab stops. So what was going on?

In the old situation the user was starting the application on his local pc. The application remembered the last username and pre-filled this, therefore the cursor was already in the Password field. The user simply entered his password and hit the Enter key:

On XenApp the Username field is not pre-filled because the last username is kept globally per machine. Therefore the user has to enter both the username and the password:

I tested the Tab key behavior in both situations and as I expected it didn’t work in both situations. This happens because the Tab Order has been messed up by the programmer (if you press Tab 9 times you do end up in the Username field).

Because this is something that would annoy me if I were the user I decided to fix it.

License Check fails on Citrix XenApp

Fri, 07 Dec 2012 16:30:07 +0000

Today I was asked to assist in getting an Excel Add-In to work on Citrix XenApp.

The application was packaged into a Thinapp by one of our package engineers.

However when testing the Add-In on Citrix XenApp the following message appeared:

Apparently this application does a license check that fails when run from another server (how bad).

Disclaimer
Before we go on: I would like to make clear that my goal is not to be able to use an application without license. I am just trying to make it work within the customer’s environment.

Application Hangs when Scanning in Citrix XenApp

Thu, 06 Dec 2012 16:10:50 +0000

Another interesting issue today with an application that runs on Citrix XenApp.

Environment
Customer has a Citrix XenApp 5 environment running on Windows Server 2003. Clients are all Windows XP and run the Citrix Online Plugin 12.3 full screen.

RES Workspace Extender is used to integrate locally installed application into the XenApp Session. Users have no access to the local desktop.

Symptoms
This particular application scans invoices using a USB scanner attached to the client and runs them trough a workflow.
Whenever the Start scan button was pressed the application froze.

File not found error when scanning using Twain Redirection in Citrix XenApp

Tue, 04 Dec 2012 15:07:10 +0000

Scanners attached to client machines can be used from within a Citrix XenApp session via a mechanism called Twain Redirection.

For this mechanism to work correctly the file twain_32.dll must be present in the Windows directory.

On Windows 2008 this dll should be copied from winsxs (side by side) to the windows directory as described in CTX123981.

On Windows 2003 the dll is already in the correct directory, however applications that are not Terminal Server Aware cannot find this dll because the Windows directory is redirected to the user profile. Citrix recommends copying twain_32.dll to each user’s profile directory but this will take up unnecessary space.

So what alternatives do we have?

Screen flickering with PowerPoint 2010 on Citrix XenApp

Fri, 30 Nov 2012 14:18:22 +0000

Within half an hour of writing the article "Application causes Screen Flickering in Citrix XenApp Session" I got a message that the hotfix in that article also fixes a similar problem in PowerPoint 2010.

Office 2010 uses hardware acceleration for displaying images and when this is enabled (which is the default) you will see constant screen flicker when you try to display a presentation with Images on Citrix XenApp (Server 2003):

Screen Flickering when running WPF Applications on Citrix XenApp

Application causes Screen Flickering in Citrix XenApp Session

Fri, 30 Nov 2012 13:28:54 +0000

Yesterday I was asked to troubleshoot an interesting issue with an application running on Citrix XenApp.

Environment
This customer is running Citrix XenApp 5 on Windows Server 2003 (x86). On the Client Side the Online Plugin version 12.3 is used.

The Problem
When this particular application was active the screen was flickering and black blocks appeared at seemingly random places. Further more it was not possible to resize the window:

My experience is that display issues are often related to either HDX Flash Redirection (offloading flash to the client) or the Multi Monitor hook.

Citrix License Server Crash

Thu, 23 Aug 2012 15:29:40 +0000

After updating a Citrix License server from 11.6.1 to 11.10 the Citrix Licensing Service crashed immediately after startup.

In the Event Log the following error was shown:

I suspected that there was a corrupt licensing file in the MyFiles folder (Default C:\Program Files\Citrix\Licensing\MyFiles).

Modify VB Executable to force Taskbar Button

Sat, 04 Aug 2012 11:07:18 +0000

I had to troubleshoot an application that was published with Citrix XenApp. The problem with this application was that it didn't have an button/icon in the taskbar and the window would sometimes disappear.

I noticed that this (cr)application was written in Visual Basic, so I decided to run it through a decompilation tool.

The decompiler was able to list the forms used in the Application:

Excel 2010 multi-threaded calculation

Fri, 08 Jun 2012 13:21:19 +0000

I was just browsing through the Options tab in Excel 2010 when I noticed the following setting:

This feature was introduced in Excel 2007.
In the default settings, multi-threaded calculation is Enabled with "Use all processors on this computer".

On a physical desktop this would be the preferred setting since it will make formula calculation as fast as possible.

Decoding Citrix IMA Datastore Password

Tue, 29 May 2012 21:46:30 +0000

This morning Arjan Beijer sent me an interesting link to a youtube video about obtaining the Citrix IMA Datastore password using Windbg.

The video shows a method, discovered by Denis Gundarev to obtain the IMA Datastore password. Basically he uses DSMaint.exe and set’s a breakpoint on the call to CryptUnprotectData and then reads the password from memory.

I tried to call the CryptUnprotectData API with the data read from the registry directly but this failed with error NTE_BAD_KEY_STATE, this is defined in winerror.h and it means “Key not valid for use in specified state”.

Citrix Launcher Progress Update 1

Thu, 17 May 2012 23:19:12 +0000

After figuring out how to encode and decode the Citrix passwords my next step for the upcoming Citrix Launcher is experiment with config.xml and authenticating to the Citrix Web Interface.

I imported the NFuse.dtd from the Citrix Web Interface into Delphi with the XML Data Binding Wizard. The results in an NFuse Unit so I can easily create the XML data.

To create an authentication packet I use the following code:

Encoding and Decoding Citrix Passwords

Sun, 13 May 2012 21:55:02 +0000

I am working on a launcher tool for Citrix XenApp that can not only connect to a published application or published desktop but can also leverage Citrix Workspace Control to reconnect to disconnected and/or active sessions.

There doesn't seem to be any sdk that exposed the data we need so I am trying to reproduce what the Citrix online plugi-in does.

I used a HTTP monitoring tool to capture the traffic between the Online plug-in and the Web Interface. First the online plug-in will retrieve the config.xml from the server specified via the Change Server option:

Cookie Error on Citrix XenApp

Thu, 29 Mar 2012 10:02:10 +0000

A user reported that the following error while visiting a website on a Citrix XenApp server:

I tried adding the site to the Trusted Sites List and adding the url to the Per Site Privacy list:

But this didn't work, but I noticed that the site was "flickering" a lot so I suspected that HDX Flash Acceleration was the problem.

Convert MCli output into PowerShell Objects

Wed, 29 Feb 2012 21:35:49 +0000

I was experimenting today with the PowerShell cmdlets for Citrix Provisioning Server. I was surprised to learn that the output of these cmdlets are not PowerShell types such as collections and objects with methods and properties but just plain text output.

A google search for a method to quickly convert the garbage output to objects led me to this blog post by Frank Peter. He describes a clever use of the switch statement with regular expressions with the Get-DiskInfo cmdlet.

Using Frank's code as a basis I wrote a generic function that converts Mcli output to an array of objects.

Session freeze when starting Excel

Mon, 20 Feb 2012 15:42:25 +0000

Environment
Windows 2003 Enterprise (32 bit), Citrix XenApp 5, RES Workspace Manager 2011, McAfee VirusScan Enterprise 8.7.0i.

Problem
When a opening an Excel workbook from Sharepoint the whole session freezes.

I asked the user to open an Excel workbook from Sharepoint and I noticed the following popup:

So my first thought was that the user somehow clicked this message to the background and IE was waiting for a response.

The case of the Slow Xerox Universal Print Driver

Wed, 04 Jan 2012 22:54:29 +0000

Earlier this week I was asked to investigate a problem with the Xerox Universal Printer Driver. Users complained that printing to a Xerox printer was much slower than printing to an HP printer.

I received a reference document from a user, a rather complex Excel sheet. When selecting multiple tabs it took almost a minute to generate a print preview in Excel 2007 running on Windows 2003 with XenApp 5.

I was aware of a bug in the Xerox Universal Driver where almost 9.000 files were copied into the user's profile directory (I wrote about that in an earlier post). But this seemed to be another problem.

NTVDM encountered a hard error

Wed, 14 Dec 2011 21:41:22 +0000

Today I troubleshooted an old DOS application that needed to run on a 32 bit Citrix XenApp Server. The last time I saw an actual DOS application in a production environment must be years ago.

When starting the application, the WOW subsystem (NTVDM) crashed with the message: "NTVM encountered a hard error.":

After spending some time troubleshooting I remembered a similar issue from a few years ago where a DOS application worked fine from the Console but refused to work from an RDP or ICA session.

Dutch Citrix User Group Launched

Thu, 01 Dec 2011 09:51:29 +0000

A while ago I was invited for a presentation at the UK Citrix User Group. I went there together with my colleague Ingmar Verheij and we had a great day there.

I was impressed with what I say there, a community that was very much alive and with good discussions. It was clear that the UK Citrix User Group was doing very well, thumbs up for their Steering Group!

So Ingmar and I wondered why there was no active Dutch Citrix User Group in The Netherlands. There had been an initiative in the past, the DUCUG so we decided to see if we could revive it.

Extremely slow Virtual Machines on HP Smart Array P410

Mon, 02 May 2011 14:15:50 +0000

I was deploying virtualized Citrix XenApp Servers on HP BL460c G6 servers and somehow the storage (direct attached) responded very slowly.

I had expected reduced performance (see my earlier post) since I didn't have the Battery Backed Write Cache module installed.
I did order them but had to start deployment before they arrived.

I did not however expect such an extreme bad performance. Deployment took ages or sometimes failed completely and when logging in to a VM it responded very sluggish.

Disk Latency

I looked in the vSphere console what the Disk Latency was. Latency under 10ms is usually considered good while a latency between 10 and 20ms is a potential performance problem.

I was shocked to notice that the Disk Latency was much higher with peaks toward 2.000 ms (2 seconds!):

Unattended Citrix Installation: Could not Access the datastore using the DSN file

Mon, 23 Jun 2008 22:11:21 +0000

I was working on an unattended installation of Citrix Presentation Server 4.5 or rather Citrix Xenapp. I was creating the dsn file for the installation by a script that uses the echo command and output this to a file.

This is a part of the script:

Using WTSWaitSystemEvent

Fri, 25 Jan 2008 18:02:13 +0000

If you develop an application for Terminal Server you might want to react on session events. This means that your application is notified when a user logs on, logs off or becomes idle. This can be done with the WTSWaitSystemEvent function. Implementing it is rather simple and could look something like this: