Citrix Workspace app 2402

Last Modified: Apr 8, 2024 @ 3:02 pm

677 Comments

Navigation

Workspace app is the new name for Receiver. This post applies to all Workspace app versions, including the Current Release version 2311 and the LTSR version 2402.

💡 = Recently Updated

Change Log

Workspace app Versions

Citrix Workspace app uses a YYMM (year/month) versioning format, of which version 2311.1 (23.11.1.140) is the newest Current Release. See Citrix Docs for the list of new features, some of which only apply to Citrix Cloud.

Workspace app 2311 and newer have a new installer interface. 

Workspace app 2009 and newer have the new Citrix logo.

Workspace app 1912 and newer support App Protection. It’s available in LTSR version 2203 and the Current Release 2311.1 version. Workspace app 2303 and newer automatically install the App protection components with an option to start them after installation. Older Workspace apps have an option to install App protection and if you don’t select this and later want App protection then you must uninstall Workspace app and reinstall it.


  • See App Protection at Citrix Docs to enable App protection for the authentication screen. Workspace app 2305.1 and newer automatically start it for authentication if you have selected the Start App Protection check box during installation.

The newest LTSR (Long Term Service Release) version of Workspace app is version 2402.

Workspace app Modules

The Workspace app installer deploys multiple modules. Here are the important ones:

  • ICA Engine (wfica.exe) – process that uses the ICA protocol to connect to published apps and desktops.
  • Self-Service (selfservice.exe) – gets icons from StoreFront and displays them in a Window. When an icon is clicked, Self-service passes the ICA file to the ICA Engine to establish a connection.
  • Single Sign-on (SSON) for ICA (ssonsvr.exe) – captures user credentials and submits them to VDAs after an ICA connection is established
  • Workspace Auto-Update (CitrixReceiverUpdater.exe) – Notifies users of Workspace app updates. The most recent name for this component is Citrix Workspace Update.

Custom ICA files are no longer supported. However, Ryan Butler has created a script that asks StoreFront for an ICA file. Explicit credentials are supported. Find the script at Github.

Workspace app Discovery and Beacon Process

If you are using Workspace app’s built-in user interface (instead of a web browser), then Workspace app first prompts you to perform discovery, which is also called Add Account.

The Citrix logo changed in Workspace app 2009 and newer.

The Add Account wizard changed in Workspace app 2108 and newer. Enter a StoreFront FQDN, a Citrix Gateway FQDN, or Citrix Cloud Workspace FQDN. Just enter the FQDN. There’s no need to enter https or a path.

Workspace app will contact the FQDN and request download of the StoreFront Provisioning File.

  • If you entered a StoreFront FQDN, then Workspace app will download the Provisioning File directly from the StoreFront server.
  • If you entered a Gateway FQDN, then Gateway will first prompt the user to authenticate. After authentication, Gateway will connect to its configured Account Services address, and download the Provisioning File from StoreFront. The Account Services address is configured in the NetScaler Gateway Session Profile on the Published Applications tab.

If your StoreFront server is configured with multiple stores, then the user will be prompted to select a store. Unfortunately, there’s no configuration option in NetScaler Gateway to force a particular store.

The Provisioning File downloaded from StoreFront is an XML document containing values for several items configured in the StoreFront console. You can export the Provisioning File from the StoreFront console by right-clicking a Store.

The ReceiverConfig.cr Provisioning File looks something like this:

Here are the values in the Provisioning File:

  • Address – the Base URL configured in StoreFront Console
  • Internal Beacon – as configured in StoreFront Console. This can be the Base URL, or a manually specified URL.
  • External Beacons – as configured in StoreFront Console
  • Gateways – as configured in StoreFront Console. If there are multiple Gateways, when enabling Remote Access on the Store, then only one Gateway is selected as Default
  • SRID – Store ID. An important value to consider for multi-datacenter configurations. The SRID is set when the Store is created. It can also be changed by editing C:\inetpub\wwwroot\Citrix\Roaming\web.config.

Workspace app reads the Provisioning File, and configures itself by inserting the file’s contents into the user’s registry. The values are located under HKCU\Software\Citrix\Dazzle\Sites and HKCU\Software\Citrix\Receiver\SR. If you performed discovery through NetScaler Gateway, notice that the internal Base URL is added to the user’s registry.

Once Workspace app is configured, it then performs the following steps:

  1. Attempt to connect to the Internal Beacon.
  2. If the Internal Beacon is reachable, connect directly to the StoreFront Base URL (Address).
  3. If the Internal Beacon is not reachable:
    1. Attempt to connect to the External Beacons. If the External Beacons are not reachable, then stop attempting to connect.
    2. Connect to the Gateway address configured in the Provisioning File. If there is more than one Gateway, connect to the Gateway that is marked as the Default.

Here are some interesting notes on this connection process:

  • The FQDN you entered during Discovery has absolutely nothing to do with how Workspace app connects to StoreFront or Gateway. The actual connection process is controlled by the contents of the Provisioning File, not the Discovery address.
  • If the Provisioning File has multiple Gateways defined, Workspace app uses whichever Gateway is marked as Default. Workspace app completely ignores whatever Gateway FQDN you entered during Discovery. To use a non-default Gateway, the user must manually select the other Gateway in Workspace app’s Advanced Preferences.

In StoreFront Console, if any configuration changes are performed that affect the Provisioning File, it takes an hour for Workspace apps to reconfigure themselves automatically. Or users can remove Accounts and re-add (or Reset Citrix Workspace) so that the updated Provisioning File is imported.

Here are some additional methods of performing Workspace app Discovery:

  • After exporting the Provisioning File from StoreFront Console, distribute it to users, and ask them to double-click it.


  • After logging in to Receiver for Web (StoreFront), at the top right, click the username, and click Activate. This downloads the receiverconfig.cr file, which is identical to the one you can export from StoreFront Console. The user then must run the downloaded file.

Virtual Monitors

In Workspace app 1812 and newer, when connected to a published desktop on a single monitor, you can split the screen into virtual monitors. This feature is intended for large 4K monitors.

  • In the desktop toolbar at the top of the screen, click Preferences.
  • Switch to the Monitor Layout tab.
  • On the bottom, select Horizontal or Vertical, then click somewhere in the blue box to draw a line. The single monitor will be split along this line. You can set different DPI for each portion of the virtual display.
  • Right-clicking one of the split sections changes that section to the primary display.
  • Click OK when done.
  • In the toolbar, click Window to resize it to a window, and then click Full Screen to cause your virtual monitor configuration to take effect.

Uninstall Old Clients

Workspace app installer can do a force uninstall of old clients before installing the new version:

  • In Workspace app 2309 and newer, run CitrixWorkspaceApp.exe /CleanInstall /Silent
  • In Workspace app 1909 and newer, run CitrixWorkspaceApp.exe /ForceInstall /Silent.
  • In Workspace app 1908 and older (including Receiver), run CitrixWorkspaceApp.exe /RCU /Silent or CitrixReceiver.exe /RCU /Silent.

Citrix CTX325140: How to Remove Client Files Remaining on System after Uninstalling Receiver for Windows.

Installation and Configuration

Administrator privileges – Administrator privileges are required to install any missing prerequisites.

Internet required – Recent versions of Workspace app (e.g., 2311.1) download and install Microsoft Edge WebView2 Runtime, .NET Desktop Runtime 6.0.20, .NET Framework 4.8, and Visual C++. Internet access is required for the Workspace app installer to download these install files. Or there’s also an Offline Installer for Workspace app 2309 and newer.

.NET Desktop Runtime 6.0.20 – Workspace app 2309 and newer will install x86 .NET Desktop Runtime 6.0.20 if it’s not already installed.

This section contains a summary of all common command line switches, registry keys, and policy settings for Workspace app.

Links:

Workspace app 2203 LTSR CU2 and Workspace app 2212 and newer fix security vulnerabilities.

CitrixWorkspaceApp.exe current release version 2311.1 or LTSR version 2402 can be installed by simply double-clicking it.

  • LTSR Workspace app does not support Browser Content Redirection.
  • Workspace app 2006 and newer do not support Windows 7.
  • Workspace app 2206 and newer enable DPI Matching by default. DPI Matching can be disabled through client-side group policy, or in the Advanced Preferences in Workspace app 2212 and newer. DPI Matching prevents connections to CVAD 7.15. Multi-session VDAs with version 1912, by default, have DPI Matching disabled, but can be enabled in the VDA’s registry. See CTX460068 for details.

  • Workspace app 2311 and newer have a new interface for installation.


Administrator vs non-administrator

  • Non-administrator – If a non-administrator installs Workspace app, then each non-administrator that logs in to the same workstation will have to reinstall Workspace app.
    • Non-administrator installations are installed to %USERPROFILE%\AppData\Local\Citrix\ICA Client for each user.
  • Administrator – If CitrixWorkspaceApp.exe is installed using an administrator account. then the Workspace app only needs to be installed once.
    • Administrator installations are installed to C:\Program Files (x86)\Citrix\ICA Client.
    • Administrator installations of Workspace app 1912 and newer can be manually upgraded by non-administrators by clicking Check for Updates. Older versions cannot be upgraded by non-administrators.
  • Conflicts – If an administrator install of Workspace app is performed on a machine that has non-administrator installs of Workspace app, then the two installations will conflict. Best option is to uninstall non-admin Workspace app and Receiver before installing admin Workspace app. Otherwise, the user’s profile probably has to be reset before Workspace app is functional again.

Global App Configuration Service

Global App Configuration Service (GACS) is a Citrix Cloud service that can push configurations to Workspace app clients. This Citrix Cloud service is now available to all on-premises customers even if you don’t own any Citrix Cloud entitlements.

  1. Login to https://citrix.cloud.com. If you don’t have a Citrix Cloud account, then login using your Citrix.com account credentials and it will create a Citrix Cloud account.
  2. Use the top left hamburger menu to go to Workspace Configuration.
  3. Switch to the tab named App Configuration.
  4. Click Switch URL.
  5. Near the bottom, click Claim URL.
  6. Click Add URL to add your on-premises StoreFront/Gateway URL. See Citrix Docs for details. GACS uses this URL to determine which Workspace app clients should receive the settings that you configure.
  7. Back in the App Configuration page, you can now configure Workspace app settings as desired. Workspace apps that have stores under the claimed URL will then receive these settings.

Auto-Update

Workspace app supports auto-update.

Some notes:

  • If Workspace app 1912 or newer is installed as administrator, then non-administrators can click Check for Updates to manually update Workspace app. To prevent this, use group policy to disable Citrix Workspace Updates.

    • Older versions of Workspace app cannot be upgraded by non-administrators.
  • If Workspace app is installed on a VDA, auto-update is automatically disabled. This includes Remote PC.
  • Auto-update can be limited to LTSR updates only.
  • Auto-update is configurable through several mechanisms: group policy, StoreFront, Workspace app GUI, installer command line. See Configuring Citrix Workspace Updates at Citrix Docs.
  • Workspace app 2107 and later let users select an Update channel.

  • See George Spiers Citrix Receiver for Windows Auto-Update.

Auto-update is configured using Workspace app group policy under the Citrix Workspace Updates, or Auto-Update node.


Or use Global App Configuration Service.

Workspace app Splash Screen

Workspace app shows a Splash Screen on first launch with the text “Citrix Workspace app extends the capabilities of Citrix Receiver”.

To prevent this splash screen, set the following registry value: (source = Dennis Span on Twitter)

  • Key = HKEY_CURRENT_USER\SOFTWARE\Citrix\Splashscreen
    • Value (REG_SZ) = SplashscreenShown = 1

Add Account Wizard

After installation, Workspace app will launch and ask you to add an account. If Workspace app, notice the checkbox Do not show this window automatically at logon.

FTU (First Time Use aka Add Account Wizard) will be displayed only if a store is not configured. If a store is already configured via command line, GPO, or Citrix Studio, then FTU screen will not be available after installation. Otherwise, FTU can be suppressed by doing one of the following:

  • Rename CitrixWorkspaceApp.exe to CitrixWorkspaceAppWeb.exe.
  • Install using a command line switch:
    • CitrixWorkspaceApp.exe /ALLOWADDSTORE=N
  • Set the registry value: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\EnableFTU=dword:00000000 (or EnableX1FTU =dword:0)
  • Disable the EnableFTU policy setting in Receiver.admx.
  • Change Registry values post installation to suppress the Add Account window. Under HKLM\Software\Wow6432Node\Citrix\Dazzle, set AllowAddStore value to N.
  • Set the registry value: HKEY_LOCAL_MACHINE\Software\Citrix\Receiver\NeverShowConfigurationWizard (REG_SZ) = true
  • Also see Suppressing Add Account dialog at Citrix Docs.

Discover Hidden Stores

When Workspace app is first launched, it must perform Discovery, which is the process of downloading the .xml provisioning file from StoreFront. Discovery is performed by entering a StoreFront FQDN or Gateway FQDN. To discover a hidden store (a store that’s not advertised), add ?StoreName to the end of the FQDN. CTX214819 How to configure Receiver to a Store that is not advertised.

CitrixWorkspaceApp.exe Command line switches

CTX227370 Citrix Workspace app Commandline Tool contains a GUI tool to build your installer command line.
image.png

For unattended installation of Workspace app, see CTA Dennis Span Citrix Workspace App unattended installation with PowerShell or Citrix Receiver unattended installation with PowerShell.

Installer Command Line Switches are detailed at Configure and install Receiver for Windows using command-line parameters at Citrix Docs. Common Command line switches include the following:

  • /silent
  • /includeSSON – enables pass-through authentication. GPO configuration is also required as detailed below. 
    CitrixWorkspaceApp.exe /includeSSON
  • /ALLOWADDSTORE=A – by default, only SSL (HTTPS) stores are accepted. To allow non-SSL stores: 
    CitrixWorkspaceApp.exe /ALLOWADDSTORE=A
  • /STORE0 – To add a store from the installation command line: 
    CitrixWorkspaceApp.exe STORE0="AppStore;https://Citrix.corp.com/Citrix/MyStore/discovery;on;App Store"
    • Workspace App can discover the Store through NetScaler Gateway. 
      CitrixWorkspaceApp.exe STORE0="AppStore;https://gateway.corp.com#MyStore;On;App Store"
  • /SELFSERVICEMODE=False – disables the Self-Service interface and enables shortcut-only mode: 
    CitrixWorkspaceApp.exe /SELFSERVICEMODE=False
  • /AutoUpdateCheck=auto /AutoUpdateStream=LTSR – enables Citrix Workspace Update notifications and sets it to LTSR Branch only. AutoUpdateCheck can also be set to manual or disabled. AutoUpdateStream can also be set to Current. See Configuring Citrix Workspace Updates at Citrix Docs. 
    CitrixWorkspaceApp.exe /AutoUpdateCheck=auto /AutoUpdateStream=LTSR
  • /ENABLEPRELAUNCH=True – enables prelaunch: 
    CitrixWorkspaceApp.exe /ENABLEPRELAUNCH=True
  • /ALLOW_CLIENTHOSTEDAPPSURL=1 – enables Local App Access: 
    CitrixWorkspaceApp.exe /ALLOW_CLIENTHOSTEDAPPSURL=1

Registry values

HKLM\Software\Wow6432Node\Citrix\Dazzle on the Workspace app machine. All are of type REG_SZ (string) unless specified. Note: several of these are configurable using the Reciever.admx group policy template.

  • SelfServiceMode (REG_SZ) = False – Turns off Workspace app’s Self-Service interface.
  • PutShortcutsOnDesktop (REG_SZ) = True – If Self-Service interface is disabled, places all shortcuts on desktop.
  • UseDifferentPathsforStartmenuAndDesktop (REG_SZ) = True
    • UseCategoryAsStartMenuPath (REG_SZ) = True or False
    • UseCategoryAsDesktopPath (REG_SZ) = True or False
  • StartMenuDir (REG_SZ) = name of folder on Start Menu where shortcuts are placed.
  • DesktopDir (REG_SZ) = name of folder on Desktop where shortcuts are placed
  • EnablePreLaunch (REG_SZ) = True – If SSON is enabled then PreLaunch is already enabled by default.
  • AllowAddStore (REG_SZ) = A – Only if using http (instead of https) to connect to StoreFront.
  • AllowSavePwd (REG_SZ) = A – Only if using http (instead of https) to connect to StoreFront.
  • UserDomainName (REG_SZ) = pre-filled domain name
  • InitialRefreshMinMs (REG_SZ) = 1 – minimizes the launch delay before contacting store
  • InitialRefreshMaxMs (REG_SZ) = 1 – minimizes the launch delay before contacting store
  • RefreshMs (REG_SZ) = 3600000 (1 hour) – interval for Receiver icon refreshes. 1 hour is the default value.
  • MaxSimultaneousFetches (REG_DWORD) = 6  – improves the time of loading icons in Start Menu
  • MaxSimultaneousSubscribes (REG_DWORD) = 6 – improves the time of loading icons in Start Menu
  • DontWarnOfRemovedResources (REG_SZ) = True – prevents dialog boxes when resources are removed from the server. (or False)
  • SilentlyUninstallRemovedResources (REG_SZ) = True – prevents dialog boxes when resources are removed from the server
  • PreferTemplateDirectory (REG_SZ) = UNC path or local path containing shortcuts copied by the prefer keyword. Give the shortcuts a short name.
  • PnaSSONEnabled (REG_SZ) = True – Enables Single Sign-on for PNAgent (Web Interface).
  • WSCReconnectMode (REG_SZ) = 3 (default) – If this Workspace app is running inside a VDA published desktop, set it to 0.
  • AlwaysUseStubs (REG_SZ) = True. Workspace app and Receiver 4.3.100 and newer don’t create .exe stubs by default. Set this to create .exe stubs. Also see Citrix CTX211893 Controlling Shortcut behavior in Receiver 4.3.100.
  • DontCreateAddRemoveEntry (REG_SZ) = True – don’t create “Delivered by Citrix” entries in Programs and Features
  • DesktopNameFormatString = format string for shortcut names – For example “{0}_{1}_{2}_{3}”. See the link for details.
  • SelfServiceFlags (REG_DWORD) = 4 – prevents duplicate shortcuts when roaming and Desktop is redirected.
  • ReEvaluateNetwork (REG_SZ) = true – for Beacon detection with Single FQDN

To prevent the Win+G popup on Windows 10 machines:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\GameDVR
    • AllowGameDVR (REG_DWORD) = 0

To allow adding non-HTTPS stores to Workspace app:

  • HKLM\Software\Wow6432Node\Citrix\AuthManager
    • ConnectionSecurityMode (REG_SZ) = Any

To increase ICA bandwidth consumption over high latency links, set:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\TCP/IP

To prevent beacon probing from using proxy, set:

  • HKEY_LOCAL_MACHINE\Software\WOW6432Node\Citrix\Receiver\inventory
    • BeaconProxyEnabled (REG_DWORD) = 0

To enable foreground progress bar, set:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\ICA Client
    • ForegroundProgressBar (REG_DWORD) = 1

For client-to-server file type redirection, set:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\ClientDrive
    • NativeDriveMapping=”TRUE”

To fix USB devices that emulate a keyboard, set:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Keyboard
    • KeyboardTimer=”10”

To prevent “USB Hub Power Exceeded” message, set (not needed in 4.2.100 and newer):

  • HKLM\SOFTWARE\Citrix\ICA Client\GenericUSB (same path for 32-bit and 64-bit, create the keys)
    • DisableInternalDeviceCtlDispatchHook (DWORD) = 0x1

To override the devices that are mapped using optimized channels instead of generic USB, see Citrix CTX123015 How to Configure Automatic Redirection of USB Devices

Group Policy Settings

Copy the Workspace app ADMX template (C:\Program Files (x86)\Citrix\ICA Client\Configuration\receiver.admx) to C:\Windows\PolicyDefinitions (or Sysvol). Also copy receiver.adml to C:\Windows\PolicyDefinitions\en-us (or Sysvol).

Edit a GPO that applies to client machines, go to Computer Configuration | Policies | Administrative Templates | Citrix Components | Citrix Workspace and configure the following:

  • To enable pass-through authentication: go to | User Authentication |.
  • To add a store, go to | StoreFront |
    • StoreFront Accounts List – see the help text
  • To enable Auto-Update, go to |AutoUpdate| or |Citrix Workspace Updates|. (the node was renamed in 4.11 and Workspace app)
    • Enable or Disable AutoUpdate or
    • Citrix Workspace Updates
  • To enable Local App Access, go to | User Experience |
    • Local App Access Settings
  • To configure the Self-Service interface, go to | SelfService |
    • Set Manage SelfServiceMode to Disabled to completely disable the Self-Service window. This causes all icons to be placed on the Start Menu.
    • Enable Manage App Shortcut and configure it as desired.
      • To allow the Self-Service window, but prevent it from automatically opening (reside in systray), tick Prevent Citrix Workspace performing a refresh of the application list when opened. Source
    • Enable Control when Workspace attempts to reconnect to existing sessions. If this is a VDA published desktop, set it to Disabled. Otherwise configure it as desired.
    • Set Enable FTU to Disabled  to prevent the Add Account wizard from displaying.
    • Enable Allow/Prevent users to publish unsafe content if publishing content that’s opens a file or file share.

Enable automatic client drive and client microphone mapping.

  • In a client-side GPO, add the GPO ADM template from http://support.citrix.com/article/CTX133565.
  • Enable the setting Create Client Selective Trust Keys. See Below for details.
  • Configure the FileSecurityPermission setting in one or more of the regions.
  • Configure the MicrophoneAndWebcamSecurityPermission setting in one or more of the regions.

Citrix CTX203658 Start Menu Icons Set to Default (Blank Document) After Update to Receiver 4.3.100 – Windows 8 and newer

  • Computer Configuration | Policies | Administrative Templates | Windows Components | File Explorer
    • Allow the use of remote paths in file shortcut icons = enabled

Deploy Workspace app using Active Directory

To deploy Workspace app using Active Directory, configure a GPO with a computer startup script that runs the Workspace app installer executable. Citrix provides sample scripts that can be downloaded from one of the Workspace app download pages (Workspace app current release version 2311.1, or LTSR version 2402, by expanding Downloads for Admins (Deployment Tools).

Also see CTA Dennis Span Citrix Receiver unattended installation with PowerShell.

Change Workspace App’s Store Configuration, including Reset Citrix Workspace

You can change Workspace app’s configured Store/Account with a couple command lines:

"C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfService.exe" -deleteproviderbyname Corporate 
"C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfService.exe" -init -createprovider Corporate https://storefront.corp.com/Citrix/Store/discovery

 

It is sometimes necessary to Reset Citrix Workspace by right-clicking the Workspace app systray icon, clicking Advanced Preferences, and clicking the Reset link. You can do this from the command line by running "C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\CleanUp.exe" -cleanUser -silent. See CTX140149 How to Reset Receiver Using the Command Line.

Workspace app Group Policy ADMX Template

Many of the Workspace app configuration settings must be configured in group policy. These Workspace app settings are only available after installing the GPO templates.

Alternatively, Citrix Cloud customers can use Global App Configuration Service to configure Workspace app. Today it’s a REST API, but Citrix has started adding a GUI at Workspace Configuration > App Configuration.

For GPO configuration:

  1. From a machine that has Workspace app installed, find the .admx and .adml files in the C:\Program Files (x86)\Citrix\ICA Client\Configuration.
    • You can also download the ADMX files from one of the Workspace app download pages (Workspace app current release version 2311.1, LTSR version 2402, by expanding Downloads for Admins (Deployment Tools).
  2. Copy the CitrixBase.admx and receiver.admx files. Also copy the en-US folder. In Workspace app, the files are still named receiver.admx.
  3. Go to your domain’s SYSVOL share and in the Policies folder look for a PolicyDefinitions folder. If one exists, paste the .admx file directly into the PolicyDefinitions folder. If this folder doesn’t exist in SYSVOL, instead copy the .admx file to C:\Windows\PolicyDefinitions. Overwrite any existing Receiver ADMX files.
  4. The GPO settings can then be found at one of the following:
    • Computer Configuration > Policies > Administrative Templates > Citrix Components > Citrix Workspace
    • Computer Configuration > Policies > Administrative Templates > Citrix Components > Citrix Receiver
  5. For example, you can disable Customer Experience Improvement Program (CEIP) from here.
  6. See https://www.carlstalhood.com/delivery-controller-cr-and-licensing/#ceip for additional places where CEIP is enabled.
  7. Workspace app 1905 and newer has a setting to Disable sending data to 3rd party (e.g., Google Analytics).
  8. Workspace app 1905 and newer let you disable embedded browser caching.
  9. Workspace app 1905 and newer have NetScaler LAN Proxy under Network routing > Proxy.
  10. Workspace app 1808 and newer have User authentication | Single Sign-on for NetScaler Gateway.
  11. Citrix Workspace Updates, (aka AutoUpdate) can be configured using group policy. See Configuring Citrix Workspace Updates at Citrix Docs.
  12. Workspace app 1912 and newer can be configured to require in-memory ICA files only. The setting called Secure ICA file session launch is under the Client Engine node. See Citrix Docs for details on in-memory ICA files instead of writing ICA files to disk.
  13. The DPI node has a setting called High DPI that lets you disable DPI matching, which is enabled by default in Workspace App 2206 and newer.

    • Workspace app 2210 and newer let you use the GUI to re-enable High DPI.
    • Native resolution means DPI matching, whereas Yes means force high DPI.
  14. Workspace app has settings to hide Advanced Preferences, enable/disable showing the DPI option, and enable/disable H265.
  15. Workspace app 4.8 and newer have SplitDevices GPO setting under Citrix Workspace | Remoting client devices | Generic USB Remoting. See Configuring composite USB device redirection at Citrix Docs.
  16. Workspace app 2212 and newer by default disable App Protection for the authentication screen and icons list. To enable them, configure User authentication | Manage App Protection and SelfService | Manage App Protection.

  17. Workspace app 2303 and newer have Anti-DLL Injection for App Protection. It is disabled by default. Enable it in a GPO at Citrix Components | Citrix Workspace | App Protection | Anti-DLL Injection. See Citrix Docs for details.
    App running

Pass-through Authentication

Citrix blog post – A Comprehensive Guide to Enabling Pass-Through Authentication with XenDesktop 7.5

  1. Run the command
    Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $True from a Windows PowerShell command prompt on a Delivery Controller.

  2. Login to the PC as an administrator.
  3. If installing Workspace app, as an administrator, during installation, on the Enable Single Sign-on page, check the box next to Enable Single Sign-on. Then finish the installation.

  4. To verify that SSON is installed, go to C:\Program Files (x86)\Citrix\ICA Client and look for the file ssonsvr.exe.
  5. And if you open regedit and go to HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order, you should see PnSson in the ProviderOrder.
  6. Install the receiver.admx (and .adml) template into PolicyDefinitions if you haven’t already.
  7. Edit a GPO that is applied to the client PCs where the Workspace app is installed.
  8. Go to Computer Configuration > Policies > Administrative Templates > Citrix Components > Citrix Workspace.
  9. Expand Citrix Workspace and click User authentication.
  10. On the right, double-click Local user name and password.
  11. Select Enabled and then check the box next to Allow pass-through authentication for all ICA connections. Click OK.
  12. In Workspace app 1808 and newer, you can enable Single Sign-on for NetScaler Gateway.
  13. Ensure that the internal StoreFront FQDN is in the Local Intranet zone in Internet Explorer. You can use a GPO to configure this on the client side.
  14. Local Intranet zone should have Automatic logon only in Intranet zone enabled.
  15. For Windows 11 and newer, make sure the GPO setting Enable MPR notifications for the System is not enabled at Computer Configuration | Policies | Administrative Templates | Windows Components | Windows Logon Options. Make sure HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableMPRNotifications is not set to 0 on the Workspace app machine.
  16. Logoff Windows and log back on. In Task Manager you should now see ssonsvr.exe. This won’t appear unless you logoff and log back on.
  17. If Workspace app won’t connect or is slow to enumerate icons, then you might have to disable Automatically detect settings in IE.
  18. Right-click the Workspace app icon and click Advanced Preferences.
  19. Click Configuration Checker.
  20. Check the box next to SSONChecker and click Run.
  21. The lines with red x will indicate the issue and corrective action.

StoreFront Accounts

You can use a client-side GPO to add a store (Account) to Workspace app Self-Service.

  1. Install the receiver.admx (and .adml) template into PolicyDefinitions if you haven’t already.
  2. Edit a GPO that applies to endpoint devices that have Citrix Workspace app installed.
  3. Go to Computer Configuration > Administrative Templates > Policies > Citrix Components > Citrix Workspace > StoreFront.
  4. On the right, double-click NetScaler Gateway URL/StoreFront Accounts List.
  5. Select Enabled, and then click Show.
  6. Enter a store path based on the example shown in the Help box. Workspace app lets you enter a Gateway path. Then click OK.
  7. Note: Gateway paths work in GPO, but might not work when specified in the CitrixWorkspaceApp.exe installation command line.

Published Shortcuts and Reconnect

Citrix CTX200924 How to Customize App Shortcuts with Receiver for Windows

Workspace app has a user interface for setting Shortcut Paths. Right-click the Workspace app systray icon, click Advanced Preferences, and then click Shortcuts and Reconnect, or Settings Option.


From Citrix Docs Configuring application delivery: There are several methods of controlling how Workspace app displays shortcuts on the Start Menu and Desktop as detailed below:

  • Workspace app Registry values
  • receiver.admx GPO Template
  • From StoreFront in C:\inetpub\wwwroot\Citrix\Roaming\web.config
  • Published App Keywords (e.g. prefer).
  • Workspace app and Receiver 4.2.100 and newer supports published app Delivery configuration for adding the shortcut to the desktop. This only works if the app is a Favorite, or if Favorites are disabled, or Mandatory Store.

Under HKLM\Software\Wow6432Node\Citrix\Dazzle (or HKCU\Software\Wow6432Node\Citrix\Dazzle) are several registry values related to shortcuts. Some of the settings only apply if SelfServiceMode is set to False. Here are some common options:

  • SelfServiceMode – set to False so Receiver disables the Self-Service interface and automatically places all published shortcuts on the Start Menu and/or Desktop. More details in Configuring application delivery at Citrix Docs.
  • PutShortcutsOnDesktop – set to True to place every app on the desktop
  • DesktopDir – Workspace app places every shortcut on the desktop so it’s probably best to place them in a folder.
  • StartMenuDir – If there is potentially a conflict between local apps and remote apps, then you should place the Start Menu shortcuts in a folder.
  • PreferTemplateDirectory (with KEYWORDS:prefer=shortcutname) – copies the shortcutname from the template directory to the Start Menu and/or Desktop.

If you import the receiver.admx (and .adml) into the PolicyDefinitions folder, under Computer Configuration > Administrative Templates > Citrix Components > Citrix Workspace (or Receiver) is a node called SelfService.

Disable the Manage SelfServiceMode setting to hide the Workspace app Window.

Enable the Manage App shortcut setting to control placement of shortcuts.

Workspace app and Receiver 4.2.100 and newer have the ability to configure (or disable) Workspace Control using group policy. Enable the setting Control when Citrix Workspace attempts to reconnect to existing sessions and configure it as desired.

Prelaunch

Staring with Receiver 4.2, prelaunch is automatically enabled if Workspace app is installed with SSON enabled. Otherwise, set registry values to enable prelaunch. Receiver 4.2.100 prevents the prelaunch icon from appearing on the Start Menu.

  • HKLM\Software\[Wow6432Node\]Citrix\Dazzle
    • EnablePreLaunch (REG_SZ) = true or false

Additional customizations can be configured at:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\ICA Client\Prelaunch

  • Name: State
    • REG_SZ: 0 = disable, 1 = just-in-time pre-launch, 2 = scheduled pre-launch
  • Name: Schedule
    • REG_SZ: HH:MM|M:T:W:TH:F:S:SU where HH and MM are hours and minutes. M:T:W:TH:F:S:SU are the days of the week. For example, to enable scheduled pre-launch on Monday, Wednesday, and Friday at 1:45 p.m., set Schedule as Schedule=13:45|1:0:1:0:1:0:0 . The session actually launches between 1:15 p.m. and 1:45 p.m.
  • Name: UserOverride
    • REG_SZ: 0  = HKLM overrides HKCU, 1 = HKCU overrides HKLM

Device Access Behavior (Client Selective Trust)

When connecting to a XenApp/XenDesktop session, you might see the following:

To configure the default behavior, see the Citrix Knowledgebase article How to Configure Default Device Access Behavior of Receiver, XenDesktop and XenApp. Note: there is a bug fixed in Receiver 4.2.100 and newer.

  1. Download the ADMX file from http://support.citrix.com/article/CTX133565.
  2. Copy the .admx and .adml files to PolicyDefinitions (Sysvol, or C:\Windows).
  3. The .adml file goes in the en-US folder.
  4. Edit a GPO that applies to the endpoint devices that are running Receiver.
  5. Go to Computer Configuration | Policies | Administrative Templates | Citrix Components | Citrix Workspace (or Receiver) |  Citrix Client Selective Trust (x64).
  6. Enable the setting Create Client Selective Trust Keys.

  7. Then expand the regions, and configure the permission settings as desired.

Desktop Lock

As an alternative to Workspace app Desktop Lock, see Transformer in Citrix Workspace Environment Manager.

External links:

Use Studio to configure Workspace app Accounts in Published Desktop

In published desktops, Workspace app can be used for placement of shortcuts on the user’s Start Menu and Desktop. Use group policy to hide the common program groups and then use Workspace app to place published applications back on the Start Menu and Desktop based on user’s group membership and subscription preference.

  1. In Citrix Studio, on the left, expand the Configuration node, right-click StoreFront and click Add StoreFront.
  2. Enter a descriptive name for the StoreFront server.
  3. Enter the internal https URL of the load balanced StoreFront servers. Add the path to your store (e.g. /Citrix/Store) and then /discovery on the end of the URL. The full URL would be similar to https://citrix.corp.com/Citrix/Store/discovery. Click OK.
  4. Edit a Delivery Group that has a published desktop and Citrix Workspace app installed.
  5. On the StoreFront page, change the selection to Automatically, using the StoreFront servers selected below, and then check the box next to the StoreFront URL. Click OK. Now when users launch the published desktop, Workspace app will be automatically configured with this URL.

Published Desktop – use Workspace app to control Shortcuts

If you install Workspace app inside a published desktop (Workspace app on a VDA), then Workspace app can get icons from StoreFront and put those icons on the user’s published desktop Start Menu and Desktop. This is an alternative to using a User Experience Management product to control shortcut placement.

Note: Workspace app tends to be slow to create Start Menu shortcuts, so make sure you perform a Proof of Concept to determine how this functionality impacts logon times.

Configuration of Workspace app inside a published desktop is simplified if you have the following minimum versions:

  • Workspace app installed inside the VDA
  • VDA 7.17 or newer
  • StoreFront 3.14 or newer

If you meet these minimum version requirements, then Workspace app installed in the VDA automatically tries to launch published applications on the same local VDA rather than trying to launch them from a different VDA (aka double-hop). This feature is called vPrefer.

Do the following for all versions of Workspace app, VDA, and StoreFront, whether using the Prefer keyword or not:

  1. Make sure Workspace app or Receiver version 4.11 or newer is installed on the VDA.
  2. Install the Workspace app ADMX files if you haven’t already. For vPrefer, make sure they are the ADMX files from Workspace app.
  3. Enable the Group Policy setting Remove common program groups from Start Menu and apply it to non-administrators.
    • This removes all Public (aka All Users) Start Menu shortcuts. Workspace app will re-add the shortcuts based on user group membership.
  4. On the VDA, configure the following Workspace app Registry keys (or corresponding settings in the receiver.admx GPO template):
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Dazzle\WSCReconnectMode=”0″ so Workspace app doesn’t try to reconnect to the published desktop you’re already running.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Dazzle\SelfServiceMode to False. This turns off the Workspace app Self-Service GUI and acts like all icons are subscribed. Otherwise, only subscribed (favorited) icons would be placed on the Start Menu and Desktop.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Dazzle\UseCategoryAsStartMenuPath = True. This creates a Start Menu folder based on the published app’s configured Category.
  5. Configure each desired published app to Add shortcut to user’s desktop.

    • Or, configure HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Dazzle\PutShortcutsOnDesktop = True to place all icons on the desktop.
  6. To control icon placement, configure the following registry values:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Dazzle\StartMenuDir to place published applications in a sub-folder. Note: Windows Server 2012 and Windows 10 and newer only supports a single level of Start Menu folders, so setting this effectively turns off published app categories.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Dazzle\DesktopDir to place published applications in a sub-folder on the desktop.
  7. Pass-through authentication:
    1. In a GPO that applies to the VDA, import the receiver.admx file, and set Local user name and password to Enabled. Check the box next to Allow pass-through authentication for all ICA connections.
    2. If you’re using Gateway internally, and if Workspace app 1808 or newer, then also enable Single Sign-on for NetScaler Gateway.
    3. In a user-level GPO that applies to the VDA, add the StoreFront FQDN to the Local Intranet zone. Make sure it is not in the Trusted Sites zone, or enable Automatic logon with current user name and password for the Trusted Sites zone.
    4. Make sure ssonsvr.exe is running after you login to the VDA. If not, troubleshoot it.
  8. When configuring Citrix Profile Management, make sure !ctx_startmenu! is not excluded from roaming.
  9. In Citrix Studio, configure a Delivery Group with delivery type = Desktop and Applications. Assign users to the delivery group, and the individual published applications (if visibility is limited).
    1. In Citrix Studio, edit each published application, and on the Delivery tab, specify a category. This will become the Start Menu folder name.
    2. If Workspace app Self Service Mode (GUI) is enabled, in Studio, edit each application, and add KEYWORDS:Auto and/or KEYWORDS:Mandatory to the published application description. This forces the applications to be subscribed/favorited. Only subscribed (or Favorite) apps are displayed in the Start Menu and Desktop. Unless you disable Workspace app’s SelfService interface as described earlier.
    3. Another option is to go to the StoreFront Console, click Stores on the left, and on the right, click Configure Store Settings, and click Disable User Subscriptions. This causes all apps to appear on the Start Menu and/or Desktop depending on Workspace app configuration.
  10. Create a group policy that applies to VDAs, and configure the group policy to define the Store URL for Workspace app similar to https://citrix.corp.com/Citrix/Store/discovery. Replace the FQDN with your load balanced StoreFront FQDN. Also replace the path to the store with your store path. Make sure there is /discovery on the end. By default, Workspace app and Receiver only support https.
    1. Your StoreFront store probably delivers both application and desktop icons. If you want to filter out the desktop icons, then create a new StoreFront store, and configure the Workspace app on the VDA to connect to the new Store.
    2. In StoreFront Console, click the store for VDAs, and click Configure Store Settings. On the Advanced Settings page, in the Filter resources by type row, choose Citrix.MPS.Desktop.
  11. For vPrefer in Workspace app, VDA 7.17 (or newer), and StoreFront 3.14 (or newer), edit a GPO that applies to the VDAs.
    1. Go to Computer Configuration | Policies | Administrative Templates | Citrix Components | Citrix Workspace (or Receiver) | SelfService.
    2. Edit the setting vPrefer. This setting is only in Workspace app ADMX templates from Workspace app.
    3. Set it to Allow all apps. Source = 7.17 vPrefer – not working with 32Bit Apps at Citrix Discussions.
  12. On your Delivery Controller, in PowerShell, run set-brokersite -TrustRequestsSentToTheXmlServicePort $true
    • This is required for Pass-through Authentication from Workspace app.
  13. Configure your client devices to connect to the published desktop.
    1. When users connect to the published desktop, Workspace app will auto-launch and hopefully auto-login.
    2. If Workspace app Self-Service Mode is disabled, all published applications should automatically appear in the Start Menu and Desktop.
    3. If Workspace app Self-Service Mode is enabled, then only applications with KEYWORDS:Auto and/or KEYWORDS:Mandatory in the published application description will be displayed. Users can open the systray icon to subscribe to more applications.
    4. Users can copy icons from the Start Menu to the desktop. Make sure the user Copies the icon and doesn’t Move it.
    5. Users can then launch applications directly from the Start Menu, from the Desktop, or from the Workspace app (if the Self-Service interface is enabled).
    6. If Workspace app 4.11 (or newer), VDA 7.17 (or newer), and StoreFront 3.14 (or newer), then vPrefer is enabled by default. When launching an app icon that came from Workspace app, Workspace app checks the local VDA machine to see if the application can be launched on the local VDA instead of by creating a new Citrix double-hop session.
    7. If the application is installed locally on the VDA then the local application shortcut should launch quickly. If the application is on a different delivery group then a second (double-hop) Citrix HDX/ICA connection will be established.
    8. If the user deletes Workspace app shortcuts from the Start Menu, you can get them back by going to the systray icon and refreshing the applications. Or sometimes you have to reset Workspace app.

If you are running components older than Receiver 4.11, VDA 7.17, and StoreFront 3.14, then you’ll need to configure the prefer keyword to get Receiver delivered icons to launch on the local VDA instead of in a new double-hop Citrix connection.

  1. Enable the Group Policy setting Remove common program groups from Start Menu and apply it to non-administrators.
    1. For applications that are installed on the same VDA that is publishing the desktop, configure Group Policy Preferences to recreate the application shortcuts based on Active Directory group membership. Applications on other delivery groups are handled by Receiver.
    2. Or use the prefer keyword to copy shortcuts from the PreferTemplateDirectory.
  2. On the VDA, configure the following Receiver Registry keys (or corresponding settings in the receiver.admx GPO template):
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Dazzle\PreferTemplateDirectory = a UNC path or local path containing shortcuts to be copied by the prefer keyword. This can point to C:\ProgramData\Microsoft\Windows\Start Menu.
  3. In Citrix Studio, configure a Delivery Group with delivery type = Desktop and Applications. Assign users to the Delivery Group and the applications (if visibility is limited).
    1. In Studio, edit each application and change KEYWORDS:Prefer to KEYWORDS:prefer. Notice the lower case p. It doesn’t work with uppercase P.
      • With the prefer keyword, if you publish an application that is also created using Group Policy Preferences, the Group Policy Preferences icon will take precedence. This is good. Otherwise the Receiver published application icon would result in a new Citrix double-hop session.
      • See Ralph Jansen Citrix Receiver 4.1 Prefer keyword examples
    2. If using the prefer keyword with the PreferTemplateDirectory, enter it as KEYWORDS:prefer=shortcutname where shortcutname is the name of the shortcut that is copied from the Template directory.
  4. Configure your client devices to connect to the published desktop.
    1. When users connect to the published desktop, Group Policy Preferences will create shortcuts to local applications.
    2. Receiver will auto-launch and hopefully auto-login.
    3. If Receiver Self-Service Mode is disabled, all published applications should automatically appear in the Start Menu and Desktop.
    4. If Receiver Self-Service Mode is enabled then only applications with KEYWORDS:Auto and/or KEYWORDS:Mandatory in the published application description will be displayed. Users can open the systray icon to subscribe to more applications.
    5. For published applications with KEYWORDS:prefer=shortcutname, Receiver should copy icons from the template directory to the Start Menu and/or Desktop. See below for considerations.
    6. Users can copy icons from the Start Menu to the desktop. Make sure the user Copies the icon and doesn’t Move it.
    7. Users can then launch applications directly from the Start Menu, from the Desktop, or from the Receiver (if Self-Service interface is enabled).
    8. If a local shortcut (e.g. Group Policy Preferences shortcut, or copied from template directory) matches a published application with KEYWORDS:prefer then the local shortcut will override the published application icon.
    9. If the application is installed locally on the VDA then the local application shortcut should launch quickly. If the application is on a different delivery group then a second (double-hop) Citrix HDX/ICA connection will be established.
    10. If the user deletes Receiver shortcuts from the Start Menu, you can get them back by going to the systray icon and refreshing the applications. Or sometimes you have to reset Receiver.

Notes regarding Prefer Template Directory

  • Prefer Template Directory can point to C:\ProgramData\Microsoft\Windows\Start Menu, which is the All Users Start Menu.
  • The shortcuts copied from the Prefer Template Directory are renamed to match the published app name.
  • For prefer local apps, any command line parameters specified in the published app are ignored. If you need these command line parameters, add them to the shortcut in the Prefer Template Directory.
  • If you have multiple published apps pointing to the same prefer local shortcut, then only one copy will be made, and it will have the name of only one of the published apps. To workaround this, in the Prefer Template Directory, create separate shortcuts for each published app, and adjust the published app prefer keyword accordingly.
  • Jan Hendrik Meier Automatic Shortcut generation for local installed applications in a Citrix XenDesktop / XenApp 7.x environment has a script that can create shortcuts based on the published apps with prefer keyword. These shortcuts can then be copied to your Prefer Template Directory.

How to Script/Automate Workspace app and Receiver Self-Service

From Citrix Knowledgebase article Driving the Citrix Receiver Self-Service Plug-in Programmatically: by default, Workspace app Self-Service (SSP) activities are driven by user interaction. However, SSP exposes sufficient information for its activities to be scripted.

When SSP builds a shortcut, it builds it to a small stub application in a file %appdata%\Citrix\SelfService\app-name-with-spaces-removed.exe for each resource. These files allow SSP to create a fake ‘install’ record for Add/Remove Software. Running these .exe files causes the application to launch. Note: Workspace app and Receiver 4.3.100 and newer don’t create stubs by default. To enable, set HKLM\Software\Wow6432Node\Citrix\Dazzle\AlwaysUseStubs (REG_SZ) = true.

If you want to drive SSP directly for launch instead of through an .exe stub, look at the keys under HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall. There will be keys in there named farm-name@@server-farm-name.app-friendly-name. In these keys you’ll find a LaunchString value that shows the relevant parameters. These parameters are user-independent and can therefore be cloned from a reference user to a general case. You can copy and reuse these parameters without interpretation.

Running the command selfservice.exe –init –ipoll –exit starts SSP, performs a refresh (interactive poll) from the current provider, and forces a clean exit.

Additional command line parameters are detailed at Driving the Citrix Receiver Self-Service Plug-in Programmatically.

 

Citrix Workspace app come with a .dll file that implements the Citrix Common Connection Manager SDK. You can use the CCM SDK to do the following:

  • Launch Sessions
  • Disconnect Sessions
  • Logoff Sessions
  • Get Session Information

Citrix was kind enough to develop a PowerShell module that calls functions from the .dll. Get the CCMPowershellModule from Github. The PowerShell module contains functions like the following:

  • CCMTerminateApplication
  • CCMLaunchApplication
  • CCMGetActiveSessionCount
  • CCMDisconnectAllSessions

Launcher Scripts

Ryan C Butler Storefront ICA file creator at Github. See Create an ICA File from Storefront using PowerShell or JavaScript for more info.

Stan Czerno – Powershell Script to launch one or more Published Applications from Citrix Storefront 2.x through 3.11: the script launches a browser, connects to StoreFront (or NetScaler Gateway), logs in, and launches an icon. This is a very well-written script that uses a .dll file from Citrix Workspace app to display session information.

Citrix Solutions Lab StoreFront Launcher Script at Github. It attempts to closely resemble what an actual user would do by:

  1. Opening Internet Explorer.
  2. Navigating directly to the Receiver for Web site or NetScaler Gateway portal.
  3. Completing the fields.
  4. Logging in.
  5. Clicking on the resource.
  6. Logging off the StoreFront site.

David Ott StoreFront App/Desktop Launch Testing Script uses Internet Explorer to login to StoreFront and launch a resource. Sends email with the result. Uses wficalib.dll to get session information.

Microsoft Teams

Citrix and Microsoft jointly support the delivery of Microsoft Teams from Citrix Virtual Apps and Desktops using optimization for Microsoft Teams. The Teams optimization components are built into VDA and Workspace app. There is no need to install anything separately. The feature is based on Browser Content Redirection so don’t exclude that feature when installing the VDA.

Microsoft Teams optimization/offloading requires the following:

  • Newest version of Microsoft Teams machine-wide installation (ALLUSER=1)
  • Newest version of Citrix VDA
  • Newest version of Citrix Workspace app.

Feature matrix and version support at Citrix Docs shows the required versions of Teams, Citrix VDA, and Citrix Workspace app for various Teams features.

See Citrix Docs Optimization for Microsoft Teams.

Skype for Business

Citrix has a HDX RealTime Optimization Pack for Workspace app that enables offloading of Skype for Business media protocols to the client device. Here are the available versions:

The HDX RealTime Optimization Pack comes in two pieces: the Connector (on the VDA), and the Media Engine (on the Workspace app machine). Usually both pieces must be the same version, but versions 2.3 and higher now allow version mixing.

24-page Citrix PDF Delivering Microsoft Skype for Business to XenApp and XenDesktop Users.

For Skype for Business Location Based Routing, you’ll need the following: (Source = Citrix Derek Thorslund at Location based routing at Citrix Discussions)

  • Microsoft added support for Location Based Routing (LBR) with the virtualized Skype for Business 2016 client (and HDX RTOP 2.1 and above) in the Click-to-Run (C2R) download quite a long time ago, but it hasn’t yet been introduced in the MSI package.
  • It requires setting IsLBRInVDIEnabled on the Skype for Business Server to True: 
    $x = New-CsClientPolicyEntry -Name "IsLBRInVDIEnabled" -Value "true"
Set-CsClientPolicy -Identity "<ClientPolicyName>” -PolicyEntry @{Add=$x}

When offloading voice and video to Workspace app machines, don’t forget to configure QoS on the client machines. See Citrix Blog Post Implementing the Citrix HDX RealTime Optimization Pack: Don’t Forget About QoS/DSCP.

Citrix CTX222459 RealTime Optimization Pack Capability Checker: It will list out endpoint hardware/software information which will be used to process audio and video. The tool is independent of RealTime Optimization Pack version and runs any Windows machine.

Citrix CTX214237 LOPper – Lync Optimization Pack Log Parser: parses log files generated by Citrix HDX RealTime Optimization Pack (HROP) when an audio/video call is made using Lync 2013/Skype for Business (SfB) and shows relevant information in a UI.

Troubleshooting – Citrix QuickLaunch

Citrix CTX219718 QuickLaunch Tool (Testing Application and Desktop Launch) lets you launch Citrix sessions directly from a Controller without needing StoreFront.

You enter a Controller address, credentials, and then it shows you the published resources. You can pick a resource, edit properties on the other tabs, and then Connect. This allows you to easily try different connection properties.

If you run into problems launching a session, use Sysinternals DebugView while running CQL in Debug mode (/debug switch).

Troubleshooting – Workspace app Logging

In Workspace app 2309 and newer, if you right-click the Workspace app icon in the system tray, there’s a Troubleshooting menu with a Collect Logs option.

You can also access Log Collection from Advanced Preferences.

There are a couple methods of logging Workspace app for Windows operations. One method is CTX141751 Citrix Receiver Diagnostics Tool – For Windows, which creates a CDF trace that can be parsed by CDFControl.

Another method is CTX132883 How to Enable Logging on Receiver for Windows Using Registry Entries. The logfiles in %USERPROFILE%\Appdata\Local\Citrix\ are human readable. And CTX206102 Enable SSON Logging Using Registry Key.

Instead of creating the registry keys manually, you can use the following .reg file provided by Wolfgang Thürr:

Windows Registry Editor Version 5.00

;only for x64 windows os
;import with admin rights
;restart your computer to activate the logging and tracing settings
;create C:\TEMP for the launch ICA log and SSON logn (no environment variables can be used)

;general Workspace app and Receiver logging
;************************
;logpath: %USERPROFILE%\Appdata\Local\Citrix\Receiver
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix]
"ReceiverVerboseTracingEnabled"=dword:00000001

;Authentication Manager logging
;******************************
;logpath: %USERPROFILE%\Appdata\Local\Citrix\AuthManager
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\AuthManager]
"LoggingMode"="verbose"
"TracingEnabled"="True"
"SDKTracingEnabled"="True"

;Self Service logging
;********************
;logpath: %USERPROFILE%\Appdata\Local\Citrix\SelfService
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Dazzle]
"Tracing"="True"
"AuxTracing"="True"
"DefaultTracingConfiguration"="global all –detail"

;save launch ICA
;***************
;logpath: C:\TEMP\ica.log (no environemnt variables allowed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\Logging]
"LogConfigurationAccess"="true"
"LogConnectionAuthorisation"="true"
"LogEvidence"="true"
"LogICAFile"="true"
"LogFile"="C:\\TEMP\\ica.log"
"LogStartup"="true"

;Receiver Always On Tracing
;**************************
;generates ETL Files for analyzing with CDFControl see CTX111961 for details
;can be configured or overruled by GPOs (icaclient.admx)
;path %USERPROFILE%\AppData\Local\Temp\CTXReceiverLogs
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\ICA Client\AoLog]
"EnableTracing"=dword:00000001

;Single Sign-on Logging
;**************************
;https://support.citrix.com/article/CTX206102
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Install\SSON]
"DebugEnabled"="true"
"LogPath"="C:\\Temp"

Troubleshooting – Duplicate Stores

Stores are sometimes duplicated in Workspace app, especially if you are running Workspace app inside a VDA. (h/t Dan High)

StoreFront URLs can be defined in several places:

  1. In Studio, go to Configuration > StoreFront and delete all URLs configured here.
  2. Look in GPOs for Computer Configuration > Administrative Templates > Policies > Citrix Components > Citrix Workspace > StoreFront > NetScaler Gateway URL/StoreFront Accounts List. Remove any URLs configured here.
  3. In the client-side registry, at HKLM\Software\Wow6432Node\Citrix\Dazzle\Sites, you might see store addresses that were specified during a command line installation of Workspace app.
  4. When Citrix Workspace app switches between StoreFront servers in multiple datacenters, it’s possible for each datacenter to be treated as a separate Workspace app site. This can be prevented by doing the following. From Juan Zevallos at Citrix Discussions:
    1. Match the Base URL in all datacenters.
    2. Match the SRID in all datacenters – The SRID can be safely edited in the C:\inetpub\wwwroot\Citrix\Roaming\web.config. Make sure to propagate changes to other servers in the group.
    3. Match the Delivery Controller names under “Manage Delivery Controllers” – The XML brokers can be different, but the actual name of the Delivery Controller/Farm must be identical.

If you are running Workspace app on a VDA, once you’ve removed the configured URLs shown above, do the following to clean up the VDAs:

  1. On the VDA, HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix – Delete the number folders representing policy entries.
  2. On session host VDAs, HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Citrix – Remove the entries for storefront in the following folders.
    1. Under \receiver\ctxaccount delete all entries.
    2. Under \SR\Store delete the entries.
  3. On the VDA, C:\ProgramData\CitrixCseCache – Delete all files
  4. On the VDA, C:\ProgramData\Citrix\GroupPolicy – Delete all folders and files.
  5. Run gpupdate and logoff.
  6. In the user’s registry, HKEY_CURRENT_USER or the profile registry hive. Possible profile reset.
    1. Under Software\Citrix\Dazzle\Sites – Delete all entries.
    2. Under Software\Citrix\Receiver\ctxaccount – delete all entries.
    3. Under Software\Citrix\SR\Store – delete the entries.
  7. Verify no cached profile folders for user on server.

677 thoughts on “Citrix Workspace app 2402”

  1. For some strange reason receiver is popping up asking for user credentials every so often, when before it wouldn’t especially since sso is enabled. Any clues to what this could be?

    Reply

  2. It drives me mad that it is now extremely difficult to launch a published application or desktop from the command line. Do you know of any way to do this Carl?

    Reply

  3. Thanks for the website Carl, it’s my number 1 go to.

    I wanted to ask you more about the “prefer” keyword. I have it working internally however how do you see this work if the uses is on a laptop and goes off network. Beacons etc connect the user back through however as the laptop doesn’t have direct network access then the prefer keyword is still causing local apps to launch in preference. Not ideal for Outlook and Skype as they need network access to sync. I need the XenApp versions to launch in this case. Any ideas?

    I feel the prefer keyword is what I need however it’s causing other issues.

    Reply

    1. For Outlook and Skype, you don’t have external access through CAS or Edge servers?

      I usually only use prefer when running Receiver on published desktops.

      What you’re asking for seems like an interesting idea. You might have to call Citrix Support and submit an enhancement request.

      Reply

      1. Unfortunately only CAG has external access.

        My other idea was to use multiple stores, eg internal store with prefer tags and external store without prefer tags which works but does duplicate apps a bit, however how do I get the receiver client to switch stores based on on/off network? I know I can route the CAG direct to the external store however what about those laptops that have both stores configured within receiver?

        I have raised this with citrix and still under investigation however I thought I’d ask the widen community as to how they’ve done it as I find it hard to believe I’m the first that has a laptop on and off network that wishes to use the prefer tag to utilise local resources when available.

        Another idea I thought was to simply place the Citrix apps in a separate folder in the start menu and do away with the prefer tags and leave it up to the user to make the choice of local (if available) or remote.

        Cheers

        Reply

  4. Hi Carl,

    Great article! I wanted to run something by you to see if you have seen the issue before. My company is leveraging a VDI managed service from an outsource provider. The production version is still XenDesktop 5.6. We are having major issues with Citrix Receiver for Windows version 4.x locking up when users switch between full screen and windows mode. At times you can still interface with some open windows/applications, but the start menu is non-responsive to mouse clicks. We are also experiencing resolution issues when going from windows mode to full screen. The screen will offset down and to the right. Disconnecting from the receiver and logging back in immediately resolves the problem. The VDI session is not really hung is just the receiver.

    Any thoughts?

    Thanks in advance!

    Reply

    1. I suspect there isn’t much you can do on the client side. I would begin by upgrading the VDA to 7.8. You can do that without upgrading the Controllers.

      Reply

      1. Another question…We are using the 4.4 client and installing with this command line.
        CitrixReceiver.exe /includeSSON /STORE0=”PNAgent;https://web.name.net/Citrix/Pnagent/OD/config.xml;on;OnDemand” /SELFSERVICEMODE=False /RCU /silent

        In our GPO we have
        Kerberos authentication – Enabled
        Local user name and password – Enabled
        Enable pass-through authentication – Enabled
        Allow pass-through authentication for all ICA connections – Enabled

        After the installation is complete and the user restarts the computer, when a user logs in they don’t automatically see their applications in the start menu. The user has to click on refresh or double click the Receiver icon for it to start ssonsvr.exe and then every time the user logs in or out it does the pass through fine. Why doesn’t it work that first time? Did I miss something?

        Reply

  7. I wanted to say thank you Carl for an excellent article but also update you on my own issue which I couldn’t fix using your article. In short, we had problems with slow enumeration of applications on the start menu after installing Citrix Receiver 4.3 and 4.4, up to 2 minutes which wasn’t great for users. A case was logged, logs gathered and the Citrix Engineer spotted something. The issue was simple, we had “Automatically detect settings” on the Internet Explore connections tab under Internet Settings, enabled via group policy. Once disabled, start menu was instant.

    Reply

  8. Hello Carl!
    Great article(s) 🙂

    Have you ever come across a problem that a user get the logon to store prompt even though they’re logged in? The user login to our Citrix servers and inside the virtual desktop they access a published app, it’s here the problem with the login prompt occurs.

    The users press that the receiver should remember its credentials, but the prompt still ask for credentials. The prompt ask several times per day for credentials. If the user ignores the prompt it will disappear and the user can still use the apps, the user can still use all apps if he or she cancel the prompt.

    I use Citrix Profile Management and stream the profiles to the users, perhaps its some location for the credentials I need to include?

    Reply

    1. Why not enable Single Sign-on?

      Are you load balancing? Is persistence timing out?

      You might have to enable Receiver logging. Also, anything in StoreFront > Event Viewer > Applications and Services > Citrix Delivery Services?

      Reply

  9. Hi Carl, great article so thank you.

    Have you ever come across an issue when launching a published desktop in IE 11, that the desktop just doesn’t launch. This is an intermittent problem for us, maybe after a reboot or closing IE a few times it will work. Tried a few versions of Receiver. Happens mostly on older machines, I’m thinking it’s local resources but keen to know your thoughts?

    Reply

    1. Are you saying that the .ica file is not downloaded and transferred to Receiver?

      What is the web server? Web Interface? Or StoreFront? What version? What security zone is the website in?

      Any other IE plugins? Try disabling all except the Citrix plugin.

      Reply

      1. Thanks Carl,
        We’re using Storefront 2.6, but have tested in 3 aswell.

        The odd thing is the Citrix plugin doesn’t appear in IE – although it works intermittently. Using latest version or receiver and tested with previous versions.
        Disabled other plugins, same outcome.
        Site is in Trusted Sites and Local Intranet.

        Any reason why I wouldn’t see the receiver plugin in IE?

        Thanks again.

        Reply

        1. When going to Manage Add-Ons, there’s a drop-down to select All Add-ons instead of just Currently Loaded.

          Reply

          1. Yeah that’s the thing, when I view all add-ons, the Citrix client isn’t there. Any ideas?

          3. It doesn’t appear on any of the working machines either – The issue is intermittent, worse on some machines than others. I’m investigating a group policy that is in place to manage add-ons. I don’t think we are restricting add-ons but i’ll test.

          4. Hey Carl,
            No luck with group policies, as it’s intermittent it would seem not a policy issue. Compatibility mode is not enabled.
            It seems the first time you log on to a physical pc, open the browser and log in, the desktop will fail. Subsequent attempts seem ok mostly. I was curious if the web plugin could be pre-loaded in some way.
            Still also very curious why I’m not seeing the Add-on in IE 11. I’m using Win 7 32bit (I can see the add-on on a virtual Win 7 64bit machine).

            Appreciate your help.

  10. Hi Carl. Have you seen Receiver 4.4 lose the ability to ‘reset receiver’ under advanced preferences from the system tray icon? Half our VDI images are fine; wondering if we have an image issue.

    Reply

  11. Thanks Carl,
    Is there another way to configure and populate the “StoreFront Accounts List” without using group policy?

    Reply

    1. A command line install switch.
      StoreFront URL bound to Delivery Group in Citrix Studio.
      Edit HKLM\Software\Wow6432Node\Citrix\Dazzle\Sites. New users read this key.
      Receiver.admx also works in local GPO.

      Reply

      1. Thanks Carl, That worked for me except my desktop app shortcuts are all in ONE folder called “Citrix” instead of individually.

        Reply

  12. Is the Switch “ALLOWADDSTORE=N” still valid in 4.4?

    I used it in installing and even controlled that the appropriate registry exist. Yet I am still being prompt to add “store” each time I login

    Reply

  13. Hi Carl,

    After setting step by step citrix receiver in regedit, put the address of my server to add an account, it requests a username and password of my domain and, after I enter the credentials of “Domain Administrator”, the following message appears:

    “Citrix receiver Could Not add account. Check your account settings and try again.”

    NetScaler Gateway is disabled in Delivery Controller.

    Updated version of the Citrix receiver to the latest version.

    I set up the StoreFront 2.6 with HTTP. I use the XenApp 7.6.

    Access applications over the Web works perfectly.

    Where can be the error?

    Thanks,

    Reply

      1. Hi Carl,

        I wonder if there is and how I can disable the shortcuts created on the user’s desktop by Citrix receiver, after it is closed, carried log off.

        Currently, it soon with my credentials on the receiver citrix, and it carries the apps on the desktop and in the start of my domain user menu. I want this to happen, but when I disconnected from my citrix receiver, I want you to go away shortcuts.

        There is this possibility?

        I’m waiting.

        Big hug.

        Reply

        1. There are options for “Remove apps on logoff” and “Remove apps on Exit”. Not sure if that would help you.

          Reply

  14. hello Carl !
    after upgrade my reciver to ver. 4.3.100.10, i cant connect thru netscaler.

    I found an option that blocks the connection(client error 1110, in local logs i see schannel error 40 – that means – handshake_failure – Indicates that the sender was unable to negotiate an acceptable set of security parameters given the options available. This is a fatal error).

    when i remove SSL Profile, all works fine.

    my SSL Profile—-
    1) Configuration for Front-End SSL profile
    Name: more_secure
    DH: DISABLED
    DH Private-Key Exponent Size Limit: DISABLED Ephemeral RSA: ENABLED R efresh Count: 0
    Session Reuse: ENABLED Timeout: 120 seconds
    Non FIPS Ciphers: DISABLED
    Cipher Redirect: DISABLED
    Client Auth: ENABLED Client Cert Required: Mandatory
    SSL Redirect: DISABLED
    SNI: DISABLED
    SSLv3: DISABLED TLSv1.0: ENABLED TLSv1.1: ENABLED TLSv1.2: ENABLED
    Push Encryption Trigger: Always
    PUSH encryption trigger timeout: 1 ms
    Send Close-Notify: YES
    Push flag: 0x0 (Auto)
    Deny SSL Renegotiation FRONTEND_CLIENT
    SSL quantum size: 8 kB
    Strict CA checks: NO
    Encryption trigger timeout 100 mS
    Encryption trigger packet count: 45
    Use only bound CA certificates: DISABLED
    Subject/Issuer Name Insertion Format: Unicode
    Strict Host Header check for SNI enabled SSL sessions: NO
    Done
    —–

    cant you tell me whats wrong in profile ?

    tnx !!!

    Reply

    1. You are requiring client certificates? I don’t think that works in Receiver unless you have a Smart Card.

      Reply

      2. hello carl!
        when i place my cert to eToken, reciver start working =)
        if cert in local store, i see error 1110 =))
        it makes sense to talk to citrix supp ?

        Reply

          2. After the account is added to Receiver, the Auth configuration is provided by StoreFront. Does the config in StoreFront match what your Gateway is expecting?

            There’s an article to turn on Receiver logging. You can also use the Receiver Troubleshooting tool to get a CDF Trace and view it in CDF Control.

          3. maybe i wrong explain.
            when i connect over web brouser, then auth and user apps or desktop thru receiver, all work.
            but, i can’t config standalone receiver connect to recources.
            i enter URL in receiver app, and hi thell me cant connect(over netscaler) when i in local envirement and enter internal URL all work fine.

          4. If NetScaler is requiring client certs then Receiver can’t handle that unless it’s on a smart card. Other potential issues are: Base URL not HTTPS, Base URL not reachable by NetScaler, Internal Beacon misconfigured, etc. Turn on Receiver logging and it will tell you the communication process and the issue.

  15. Hi Carl, thanks so much for your hard work. You are the man!!!
    Easy question:
    My setup:
    XenApp65/Storefront 3.0/Receiver 4.3.100
    MS roaming profiles.
    XenApp1 has outlook2010 published to user
    XenApp2 has excel2010 published to user
    An email is sent to user with Excel file attached.

    Problem:
    note: I wipe user’s roaming profile and “delete local cached copies of profile” is set, then:
    On very first logon to outlook2010, user gets correct FTA to open Excel attachment in published Excel.
    On subsequent logons, somehow FTA for has changed to the “Chooseanapplication.exe”, even though the excel.exe stub is still in “C:\Users\\AppData\Roaming\Citrix\SelfService”

    Any thoughts ?????
    Thanks

    Reply

    1. If you are using MS profiles then I suspect that usrclass.dat is not being roamed. FTAs are set under HKCU\Software\Classes, which is saved to usrclass.dat, which is located under %localappdata%.

      Reply

  16. FYI It looks like in 4.4 it no longer does the EXE stubs and now just uses the Launch command RE: “If you want to drive SSP directly for launch instead of through an .exe stub, look at the keys under HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall”

    Reply

    1. I’ve seen both in the newer versions of Receiver. I’m not sure how it picks .exe stubs or launch commands. I just tried 4.4 and it’s definitely doing .exe stubs.

      Reply

  17. Hi Carl,

    When launching an application is it possible to set Citrix Receiver to show ‘More Information’ as default to show which task is running during the startup process. Good for troubleshooting purposes when the user logs a call to identify at which stage the app is failing to launch.

    Thanks

    Reply

    1. I don’t see any way to do that. I found HKLM\SOFTWARE\Wow6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\Server\HideStatusIndicator but I don’t think that’s it.

      Reply

  18. I’ve deployed citrix xendesktop 7.6 with provisioning services 7.6. I published my desktops now i want to configure pass through authentication to enable desktop lock feature.. ive already enabled pass through authentication from citrix storefront as well as in the local group policy.. im using Lenovo M73 Embedded Thin Clients. Whenever i try to install desktop lock it gives me error for configuring pass through authentication.. please guide me through this.. following is the link that i followed to configure GPO.

    https://www.citrix.com/blogs/2014/04/11/a-comprehensive-guide-to-enabling-pass-through-authentication-with-xendesktop-7-5/

    Reply

  19. Is the netscaler required for Citrix receiver on mobile devices? Or if they have internal wifi it can be accessed directly?

    Reply

  20. Hi Carl,

    Thanks for the great info! Is there a way to run a published application multiple times simultaneously logged in as a different user on one machine? I have been able to do this using the full PN Client running on our current 4.5 Environment. I’ve setup a Xenapp 7.6 Test environment and haven’t been able to see an option on the new Citrix Receiver 4.3.

    Jon

    Reply

    1. If I need to launch apps as different users I find it easiest to do using a browser. Login to the browser as a user and launch the app. Close the browser without logging off or else Workspace Control might close the app. Open the browser again and login as somebody else and launch another app.

      Reply

  21. Hi Carl,

    Great comprehensive article! I was wondering if you can comment or point me in the right direction for our issue below.

    We are using Windows Embedded Wyse Terminals, with Citrix Receiver 4.2.100.14 installed, connected to a XenDesktop 7.6. We don’t use SSO, so users are prompted to enter their login credentials. The problem is that when the Wyse terminal is logged in as the default user, the login process to the Citrix Receiver, the publishing of shortcuts to the desk and the subsequent launch of the virtual desktop is very, very slow. However, if I manually log on as the Administrator account and login to Citrix, the entire process is very quick, just as it used to be on the legacy version 3 Enterprise Receiver.

    Have you come across this behaviour previously by any chance?

    Thanks!

    Reply

    1. There are many threads at discussions.citrix.com about slow icon enumeration.

      Any faster if write cache is disabled? Did you try the registry keys listed in this topic? Reusing stubs might also help.

      Reply

  22. HI Carl, thanks for a great article. I have followed this in order to get local apps launching on the desktop using the ‘prefer’ keyword. I have a strange problem though on a 2012R2 Shared Desktop and Receiver 4.3. With a clean profile on first logon the user gets all the correct apps and the shortcuts from the prefertemplatedirectory UNC are copied down. On second logon only shortcuts for published apps are created but not the ones using ‘prefer’ keyword. Start Menu is not redirected and UPM is not synchronising it so I can’t understand why the shortcuts are not created again. SSO all seems to work just fine.

    Reply

  23. Hi Carl, I am evaluating Receiver 4.3. How do I prevent my published apps from appearing in start menu? I have not configured StartMenu path in GPO or Registry. It is appearing in main start menu as per “Client Application Folder” in Application properties. Right now we are using REceiver 3.4. We dont have PNAgent pulling all the apps on logon. We have couple of applications in start menu which is configured using PNAgent similar to this “C:\Program Files(x86)\Citrix\ICA CLient\pnagent.exe ” /CitrixShortcut: /QLuanch “Farmname:AppName”. We use these shortcuts for accessing XA published application.

    Reply

    1. In Receiver Enterprise you can right-click the Receiver icon, click Settings or something like that and there’s a Shortcuts page where you can control placement of Shortcuts. Not sure if you can do this in Receiver Self-Service when running in PNAgent mode.

      Generally if I have a PNAgent site, I prefer to use a real PNAgent client like Receiver Enterprise 3.4.500.

      They might be some changes you can do in “C:\inetpub\wwwroot\Citrix\Store\Views\PnaConfig\Config.aspx” on the StoreFront server.

      Reply

      1. Thanks for the reply Carl. I was able to resolve the issue by deleting Receiver.exe from startup folder and disabling connection center from RUN key. We want to move to Receiver 4.3 because 3.4 is going EOL by Feb next year.

        I was able to construct Standalone published app shortcut using StoreID and Citrix ID. This is my final string in published app shortcut in client PC.

        “C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfService.exe” -launch -s storeID -CitrixID @@FarmName:AppName -ica FarmName:AppName -cmdline

        Now I see weired behavior….published apps start appearing in StartMenu when this standalone shortcuts are launched, this is happening only to the ID which installed Receiver in the client PC.
        I was able to overcome this by using local account for installing receiver.

        Regards,
        Nirmal

        Reply

  24. Hi,
    I am trying to figure out a way to access a Citrix application as a Windows Remote App.
    I have read your article and it’s very good, but I think I am missing something.

    If I just use the IE as the remote app, while supplying the URL that we usually use, then it tries to save and launch Citrix receiver from the local machine instead of server.

    I also tried to install the Citrix Receiver using the STOREx parameter, and have the Citrix Receiver itself as the Remote App, but when launching it I get an error – cannot contact STORENAME.

    So now my guess is that I’m probably missing something simple somewhere… Or – maybe it’s not that simple…

    I will appreciate it if you can help me !

    Thanks.

    Reply

  25. Excellent Blog, I’ve followed this to get Passthrough Authentication working but am getting a logon prompt in Citrix Receiver. If I open IE and connect to Storefront Server it works fine. If I paste the url in with discovery at the end it attempts to download the cr(?) file

    • Xenapp 7.6
    • Storefront 3.0

    • Windows 7 Client
    • Citrix Receiver 4.3 (Latest Version) installed with /includeSSON switch

    Any Ideas?

    Reply

    1. Are you saying that you opened Receiver, entered a discovery URL and it then prompts you for authentication? Once the .cr file is downloaded and imported into Receiver, Receiver will check the internal beacon to make sure it’s reachable. If not then Receiver will connect to Gateway, which does not support SSON.

      Reply

      1. I’m configuring the Receiver by GPO so I never see the Email / Address prompt. I can see the correct settings are being applied to the workstation via RSOP and in the registry.

        When I launch the receiver it displays “Connecting” for about 20 – 30 seconds and then prompts me for user credentials.

        Reply

  26. Installed Receiver 4.3.100.10167 (Newest Version), works fine with Passthrough and SelfService-Portal! But Problem, can’t logoff and logon as another user, if logon via passthrough there is no logoff working, i can klick but nothing happens. Any idea its a bug or know anyone a workaround to fix? In Citrix-Forums there are people with the same issue but no solution for this problem.

    Reply

  27. Hi Carl,

    You mentioned:

    “When SSP builds a shortcut, it builds it to a small stub application in a file %appdata%\Citrix\SelfService\app-name-with-spaces-removed.exe for each resource. These files allow SSP to create a fake ‘install’ record for Add/Remove Software. Running these .exe files causes the application to launch.”

    We get this behaviour on our published desktops.

    However, we don’t seem to get this behaviour on the windows 7 workstations. What we are getting are shortcuts that run selfservice.exe -launch farm-name@@server-farm-name.app-friendly-name

    Is this an expected behaviour or is there some sort of setting to ensure the shortcuts are created the same way regardless of whether a users logs onto a published desktop or a windows 7 computer?

    Thanks.

    Reply

          1. I wonder what the difference is and whether or not it can be configured — on the published desktops (running windows 2008 R2), the shortcuts is as you say pointing to the .exe files under appdata.

            On the Win7 workstations, the shortcut points to the selfservice.exe -launch uninstall guid….

          2. The other thing I noticed is this:

            1. published an new app to the user
            2. Hitting “refresh” on the citrix receiver does not seem to work — the new app does not show up.
            3. New published app only shows up when the user logs off and back on again.

          4. Just adding a user directly into the app ACL. The only way to get the apps to refresh is by exiting receiver and re-running again.. The refresh option does not seem to work.

  28. Hi Carl,
    Great article about Receiver and Keywords:prefer .

    My Problem is when i unassign an application using prefer by removing a User form the corresponding Security Group, the Icon remains on the Desktop and Start Menü.
    Do you have an idea?

    Kr
    Sebastian

    Reply

    1. I noticed that changing anything of the published application shortcut ( parameters or thumbnails) is ignored as well… I’m deploying the storefront url via studio. Can anyone confirm this behaviour?

      Reply

  29. Hi Carl,

    Do you know of a way to deploy also the Gateway Address while installing? Using the receiverconfig.cr it adds the Gateway as it should and the user gets his store and everything. If use the /STORE switch i see no option in defining the gateway url. We are now deploying the receiver with SRProxy.exe “receiverconfig.cr” but it would be nice if we could do it completely silent.

    BR,
    Chris

    Reply

    1. I’ve seen several people ask for this but I haven’t found a good solution. You’ll probably need to call Citrix Support and they might ask you to submit an enhancement request.

      Reply

  30. Hi Carl,

    Great article, thanks for sharing. I’m implementing the receiver admx files, and can now see Citrix Components > Citrix Receiver within group policy, however the “storefront” folder is missing entirely, along with many other folders.

    These are the September 2015 release of ADMX files from Citrix (same issue with some slightly older ones also).

    have you come across that?

    Cheers,
    brad.

    Reply

  31. Hi Carl,

    The storefront web created as part of intranet site, I’ve tried to import registries / using ADM to suppress File security warning, however both methods will not work for intranet region, the prompt is not suppressed even though full access was given to all. However, if i add the storefront site into trusted site zone, it worked. Or if full access is given to internet region, it worked as well. What could be the reason that receiver is not detecting storefront site as intranet site??

    Reply

    2. Same for me. I’m guessing the sites manually added to Local Intranet zone are ignored. You’ll probably need to open a support case with Citrix.

      Reply

  32. Carl, Do either 4.2 or 4.3 allow for SSON but no desktop or start menu icons – keeping all apps inside the Receiver window. Users all seem to get confused when they are prompted for the username/password box after restarting their PC.

    Reply

    1. You can certainly install Receiver with /includeSSON and configure it for SSON. To prevent Start Menu and Desktop I assume you’d have to configure the Dazzle registry keys. Not sure if it completely blocks it. But if you want all apps in a window, another option is use a browser.

      Reply

  33. On SSO:

    I have native Receiver 4.3 installed with SSO on a Windows 7 fat-client. The users have some locally installed software on their Client, and also access some Applications and Desktops on “Citrix XenDesktop” environment. Everything seems to be working fine and the users are able to start their application or desktop from the native receiver without any problem.

    However some users need to start some locally installed application with “RunAs” with a different credential, for example their AdminAccount. The moment this is accomplished, the native Receiver will just be popping up Logon dialogue and “PIN” or “password” not valid messages, which then later blocked the UserAccount used with the “RunAs”.

    It seems the native receiver during its refresh process is using the UserName used with “RunAs”, with the password of the main interactive credential, which will eventually blocked that account after various failed login.

    Is this a known bug? Any workaround for this problem? The native Receiver with SSO is unfortunately not usable for us in this way.

    Thanks

    Reply

  34. Is there a way to install Receiver 4.3 without any prompts, but still get a confirmation that it finished? I am trying to make this install as easy as possible for our Field Techs.

    Reply

  35. We have Xenapp 7.6 up and running with Receiver 4.3 and StoreFront 3.0. Everything thus far is working as intended. Our challenge is our I.T. staff. We have normal accounts and admin accounts with higher privilege. With SSO, our normal account gets signed into StoreFront as well as the Receiver. If I log out of StoreFront and manually log in with my admin account I get errors attempting to launch non admin applications. To clarify, our normal apps and admin apps are in separate delivery groups and our admin account is a member of both delivery groups. Attempting to launch an app gives a System Event error ID 7 “ICA Connection request denied because the current user, domain\normal, is no the owner of the Session, domain\admin.”. Our 6.5 environment does not have this issue, although with the 6.5 environment we are not logging into the receiver or using SSO. Any ideas of an alternate solution or a known fix if this is an actual issue? Just looking for guidance. Thanks

    Reply

    1. When using multiple accounts, I prefer to login to the webpage using explicit credentials. Use Receiver for the normal account and use RfWeb for admin account.

      As for the error, it seems like it’s trying to reconnect to an existing session, which is weird. Do you have this problem if you ensure that the previous session is completely closed?

      Reply

  36. Hi Carl,

    I have Receiver 4.3 and XenApp 76. I have got nearly all of the Receiver pass through working except for one bit. If a new user (new profile) logs in to a Hosted Shared Desktop, the Receiver does not automatically poll therefore no shortcuts are created. If hwoever, I manually laucnh Receiver from the taskbar, then it does all this. This does’nt happen the second time I log in. I do not want to simply laucch the Receiver from the StartUP folder or Run key. Why does it not do it for new users only?

    Reply

    1. Could be a bug. I think I’ve seen a similar thread at discussions.citrix.com. You could put a shortcut in Startup to run SelfService.exe -poll.

      Reply

      1. Hi Carl, this workaround worked on Windows 8 Thin Clients, but not on Windows 7 Thin Clients. I am running Citrix Receiver 4.2.1. I need to enumerate all shortcuts because the write filter is ON and every time a thin client is rebooted, it will create new users’ profiles. Do you have any idea if a different trick or switch is needed on Windows 7 scenarios?

        Reply

        1. The SelfService.exe -poll helps enumerating the published apps in 30 to 60 seconds. Without it, it takes few minutes to do so. However, Windows 7 Thin Clients take few minutes regardless.I created InitialRefreshMaxMs and InitialRefreshMinMs and set their values to 1, but that did not help! I used this command and no luck neither selfservice.exe -init -ipoll.

          Any help will be really appreciated!

          Reply

  37. HI Carl – I’ve followed this article word-for-word (awesome doc by the way) but I’m still not able to get the icons published to the desktop or the start menu. When I look at the Citrix receiver in the taskbar it gives the option to Refresh, I’ve tried this without any luck. The one thing that I know I’m missing is the “Log On” option that should be there with the Refresh option. If I go to the Storefront site through IE then I get the option to Log in using the user credentials I logged in with and it works (ssonsvr.exe is running). I need the shortcuts to be populated on login in both the desktop and start menu folder. What am I missing?

    Reply

    1. Is Favorites/Subscriptions enabled? If so then you need to subscribe to an icon before it appears. Or you can disable Self-Service Mode in the Receiver.

      Reply

  38. Carl,
    thank you for these good explanations.
    I have a question concerning the KEYWORDS.
    Are you really sure that the way which you describe with the link from Ralph Jansen is working with StoreFront 3.0 and Receiver 4.3? I’ve test a lot of combinations without success.
    My goal is to prevent receiver connecting to a new server when a user runs a published application within his published desktop. I want to check receiver if the application is available on the same server and if yes, then run the local version. In the early times it was called session-sharing.

    I read in citrix blogs that many customers a annoyed about that and they wish these feature back.
    What is you opinion on it? Did you accomplish the goal with KEYWORDS:prefer to prevent receiver from session-hops?

    Greetings from Germany and Thank you again for your work!

    Reply

    1. I have definitely done the KEYWORDS:prefer on Receiver 4.2.100 and it mostly works. There are some quirks however, especially with the new Metro Start Menu in 2012 R2. I have not yet attempted Receiver 4.3 on a published desktop.

      Reply

  39. Been using adm template with Receiver 4.1 and now trying to replace with admx. Though it is indicated that “Receiver” files are the most important but decided to copy all file once and for all in “SYSVOL”.
    I observed however that “adml” is missing for “HDXFash-Client”, which then generates an error message when opening GPO in GPMC.

    Anywhere to get this missing file?

    Reply

  40. Great Article. Definitely helping me. I do have one question for you Carl regarding the old Enterprise way of auto-displaying everything into the start menu (start menu integration). I’ve been playing around with it for a while now, but when a user logs in it doesn’t seem to populate the start menu at all.

    Reply

    1. I assume you configured the registry keys or GPO to disable Self Service mode and put all icons on the Start Menu. You might have to configure a startup program to run SelfService.exe -poll

      Reply

      1. You assume correctly. I’m using WinXPEmbedded because these are thin clients. Trying to do these settings into the master thin client image, re-image the clients, and they are set to reset to the default image every night.

        Using registry;

        HKLM\software\Citrix\Dazzle
        AllowStore = N
        PutShortcutsInStartMenu = True
        SelfServiceMode = False
        StartMenuDir = c:\documents and sertings\ all users\ start menu\
        UseCategoryAsStartMenuPath = true

        HKLM\software\Citrix\ica client\SSON
        Enable = true

        I log in as a standard user, and the receiver is loaded, but nothing shows up in the start menu.

        Reply

        1. StartMenuDir should point to a folder off the root of the Start menu. E.g. CitrixApps

          Otherwise your example has a typo: StartMenuDir = c:\documents and sertings\ all users\ start menu\. Should be settings instead of sertings.

          Reply

          1. Oops, that was just a typo in my haste.

            In the past the Citrix icons would show up in the base of the start menu. Those Citrix groups within folders showed up in the same folders within the start menu. Does that mean that the StartMenuDir shouldn’t be used and it’ll default to the base of Start Menu?

            Otherwise, I still can’t seem to get it populate.

          2. Does it work on a newer OS?

            UseCategoryAsStartMenuPath will create folders based on how you published the apps.

  41. Hi all,

    I am trying to figure out how to deploy the new Receiver of my remote ICA Proxy users. I have NetScaler AG with WI on NetScaler. Currently I am using the legacy OnlinePluginWeb.exe client, and testing the new Receiver client. Documentation states that I can rename the CitrixReceiver.exe filename to CitrixReceiverWeb.exe and it will install the web plugin equivalent. However when I do this, the install goes through and prompts for experience feedback and at the end the dialog is asking to “Add Account”. I would like to get the install working where it is pretty seamless to the user like the old legacy online web plugin. The documentation I am referring to are:

    http://support.citrix.com/article/CTX135438

    http://docs.citrix.com/en-us/receiver/windows/4-3/receiver-windows-install-wrapper/ica-client-deploy-from-rec-for-web.html?_ga=1.89667547.1714530433.1422629928

    As you will see from the links renaming to CitrixReceiverWeb.exe should have surpressed the Add Accounts message.

    Reply

    1. Last time I tried renaming 4.3 to Web.exe, it brought up the Add Account wizard. Leaving it without Web.exe lets me click finish without causing the Add Account Wizard to appear.

      Reply

  42. Hi All

    when using receiver 4.2.1 or 4.3 and connecting back to a WI 5.4 server the client seems to ignore the setting for desktop shortcut creation. E.G. its set to “never” but the client creates the shortcut anyway. When connecting to a Storefront server all is OK.

    Any ideas?

    Regs

    Mark

    Reply

    1. Do you have any apps configured to put their icon on the desktop? In WI server, if you go to the XenApp Services site, right-click the site and there’s Shortcuts, what do you have configured for the Desktop? Are you saying that Receiver in PNAgent mode ignores these settings in the config.xml file? If I truly need PNAgent functionality I’d prefer to stick with Receiver 3.4.500 since newer Receiver was never designed to support full PNAgent functionality. http://support.citrix.com/article/CTX142384

      Reply

      1. Apps are configured, the receiver is pointing to the services URL. The shortcut section is set to “never” and to user only the server setting. Don’t get this issue on 4.2 but have an SSO issue with 4.2 which 4.2.1 and 4,.3 fix.

        Can I point to receiver at the WI 5.4 site rather that the service? or is there a way of suppressing desktop creation on the client.

        Reply

        1. I never use Receiver Self-Service in PNAgent mode so I don’t know if this is supposed to work or not. Try posting to discussions.citrix.com or call Citrix Support.

          Reply

        2. If the apps are configured to put their icons on the desktop and you have the Services site set to “Server setting” then PNAgent is behaving as expected. Receiver 4.2.100 and newer finally honor the published app setting for placing the icon on the desktop. That might be why the behavior changed for you. If you install Receiver Enterprise 3.4 and point to the XenApp Services site, do you see the same behavior?

          Reply

          1. Hi, Just to let you know i have not resolved the issue. using 4.21 or 4.3 with WI 5.4 in pnagent mode does operate OK.

            for 64Bit OS
            A registry key HKLM/SOFTWARE/WOW6432Node/Citrix/Dazzle

            REG_SZ PutShortcutsOnDesktop set to a value of “False”

            Reload the server

            does the trick.

            I have set this to “false” before but it seems “False” (note uppercase F) seems to make it work.

            Regards

          3. I found that when connecting to a Storefront, Yes. However this may be present of the web,config or a if the reg if has no value(which by default is has no value).

            Using WI 5.4 however seems to require a little help by adding “False” to the key value. Citrix have confirmed the action on the reg key and i can confirm that the desktop folder no longer gets created.

            Thanks for your assistance.

  43. Hi Carl,

    We’re running storefront internally behind our NSGW infrastructure. I configured a load balanced storefront baseurl which points to the VIP of the vServer that loadbalanced our 2 storefront servers.

    The baseurl is only reachable by the 2 storefront servers. Internally clients cannot resolve the baseurl.
    The beacons are set that the storefront baseurl is internal, so all clients/receivers use the NSGW by default.

    I can add a store in receiver manually and it will work just fine. It discovers everything, beacons are added to the registry etc. and I can fire-up apps

    I would like to install receiver unattended and that part doesn’t work. The store is added but incomplete. Beacons aren’t added to the registry etc. You will get a message saying apps aren’t available. This is my unattended install command.

    CitrixReceiver /silent /includeSSON ENABLE_SSON=”Yes” UseCategoryAsStartMenuPath=”True” STORE0=”TestInternal;https://<>/Citrix/Store/discovery;On;”StorefrontTest”

    So manual adding the store works perfect. Just fire up the receiver and type in https://<<NetScaler_Gateway_FQDN works like a charm. My endgoal is to automate this process for end users. That part doesn't work.

    Hope you can give me a hint 🙂

    Kind regards,

    Mark

    Reply

    1. Mark had to change the log in methodd to sson. Its located in the store web.config file. Search for logon meathod =
      Then change the value to sson

      Reply

    2. I see the same behavior. I also searched the forums and saw other people seeing the same behavior. Gateway requires authentication before the discovery document can be downloaded so that might be the cause. I suspect you’ll have to call Citrix Support. They might ask you to submit an enhancement request.

      Another option is to distribute the provisioning file and then import it after installation. “C:\Program Files (x86)\Citrix\ICA Client\Receiver\SRProxy.exe” “ReceiverConfig.cr”. However, I haven’t figured out how to do it silently.

      Reply

      1. Thanks Carl,

        I already worked around it a bit. Made my storefront baseurl internally resolvable and used the optimalGatewayForFarmsCollection options in web.config to route the traffic to the NSGW.

        That part works like a charm but now I’m struggling getting my receiver to single sign on. I followed the different manuals. Inluded the correct installation options and set the GPO. It just don’t want to SSO me. the authmanager trace logs don’t give me specifics.

        Any clue on what this can be?

        Thanks!

        Mark

        Reply

      2. Hi Carl,

        Thanks. I worked around it a bit by making the storefront baseurl reachable by the receiver. I used the optimalGatewayForFarmsCollection section in the web.config to route the session through the NSGW.

        I followed all manuals howto enable SSON but I’m struggling with that one. My Receiver just don’t want to do SSO. I enabled the GPO, installed with /includeSSON and Enable_SSON=”YES”. I see the ssonsvr.exe process running. I also see the PnSson in the ProviderOrder key.

        Still my receiver fails to do the SSO. The authmanager tracelogs don’t give me an error I can do some googling with.

        Do you have any clue what this can be?

        Kind regards,

        Mark

        Reply

        1. There is no SSON through Gateway.

          Is the StoreFront URL in the user’s Local Intranet zone?

          Reply

          1. The authentication takes place directly on storefront via the baseurl which is the loadbalanced VIP address. The URL is in local intranet zone.

            Thanks!

    3. Exact same issue here . Carl any clue ?

      Tried to add store through CMD , Local GP , Domain GP still same result but adding manually works fine.

      Best Regards,

      Reply

  44. Hi Carl, Thanks for the informative guide. I have a XenApp 6.5 environment with Web Interface configured. I have installed the Receiver 4.2.100 with /includeSSON option and configured the policies as suggested. Also added the Web Interface Service Site to the local Intranet zone. Can see the SSON process on the server , however the Pass-through authentication does not seems to work. Just wanted to confirm if there are any issues configuring the SSON on Web Interface and if no then what changes do we need to make.

    Reply

    1. Did you configure PnaSSONEnabled = true in the Dazzle registry key?

      Is ssonsvr.exe running?

      Reply

      1. Hi Carl, Yes , PnaSSONEnabled =true and ssonsvr.exe is running fine. Also , the policy for passthrough is also enabled using GPO.

        Reply

  45. Hi Carl

    For the controlling the Device Access Mapping prompts, the GPO settings are applied at an OU which applies to the endpoint devices. How would this work for thin clients such as zero clients?

    thanks

    Reply

    1. Zero clients usually run a proprietary OS so you’d need to contact the thin client vendor for instructions. This is one of the reasons I am generally opposed to thin clients.

      Reply

  46. Hi Carl,

    Appreciate the extremely informative guide you have posted here, thanks to this I have SSON working correctly.
    One question though, where did you get your version of the icaclient.adm template? I have installed XenDesktop 7.6, and retrieve the ADM file from a Receiver 4.2 installation, however I’m missing various subfolders – particularly the Self Service container.

    Many thanks,
    Jim

    Reply

    1. When VDA installs Receiver, it installs to C:\Program Files (x86)\Citrix\Online Plug-in. When you install Receiver normally it installs to C:\Program Files (x86)\Citrix\ICA Client. So the installations are slightly different between the two.

      Reply

      1. Thanks for the reply – I managed to suss it out; with the default 4.2.100 Receiver installation the icaclient.adm template is 129KB, however when I downloaded Receiver 4.2 CU1 Hotfix 1, the included icaclient.adm file is 137KB – once I had this in GPMC I could see the SelfService options where I could then define shortcut policies.

        Reply

  47. hi Carl

    when i want use local app Access, must i configure than also the GPO – icaclient.adm with – User Experience – Local App Access Settings, or is it enough to have the reg key with prefered template Directory?

    greetz
    frank s.

    Reply

    1. I think you are conflating two different technologies. Local App Access = Reverse Seamless so that local apps appear within a remote session. Prefer Template Directory means that prefer the apps installed on the same machine as the Receiver rather than the remote application. They are kind of opposite.

      Reply

  48. When importing the ICACLIENT.ADM template in GPO. Does the policies apply to the Xenapp servers only? Or the StoreFront?

    Reply

    1. The icaclient.adm contains settings that apply to any Receiver client. This could be published desktops that have Receiver installed in them. Or it could be regular Windows PCs.

      Reply

      1. Ok, So in our case they use Pc’s So I would need to push this out to all the computers that have he reciever and use 7.6?

        Reply

        1. You only need icaclient.adm if you want to change the default configuration of Receiver. For example, if you need Single Sign-on then you would need to use icaclient.adm. Shortcut settings are also configurable from icaclient.adm.

          Reply

          1. I see. So in my case i need the published apps on the users desktop. So i would use that with reciever 4.2. Along with pass through

  49. ON
    Published Desktop – Shortcuts

    4.Pass-through authentication: you stated to set a gpo? I though this was done in the Storefront authentication?

    What I am trying to do is replace the was the pnagent is being used now. We have it configured when you log on the domain, pass through authentication logs you into citrix, and the apps appear on the desktop. How do I go about doing this in the latest xenapp 7.6 with the new receiver? So much has changed lol

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *