So I had a user that had requested the Storyboard feature of PowerPoint. I found a couple ways that you could do it. You can install the Visual Studio Community Edition with installing either the Universal Platform Windows development (~8GB) or Office / Sharepoint development (~17GB). That looked rather large install for the feature. Also found another option for enabling the feature, installing the Microsoft Team Foundation Office Integration. That was less than ~1GB. That seemed the better option. So went with that! So if you need some storyboarding powers, the TFS Office Integration seems the easier and faster method to get it going.
Sometimes it is just good to have all the network names of your VDI and IP. This will get the VM name, network adapter, network name defined in vSphere, and IP.
# Script to get network names for VDI machines. This was tested with VMware 7.x, Citrix Cloud connection configured with the "default" profile, and VDI with single NIC.
asnp Citrix*
Get-XDAuthentication -ProfileName "default"
$date = Get-Date -Format MMddyyyy
$report = @()
$CurrentItem = 0
$PercentComplete = 0
$ctxVDI = (Get-BrokerMachine -MaxRecordCount 100000 | Where-Object SessionSupport -eq "SingleSession" | Where-Object HostedMachineName -ne $null | Select-Object HostedMachineName).HostedMachineName
$totalItems = ($ctxVDI).count
foreach($ctx in $ctxVDI){
Write-Progress -Activity "Getting network name for $ctx" -Status "$PercentComplete% Complete:" -PercentComplete $PercentComplete
$line = "" | Select-Object VM, Name, NetworkName, IPAddress
$networkInfo = (Get-VM $ctx | Get-NetworkAdapter)
$ipAddress = (Get-VM $ctx | Select-Object @{N="IPAddress";E={@($_.guest.IPAddress[0])}})
if($networkInfo -ne $null){
$line.VM = $ctx
$line.Name = $networkInfo.Name
$line.NetworkName = $networkInfo.NetworkName
$line.IPAddress = ($ipAddress).IPAddress
}
$report += $line
$CurrentItem++
$PercentComplete = [int](($CurrentItem / $TotalItems) * 100)
}
$report | export-csv c:\scripts\logs\$date-vdinetworks.csv -NoTypeInformation -Append
So you got your SAML Authentication server all configured. You got your MFA rolling. You start your day. You open up another app that has an assigned enterprise application to it with conditional access set. Then you open up your Citrix tab. You go to the site. It redirects you. And BOOM. Just like that. ERROR!!!
You think think think and think about why you are getting the error. You know when you opened Citrix FIRST yesterday the world was all sunny and bright. But today, that is not the case. But you really read the error closely. And you notice something… Authentication method ‘Password.’ You know that when you opened Citrix yesterday with your password and MFA, then continued on, it all worked. But change the order, and it does not. So. You go and check your SAML authentication settings.
You’ll see that by default, the “Password” class type is selected when you create the SAML authentication server. If you click on it so it is no longer blue, then save it, you notice that everything seems to work. So anything that is set there is EXPECTED in the assertion, not what is ACCEPTED. This would happen more if you have conditional access to not prompt on prem for one app, and prompt always on the other enterprise app. If you clear that, it will allow you to use the SAML assertion you got from the other app, assuming it is with the same IDP. There is also another option that you see outlined. “Force Authentication.” This option, if set, will force the session you start to redo the authentication and not use anything that you have cached. This is also good for testing purposes to force it to go through the authentication process.
With the wonders of doing your certificates on a much more frequent basis now, this becomes a yearly task. If you are using the WebPlayer feature of Session Recording on-prem (it is really nice), there is a little more tedious process you have to complete.
This link has the overview you need to get you through the process. The only step I did not see in the article was the startwebsocketserver command at the very end. The location of the SsRecWebSocketServer.exe.config file you can find in the C:\Program Files\Citrix\SessionRecording\Server\Bin folder. I recommended making a copy of the file before you start.
But for your steps….
Get the certificate from your certificate provider of choice.
Import the certificate onto the Session Recording server.
Bind the certificate in IIS.
Bind the certificate in the Session Recording Server properties.
Export the cert as PFX to a local folder.
Perform the operations in the link above using OpenSSL to convert the exported PFX into a PEM file and extract the key file.
Modify the SsRecWebSocketServer.exe.config file in the C:\Program Files\Citrix\SessionRecording\Server\Bin.
Enter the location for the cert file and the key file.
Save file.
Open an elevated command prompt.
Navigate to the C:\Program Files\Citrix\SessionRecording\Server\Bin folder.
Enter “TestPolicyAdmin.exe -stopwebsocketserver” and press enter.
Enter “TestPolicyAdmin.exe -startwebsocketserver” and press enter.
The WebPlayer should be working as expected. If you do not update the SsRecWebSocketServer.exe.config file, the WebPlayer will give a WebSocket error.
**Update: So.. It appears it does show up but… it shows under “Show built-in Responder Policies. **
This is where you select to show built-in.They should up like normal now.
Did an upgrade of 13.0-84.11 to 13.0-87.9. Same thing occurred as in the upgrade to 13.0-85.15. The responder policies seem to vanish from the GUI. It will show the correct number of policies at the overview screen, if you look on the bound vServer, but not in the pane that shows all available policies. If you check the ns.conf, you will see the policies are there and are bound where they should be. Seems to be a bug again where it goes the way of the dodo.
You can see there are policiesYou see there are no policies showingBut you can see there are policies bound to the vServer
Ran into some fun with setting up FAS for MFA. I was testing a shorter list of ciphers on a test SSL profile on ADC on the test vServer. Come to find out, when accessing a machine that was using MFA from outside the network, I was getting an SSL error 4 on Windows machines and SSL error 47 on Stratodesk machines. I hadn’t seen that error since Receiver 4.x. It appears there are some additional ciphers needed in regards to the Citrix Workspace App. It appeared to work fine with the other cipher set using the HTML5 Workspace App. This article has the updated cipher set you need to have or it may cause you some issues (Changes To FAS Ciphers). These would be applied to your SSL profile assigned to the vServer on the ADC.
Ciphers needed in the SSL profile that are in link above
I also ran into an issue with EndGame.
When trying to connect from to VDI Windows 10 machines, you would encounter an incorrect user name or password error if EndGame was enabled, instead of it SSO logging you in.
Checking the event log on the machine, you encounter a Smart Card Logon Event 5.
There are 2 DLLs you have to add to a global exclusion, scardhook.dll and scardhook64.dll. These are located under C:\Program Files\Citrix\ICAService. Just excluding those DLLs got rid of the Event 5 Smart Card Logon error and allowed the Provider DLL to initialize.
After getting these exclusions applied, SSO works normally for accessing the VDI machines.
So you want to know how many people are in the groups. As luck would have it, you can get that. There was an interesting thing that I encountered with Get-ADGroupMember when trying to return a count. If there were 0 members, it returned correctly. If there were 2 or more, it returned correctly. If there was 1 member, it returned nothing. It wasn’t null as I checked that. It just returned nothing. Found the answer on this site as to why it was doing it:Why it returned nothing. TLDR: From Martin9700, PowerShell, when only 1 object is returned it is returned AS that object. Count is property of an array (and you can have an array of pretty much any variable/object type)
So with that in mind, I went the route below to do a Measure-Object, then do the count. That returned the results I expected. I also wanted to only select the unique users in the group just in case there were nested groups that a user might have been in more than one of.
# Script to get user group counts. This requires the AD Powershell module, access rights to AD, a central location of Citrix groups, a naming convention, and used in Powershell ISE 5.1.
$domain = "domain"
$searchBase = "OU=CitrixGroups,OU=Groups,DC=somecompany,DC=com"
$getCtxGroups = (Get-ADGroup -server $domain -SearchBase $searchBase -Filter {SamAccountName -like "CitrixGroupNamePattern*"} | Select-Object SamAccountName)
$totalItems = ($getCtxGroups).Count
$date = Get-Date -Format MMddyyyy
$report = @()
$currentItem = 0
$percentComplete = 0
ForEach($ctxGroup in $getCtxGroups){
Write-Progress -Activity "Processing user count on ($ctxGroup).SamAccountName" -Status "$PercentComplete% Complete:" -PercentComplete $PercentComplete
$userCount = (Get-ADGroup -Server $domain $ctxGroup.SamAccountName | Get-ADGroupMember -Recursive | Select-Object -Unique | Measure-Object).Count
$line = "" | Select GroupName, UserCount
$line.GroupName = $ctxGroup.SamAccountName
if($userCount -ne 0){
$line.UserCount = $userCount
}
if($userCount -eq 0){
$line.UserCount = "Empty"
}
$currentItem++
$percentComplete = [int](($currentItem / $totalItems) * 100)
$report += $line
}
$report | Export-Csv c:\scripts\logs\$date-ADUserGroup-Counts.csv -Append -NoTypeInformation
So you’ve downloaded a cool new module. Your buddy gave you a module to test out. You copy it over and start looking to load it. You get the oh no! message. Your computer thinks you are being shady and blocks the file.
You have heard tale of an option to right-click EVERY single file and unblock the files.
All you want to do is unblock the files and load the module (at your own risk of course!). Well, then. Do it! Copy the module to your module directory in your path. Set the path to where it is. Iterate through those files, then load that module!
So you have a new / different vCenter you want to move your VDI machines to. For the power management part, you will need to have the other hypervisor connection configured. You can run the script below to change the hypervisor connection on your VDI machines. You will want to make sure you have the VMs powered down before beginning. The first steps are just information gathering. This is part of migrating machines to new hardware. I will be adding the other pieces at a later date.
First you will need to get your hypervisor names and Uids with this command: Get-BrokerHypervisorConnection | Select-Object Name, HypHypervisorType, Uid.
Then you can get a list of machines with the hypervisor connection you want to change from. This was just getting the first machine that had the hypervisor I wanted to change from. Machine was already moved to a new Uid but it would be 2 in this case. Get-BrokerMachine -MaxRecordCount 100000 | Where-Object SessionSupport -eq “SingleSession” | Where-Object HypervisorConnectionUid -eq “3” | Select-Object -first 1 | Select-Object HostedMachineName, HypervisorConnectionName, HypervisorConnectionUid
<# Script to change Hypervisor connection and power systems back up. This was done with PowerShell ISE 5.1, default profile configured on CitrixCloud SDK, and ESXi 7.0 with connection
to vCenter. This was built from Ben McGirt and slightly modified to get the machine names with a specific configured HypervisorConnection via Get-BrokerMachine command.
As it is best to change these settings and power the VM on, you will need to have the VMs powered down before beginning. The Uid in the example is "2" to get the machines using a different
HypvisorConnectionUid that you wish to change from and setting in this example to HypervisorConnectionUid "3."
#>
Get-XDAuthentication -ProfileName "default"
$getVDIMachines = Get-BrokerMachine -MaxRecordCount 100000 | Where-Object SessionSupport -eq "SingleSession" | Where-Object HypervisorConnectionUid -eq "2" | Select-Object HostedMachineName, HypervisorConnectionName, HypervisorConnectionUid
$citrixVMs = $getVDIMachines.HostedMachineName
Function PowerOnVM ([string] $Name) #, [string] $Hostname)
#From https://thecloudxpert.net/2016/04/25/howto-power-on-a-vmware-virtual-machine-with-powercli-powercli-101/
{
$VM = Get-VM -Name $Name
Switch ($VM.PowerState)
{
PoweredOn { Write-Host "$VM already Powered On.";break}
PoweredOff { Write-Host "Powering on $VM"; Start-VM -VM $VM;break}
Suspended { Write-Host "$VM suspended.";break}
Default {break}
}
}
ForEach ($VM in $CitrixVMs){
Set-BrokerMachine -MachineName ("*\" + $VM) -HypervisorConnectionUid 3
Start-Sleep -Seconds 2
PowerOnVM $VM
}
You know you have a LOT of apps. But you want to know about 1 app in particular. You could go to Studio and look. You could peruse the various pieces and parts to and get what you want. Or…. you could just grab it via script. So that is what we gonna do here. We are going to present a grid view of the applications you have published, select one of them, and give you all the information you have room for! And, for an unlimited time offer, export to csv! This requires having setup your Citrix Cloud authentication and using your secureclient.csv to access.
