Virtualization, technology, and random rantings with a focus on Citrix and VMware.

Category: PowerShell

That One Time, You Got SMAPP’d!

So you run SiteManager. And somebody done decided they want to make a new server that will host the security.dat file. And… You already did the work to create custom .ini file locations for the users. NOW you have to change all those smapp.ini files with the updated location of the security.dat file. How dare they?! Well. That could be some fun if you have a lot of users. Wait…. Powershell for the rescue! If you happen to use a profile server to host the user files, you can easily replace it with the new location of the security.dat file.

Update: Not sure what happened, but the code paste didn’t take evidently. I blame gremlins. It has been corrected.

# Replace a line / value in .ini file stored in Citrix UPM folder location when a change to the application is made.
# An example is for SiteManager, if you change the location of the .dat file for security.dat file and you are using a custom .ini
# created and stored with the user profile.

$filePath = "e:\locationofupmfolders"

$Files = Get-ChildItem -Path $filePath -Recurse -File -force -Include "smapp.ini"

foreach($file in $files)
    {
        $find = "value-you-want-to-change"
        
        $replace = "value-you-want-to-change-to"
        
        $content = Get-Content $($file.FullName) -Raw
        
        #write replaced content back to the file
        $content -replace $find,$replace | Out-File $($file.FullName) | write-output
        
        
    }  
 

Easy peasy. Now they have the new location of the security.dat file!

Keep It On The Level, The MinimumFunctionalLevel

Sometimes, over time, you upgrade and upgrade. But maybe you forgot to upgrade your functional levels for your Machine Catalogs and Delivery Groups. If you don’t have the right functional level, you may be missing out on features. (Link to functional levels: https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/machine-catalogs-create.html#vda-versions-and-functional-levels)

So here is a quick way to upgrade the functional level. This is done for “L7_20” level. As newer levels come out, you can change the value.

# This will upgrade functional levels on Delivery Groups and Machine Catalogs. This will need to be ran on either a Delivery Controller or somewhere you have the Citrix Powershell SDK installed.
asnp Citrix*
$adminAddress = "deliverycontroller-FQDN:80"
$brokerCatalog = Get-BrokerCatalog -AdminAddress $adminAddress |Where MinimumFunctionalLevel -lt "L7_20"|Select Name, MinimumFunctionalLevel
$brokerDesktopGroup = Get-BrokerDesktopGroup -AdminAddress $adminAddress |Where MinimumFunctionalLevel -lt "L7_20"| Select Name, MinimumFunctionalLevel
foreach($brokerCat in $brokerCatalog) {
    Get-BrokerCatalog -AdminAddress $adminAddress -name $brokerCat.name | Set-BrokerCatalog -MinimumFunctionalLevel L7_20
    }
foreach($brokerDesk in $brokerDesktopGroup) {
    Get-BrokerDesktopGroup -AdminAddress $adminAddress -name $brokerDesk.name | Set-BrokerDesktopGroup -MinimumFunctionalLevel L7_20
    }
# Check Machine Catalogs after upgrading functional levels
Get-BrokerCatalog -AdminAddress $adminAddress |Where MinimumFunctionalLevel -lt "L7_20"| Select Name, MinimumFunctionalLevel
# Check Delivery Groups after upgrading functional levels
Get-BrokerDesktopGroup -AdminAddress $adminAddress |Where MinimumFunctionalLevel -lt "L7_20" | Select Name, MinimumFunctionalLevel

Under My SSL Thumbprint

Wouldn’t you know it!? A vCenter certificate got changed out and now your hypervisor connector is showing it no worky. Come to find out you missed the email memo that the certificate was getting changed. Or you might’ve been busy and didn’t think too much of it. Well, now you have to get it fixed! What if there was a way to get that information quickly and easily so that you just had to do some copy / paste magic to resolve it? Well…. There is! This handy dandy little script will get those pesky thumbprints and kick them out as a csv so you can use them to update your connector in the XenDesktop database.

# A script to check SSL thumbprints on your Citrix hypervisor connections. This will get all of the thumbprints of your connectors and will get the SSL thumbprints of your vCenters if you happen to have more than one.
# This is for running on in-premise Citrix farm (7.x) on a Delivery Controller with 10.1.0 VMware.PowerCLI module and the Citrix SDK installed with VMware ESXi 7.0U1 or later. This also is ran in ISE. Get-SSLThumbprint function is from https://gist.github.com/lamw/988e4599c0f88d9fc25c9f2af8b72c92
# with the return $SSL_THUMBPRINT -replace '(..(?!$))','$1' changed from ending in '$1:' The instructions for changing the SSL thumbprint can be found at https://support.citrix.com/article/CTX224551. 

asnp Citrix*

Function Get-SSLThumbprint {
    param(
    [Parameter(
        Position=0,
        Mandatory=$true,
        ValueFromPipeline=$true,
        ValueFromPipelineByPropertyName=$true)
    ]
    [Alias('FullName')]
    [String]$URL
    )

add-type @"
        using System.Net;
        using System.Security.Cryptography.X509Certificates;
            public class IDontCarePolicy : ICertificatePolicy {
            public IDontCarePolicy() {}
            public bool CheckValidationResult(
                ServicePoint sPoint, X509Certificate cert,
                WebRequest wRequest, int certProb) {
                return true;
            }
        }
"@
    [System.Net.ServicePointManager]::CertificatePolicy = new-object IDontCarePolicy

    # Need to connect using simple GET operation for this to work
    Invoke-RestMethod -Uri $URL -Method Get | Out-Null

    $ENDPOINT_REQUEST = [System.Net.Webrequest]::Create("$URL")
    $SSL_THUMBPRINT = $ENDPOINT_REQUEST.ServicePoint.Certificate.GetCertHashString()

    return $SSL_THUMBPRINT -replace '(..(?!$))','$1'
}


$xdConnections = Get-ChildItem XDHyp:\Connections | Select HypervisorConnectionName, HypervisorAddress, SslThumbprints

$xdThumbprints = @()

foreach($xdc in $xdConnections) 
    {
    $line = ""| Select HypervisorConnectionName, HypervisorAddress, SslThumbprints, vCenterThumbprints, SameThumbprint
              
    $line.HypervisorConnectionName = ($xdc).HypervisorConnectionName
    $line.HypervisorAddress        = ($xdc).HypervisorAddress | Out-String
    $line.SslThumbprints           = ($xdc).SslThumbprints | Out-String
    $line.vCenterThumbprints       = Get-SSLThumbprint (($xdc).HypervisorAddress | Out-String)
    $line.SameThumbprint           = ($line.SslThumbprints -match $line.vCenterThumbprints)

    $xdThumbprints += $line
        
    }

$xdThumbprints | Export-Csv c:\scripts\logs\sslthumbprints.csv

Where In The World Is Carmen Sandiego?!

You ever get an email from a user that just has their name in it and my VDI isn’t working? You ever go to Citrix Studio and look for the user and sort to find them? Well…. How about a better, faster, more streamlined way!? (Might be some powershell involved)

Look no further! Below is a fast and easy way to find that machine that the user just may have happened to forget to include in said email!

Got to make sure you have have the Citrix Studio Powershell modules in there and load them.

If you happen to do the above, you get this:

Gets you the result with names and machine names.

And so you can do that sweet, sweet copy / paste, code snippet below.

asnp Citrix*

$adminAddress = "deliverycontroller.fqdn:80"

Get-Brokermachine -AdminAddress $adminAddress -MaxRecordCount 1000 | Where AssociatedUserNames -like "*partofusername*" | Where SessionSupport -eq "SingleSession" | Select AssociatedUserNames, HostedMachineName, RegistrationState, OSType

Hope that is of some help to you! I typically user the last name for the part of the user name to search the assignments.

Power Up The ArcGIS Reactor Shell!

I’m sure many of you out there like ArcGIS and all that it can do for you! Well, maybe you have it in Citrix. Maybe you have custom SearchOptions.cfg’s. Maybe you have style sheets. Maybe you even like to have viewer and professional license versions available to all your users. Well….. In the long long ago, batch was the thing to power all things like this. What if. Just what if I told you, that powershell works too!? How awesome would that be?! You can upgrade your script from batch and stroll down PoSH street! How about see below and you too, for the low low price of free, can enjoy this method too!

**Fixed an issue with the ESRI_SOFTWARE_CLASS not respecting the Viewer / Professional option. This was tested and the issue is corrected. Change has been made below.** **Made an edit to reduce the number of changes you have to make and make it easier to switch between ArcGIS Desktop versions.**

# This is to launch ESRI ArcGIS in Citrix. This is using PowerShell version 5.1.17763.1971, on Server 2019 hosts, with Citrix UPM, and with ArcGIS 10.8.1 and with Seach Options. You can comment out
# the Search Options if you are not using them.
# Date: 08182021

# This sets the $username variable which will be used to map drives.
$UserName = [Environment]::UserName

# Sets profile server name for Citrix UPM. Enter profile server FQDN.
$profsrv = "profileservername.fqdn"

# Sets ArcGIS Version to be used in the script. There are several references to the version in the script. Enter version in format below.
$arcver = "Desktop10.8"

# Sets license server location. Enter license server FQDN.
$licsrv = "licenserver.fqdn"

# This section is to set the locations for _master if hosting on profile server (You can use whereever the _master location is as long as permissions are set and it is accessible
# from the network the Citrix hosting VDA's are located.You can use other drive letters, just make the change to the variables below and the section on removing drives and remapping.# This is location of "SearchOptions.cfg" files.

# This is location of "SearchOptions.cfg" files.
$Master= "\\$profsrv\GIS\_master" 

# Location of ArcCatalog.gx, GxDBFactCache.dat, and GxObjFactCache.dat files.
$Desk= "\\$profsrv\GIS\_desk" 

# Location of ArcMap Toolbox and styles.
$Desk1= "\\$profsrv\GIS\_desk1"

# Location of drives for GISDATA.
$QDest = "\\$licsrv\GISDATADRIVE"
$SDest = "\\$licsrv\GISDATADRIVE"
$NDest = "\\nas.fqdn\dfs\sharename"

# This tests to see if the location for the Search Options have previously been created for the user, and creating them if it is not present.
If (!(Test-Path "\\$profsrv\CITRIXUPM\$UserName\UPM_Profile\AppData\Local\ESRI\$arcver\ArcCatalog\SearchIndex\Configs\searchoptions.cfg")) {
   Write-Host  "Please wait while your Search Options are created..."
   robocopy $Master "C:\Users\$UserName\AppData\Local\ESRI\$arcver\ArcCatalog\SearchIndex\Configs" /e /S
   }

# This tests to see if the ArcCatalog options have previously been created, and create them if not.
If (!(Test-Path "\\$profsrv\CITRIXUPM\$UserName\UPM_Profile\AppData\Local\ESRI\$arcver\")){
    Write-Host "Please wait while your ArcCatalog Options are created..."
    robocopy $Desk "C:\Users\$UserName\AppData\Roaming\ESRI\$arcver\ArcCatalog\" /e /S /Y
    }

# This tests to see if the ArcCatalog options have previously been created, and create them if not.
If (!(Test-Path "\\$profsrv\CITRIXUPM\$UserName\UPM_Profile\AppData\Local\ESRI\$arcver\")){
    Write-Host "Please wait while your ArcCatalog Options are created..."
    robocopy $Desk1 "C:\Users\$UserName\AppData\Roaming\ESRI\$arcver\" /e /S /Y
}

# This removes any mapped drives that might previously have been mapped.
Remove-PSDrive Q,S,N –Force -Verbose

# This maps the drives to the locations for ArcGIS data and files.
New-PSDrive -Name Q -PSProvider FileSystem –Root "$QDest"
New-PSDrive -Name S -PSProvider FileSystem –Root "$SDest"
New-PSDrive -Name N -PSProvider FileSystem –Root "$NDest"

# Sets the Class version to "Professional" license use. Comment out the Professional and uncomment the Viewer to change version.
set ESRI_SOFTWARE_CLASS="Professional"
#set ESRI_SOFTWARE_CLASS="Viewer"

# This sets the location of the executable for the ArcGIS files and starts the process.
$dir = "C:\Program Files (x86)\ArcGis\$arcver\bin"
Start-Process $dir\ArcMap.exe

Now this above will get the script for you. But… You have to publish it as well! So, how about them settings!? This is the screenshot of the settings to use to publish it. You will need to go back and change the icon if you want to have it show the ArcGIS icon instead of the powershell icon. For the copy / pasters out there:

Publishing Citrix app settings:

Path to the executable file: C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe

Command line arguments: -ExecutionPolicy Bypass c:\appscripts\ArcMapAdv-PS.ps1

Working directory: C:\WINDOWS\system32\WindowsPowerShell\v1.0\

So there you have it! A way to launch ArcGIS in Citrix with powershell instead of batch!

Is That VM Running Or Taking A Nap?

Have you ever had machines not reboot properly? Have you had VMs you just don’t know if are awake and ready to serve your hungry customers? Have you ever just wanted to know if they are stepping through their paces? Well, here at XenApplePie, we have a solution for you! For only 35 payments of $0.00, you too can own this piece of automated automation!

But seriously. Sometimes you have a reboot policy set on your Delivery Group, and for some reason that pesky VM just doesn’t want to turn back on (From checking what it does, it looks like the DDC sends a shutdown and then a start command to reboot it). If you have had this happen, it can be frustrating to come in and either your hosting machine is off and users can’t access, or you can have a machine turned up to 11 to support your users. This little script, ran daily, can help prevent such frustrations and symptoms such as: pounding head on desk; shouting to the skies about your fury; verbal diarrhea of expletives not suitable for aural consumption.

Update below to the trim method used. The new method uses the split method versus the substring method. This method will work better as the length of the domain name won’t affect the outcome of the scripts and will save from making edits to the script for each domain. Another edit is for the HTML formatting to make it more readable in the report that is emailed.

So without further ado, well, ado ado ado. Here you go!

# This script was tested with 1912LTSRCU1 using Powershell 5.1.17763.1852 with PowerCLI version VMware PowerCLI 12.2.0 build 17538434 on vSphere 7.x.
# Build Date: 06292021
# https://www.pdq.com/blog/secure-password-with-powershell-encrypting-credentials-part-2/
# The above link contains the method to encrypting the password to use for the script and schedule in task scheduler.

# Loads Citrix snapins (This is assuming you have loaded the Citrix SDK / Studio on the machine that will run the check.)
Add-PSSnapin Citrix*

# vCenter connection section
# This tells PowerCLI to ignore invalid certicate action.
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -DisplayDeprecationWarnings $false -Scope Session -Confirm:$false

# This section is done via the method above in the pdq article for doing powershell scripts with encryption to show how to make the cred file, key file, and encrypt the information.
# The section also from https://notesofascripter.com
$password = Get-Content C:\scripts\creds.txt | ConvertTo-SecureString -Key (Get-Content C:\scripts\creds.key)
$credentials = New-Object System.Management.Automation.PsCredential("domain\username",$password)
Connect-VIServer somevcenteraddress -Credential $credentials
# End https://notesofascripter.com


# This is to get the list of machines from the delivery controller with the filter to get a specific set of machines.
$machines = Get-BrokerMachine -AdminAddress "delivery-controller.domainfqdn:80" -Filter {CatalogName -contains '*some_catalog_name_string*'}|Select-Object -Property machinename, desktopgroupname,inmaintenancemode

# This sets up an array to manipulate
$machine_array = @($machines)

# This goes through the array and removes VMs that have the "inmaintenancemode" value set as "True."
$machines_avail = $machine_array |where-object {$_.inmaintenancemode -ne "true"}

# The output of the Get-Brokermachine will retrieve the "machinename" with the domain preface. This trims the preface domain\servername. This method is better than the previously listed method as it will split at the "\" character, regardless of the length of the domain preface.
$vmtrim = $machine_avail.machinename
$vmtrimmed = (($vmtrim)|%{ ($_ -split '\\')[1]})

# This takes the result of the value above and assigns it to another variable that will be used to power on machines that have powered off.
$vmnames = $vmtrimmed

# This gets the additonal information from the "Get-VM" command and places it in a variable.
$vm = Get-VM $vmnames

# This creates and assigns the output of the "foreach if / else" loop. 
# This section was utilized from site "https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/PowerCLI-start-multiple-VM-if-poweredOff/td-p/501598."
$output = $vm | foreach {

# This checks to see the value of the "PowerState" being "PoweredOff."
    if ($_.PowerState -eq "PoweredOff") {

# This shows a message that a VM was started and generates an output for your report.
        "Starting $($_.name) on $($_.VMHost)"

# This starts the VM and captures the output for the report.
        $StartingVMs = Start-VM $_ -Confirm:$false

    }

    else {

# This generates a message for the output for the report if the VM is already running.
        "$($_.name) is already running on $($_.VMHost)"

       

    }

}
# HTML Formatting
$style = "<style>BODY{font-family: Arial; font-size: 10pt;}"
$style = $style + "TABLE{border: 1px solid black; border-collapse: collapse;}"
$style = $style + "TH{border: 1px solid black; background: #dddddd; padding: 5px; }"
$style = $style + "TD{border: 1px solid black; padding: 5px; }"
$style = $style + "</style>"

# HTML Email Body
$body = $report | ConvertTo-Html -Head $style
# End of section from "https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/PowerCLI-start-multiple-VM-if-poweredOff/td-p/501598."

# Generates email with attachment.
# This section to end was gotten from assistance from the author of https://notesofascripter.com. This also uses the .NET method of generating the email.
# Notesofascripter section
$date = Get-Date -Format "MM-dd-yyyy"
$emailFrom = "yourserviceemail@company.com"
$emailto = "youremailgroup@company.com"
$subject = "Daily Something Server Check| $date" 
$email = New-object System.Net.Mail.MailMessage 
$email.to.Add($emailto)
$emailCC = "emailgroup@company.com"
#$email.CC.Add($emailCC)
$Email.From = New-Object system.net.Mail.MailAddress $emailFrom
$email.Subject = $subject
$email.IsBodyHtml = $true
#$attachment = $Reports[1]
#$email.Attachments.add($attachment) If you want to do as attachment
$email.body = $body
 

$smtpserver="smtp.company.com" 
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($email)
;
# End of Notesofascripter section.

# Disconnect from vcenter
Disconnect-VIServer * -confirm:$false

Trying To Tie It Together

Wow! Two posts in one day!? What is that!?

So… I’m working on getting this completed. What you may ask? I’m working on powershelling myself into some quick reference materials. I haven’t seen many things that help tie a published application back to a machine. I’m working on one that will get the last missing pieces. Right now, this ties the machine to the application with the users assigned to it. This only shows who is assigned to the applications and what machine it is running on. The next iteration will hopefully tie in the assignments made at the Delivery Group level.

Enter-PSSession servername
asnp citrix*
get-brokermachine | select catalogname,hostedmachinename, @{N="publishedapplications";e={$($_.publishedapplications -join ',')}}, @{N="AssociatedUserNames";e={$($_.AssociatedUserNames -join ',')}} | export-csv c:\software\allapps.csv -NoTypeInformation -append
exit-pssession

This will get you the machine catalog, the hosting machine, published applications, and the users assigned to it. Sometimes a quick glance to find where an application is running is helpful. You still have to parse the CSV for what you need, but it is all in one place. Let’s see if we can make it slightly better the next time around. Maybe make a winform with some buttons that show it in text areas. We shall see!

Assistance on getting this working goes to Stuart. Check out his blog!

Something Mandatory This Way Comes….

 

So, you have found that you have the dreaded, evil, painful, Mandatory Upgrade message…. This has happened to me a few times. I’ve spoken with Citrix support (which was very good about this btw) to get fixed a couple of times. The third time, I tried my hand at re-creating the sorcery that was shown to me. I pulled a Sorceror’s Apprentice fail for a bit. After arguing with my hand against my forehead and maybe some choice angry words of frustration dipped in a rainbow of expression, I finally got it. I got the order of operations right. I got the thingie to come back to me without resorting to percussive maintenance. That would be quite difficult since they are virtual. It would’ve been as effective as a flame-proof candle. But, I share with you below what I did to bring it back from the dreaded error….

 

Go ahead and close Studio and log out at that point. You need the account that was used to build the farm. I tried other accounts, and they just didn’t have the power. This account also needed SA on the SQL server to register all the instances. So that is what I found prerequisite. Then, open some sweet, sweet Powershell ISE as administrator.  Copy and paste this into the ISE. Run the first two lines to see the count of instances. There should be 60 per controller for 7.15LTSR. There is one line commented out. Run that line and only that line on ONE controller, otherwise you are starting the process over again. Once you run it on the first controller, comment it back out and run that beautiful bean footage from “Get-Service Citrix* | Stop-Service -Force” onward. You will have to repeat the process sans the commented out line on the rest of the Delivery Controllers.

 

asnp Citrix*

Get-ConfigRegisteredServiceInstance | measure

Get-Service Citrix* | Stop-Service -Force
Get-Service Citrix* | Start-Service

#Get-ConfigRegisteredServiceInstance | Unregister-ConfigRegisteredServiceInstance

Get-AdminServiceInstance | register-configserviceInstance
Get-AcctServiceInstance | register-configserviceInstance
Get-ApplibServiceInstance | register-configserviceInstance
Get-BrokerServiceInstance | register-configserviceInstance
Get-ConfigRegisteredServiceInstance | register-configserviceInstance
Get-ConfigServiceInstance | register-configserviceInstance
Get-EnvTestServiceInstance | register-configserviceInstance
Get-HypServiceInstance | register-configserviceInstance
Get-LogServiceInstance | register-configserviceInstance
Get-MonitorServiceInstance | register-configserviceInstance
Get-ProvServiceInstance | register-configserviceInstance
Get-SfServiceInstance | register-configserviceInstance
Get-TrustServiceInstance | register-configserviceInstance
Get-OrchServiceInstance | register-configserviceInstance

Get-ConfigRegisteredServiceInstance -servicetype config | Reset-AdminServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-AcctServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-ApplibServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-BrokerServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-ConfigServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-EnvTestServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-HypServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-LogServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-MonitorServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-ProvServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-SfServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-TrustServiceGroupMembership
Get-ConfigRegisteredServiceInstance -servicetype config | Reset-OrchServiceGroupMembership

 

After you run this, you should be able to run the “Get-ConfigRegisteredServiceInstance | measure” command again to see the proper number of instances. You can run this after you run the above on a controller and see if the number increments properly. Sometimes you have to reboot the Controller after doing the fix. If you have 4 Delivery Controllers, it will look like below:

 

You should be able to open Studio now and it looks all pretty and pristine!

Let me know if this helps you out! Tune in for next blog’s episode, “Something, Something, Something Dark Side.”

 

 

 

 

 

PoSh Spice Be Here!

I want to take a moment… Ok, that moment’s over. Bringing to you from the world of powershell, powercli, and power scripting….. Stuart Yerdon, and the webmaster of https://notesofascripter.com. He has been featured as a vExpert, a connoisseur of all things M:TG (If you have to ask….), and a colleague and friend of mine. Check out his site and all things powershell. If you got a problem, and you can find him (you can at https://notesofascripter.com), you’ll find what you seek.

Page 4 of 4

Powered by WordPress & Theme by Anders Norén