Category: Windows

Replacing Your Certificate On Session Recording Server

On September 28, 2022

With the wonders of doing your certificates on a much more frequent basis now, this becomes a yearly task. If you are using the WebPlayer feature of Session Recording on-prem (it is really nice), there is a little more tedious process you have to complete.

https://docs.citrix.com/en-us/session-recording/1912-ltsr/view-recordings/session-recording-web-player.html

This link has the overview you need to get you through the process. The only step I did not see in the article was the startwebsocketserver command at the very end. The location of the SsRecWebSocketServer.exe.config file you can find in the C:\Program Files\Citrix\SessionRecording\Server\Bin folder. I recommended making a copy of the file before you start.

But for your steps….

Get the certificate from your certificate provider of choice.

Import the certificate onto the Session Recording server.

Bind the certificate in IIS.

Bind the certificate in the Session Recording Server properties.

Export the cert as PFX to a local folder.

Perform the operations in the link above using OpenSSL to convert the exported PFX into a PEM file and extract the key file.

Modify the SsRecWebSocketServer.exe.config file in the C:\Program Files\Citrix\SessionRecording\Server\Bin.

Enter the location for the cert file and the key file.

Save file.

Open an elevated command prompt.

Navigate to the C:\Program Files\Citrix\SessionRecording\Server\Bin folder.

Enter “TestPolicyAdmin.exe -stopwebsocketserver” and press enter.

Enter “TestPolicyAdmin.exe -startwebsocketserver” and press enter.

The WebPlayer should be working as expected. If you do not update the SsRecWebSocketServer.exe.config file, the WebPlayer will give a WebSocket error.

Dazed And ConFAS’d : Cipher Suites For FAS And EndGame Exceptions For VDI

By Kris Davis

On September 13, 2022

In Citrix, Gateway formerly known as Netscaler, Netscaler, nFactor, Receiver, Windows, XenApp

Ran into some fun with setting up FAS for MFA. I was testing a shorter list of ciphers on a test SSL profile on ADC on the test vServer. Come to find out, when accessing a machine that was using MFA from outside the network, I was getting an SSL error 4 on Windows machines and SSL error 47 on Stratodesk machines. I hadn’t seen that error since Receiver 4.x. It appears there are some additional ciphers needed in regards to the Citrix Workspace App. It appeared to work fine with the other cipher set using the HTML5 Workspace App. This article has the updated cipher set you need to have or it may cause you some issues (Changes To FAS Ciphers). These would be applied to your SSL profile assigned to the vServer on the ADC.

Ciphers needed in the SSL profile that are in link above

I also ran into an issue with EndGame.

When trying to connect from to VDI Windows 10 machines, you would encounter an incorrect user name or password error if EndGame was enabled, instead of it SSO logging you in.

Checking the event log on the machine, you encounter a Smart Card Logon Event 5.

There are 2 DLLs you have to add to a global exclusion, scardhook.dll and scardhook64.dll. These are located under C:\Program Files\Citrix\ICAService. Just excluding those DLLs got rid of the Event 5 Smart Card Logon error and allowed the Provider DLL to initialize.

After getting these exclusions applied, SSO works normally for accessing the VDI machines.

How Many Users Are In There? : Getting Group Membership Counts

By Kris Davis

On August 31, 2022

In PowerShell, Windows

So you want to know how many people are in the groups. As luck would have it, you can get that. There was an interesting thing that I encountered with Get-ADGroupMember when trying to return a count. If there were 0 members, it returned correctly. If there were 2 or more, it returned correctly. If there was 1 member, it returned nothing. It wasn’t null as I checked that. It just returned nothing. Found the answer on this site as to why it was doing it:Why it returned nothing. TLDR: From Martin9700, PowerShell, when only 1 object is returned it is returned AS that object. Count is property of an array (and you can have an array of pretty much any variable/object type)

So with that in mind, I went the route below to do a Measure-Object, then do the count. That returned the results I expected. I also wanted to only select the unique users in the group just in case there were nested groups that a user might have been in more than one of.

# Script to get user group counts. This requires the AD Powershell module, access rights to AD, a central location of Citrix groups, a naming convention, and used in Powershell ISE 5.1.
$domain          = "domain"
$searchBase      = "OU=CitrixGroups,OU=Groups,DC=somecompany,DC=com"
$getCtxGroups    = (Get-ADGroup -server $domain -SearchBase $searchBase -Filter {SamAccountName -like "CitrixGroupNamePattern*"} | Select-Object SamAccountName)
$totalItems      = ($getCtxGroups).Count
$date            = Get-Date -Format MMddyyyy
$report          = @()
$currentItem     = 0
$percentComplete = 0


ForEach($ctxGroup in $getCtxGroups){
  Write-Progress -Activity "Processing user count on ($ctxGroup).SamAccountName" -Status "$PercentComplete% Complete:" -PercentComplete $PercentComplete
  $userCount      = (Get-ADGroup -Server $domain $ctxGroup.SamAccountName | Get-ADGroupMember -Recursive | Select-Object -Unique | Measure-Object).Count
  $line           = "" | Select GroupName, UserCount
  $line.GroupName = $ctxGroup.SamAccountName
  
  if($userCount -ne 0){
   
    $line.UserCount = $userCount
    
  }
 
  if($userCount -eq 0){
    $line.UserCount = "Empty"
  }
    
  $currentItem++
  $percentComplete = [int](($currentItem / $totalItems) * 100)
  
  $report += $line
}


$report | Export-Csv c:\scripts\logs\$date-ADUserGroup-Counts.csv -Append -NoTypeInformation

Are You The Keymaster!? : Script To Change ListOfDDCs in Registry

By Kris Davis

On July 13, 2022

In Citrix, PowerShell, Windows, XenApp

You have an upcoming change and some new DDCs you brought online. You may be changing out to Citrix Cloud (you better be), and you may need to change the ListofDDCs to you Cloud Connector. Sometimes GPO may take a minute to reflect what you want set. You can use this to change the ListOfDDCs quickly. You can also add the ListofSSIDs if that is something that you use by adding another registry name and value in your script block. I have the Get-ItemProperty used twice to get the result of what was set before the change and to show the reflected change. I just like to doubly confirm something and make sure something hinky was not afoot.

# Script to change DDCs on a group of Citrix servers. You will need access to the remote servers and firewall access with PowerShell.
$listServers = Get-Content c:\scripts\logs\svrlist.txt
$date        = Get-Date -Format MMddyyyy
$report      = @()

foreach($srv in $listServers) {

  $scriptBlock = {
    
    $regName  = "ListOfDDCs"
    $regValue = "DDC1 DDC2 or CC1 CC2"
    Get-ItemProperty -Path HKLM:\Software\Citrix\VirtualDesktopAgent
    Set-ItemProperty -Path HKLM:\Software\Citrix\VirtualDesktopAgent -Name $regName -Value $regValue
    Get-ItemProperty -Path HKLM:\Software\Citrix\VirtualDesktopAgent
       
  }

  $ddcUpdate  = Invoke-Command -ComputerName $srv -ScriptBlock $scriptBlock
  
  $report += $ddcUpdate
  
}

$report | Out-File c:\scripts\logs\$date-ddcchange-list.txt