Wasn’t is simpler when it was called Terminal Server? Previous posts like this have shorter titles: Windows Server 2008 SP2: What’s in it for Terminal Servers? and Windows Server 2003 SP2: What’s in it for Terminal Servers?

The document Hotfixes and Security Updates included in Windows 7 and Windows Server 2008 R2 Service Pack 1 Beta has the complete list of what’s fixed in SP1. RemoteFX might steal the show, however I’m specifically interested in what fixes there are for Terminal Server or Remote Desktop Session Host as it’s now called.

The table below is filtered for just those fixes, each of which is available now if you can’t wait for SP1 due in H1 2011:

If you’re interested in the Group Policy fixes in SP1, Alan has listed those here.

Windows Server 2008 R2 SP1: What’s in it for Remote Desktop Session Host? is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

This session was about DirectAccess in Windows 7 and Windows Serve 2008 R2 as well as Terminal Services Remote Desktop Services changes in Windows Server 2008 R2. The DirectAccess feature looks pretty compelling but it will take some time to get to there. However, the Remote Desktop Services stuff was actually pretty cool.

DirectAccess

DirectAccess is essentially access to the corporate network without a VPN.

DirectAccess provide seamless access to the corporate network  (corpnet) over IPsec and IPv6, however you can tunnel this inside IPv4 and TLS for where you can’t get direct IPv6 connections. DirectAccess leverages policy based network access – this mean that DirectAccess is integrated with Network Access Protection for policy and remediation services.

On the client-side there is a name resolution agent that directs requests for corporate resources to corporate DNS servers and requests for Internet resources to public DNS servers. Sounds like no more split tunneling issues that you would have with standard VPN connections.

DirectAccess requires a domain connected machine but does not actually require a user to be logged on for it to be connected to the corpnet. This means that anyone responsible for management of workstations can access those machine just like they were on the local LAN. Things like Group Policy can also be applied when the machine is outside the network too.

Today we have increased TCO because we need to get those mobile machines into the network to manage them, but with DirectAccess this is no longer an issue (of course those machines will need to be running Windows 7).

To get DirectAccess you will need Windows Server 2008 R2 to support the server-side connection (what the speakers were calling a Thin Edge DoS Prevention Server) and the Windows 7 client. Unfortunately we won’t see DirectAccess coming to Windows Vista.

There were also some specific Windows Server 2008 R2 Domain Controller requirements if you are looking at two-factor authentication. I’m not sure if that meant all DCs in the domain or forest or just DCs that the machine would be authenticating too.

The demo of DirectAccess was pretty straight-forward – if you are away from the corporate network you can still access internal or external resources just like you were onsite. It does look to be pretty seamless to the user.

Windows Server 2008 R2 Remote Desktop Services

You’ve probably already seen that Terminal Services has been renamed to Remote Desktop Services in Windows 7 and this has been done to bring into into line with its new capabilities where it supports VDI scenarios too. Of course all of the components have been renamed so now we have Remote Desktop Gateway, Remote Desktop Connection Broker, Remote Desktop Web Access and Remote Desktop Easy Print, all of which support or are supported by Terminal Server and VDI connections.

The new broker supports both TS and VDI sessions and you can see this with a unified view of your applications and desktops when you sign into the new Web Access.

I was glad to hear the speaker stress that Terminal Server is more scalable than VDI – somewhere in the range of 3 to 10 times more scalable. So if you’re thinking of replacing your TS infrastructure with VDI, you should probably be looking at applying the best tool for each usage scenario.

There was a quick list of improvements to Remote Desktop Services (you should be able to get a more detailed list soon)

• Remote Desktop Services Gateway security improvements (this was a bit vague)
• True multi-monitor support – up to 10 monitors supported
• Bi-directional audio (a bit late to the party with this one)
• Consent signing support i.e. a usage policy that users must consent to before logging in
• 2D and 3D remoting for DirectX 10.1
• DXGI, which is a replacement for GDI, which I gather has better support for remoting standard WinForms type applications
• RemoteApp language bar support – this mean that your remote application can integrate with your local language settings
• Integrated single sign (I assume this is an improvement over Windows Vista and Windows Server 2008)
• User Profile Cache Quota (applies a global quota for profile directory and removes the need to delete profiles at logoff)
• Application install improvement – no more Install mode to install applications

At this stage there are no concrete details on what features will make it into the updated Remote Desktop Client for Windows Vista and Windows XP, but there will most certainly be some features dependant on Windows 7 as the client.

The Web Access feature gets a make over (a big improvement over Windows Server 2008 if you ask me) plus forms-based authentication – much better than the auth dialog you see today. There’s also some client side interaction too, after you successfully authenticate you get a system tray notification that handles status information and allows you to disconnect (similar to what Citrix has today).

The connection experience was demoed and it did look pretty cool. The presenter was using a Windows Server 2008 R2 machine as the host connecting to a remote desktop that woke up a stored VM of Windows 7 running in Hyper-V. He then showed the Gears of War trailer streaming over this connection which played perfectly (this would be a LAN based scenario however, streaming over a slower connection wouldn’t be quite as nice). This stuff works on Terminal Server and VDI connection too.

There was also some improved RemoteApp integration. In Windows 7 there is an additional Control Panel applet in which you configure your connect to the farm and the applications are automatically added to your Start Menu – applications as well as desktops. This is very similar to Citrix’s PNAgent and the user experience looks pretty good.

Finally there were a few other random points:

• The speaker spoke of folder redirection as ‘profile virtualisation’, which just made me cringe
• Still no user based filtering in the Web Access at this time and it sounds like there are no plans to add this for RTM
• Microsoft are not doing anything to RDP to cope with high latency in this release
• There will be no changes to licensing requirement; however it sounded like there might be some technical changes, but don’t quote me on that one..

SVR203: Windows Server 2008 R2: Work Anywhere Infrastructure is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Want the Remote Desktop Connection 6.1 client for Windows XP but can’t update to Service Pack 3 or Windows Vista? No need to hack files from SP3, just grab the update from here:

Update for Windows XP (KB952155)

Install this update to use new Terminal Services features on a computer that is running Windows XP Service Pack 2 connecting to computers that are running either Windows Vista or Windows Server 2008 operating systems.

There’s a MUI pack available too. The knowledge base article for this update should be available soon, hopefully. Unfortunately there doesn’t appear to be an update available for Windows Server 2003.

Remote Desktop Connection 6.1 for Windows XP SP2 is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Yay, great news – Citrix has released an update to fix the handling of Adobe Flash versions for Presentation Server 4.0. This has currently been released as part of the latest hotfix rollup for Presentation Server 4.0.

For Presentation Server on Windows Server 2003 and above, this means that the SpeedFlash feature that accelerates the display of Flash is no longer version dependant. We’ll be able to update Flash now without losing the acceleration support.

A private hotfix should be available for Presentation Server/XenApp 4.5 but you’ll have to contact Citrix support to get it. The next hotfix rollup for 4.5 will include this fix.

Update To Fix Flash Handling on Presentation Server is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

In my last article I hinted at creating dynamic Start Menus using Access-Based Enumeration (ABE) in Windows Server 2003 SP1 and above. I have read an article on this subject previously on the Internets, but the tubes must be clogged up as I can’t find it anymore. If anyone has a link please let me know, because I would like to link to it.

So because I can’t find that article and Dylan asked how this is done, here’s my own version:

In this example I’m configuring a Start Menu for a Windows 2003 Terminal Server. This is probably the most common scenario for managing Start Menus and ABE helps to create a dynamic Start Menu even though all users may be accessing the same menu items.

My test environment consists of a Windows Server 2008 domain controller/file server named DC and a Windows 2003 Terminal Server named TS in a domain named dev.local with a DFS Namespace named Public.

Create A Share To Host The Start Menu

Access-based enumeration won’t work on local folders so you’ll need to redirect the Start Menu to a network folder. In my example configuration I’ve created a share named StartMenus which is located at E:\StartMenus on DC. Once the folder is shared, enable ABE. See my previous article on how to do this.

I’ve also set NTFS permissions on this folder so that Administrators and SYSTEM have Full Control and Authenticated Users have Read-only access. Ensure that the Administrators group has ownership on this and any sub-folders, otherwise, by default, folder redirection will not work.

Improving The Share Configuration

If you are hosting the share on Windows Server 2003 R2 or Windows Server 2008, I recommend enabling a File Screen on this location so that only .LNK, .URL and .INI files can be copied to this location. This will help prevent files with potentially harmful content being copied to the Start Menu and executed (especially the Startup location). Allow .INI files because the Start Menu is populated with DESKTOP.INI files.

You should also add this share to a DFS Namespace so that if you need to move the Start Menus to another server, you won’t need to modify Group Policy. In my example environment my new network path is \\dev.local\Public\StartMenus. DFS can also provide high-availability for your Start Menus through DFS Replication.

Create The Start Menu(s)

Create a folder below your new share for each Start Menu you require. This method of creating Start Menus doesn’t account for the configuration of each Terminal Server. For example, you might have multiple Terminal Server silos, so you’ll need to create a Start Menu for each silo (if you’re publishing multiple desktops). My example environment has a Start Menu location at \\dev.local\Public\StartMenus\TerminalServer.

Copy shortcuts from the local machine to the network share. You’ll need to copy from the user Start Menu as well as the common Start Menu to construct a menu with all of the required application shortcuts plus the usual suspects. After (or before) copying, clean up the shortcuts so that only the shortcuts you require are located there.

Create groups in your domain that you can use when setting permissions on your Start Menu. Most organisations will use a group to represent each application, but if you can go with role-based groups they will be mean less administrative overhead.

Set permissions on each shortcut folder or individual shortcuts as required. Once access-based enumeration is enabled users will see only the shortcuts they have read access to. Setting permissions on the shortcuts and folders is a great candidate for scripting or Group Policy. If you keep the permissions configuration in a script or use Group Policy to set permissions you can ensure those ACLs will stay consistent.

Redirect The Start Menu

In my example I’m configuring a Start Menu for a Terminal Server environment, so I’m going to redirect the Start Menu via a loopback policy applied to my Terminal Servers OU. I also deny the Apply Group Policy right to Domain and Enterprise Admins (or other applicable administrator groups on this GPO so folder redirection does not apply to those users.

Create a GPO on the Terminal Servers OU and enable the loopback policy:

Computer Configuration / Administrative Templates / System / Group Policy / User Group Policy loopback processing mode

I generally set this to Merge because most settings are configured by GPOs on the user OUs. Also enable the setting to hide the common Start Menu. If you don’t enable this setting, users will see both the redirected and local Start Menus.

User Configuration / Administrative Templates / Start Menu and Taskbar / Remove common program groups from Start Menu

Now enable folder redirection to your network share and be sure to set the option ‘Redirect the folder back to the local userprofile location when policy is removed’. Here’s a copy of the GPO report to see exactly how I’ve configured it.

Start Menu folder redirection in this manner allows you to stop customising the local Start Menu. This is something I see TS administrators do in numerous organisations. I find this practice to be un-necessary and increases the administrative overhead. Redirect the user Start Menu so that administrators have access to all of the locally installed shortcuts.

Let’s See What It Looks Like

Now that the configuration in complete your users should have a Start Menu customised for them. If they don’t you should check the Application log for any Group Policy errors.

What users should see on their Start Menus should be fairly predictable. My first user sees the following configuration:

And the second user sees a different Start Menu:

Summary

Using Access-Based Enumeration in Windows Server 2003 SP1 and above, we can create a Start Menu solution customised for each user. There are numerous ways to achieve this (perhaps even more flexible), but ABE gives us a no script, no 3rd party solution – nice and simple.

Building Dynamic Start Menus With Access-Based Enumeration is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

A workaround has been posted in the forums. Run the following command to exclude Internet Explorer from the multiple montior hooks that Presentation Server provides:

[quickcode:noclick]REG ADD “HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Multiple Monitor Hook” /v Exclude /d “iexplore.exe” /t REG_SZ /f[/quickcode]

Avert thy eyes, lest you be turned to stone! Well, not quite, but your users might be stoning you if your Oracle JInitiator applications look like this (I’ve spared you the hot pink version):

This behaviour is due to a couple of Presentation Server hotfixes – PSE450R01W2K3035 and PSE450R01W2K3042 (which supersedes the former). Ironically these hotfixes directly address some graphical display issues:

• In 16-bit color connections, blue or cyan rectangles might appear on graphics.
• In 16-bit color connections, text, lines, and shadows on inactive menu buttons and windows might appear blue instead of gray.
• In 16-bit color connections, blue or cyan rectangles might appear on graphics.

I’ve tested the following configurations in our environment:

• PSE450R01W2K3035 installed only
• PSE450R01W2K3042 installed after installing PSE450R01W2K3035
• PSE450R01W2K3042 installed only
• ICA and RDP connections
• 256 colour, 16-bit colour and 24-bit colour depths

These versions of the JInitiator experience the issue, and they even come with their own colour scheme:

• Oracle JInitiator 1.3.1.28, paints the form in pink or purple, hot pink is especially nice
• Oracle JInitiator 1.3.1.25, paints the form white
• Oracle JInitiator 1.3.1.22, paints the form yellow and green, very earthy

We’re having some problems with earlier versions of the JInitiator so I haven’t been able to test those. These hotfixes address a large number of issues including some of seamless windows updates as well as being required to use the SmartAuditor feature of Presentation Server. Hopefully Citrix will have an update soon.

Citrix Support forum topics covering this issue:

• Problem Citrix PS 4.5 with Oracle web
• Issues after installing PSE450R01W2K3035.msp

Citrix Hotfix Turns Oracle JInitiator Pink is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Like any good IT pro you’re probably keeping an eye on the latest software releases and updating to keep on top of security updates. When it comes to Adobe Flash under Citrix Presentation Server, you’ll want to ensure that the latest update is supported by SpeedFlash/SpeedScreen.

Unfortunately the latest version of Adobe Flash Player, 9e (9.0.115.0), which addresses various vulnerabilities, isn’t supported by SpeedFlash. This is because SpeedFlash works by looking for known names of the Flash ActiveX files and this does not include version 9e (FLASH9E.OCX). 

A hotfix is available for Presentation Server 4.0 to provide support for the most recent versions, except for 9e, and I’m not sure where this leaves Presentation Server 4.5. There’s currently an issue getting to that article, but you’ll need to contact Citrix to get a hold of the hotfix.

This means that at this time, you’ll have to weigh up updating to the latest version of Flash to fix security vulnerabilities or keep SpeedFlash working to provide improved performance. I know which one users would pick.

You can read more about how SpeedFlash works and what versions of Flash are supported by reading Derek Thorslund post on the Secrets for Optimising Flash Performance. Good news is that Citrix is working on a method of supporting Flash that does not rely on file names. Let’s hope an update is released soon.

Updating Flash On Presentation Server? Consider SpeedFlash First is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

If it’s the 834th time you’ve seen the Terminal Server help file open after you’ve enabled Terminal Server and you would like to stop this from happening in your automated builds, just delete this registry value before anyone logs onto the box (i.e. via CMDLINES.TXT or SysPrep):

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TerminalServerInstalled

Prevent Terminal Server Help From Displaying At Logon is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Citrix have released (and even re-released) whole slew of updates in the past few weeks that finally get’s a feature of Presentation Server working that’s close to my heart – high colour icons. Yes, high colour icons – the single most important feature that Citrix could add to Presentation Server! Forget application streaming, the new killer feautre is high colour icons!

Well perhaps a little perspective is in order , but I do think this is an important feature for usability. Here’s what you get – before:

and after:

As well as high colour icons with the Program Neighbourhood Agent client:

What do you need to get this going? You’ll need to install the following updates, so unfortunately it’s no small undertaking.

1. Upgrade to Presentation Server 4.5. You won’t get far without out this so hopefully you’re thinking about this upgrade or have upgraded already;
2. Download and install the last Access Management Console (requires a login);
3. Install Hotfix Rollup Pack PSE450W2K3R01 – For Citrix Presentation Server 4.5 and Citrix Access Essentials 2.0;
4. Update to Web Interface 4.6 for Windows (requires a login);
5. Deploy the Citrix Presentation Server Client 10.1 (This will only work for Web Interface and Program Neighbourhood Agent clients – unfortunately Program Neighbourhood clients will be left out in the cold);
6. Enable 32-bit colour icon support (this is the default behaviour) – Farm properties / Presentation Server / General;
7. Delete and republish your published applications. Although Citrix says you need to delete and republish your applications, can can just reselect an icon for each application. Check out a script I’ve written to do this.

Yes, that last part is right, delete and re-publish your applications. You can check out FarmAppUtil for this or take a look at a script I’ve written to do the same. This script will recreate published applications using the XML files exported from the Access Management Console. You can first export the XML files to a folder and then pass the folder to the script which will parse each XML file and create the published application. There are some caveats with this script though:

1. This is version 1.0, please test the script before you run it in a production environment;
2. This version will only import published applications. Published desktops and content won’t work; and
3. For the script to add an icon to the published application, the application must be installed on the machine where you run the script and it will use the first icon in the executable.

High Colour icons for Citrix Presentation Server applications is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

During testing of Adobe Reader 8 on a new Presentation Server 4.0 farm, I tested Adobe Reader 8 as a published application in a seamless window, using the ICA Client 9.230.50211. When using the toolbars in the published application (right clicking on the toolbars or clicking any of the drop down items) the application would exit completely without any errors logged on the server.

Fortunately applying the latest hotfix rollup for Presentation Server 4.0 – PSE400W2K3R02 fixed the issue. I know publishing Adobe Reader probably doesn’t happen that often, but the same issue most likely affects the Adode Acrobat 8 products too.

Adobe Reader/Acrobat 8, Citrix Presentation Server and Seamless Windows is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Every six to eight months or so, I have an issue logging onto a Terminal Server and then have to research the issue each time from scratch because I can’t remember how I fixed it. Here’s how it starts – after logging onto a Terminal Server I receive the following helpful error message:

To log on to this computer, you must have Terminal Server User Access permissions on this computer. By default, members of the Remote Desktop Users group have these permissions. If you are not a member of the Remote Desktop User group or another group that has these permissions, or if the Remote Desktop User group does not have these permissions, you must be granted these permissions manually.

After troubleshooting by checking and double checking that the account I am using has the correct privileges to login remotely, I realise that I can still login to the console via MSTSC /CONSOLE. Sounds like licensing, so sure enough in the System log; an event with ID 1010 from source TermService is logged:

The terminal server could not locate a license server. Confirm that all license servers on the network are registered in WINS/DNS, accepting network requests, and the Terminal Server Licensing Service is running.

Fixing the licensing issue fixes the logon issue and I can logon to the server remotely, but I’ve still wasted a 1/2 hour troubleshooting because the original error message lead me in a wrong direction. Surely Windows could present a dialog detailing the correct problem rather than something else completely, especially given that it logs a licensing related event at the same time.

The Citrix support site has detailed documents on troubleshooting Terminal Server logon issues, far better than anything I could find on the Microsoft support site:

• CTX106920 – Error: You do not have access to logon to this Session….
• CTX564283 – Troubleshooting 1003 and 1004 Terminal Server Licensing Errors

TS Logon Issues? It’s Not What You Think is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Like all ridiculously expensive software we love to hate, the SAP GUI does not use standard Windows print queues to send print jobs, but implementes a printing method they call SAPLPD instead. This is launched by a process that looks to be external to the SAP GUI component and does not respect the working directory key in each users registry. This process will attempt to write a file named LPRINT.NUM to the working directory of it’s parent process, the SAP GUI. If user does not have rights to write to this location the SAP GUI will exit completely without warning.

I just has this situation with a client who deploys a shortcut to the SAP GUI via published content with the Presentation Server Client. The working directory for published content cannot be specified like you can with a published applications, and therefore the working directory for the SAPGUI ended up being “\Program Files\Citrix\ICA Client”. User by default dosen’t have write access to this location. We modified the shortcut in the “Start Menu\Programs\Startup” folder for the Program Neighbourhood Agent, to set the working directory to their home folder and SAPLPD worked as it should.

SAP GUI 6.40 with Patch Level 10 and above provides a different method of printing from Terminal Server. More information here:

Best Practices for Implementing SAP GUI 6.40 for Windows Using Citrix Presentation Server 4

Adventures with SAP GUI, SAPLPD and Terminal Server is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

If the Citrix Program Neighbourhood Agent is slow to connect to the PNAgent web service and then takes time to display a list of applications, it’s probably related to folder redirection of the Application Data folder. Program Neighbourhood Agent, by default, stores cache information in the following folder:

%APPDATA%\Citrix\PNAgent\AppCache

Redirecting Application Data to the network will then cause the PNAgent to store this cache folder on the network. Placing this back on the local disk will improve performance. The location of the AppCache folder is controlled with the following registry key:

HKEY_CURRENT_USER\Software\Citrix\Program Neighborhood Agent\Application Cache

Now if only the Citrix Program Neighbourhood and Program Neighborhood Agent would not store cache in the roaming profile by default…

Slow Program Neighbourhood Agent? is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

I’ve just spent yesterday and today working on a site where the client had a need to run both the Microsoft Java VM and the Sun Java VM on their Terminal Servers. (The Microsoft Java VM is used for one site only, yes developers strike again). I was pretty happy when I was able to use Presentation Server 4.0 and Application Isolation Environments to get these to work on the same server, in Internet Explorer, at the same time. Here’s how:

1. Install the Microsoft Java VM to the Terminal Server and then install the latest Sun Java Runtime Environment and ensure that Internet Explorer is configured to this as the default (This is a machine level setting).

2. Create an Isolation Environment to hold an instance of Internet Explorer. Check out this document on the Citrix Knowledgebase, which describes how to associate Internet Explorer with an Isolation Environment. This applys to Windows Server 2003 as well.

How to install Internet Explorer (IE) 6 into an isolation environment on Windows 2000

3. Add the following registry entry to the Isolation Environment (change the version number to the version of the Sun Java VM you have installed and used by Internet Explorer)

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Plug-in\1.5.0_04]
"UseJava2IExplorer"=dword:00000000

Install the registry entry by placing this into a .REG file and import via

AIESETUP /W /N "Microsoft Java VM" REGEDIT /S SunJava-Off.REG

Where “Microsoft Java VM” is the name of the Isolation Environment and SunJava-Off.REG is the name of the registry file.

4. Create a new published application instance of Internet Explorer. In my case, because it was for one site only, I specified the URL after IEXPLORE.EXE and labled the published application to reflect the web site.

5. Associate this published application with the Isolation Environment.

6. Test and voila! The Sun Java VM as the default and the Microsoft Java VM only for those sites that require it. Of course there will be some user training involved but the solution works. My next step is to take this a little further and add registry settings to remove the address bar and toolbar so that users won’t be tempted to navigate to other sites in the published instance.

The only issue I found with this approach is that when launching the published application there is a 2 minute (yes, 2 minute) delay before Internet Explorer launches (you will see the AIERUN window displayed in the mean time). I’ll update this post if I find the reason. I don’t think that this document gives a suitable explaination:

Application launch performance is slower when applications are launched into an isolation environment

Juggling Java VMs is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Always an interesting discussion around the traps is that of how much memory to install in Terminal Servers. Due to the nature of Terminal Server and limitations of the 32bit architecture, kernel address space will be exhausted before a Terminal Server will run out of RAM (depending on the number of users, of course). Brian Madden has an excellent article discussing this limitation.

Microsoft, on the other hand, has the Terminal Server Capacity and Scaling white paper. This paper discusses testing methodologies for sizing Terminal Servers and it has a section on enabling Physical Address Extension (PAE) to allow Windows to access more than 4GB of RAM. It specifically lists the configuration of a test machine with 6GB of RAM. I think I’m now officially confused. Someone must have a definitive answer.

Whilst I’m on this subject, I must plug AppSense Performance Manager. This tool helped us with a Terminal Server farm, on IBM BladeCentre hardware (4GB RAM in each server) hitting the wall at around 120 users per server. Performance Manager got us to around 125 users per server with 1GB of RAM still free.

Sizing Terminal Servers and the 4GB memory limit(?) is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

I’ll file this under “Stupid Things I Didn’t Know”. Citrix Presentation Server relies on the PATH variable for core components to run. I was adding to the PATH variable, in a scripted build after the CPS install and before a reboot, with a command like this:

C:\REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment” /v Path /d “%PATH%;%ProgramFiles%\Sysinternals” /f

Unfortunately, that additions to the PATH that the CPS Setup program has added aren’t seen because I’m calling all this from the same session of CMD.EXE. After a reboot the server would not load the logon dialog and show this error instead:

The Logon User Interface DLL
C:\WINDOWS\system32\ctxgina.dll failed to load

Errors similar to the following are logged in the event viewer:

Event Type: Error
Event Source: IMAService
Event Category: None
Event ID: 3609
Date: 19/10/2005
Time: 1:48:18 PM
User: N/A
Computer: INGAUGBATS02
Description:
Failed to load plugin MfSrvSs.dll with error IMA_RESULT_FILE_NOT_FOUND

Setting the PATH back to what it should be will fix the issue. I’ll have to find a way to modify the registry entry directly, but my question to Citrix is: Why does Presentation Server rely on the PATH variable? Would it not read the location of files from the registry?

Lessons from the field: Presentation Server is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

If I could live in a world without Java, I’d be happy…

The Citrix Presentation Server 4.0 Management Console requires a specific version of the Sun Java VM to be installed before the console’s setup program will run. The version required is 1.4.2_06 and the latest version of the VM from Sun is 1.5_02. I usually install the 1.5 version to support Java in Internet Explorer, so it’s a pain to have to install both. A little cheating can be used to get the 1.5 VM to support the Management Console. The following commands will fool the setup program into thinking that the correct version is installed and all will be well.

REG ADD “HKLM\SOFTWARE\JavaSoft\Java Runtime Environment\1.4″ /v JavaHome /d “C:\Program Files\Java\jre1.5.0_04″ /f
REG ADD “HKLM\SOFTWARE\JavaSoft\Java Runtime Environment\1.4″ /v MicroVersion /d “2″ /f
REG ADD “HKLM\SOFTWARE\JavaSoft\Java Runtime Environment\1.4″ /v RuntimeLib /d “C:\Program Files\Java\jre1.5.0_04\bin\client\jvm.dll” /f

I found this information on page 76 in the Advanced Concepts Guide for Presentation Server 4.0.

Presentation Server and the Sun Java VM is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.