Workspace Environment Management (WEM) 1808

Last Modified: Dec 1, 2018 @ 6:08 pm

Navigation

This post covers Citrix Workspace Environment Management (WEM) versions 1808, and 4.7 through 4.1.

ūüí° = Recently Updated

Change Log

Overview

Workspace Environment Management¬†(WEM) is Citrix’s Performance Management and UEM (User Environment Management) tool for all XenApp/XenDesktop Enterprise or Platinum Customers with active Software Maintenance (Subscription Advantage is not sufficient). The WEM Agent is supported on XenApp 6.5, and XenApp/XenDesktop 7.x. Videos:

Note: WEM does not replace Citrix Profile Management. You usually implement both.

Citrix Blog Post User Experience on Steroids: Citrix Workspace Environment Management has a list of Frequently Asked Questions about WEM, including a drawing of the architecture.

From Hal Lange at Database sizing at Citrix Discussions: SQL Always On is fully supported.  The ONE caveat is to remove from the Always On Availability Group before upgrading.

Here is the official calculations from the Norskale days on space needed on the SQL Server:

  • Reserve 1GB of RAM per 1,000 users deployed
  • RAM=1.5GB system + (1.5GB SQL + 1 GB per 1,000 users) for that SQL instance
  • Disk = 1GB per 10,000 users per year + 10 MB per WEM site configured

Upgrade WEM

CTA Marco Hofmann at CUGC: How-To: Update Citrix Workspace Environment Management (WEM) from 4.x to 4.7 (v4.07.00.00)

To upgrade Citrix WEM:

  1. In-place upgrade the Citrix Licensing Server. No special instructions.
    • Ensure the installed licenses a non-expired Subscription Advantage date.
  2. In-place upgrade the WEM Server. No special instructions.
  3. Use the Database Maintenance tool to upgrade the WEM database. You might have to run the WEM Broker Configuration Tool on each Broker to point to the upgraded database.
  4. In-place upgrade the WEM Console. No special instructions.
  5. In-place upgrade the WEM Agents.

Install/Upgrade WEM Server (Broker Service)

The WEM Broker Service can be installed on one or more servers, including Delivery Controllers. The WEM Agent cannot be installed on the Broker Server.

A WEM Server with 4 vCPU and 8 GB RAM can support 3,000 users.

  1. Download Workspace Environment Management 1808 and extract it.
  2. Run the downloaded Citrix Workspace Environment Management Infrastructure Services Setup.exe.
  3. Click Install to install the prerequisites.
  4. In the Welcome to the InstallShield Wizard for Citrix Workspace Environment Magement Infrastructure Services page, click Next.
  5. In the License Agreement page, select I accept the terms, and click Next.
  6. In the Customer Information page, click Next.
  7. In the Setup Type page, click Next.
  8. In the Ready to Install the Program page, click Install.
  9. If you are upgrading, you might be prompted to restart applications.
  10. In the InstallShield Wizard Completed page, click Finish.
  11. Programs and Features shows the Citrix Workspace Environment Management Infrastructure Services as version 1808.0.1.1.
  12. Antivirus –¬†C:\Program Files (x86)\Norskale\Norskale Infrastructure Services must be excluded from Antivirus scanning. Or exclude: Norskale Broker Service.exe; Norskale Broker Service Configuration Utility.exe; Norskale Database Management Utility.exe.
  13. Firewall РEnsure firewall allows the following ports to/from the WEM Broker servers. See Citrix CTX101810 Communication Ports Used by Citrix Technologies.
    • Agent Port defaults to TCP 8286 – from WEM Agent to WEM Broker
    • AgentSyncPort defaults to TCP 8285 – from WEM Agent to WEM Broker SQL
    • AdminPort defaults to TCP 8284 – from WEM Admin Console to WEM Broker
    • Monitoring Port defaults to TCP 8287 – from Director to WEM Broker
    • AgentPort defaults to TCP¬†49752 –¬†from WEM Broker to WEM Agent
  14. See¬†CTX218965¬†Error: “Server sent back a fault indicating it is too busy to process the request” and the WEM Agent fails to connect to the Broker Service if you need to throttle the number of connections if you have insufficient resources on the WEM Broker server.

Upgrade WEM Database

Workspace Environment Management 4.5 and newer have PowerShell commands. For details, see Citrix Workspace Environment Management SDK v4.5 at Citrix Developer docs.

To upgrade the Workspace Environment Management database using the GUI tool:

  1. If this is a new install, skip to Create WEM Database.
  2. The person running Database Management must be a sysadmin on the SQL Server. Or you can enter a SQL login.
  3. On the WEM server, run Database Management from the Start Menu.
  4. If upgrading, in the ribbon, click Upgrade Database.
  5. Enter the SQL Server Name.
  6. Enter the existing WEM Database Name.
  7. Configure the credentials for the WEM service account.
  8. If your account is not a sysadmin on Citrix, then enter a SQL account in the Database Credentials fields.
  9. Click Upgrade.
  10. Click Yes when asked to proceed.
  11. Click OK when prompted that database upgraded successfully.
  12. Click Finish to close the Database Upgrade Wizard.
  13. Close the WEM Database Management Utility.
  14. After the database is upgraded, run the WEM Infrastructure Service Configuration Utility to set the database connection settings again. Upgrading seems to wipe out the settings.

    1. On the Licensing tab, configure the licensing server.
    2. On the Advanced Settings tab, configure the service account.
    3. On the Database Settings tab, enter the database server name and database name.
    4. In the ribbon, click Save Configuration.
    5. Click Yes to restart the Broker Service.
  15. Skip ahead to upgrade the WEM Administration Console.

Create WEM Database

Workspace Environment Management 4.5 and newer have PowerShell commands. For details, see Citrix Workspace Environment Management SDK v4.5 at Citrix Developer docs.

To create the database using the GUI tool:

  1. The person running Database Management must be a sysadmin on the SQL Server. Or you can enter a SQL login.
  2. Make sure SQL Server authentication (mixed mode) is enabled on the SQL server > Properties > Security. Even though the WEM Broker server runs as an AD account that is used login to SQL, WEM Broker also uses a SQL account named vuemUser, which means mixed mode must be enabled. Source = John Long at WEM new install, cannot connect to infrastructure server at Citrix Discussions.

  3. On the WEM server, run WEM Database Management Utility from the Start Menu.
  4. If a new install, in the ribbon, click Create Database.
  5. In the Create database Wizard page, click Next.
  6. In the Database Informations page, enter the SQL server name, and enter a new Database Name.
    1. Only enter an instance name if you have a named SQL instance.
    2. Only enter a port number if your SQL instance is listening on a static port number other than 1433.
    3. From Måns Hurtigh at Problem creating WEM 4.3 Database on SQL Server 2012 at Citrix Discussions: The database name cannot contain a dash.
  7. The paths might not be correct so double check them. Then click Next.
  8. In the Database Server Credentials page, if your account has sysadmin permissions, then leave the box checked. Otherwise, uncheck the box, and enter a SQL login that has sysadmin permissions. Click Next.
  9. In the VUEM Administrators section, click Browse, and select your Citrix Admins group.
  10. In the Database Security page, if you intend to load balance multiple WEM servers, then specify a Windows service account for database access. The Broker Service will run as this account. Ryan Revord Load balancing Citrix Workspace Environment Manager. And the new load balancing topic at Install the Citrix Workspace Environment Management Infrastructure Services at Citrix Docs.
  11. The Database Creation Wizard also creates a SQL account called vuemUser with an 8 character alphanumeric password. If you want it more complex, check the box and specify the password.
    • Note: if you intend to implement AlwaysOn Availability Group, then you must specify this password, since you’ll be asked for it again when adding the database to the Availability Group. Also see SQL Server Always On at Citrix Docs.

  12. Click Next.
  13. In the Database Information Summary page, click Create Database.
  14. Click OK when prompted that the database was created successfully.
  15. Click Finish to close the Database Creation Wizard.
  16. Close the WEM Database Management Utility.
  17. There is a log file at¬†“C:\Program Files (x86)\Norskale\Norskale Infrastructure Services\Citrix WEM Database Management Utility Debug Log.log”

WEM Broker Configuration

  1. On the WEM Server, run WEM Infrastructure Service Configuration Utility from the Start Menu.
  2. On the Database Settings tab, enter the SQL Server name and database name.
  3. Switch to the Advanced Settings tab.
  4. If you intend to load balance WEM Servers, then Browse to a service acccount. This service account must have access to the database. Ryan Revord Load balancing Citrix Workspace Environment Manager.
  5. The service account must be in the local Administrators group on the WEM server.
  6. On the Database Maintenance tab, consider checking Enable Scheduled Database Maintenance.
  7. On the Licensing tab, you can enter a Citrix License Server 11.14.0.1 or newer that has valid licenses. Or you can enter the license server later in the admin console.
  8. Click Save Configuration in the ribbon.
  9. Click Yes when asked to restart the Broker Service.
  10. Close the WEM Infrastructure Service Configuration utility.
  11. If you are load balancing WEM servers, then you must also create a Kerberos SPN, where [accountname] is the service account you are using for the Norskale service. Ryan Revord Load balancing Citrix Workspace Environment Manager.
    setspn -U -S Norskale/BrokerService [accountname]

Install/Upgrade WEM Console

  1. Run Citrix Workspace Environment Management Console Setup.exe.
  2. In the Welcome to the InstallShield Wizard for Citrix Workspace Environment Management Console page, click Next.
  3. In the License Agreement page, select I accept the terms, and click Next.
  4. In the Customer Information page, click Next.
  5. In the Setup Type page, click Next.
  6. In the Ready to Install the Program page, click Install.
  7. In the InstallShield Wizard Completed page, click Finish.

WEM Configuration Sets (formerly known as Sites)

In WEM 4.3, Sites was renamed to Configuration Sets.

  1. From the Start Menu, run WEM Administration Console.
  2. In the ribbon, click Connect.
  3. In the Database Broker Information window, enter the WEM Server name, and click Connect.
  4. Some WEM Console settings are global (every agent gets the same setting). So if you want different global settings for different agents, then you create multiple WEM Configuration sets. At the top of the window, in the ribbon, you can create a new WEM Configuration set. 
  5. Once you have multiple Configuration sets, you can use the drop-down to switch between them.
  6. An Agent can only belong to one WEM Configuration set. Different Agents can belong to different WEM Configuration sets.
  7. In WEM 4.3 and newer, you add agents to the Configuration set at Active Directory Objects (workspace on bottom left) > Machines (node on top left). You can add OUs or individual objects (computers or computer groups).
  8. In WEM 4.2 and older:
    1. The WEM Group Policy template has a GPO setting to specify the WEM Site name that an agent should use.

Import Recommended Settings

  1. If you have multiple WEM configuration sets, this process should be repeated for each WEM configuration set.
  2. In WEM 4.4 and newer, on the right side of the ribbon, click Restore.

    • In WEM 4.3 and older, on the right side of the ribbon, click Import Settings.
  3. In WEM 4.4 and newer, select Settings, and click Next.
  4. In the Settings Restore wizard, click Next.
  5. In the Restore from folder section, click Browse, and browse to the \Workspace-Environment-Management-v-1808-00-01-01\Configuration Templates\Default Recommended Settings folder that was included in the WEM download.
  6. In the Settings Type Selection section, check all available boxes, and click Next.
  7. In the Restore settings processing window, click Restore Settings.
  8. Click Yes when prompted to replace.
  9. Click Finish.

James Kindon at WEM Hydration Kit has a collection of Applications, File System and Registry Actions that can be imported to WEM.

WEM Administrators

  1. In the Administration Console, go to Administration (workspace on bottom left) > Administrators (node on top left).
  2. In the right pane, click Add, and specify an Active Directory group that can administer WEM.
  3. After adding a group or user, right-click the new administrator, and click Edit.
  4. Use the Permissions drop-down to select a role. The roles are detailed at Administrators at Citrix Docs.
  5. Then use the State drop-down to select Enabled. New administrators are initially disabled. Click OK to close the window.

WEM Agent Configuration

For configuration guidance, see James Kindon and Hal Lange at WEM Advanced Guidance – Part 1¬†and WEM Advanced Guidance‚ÄďPart 2: User Interaction at CUGC.

  1. In the WEM Administration Console, in the Advanced Settings workspace (bottom left), there are several tabs for configuring the agent.
  2. On the bottom of each tab is an Apply button. Click this button periodically to save your configuration to the database.
  3. On the Main Configuration tab, one option you might want to enable is Launch Agent for admins.
  4. Also consider enabling Launch Agent at Reconnect.
  5. In the right pane, on the Reconnection Actions tab, you can select which modules should be refreshed on reconnect.
  6. The Agent Options tab defaults to processing printers and drives asynchronously.
  7. Setting on these tabs are mostly self-explanatory. Feel free to change any as desired.
  8. The Service Options tab has a setting for Bypass ie4uinit Check. Enabling this eliminates a 2 minute delay before WEM Agent starts. See Marco Hofman at https://www.carlstalhood.com/workspace-environment-manager/comment-page-1/#comment-5069 for details.
  9. On the top left, in the Advanced Settings workspace, there’s a¬†UI Agent Personalization node.
  10. In the right pane, in the UI Agent Options tab, you can change the Agent skin, and Preview it.
  11. Other settings on this page let you hide the splash screen.
  12. The Helpdesk Options tab lets you enable Screen Capture.

System Optimization

  1. The System Optimization workspace (bottom left) lets you configure the various optimizations.
  2. On the top left, click the CPU Management node.
  3. CPU Spikes Protection gives processes equal access to the CPU.
    • From Hal Lange: “CPU Usage Limit should never be set to higher a percentage than one CPU. This will keep a single threaded application from thrashing a CPU.¬† Example:¬†if 2 CPU’s are available, the CPU setting should not be set above 49%,¬†if 4 CPU’s are available, the CPU setting should not be set above 24%”
    • Hal Lange demonstrates¬†Citrix WEM Performance Optimizations in a YouTube video.
  4. Other tabs on the right let you manually specify CPU priority and/or clamping.

    1. CTX230843 WEM protection and Skype for Business + Real Time Optimization Pack has a list of processes that should be excluded from WEM CPU Spikes protection.
    2. From CTA Chris Schrameyer¬†WEM ‚Äď CPU LOGGING:¬†WEM does not provide any built-in logs to determine when a CPU Spikes Protection action is taken. It would be nice to know what processes are often limited, so we can then add them to a CPU Clamping policy or identify why they are using so much CPU.
  5. On the top left, click the Memory Management node.
  6. In the right pane, you can enable¬†Working Set Optimization¬†to periodically reclaim memory from running processes. This feature tells processes to flush their memory to disk. In other words, you’re trading memory for disk.
  7. On the top left, click the I/O Management node.
  8. On the right, you can prioritize process IO.
  9. On the top left, click the Fast Logoff node.
  10. In the right pane, enabling Fast Logoff disconnects a session immediately, and runs logoff processes in the background.

Security

  1. In Workspace Environment Management 4.5 and newer, on the bottom left, click the Security workspace. In older WEM, stay on the Process Optimization workspace.
  2. On the top left, click the Process Management node.
  3. In the right pane, in the Processes Management tab, enable Process Management. The other tabs are grayed out until you check this box.

  4. You can BlackList processes. There’s also a WhiteList, but once something is added to the WhiteList, then all other processes are blocked.
  5. In Workspace Environment Management 4.5 and newer, on the top left, click Application Security.
  6. You can use the top-left sub-nodes to configure AppLocker. See Application Security at Citrix Docs.
  7. If you click the Executable Rules sub-node, on the bottom right is a button to Add Default Rules.
  8. If you edit a rule…

    1. You can assign the rule to a user group.
    2. The list of user groups comes from Active Directory Objects (workspace) > Users.
  9. On top of the right pane, set Rule enforcement to On or Audit.
  10. In the ribbon is a button to Import AppLocker Rules that were exported from a group policy. See CTA  Saadallah Chebaro Configure Citrix Workspace Environment Management Application Security for details.
  11. The other sub-nodes follow the same configuration pattern.

Policies and Profiles

  1. The Policies and Profiles workspace (bottom left) has four nodes on the top left.
  2. In the Environmental Settings node (top left), in the right pane, you can enable Environmental Settings, and configure restrictions that are usually configured in group policy. Peruse the various tabs on the right. Administrators can be excluded from these restrictions.
  3. The Environmental Settings within the WEM Administration Console are per-machine, not per-user. This means that, by default, all the settings configured inside of a Configuration Set apply to every non-admin user that logs into that particular Agent machine. In order to have different Environmental Settings apply to different users/user groups, they would need to be applied to a separate WEM Agent machine, and all the settings would need to be configured inside a separate Configuration Set to which the WEM Agent Machine is bound. Source = CTX226487 Guidance on configuring WEM settings per user/user groups.
  4. If you switch to the Citrix Profile Management Settings node, you can use WEM to configure Citrix Profile Management. See the Citrix Profile Management post for details on a recommended configuration.

    1. WEM 4.2 and newer includes the latest UPM 5.5 and 5.6 features, including: Active Write Back Registry, NTUSER.DAT Backup, and Default Exclusion Lists.
    2. WEM 4.4 and newer includes the latest UPM 5.8 and 7.15 features, including Enable Logon Exclusion Check.
    3. WEM 1808 and newer includes configuring the latest UPM 1808 features, including¬†Outlook Search Index Roaming.¬† ūüí°
  5. If you use WEM to configure UPM settings, but the settings are not applying to the WEM Agent, then see Citrix CTX219086 Some UPM or WEM Agent parameters may not be applied by the agent after switching from GPO settings to Workspace Environment Management settings.
  6. In the right pane, the File System tab has a useful Profile Cleansing button to remove excluded folders from an existing UPM profile share.

    1. Adjust the Profiles Root Folder, click Scan Profiles Folder, and then click Cleanse Profile(s). This might not be necessary if you enable Logon Exclusion Check.
  7. To configure folder redirection, on the top left, click Microsoft USV Settings.
  8. On the right, on the Roaming Profiles Configuration tab, check the box to Process User State Virtualization Configuration.
  9. Then switch to the Folder Redirection tabs, and configure them as desired.

WEM Agent Group Policy

  1. In the WEM Download, go to the \Workspace-Environment-Management-v-1808-00-01-01\Agent Group Policies\ADMX folder, and copy the .admx file, and the en-US folder to the clipboard.
    • In WEM 4,3, 4.4, and 4.5, the .admx file is postfixed with “v4.3”.
    • In WEM 1808, the .admx file is postfixed with “v1808”.
    • WEM 4.6 and WEM 4.7 do not include the version number in the .admx file name.
  2. Go \\MyADDomain.com\sysvol\MyADDomain.com\Policies. If you have a PolicyDefinitions folder here, paste the file and folder.
  3. If you don’t have PolicyDefinitions in Sysvol, then instead go to¬†C:\Windows\PolicyDefinitions, and paste the file and folder there.
  4. Look for older versions of the .admx and .adml files (in the en-us subfolder), and delete them.
    • In WEM 4.6 and WEM 4.7, the .admx and .adml files no longer have a version designation, so remove any .admx and .adml files that have a version number.
    • The WEM 1808 .admx and .admx files have v1808 in their names, so remove any .admx and .adml files that don’t have a version number.



  5. Edit a GPO that applies to the VDAs that will run the WEM Agent.
  6. Go to Computer Configuration | Policies | Administrative Templates | Citrix | Workspace Environment Management | Agent Host Configuration.
  7. On the right, double-click Infrastructure server.
  8. Enable the setting, enter the FQDN of the WEM server (or load balanced name), and click OK. Note: It must be FQDN. Also see Ryan Revord Load balancing Citrix Workspace Environment Manager.
  9. In WEM 4.3 and newer, to assign an Agent to a Configuration Set (formerly known as Site). In the WEM Administration Console, go to Active Directory Objects workspace (bottom left) > Machines node (top left), and in the right pane, add an OU or individual machines.
  10. It’s possible that an Agent might register with multiple Configuration sets. You can review the registrations at¬†Administration¬†workspace (bottom left) > Agents¬†node (top left) >¬†Registrations¬†tab (right pane).
  11. It also might show you Agents not registered with any Configuration Set. Add the Agent to Active Directory Objects > Machines.
  12. If WEM 4.2 or older:
    1. You can configure the WEM Agents to connect to a non-default WEM site by editing the Site Name GPO setting.

Install/Upgrade WEM Agent

  1. If App Layering, Citrix recommends installing the WEM Agent in the Platform Layer.
    1. If you are installing the WEM Agent in a App Layer, see George Spiers to workaround an issue with the Netlogon service in a Platform Layer that has the Provisioning Services Target Device software installed.
  2. Use registry editor to confirm that the WEM GPO has applied. Look for HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Norskale\Agent Host\BrokerSvcName.
  3. On a VDA Master machine, run the downloaded Citrix Workspace Environment Management Agent Setup.exe.
  4. If you are installing the Agent on a Provisioning Services vDisk, there are a couple Agent Installer Switches that let you move the WEM cache file to the PvS cache disk:
    "\\fs01\bin\Citrix\WEM\Workspace-Environment-Management-v-1808-00-01-01\Citrix Workspace Environment Management Agent Setup.exe" /v"AgentCacheAlternateLocation=\"D:\WEMCache\""
  5. You can use the ARPSYSTEMCOMPONENT=1 switch to prevent the Agent from showing up in the Programs and Features list where it can be uninstalled.
  6. Citrix CTX218964 How To Secure a Citrix WEM Agent Installation in Cases Where Users are Local Administrators also details how to configure a group policy to prevent local administrators from stopping the Agent service.
  7. Click Install to install the prerequisites.
  8. In the Welcome to the InstallShield Wizard for Citrix Workspace Environment Management Agent Host page, click Next.
  9. In the License Agreement page, select I accept the terms, and click Next.
  10. In the Customer Information page, click Next.
  11. In the Setup Type page, click Next.
  12. In the Ready to Install the Program page, click Install.
  13. In the InstallShield Wizard Completed page, click Finish.
  14. After installation, check the registry under HKLM\System\CurrentControlSet\Control\Norskale\Agent Host to verify your command line switches applied correctly.
  15. Citrix CTX219839 How to Enable Debug Logging on Workspace Environment Management Agent manually, if no connectivity to Broker exists. Set AgentDebugModeLocalOverride and AgentServiceDebugModeLocalOverride to 1. The Norskale Agent Host Service Debug.log file will be written to %ProgramFiles(x86)%\Norskale\Norskale Agent Host. The Agent Log file will be written to the User Profile (i.e. under %UserProfile%).
  16. Srinivasan Shanmugam at¬†WEM Agent v4.5 Upgrade Issues at CUGC mentioned that you might have to delete the upgraded Agent’s local database.
  17. Optionally, you can pre-build the Agent Cache by running AgentCacheUtility.exe, which is located in C:\Program Files (x86)\Norskale\Norskale Agent Host.
  18. It needs the following switches:
    -refreshcache -brokername:MyWEMServer
  19. From Hal Lange: “AgentCacheUtility does except short values (Eg AgentCacheUtility -r -b:)¬† the broker name should always be in FQDN since this does use Kerberos for the authentication.”
  20. You can also use the WEM Administration Console at Administration workspace (bottom left), Agents node (top left), to refresh the cache. The Synchronization column indicates if the cache is up to date or not. It takes a few minutes to update.
  21. From Hal Lange: “Need to optimize the client by running ngen for .NET optimizations¬†in the x64 and x86 directories. These commands will help optimize ANY .NET application installed on the system
    C:\Windows\Microsoft.NET\Framework\v4.0.30319
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319
    ngen.exe update
    ngen.exe eqi 1
    ngen.exe eqi 3
  22. Antivirus –¬†¬†C:\Program Files (x86)\Norskale\Norskale Agent Host must be excluded from Antivirus scanning. Or exclude Norskale Agent Host Service.exe; VUEMUIAgent.exe; Agent Log Parser.exe; AgentCacheUtility.exe; AppsMgmtUtil.exe; PrnsMgmtUtil.exe; VUEMAppCmd.exe; VUEMAppCmdDbg.exe; VUEMAppHide.exe; VUEMCmdAgent.exe; VUEMMaintMsg.exe; VUEMRSAV.exe.
  23. After Agents are installed, the Administration workspace (bottom left), Agents node (top left), shows the list of Agents, allowing you to perform actions against an Agent. For example, if UPM settings are not applying to your Agents, you can right-click the Agent, and click Reset Citrix Upm Settings. You might have to click the Refresh button on the bottom right. See Workspace Environment Manager UPM at Citrix Discussions.
  24. If you use WEM to configure UPM settings, but the settings are not applying to the WEM Agent, then see Citrix CTX219086 Some UPM or WEM Agent parameters may not be applied by the agent after switching from GPO settings to Workspace Environment Management settings.  Delete the machine cache, which is at the following registry location:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Norskale\Agent Host\UsvMachineConfigurationSettings
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Norskale\Agent Host\UpmConfigurationSettings

    This will force VUEM to re-apply the per-machine settings (Microsoft USV or Citrix UPM settings, respectively).

  25. James Kindon describes the WEM Client Side Tools including: Log Parser, Resultant Actions Viewer, VUEMAppCMD, Manage Printers, Manage Applications, and Help Desk Tools.

WEM Agent on Provisioning Services

From Julian Mooren Citrix Workspace Environment Management with PVS ‚Äď Synchronization State ‚ÄúUnknown‚ÄĚ: For PvS, schedule a task to run the following commands at Target Device boot (Trigger = At Startup).

"C:\Program Files (x86)\Norskale\Norskale Agent Host\AgentCacheUtility.exe" -refreshcache

From CTA David Ott at Using Citrix Workspace Environment Management to Redirect Folders via Symbolic Links ‚Äď Speed Up Logon:¬†before shutting down your maintenance/private mode vdisk to re-seal, kill the Norskale Agent Host Service. For whatever reason if you don‚Äôt do this it can cause your vms in standard mode to take an obscenely long time to shutdown.

If you have a PVS environment and you have redirected the WEM cache to the persistent drive, use a startup task to refresh the cache, force restart the Norskale Agent Host Service, and start netlogon after. If the cache doesn’t already exist, WEM doesn’t seem to check with the WEM server. You have to create the cache, and then restart the service so that it reads it, and force restarting the Norskale Agent Host Service will stop netlogon (dependent on it).

Login Base Image Script Framework (BIS-F) automates many image sealing tasks, including tasks for Workspace Environment Management. The script is configurable using Group Policy.

Monitoring

  1. In the WEM Administration Console, the Monitoring workspace (bottom left) lets you see Logon Time and Boot Time reports.
  2. Double-click a category to see more info.

  3. Configuration node (top left) lets you configure Work Days Filtering for Login/Boot Time Reports.
  4. When you make changes in the console, if agents are already installed, you can right-click the agent icon (by the clock), and Refresh.
  5. You can also go to the Administration workspace (bottom left) > Agents node (top left). In the right pane, right-click one or more Agents, and click the Refresh options.

WEM Actions Configuration

WEM Actions are similar to Group Policy Preferences.

The general process is as follows:

  • Create the Actions
  • Add AD user groups to the WEM Console.
  • Assign Actions to user groups. Use¬†Conditions and Rules to perform the Action for only a subset of machines or users in the user group.

Create Actions

  1. In the WEM Console, use the Actions workspace to map drives, map printers, create shortcuts (Applications), set registry keys, etc. Each Action type is a separate node.
  2. In the right pane, click the Add button to add actions. These Actions are self explanatory.
  3. Some Actions, on the Options tab, have a Self-Healing option. To optimize performance, WEM only applies an action once. The Self Healing option causes it reapply at every logon.
  4. Network Drives have no field for selecting a drive letter. Instead, you configure the drive letter later when assigning the action as detailed below.
  5. Applications (shortcuts)
    1. In the Actions pane, Applications have no option for placing a shortcut on the Desktop. Instead, you configure shortcut placement later when assigning the action as detailed below.
    2. WEM 4.6 and newer let you pull icons from a StoreFront store.

    3. Arjan Mensch at Powershell Module for Citrix WEM ‚Äď Part 3 ‚Äď EnvironmentalSettings and MicrosoftUsvSettings from GPO and much, much more¬†provides a PowerShell Module that can do several things to help setup WEM, including reading a bunch of shortcuts (e.g. from Start Menu), and converting them to an .xml file that can be imported into WEM. This simplifies Applications configuration.
    4. To prevent applications (shortcuts) from being created if the application isn’t installed, go to¬†Advanced Settings > Configuration > Agent Options, and check the box next to¬†Check Application Existence in the¬†Extra Features section.
    5. To clean up extra shortcuts, go to Advanced Settings > Configuration > Cleanup Actions, and check the boxes in the Shortcuts deletion at startup section. Also see James Kindon Citrix WEM, Modern Start Menus and Tiles.
    6. After you create Applications (Shortcuts), and assign them, on the agent, there’s a¬†Manage Applications tool that lets users control where shortcuts are created, including pinning to Taskbar and Start Menu.

    7. Applications can be placed in Maintenance Mode. Edit an Application, and find the Maintenance Mode setting on the Options tab.
    8. This causes the icon to change, and a maintenance message to be displayed to the user.

    9. The Applications node has a Start Menu View tab on the right.
  6. For the¬†Printers Action, in the ribbon, there’s a¬†Import Network Print Server button.

  7. For the Registry Entries Action, in the ribbon, there’s an¬†Import Registry File button.

    • If Registry Actions are not applying, delete¬†HKEY_CURRENT_USER\Software\VirtuAll Solutions\VirtuAll User Environment Manager\Agent\. (Source = Registry Entries not applied to users at Citrix Discussions)
  8. For File System Operations, each Action has an Options tab that lets you set the Type of Action.
  9. For File Associations, “Command” is just the parameters without the executable.
  10. James Kindon at File Type Association with WEM and SetUserFTA¬†explains how to use WEM to run¬†Christoph Kolbicz’s¬†SetUserFTA utility to reliably set file type associations on Windows 2012 and newer.

Create Conditions and Rules

  1. Once the Actions are created, you then need to decide under what conditions the Actions are performed. Go to the Filters workspace (bottom left).
  2. On the top left, switch to the Conditions node.
  3. In the right pane, create Conditions. One or more Conditions are later combined into a Rule.
  4. One of the interesting Conditions is User SBC Resource Type, which lets you run Actions for either Published Desktop or Published Application.

  5. James Kindon at WEM filter conditions on OU and IP Address at Citrix Discussions says that the Active Directory Path Match condition requires a * at the end of the path.
  6. Then switch to the Rules node (top left) and create Rules in the right pane.
  7. If you add (by clicking the right arrow)¬†multiple Conditions to a Rule, all (AND) Conditions must match. There doesn’t appear to be an OR option. The Rules are used later when assigning an Action to a user group.

Add AD Groups to WEM Console

  1. Go to the Active Directory Objects workspace (bottom left).
  2. With the Users node selected on the top left, in the right pane, add groups and/or users that will receive the Action assignments.

Assign Actions to User Groups

  1. Go to the Assignments workspace (bottom left) > Action Assignment node (top left).
  2. In the right pane, initially the bottom half is empty. Double-click a group to show the Actions that are available for assignment. WEM 1808 has a built-in Everyone group.
  3. Move an available Action from the left to the right. This assigns the Action to the user group.
  4. You will be prompted to select a Filter, which contains one or more Conditions.
  5. When you move a Network Drive to the right, you’re prompted to select a drive letter.

    • The list of drive letters is restricted based on the configuration at¬†Advanced Settings¬†workspace (bottom left) > Configuration¬†node (top left) > Console Settings¬†tab (right pane).
  6. Back in the Assignments workspace, on the right, some Actions have additional options that you can right-click. For example, you can create shortcuts on the desktop.

Actions Troubleshooting

WEM caches Actions executions under HKEY_CURRENT_USER\SOFTWARE\VirtuAll Solutions\VirtuAll User Environment Manager\Agent\Tasks Exec Cache. Sometimes clearing these keys and values will fix Actions not applying.

James Kindon at Selective Deletion of the WEM Actions Tracking Cache wrote a PowerShell script to selectively clear these registry keys and values.

Modeling Wizard

  1. In the Assignments workspace, you can use the Modeling Wizard node (top left) to see what Actions apply to a particular user.

Client Side Tools

James Kindon describes the WEM Client Side Tools including: Log Parser, Resultant Actions Viewer, VUEMAppCMD, Manage Printers, Manage Applications, and Help Desk Tools.

Transformer

In WEM 4.1 and newer, you can enable Transformer, which puts the WEM Agent in Kiosk mode. Users can only launch icons (e.g. Citrix icons). Everything else is hidden. This is an alternative to Receiver Desktop Lock. The Transformer interface is customizable. Note: desktops currently will not auto-launch from Transformer.

  1. In the WEM Console, there’s a¬†Transformer Settings workspace (bottom left) with two nodes on the top left:¬†General and¬†Advanced.
  2. Enable Transformer, and point it to your StoreFront URL. Note, this applies to all users and all agents in this WEM configuration set. You should probably have a new Configuration Set just for Kiosk devices.
  3. Other settings on the General Settings tab let you customize the appearance, and specify an unlock password. You probably want to disable the Clock. The Navigation Buttons are browser navigation.
  4. Transformer can be unlocked by pressing Ctrl+Alt+U and entering the unlock password.
  5. On the Site Settings tab, you can add website URLs that can be launched from within Transformer.
  6. At the top of the Transformer window is a Sites icon that lets you go to the sites listed in the WEM Console.
  7. The Advanced node lets you configure Transformer to launch a process other than a browser.
  8. The Advanced & Administration Settings tab lets you hide features from Transformer.
  9. To prevent users from accessing the local system, consider checking Hide Taskbar & Start Button.
  10. You probably want Log Off Screen Redirection to redirect users to the logon page when StoreFront logs off.
  11. The Logon/Logoff & Power Settings tab lets you configure the WEM Agent to autologon as a specific account. Transformer then displays the StoreFront webpage where the user enters his or her credentials.

364 thoughts on “Workspace Environment Management (WEM) 1808”

  1. So, I seem to have WEM installed and it appears to be working. However, it seems once WEM was installed and configured my Microsoft GPO seem like they are not getting applied any longer. Even adding Citrix Admins to the local Administrators group is not working. Any ideas?

  2. Hello Carl,
    I am a bit confused on a couple of things. I made a presistent D drive for my PVS write cache. Intialized it in windows and it’s in my vdas now. I use the stream wizard to build new machines or servers. My question is do I have to go to every vda to install the WEM agent on the D drive? Or can I still put the vdisk in maintenance mode and do it that way on the D drive?
    Being the D drive are presistent accross all vdas, I don’t know which option is correct?

  3. You are not registered as a Workspace Environment Management administrator. Therefore you are not allowed to access the service. Please contact your Workspace
    Environment Management administrator to gain access

    1. When it was installed a group needed to be added to administer the console. You are probably not in that group.

  4. After upgrading the WEM server to 4.3 the “Norskale Infrastructure Service” on the server isworking well, but randomly stopping. It can manually always be restarted without any problem, but after a while it is again in the “stopped” state. This has never been an issue before 4.3 Anyone experiencing the same issue andhaving a solution?

      1. Thank you, can you post a link?
        And did they find any solution other than always manually starting the service again?

  5. Hello and thanks for a great article!
    I have updated to 4.3 today and the console and database works great, but when I try to start the agent on my XenApp servern I get
    “Unhandled Exception
    CLS Terminating = True
    Exception:
    Message: Could not load file or assembly “Norskale.Vuem.Agent. Controllers, Version=4.3.0.0, Culture=neutral…..” and more

    Any idea what that could be? The server is restarted after upgrade

    1. Update: After a total new installation that error disappeared but now I gets that the agent cant start and in event viewer:
      “Service appears to be Offline and no valid local cache found!”

      1. SOLVED! It was a time difference between the infrastructure server and the machine with the agent, for 8 minutes, of some strange reason. Changed that and then everything works as expected ūüôā

      2. Hi Kent, I got the same issue. It seems to be a failure in the install routine. In most installations a file called ‘Norskale.Vuem.Agent.Controllers’ is missing. You should uninstall the agent and reinstall version 4.2. It runs with 4.3 controllers.

  6. Hello Carl,
    If read through this and u stated Wem doesn’t replace upm. But it look like wem 4.3 can do everything the upm does. I am setting this up from scratch for a new customer. Everything is fresh, can I use wem 4.3 to do all the upm setting without doing a admx like we used to? Meaning control all upm from wem side?

    1. You can use WEM to configure UPM, but it doesn’t replace UPM. What it replaces is the group policy settings for UPM.

      1. What do u mean it doesn’t replace upm? Do u mean the upm can be controlled by wem and or GPO? If you do it by wem only do you still need to import the admx file? Meaning does wem need the admx file only for upm.

        1. I think ur saying it’s not a official replacement but u can use wem instead of GPO? Meaning I don’t need the admx file because I will be using the alternative method with wem. Is this what u mean.

          Sorry for all the questions

        2. UPM is a service. It’s controlled through policies. The UPM service is doing all of the work, no matter how you configure it.

          Other UEM products have their own profile handling (backup/restore) capabilities. WEM does not.

  7. hello carl, still the problem with 4.3 agent , Broker Server name or Broker Port Error, no agent is showing up in the console. any ideas?

  8. At the Broker Service Configuration I had to type SQLServer\SQLInstance (with the backslash in it) . Only typing the SQL Server like in your documentation fails in my test lab.

    1. If you are using named instances, then you definitely need to use this format. My home lab uses the default SQL instance.

  9. So lets say you use Domain Users as your configured user, and assign it two environment variables:
    EnvVar = \\FileServer1\Stuff
    Filter: Active Directory Group match: UserGroup1
    EnvVar = \\FileServer2\OtherStuff
    Filter: Active Directory Group match: UserGroup2

    If I sign in as JoeShopfloor, who is a member of Domain Users, UserGroup1 AND UserGroup2, will my EnvVar point at “\\FileServer1\Stuff” or at “\\FileServer2\OtherStuff”?

    Mostly I’m trying to figure out if we can implement item level targeting for Windows Folder Redirection settings in WEM, since it appears that it only allows you to configure it at the site level (really??)

  10. Hi Carl,
    we are using VEEAM for years already and now want to upgrade to 4.3. Do you know if the new Agent works with the old Broker 3.5, sow we can pre-deploy the agent to all our clients?

      1. i added the server und active directory and objects, but still get this error:

        AgentLocalCacheSync.() : Local Agent cache synchronization error occured, please Check debug log for more details

  11. I am unable to get the Agent to check in with the Broker Server. WEM 4.3 installed. When I try to manually update the agentcache it gives me “Broker Server Name or Broker Port Error”. I have the machine with the agent installed added to the Machines under Active Directory Objects. Any ideas where I might be going wrong?

  12. hello carl, after upgrading to 4.3 our agents cannot connect any more to the server. i got the following error Agent ‘ATDOXAPVS001’ is not bound to any configuration set! any ideas? kind regards

      1. can i add the ou where the xa Server are located? or does it `need to be the object like the Servers himself?

    1. Have you load the updated ADM Template? Make sure you point the agents to the correct Broker Server. WEM 4.3 is different from 4.2.

  13. Hi guys

    Somehow I can’t connect to the infrastructure server anymore by console.
    I receive the following error: Error while connecting to the specified Infrastructure Server
    In the console trace I can see this:
    System.ArgumentException : Value was invalid. Parameter name: sddlForm

    Did anybody face the same problem?

    Thanks

    1. Opened a ticket. Here is the fix if anyone else comes across the issue.

      Run the following query on the VUEM database:
      SELECT * FROM VUEMUsers WHERE Name=’\’
      This will return the user statistic recording with the corrupt SID. Once you have identified the recording, you will need to run the following requests to delete it:
      DELETE FROM VUEMUserStatistics WHERE UserId=’X’

      DELETE FROM VUEMUsers WHERE IdUser=’X’
      Where X is the UserId of the recording with the corrupted SID.
      ________________________________________
      Problem Cause
      A corrupt SID recording in the Name column of the VUEMUsers table in the database. When attempting to read the user statistics, the console cannot translate the corrupted SID and thus errors out.
      ________________________________________
      Additional Resources
      One of the potential causes of the corrupt SID recording is a malfunctioning Netlogon service on a server which is mistakenly identified as having opened a session with an SID of \. If the issue re-occurs, compare the LastAgentId of the corrupt SID user record with the VUEMAgents table to determine which server the recording is coming from, then restart the Netlogon service there.

      1. The above SQL query did not work for me. I had to use SELECT * FROM VUEMUsers WHERE Name NOT LIKE ‘S-1-5-21%’ and then delete the resulting user statistics and users as specified.

    2. I didn’t run a trace, but I got the “Error while connecting to the specified Infrastructure Server” error when time was off by over five minutes on one of my VMs in a test environment.

  14. Hi Carl

    very great article. I have one question: Does the WEM Transformer support pass-through authentication to virtual desktop or apps ?

    Thanks
    Serkan

  15. Hi Carl,

    Great article, thanks! I have a strange issue with the WEM integrated Citrix Profile Management settings. When I configure the user store path with \\server\share\#SAMAccountName#\!CTX_OSNAME!!CTX_PROFILEVER! it creates a folder named #SAMAccountName#. Same with %USERPROFILE%. It looks like it doesn’t translate it correct to the name of the user. What am I doing wrong?

    1. I found out that it has something to do with NTFS rights. With Everyone ‘Full Control’ (PoC environment) usernames folders are created the way they should. So %USERNAME% (typo in my first post) is now the (user) name of the user.

  16. Hello! We are currently testing Citrix WEM. But we are having some challenges regarding site change.
    We added ADM, and set SITE. Even though we change in GPO, the VM connect to our template SITE (we created this earlier)

    It updates and show the correct SITE in registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Norskale\Agent Host – but still reads the config from template site. How can we force a SITE change?

    Thanks in advance
    José Daniel

    1. In WEM Console > Administration > Agents, if you right-click the agent and use the Refresh options, does that help?

  17. Hi Carl.

    I’m using 4.2 version and the logon freezes for 5 minutes when I use UI Agent style.
    After 5 minutes everything works well.
    If I change to CMD Agent style, the session doesn’t freeze, but the command prompt takes 5 minutes to close with the message “Processing filters conditions…”
    I’ve already tested versions 4.1 and 4.2, all of them with the same behavior.
    How can I solve this problem?

    Regards.
    Ederson

  18. Hello Carl, i have an issue at the momment hope you can help to fix it.
    te Problem is event log i see this error
    Event ID: 0 VuemAgentServiceConfigurationHelper.TryUpdateAgentRegistration (): The creator of this error has not specified any reason.
    i try finx or find reason but no succes
    so now i am deinstaled and new installed have a new error now
    event id 0 sourche Norskale Agent Service & The creator of this error has not given any reason.
    so i dont know realy what is wrong!!
    by Administration Console under i cant see also my new “xa”
    and no error can help me about it what can be reasonor how can i get it fix work again?

    i am user Server 2012r2, xendesktip 7.6 CU3
    PS before work fine it, this issue happen after i am deleted Machine catalog and create new Worker
    hope did you can help me!!

  19. On some VMs i get this state, and WEM will not execute every rule/action. This is on non-presistant VDIs with presistant cache disk. Anyone have a clue?

    Im not sure if this has anything to do with it. But i get this in the Citrix WEM agent text file.

    Event -> MainController.SwitchToMainLog() : Detected Agent Connection State -> Offline

    And if i restart the norskale agent service it gets back to Online and if i then refresh alle the rules get applied.

  20. Hi everyone,
    What’s the best practice for versioning with WEM?
    Looking at replacing AppSense with WEM and trying to find out the best way to handle versioning in regards to testing changes, etc

    Thanks,
    Will.

    1. You could create a different Site or Configuration Set (WEM 4.3) for testing then configure the agent to connect to it. You then can test your changes.

  21. New to WEM. Do you have the ability to Nest Sites? If so I havent found a way to do that. Specifically create a main site with items that affect the whole org, then create child sites that have specific settings in that?

  22. Great article. I have an issue. The SQL server is listening on a different port than 1433. Is there any way to pass the specific port on the database creation wizard? I have already tested Servername;port or Servername:port and Servername,port. The result is “Database creation error”. thanks.

    1. I have just tested in 3 different environments, running 3 different versions, and it is “Servername,port”. read the log file that is created in C:\Program FIles\x86)\Norskale\Norskale Infrastructure SErvices\ called Citrix.WEM.Database.Creation….. This will tell you the exact error. Usually has to do with the DB’s being moved to a non-discovered location and the path of the ldf and mdf will need to be changed on the first tab to match the SQL paths.

  23. Hey Carl, I ran into something interesting today and was curious if you or anyone else had this issue. When working with WEM and assignments I noticed that only 3 of the 4 working set group found showed for my user in the Norskale Vuem Agent log. I also noticed that the working set group I was missing was having issues for some other users, but those users were in a nested group. I guess the question is there a limit to the number of Working Set groups that can be applied to an individual and is there an issue with WEM going through Nested groups for assignment. (Note: I’m not really a fan of the Nested group myself, I’m just trying to confirm that it’s a issue to try to enforce why we shouldn’t be using nested groups for this)

    1. The only limitation i have found tend to be AD issues. Mainly Kerberos ticket size. I have seen no issues with Nested groups or number of groups, unless AD has the issues already.

  24. Hi Carl

    What’s the difference between “Network Drives” and “Virtual Drives”? Of course some config settings more in the network drives. But when should I use one or the other?

        1. To add more color. the VHD files will be mapped to a drive letter. This is for a desktop OS and not very compatible with a system utilizing RDS since it would attempt to mount a VHD as a drive letter for the system but not have access, due to multi-user

  25. Since installing WEM in the environment on different servers both PVS and NonPVS images I am seeing a lot of BSOD referencing REGISTRY_FILTER_DRIVER_EXCEPTION (135)”upmjit.sys. It actually happened while on a support call with Citrix. I have a ticket open but I was speaking with a “XenApp” tech had heard of Workspace Environment Manager before but knew little to nothing about it and didn’t know who I should even speak with about it. Why am I paying thousands of dollars in support? Anyway…I have submitted the memory dumps and a scout report for Citrix to analyze and get back to me on…this should be interesting.

    1. Another issue I’m seeing is the CitrixProfileManager.exe is eating RAM like Pacman after getting a power pellet. Still no support from Citrix on these WEM issues. Does active write back cause the CPM.exe to eat RAM more than normal?

        1. I updated to XenApp LTSR CU3 about 2 weeks ago and installed UPM 5.6 on the Delivery Controllers since that what the documentation listed as LTSR compatible. Should I update profile management on the Delivery Controllers to 5.7? Is there a piece that needs updated on the Server VDA’s to fix the UserProfileManager.exe process?

          1. Is that separate than the User Profile Manager that gets installed when you install the VDA (C:\Program Files\Citrix\User Profile Manager) or does running the 5.7 installer update those files in that path?

          2. Alright thanks. I’ll submit that for a change next week and hopefully that fixes the UPM issue. Now on to the modified RAM issues with Citrix support…

            Again…thanks for everything. Your guidance is always greatly appreciated.

    2. Just had the exact same issue. With an adjustment in Workspace Manager => setting the Active Writeback to disabled, all servers started to bluescreen (upmjit.sys) in a matter of minutes. I’m upgrading now to latest UPM version and Workspace agent on the VDA host.

  26. Carl, I’m not sure if I have something configured wrong or what but it appears RAM optimizations aren’t working correctly. I’m on XenApp 7.6 LTSR CU3 and have WEM installed on 48 servers all running the same image. The policy kicks in correctly and takes the RAM back from the process but under the resource monitor it put’s it in the “Modified” section of RAM saying “Memory whose contents must be written to disk before it can be used for another purpose”. The “modified” RAM just keeps growing and never releases the RAM back to be used. Am I missing a setting somewhere? Thanks,

  27. Hi, does anyone know WEM support NetScaler GSLB for the broker services?
    How does it this solution support the active/active datacenter solutions?

    1. Assuming you’ve handled SQL, I don’t see why not. I assume each Broker instance shares the same SQL database.

    1. I created a startup script that restarts netlogon and the agent service then applied it to a gpo for the servers. Haven’t had any issues as of yet in my testing…but I could be off the mark on that one.

  28. Any chance you can shed some light on the login times under monitoring? What exactly does that measure? In my test environment it’s saying the login times are 1-3 seconds but in reality it’s about 10 seconds before the app is actually launched and usable in the client device. Is that simply meaduring login time to the server and not app launch time?

  29. Carl I could use a little help with the Citrix UPM vs the WEM settings. You say WEM doesn’t replace Citrix UPM but you use both? How exactly does that work? If I have Citrix policies configured in Studio and WEM policies configured for the same thing what happens? Or if there’s differences between the 2 which one wins? I’m guess I’m just confused as to which to use and why one over the other? Any clarification would be greatly appreciated.

    1. Most UEM products have Profile (Personalization) capabilities. WEM does not. So you need to deploy both.

      As for configuring UPM, you can use WEM to configure it. Or you can use more traditional GPO or Studio.

      1. So if I already have UPM setup in Studio and working fine I don’t need to worry about configuring WEM profile settings? If I want to use the WEM settings do I need to turn off the Studio policies? What personalization capabilities are you referring to? Is there a benefit to using UPM over WEM or WEM over UPM besides WEM looking pretty with nice buttons?

        As always, thanks for the help. I don’t know what the Citrix community would do without your guides.

        1. UEM products with Personalization are more capable than UPM. Most of them have a method of specifying specific folders/registry for each application and storing each application in a separate location. When the app is launched, the application’s settings are restored at that time. Check out AppSense, VMware UEM, RES, LiquidWare Labs ProfileUnity, etc.

          1. Ahh thanks. We currently don’t have any of that in place and don’t have any specific profile settings configured besides redirection and minor things. Do you have a preference on using the settings in WEM vs UPM?

          2. If you’re anti-GPO, then you can use WEM to configure it. WEM also has a handy profile cleanup tool if you used WEM to configure UPM.

  30. Is there any way of placing desktop icons of assigned applications in sub directories of the desktop/start menu and not directly on the desktop/start menu, so that we can group in categories?
    If all applications will be put directly on the desktop this will end up in a mess sooner or later.

    1. Yes, under actions, applications, there’s a tab called “Start menu view”, in there you can add subfolders for the startmenu, then by editing an application in the bottom you can select in which folder of the startmenu you want the app to be placed.

      1. Thank you Peter, that improves things for the start menu, but in most cases placing icons on the desktop in sub folders would be much more important. But there is no equivalent like “Desktop View” or something similar to the “Start Menu View”.
        Is there any way to get this done otherwise?

        1. You could always create shortcuts to the Start Menu Folders on the desktop to give the illusion of desktop folders, but not clutter with multiple icons. This way you still only have to change the shortcut in one location.

  31. Hi Carl, do you have details on configuring a WEM server to work across multiple domains? I’ve built a WEM server on domain A, with VM’s running on domain B. When a user logs in from domain A every thing works fine, however when a user logs in from domain B, a Norskale Agent Service event log error shows the following:

    Error while retrieving user directory services groups list check log for more details (some sids may not have been translated properly)

  32. I assume there no way to limit how much RAM a user can consume in a session? I can in AppSense Performance Manager but it has a bug where user’s process get permanent placed in Suspended Mode.

  33. Hey Carl do you know if there is a way to trigger the Memory Management outside the application? I’m not even sure this would be possible, but it would be interesting if the Norskale Agent could except command lines so I could do a custom Idle time cleanup on memory. Something like Norskale Agent.exe -MemoryManagement 5 which would then cause anything that has been idle for 5 minutes to be cleaned up. I was thinking I could put something in the external Tasks that on refresh would trigger this.

  34. I’m curious about the flexibly of the server specs. One server at 4vCPU and 8GB RAM will support 3000 users. We don’t have near the need to support that many users currently but we have a dual (active-active) datacenter setup so when we build a server on one side we build the same on the other. I really don’t need two 3000 user servers so can I just run 2vCPUs and 4GB RAM on each server behind the load balancer to equal out to the same thing or is the 4×8 the minimum supported?
    Thanks.

      1. Thank you. That’s my initial plan. I’ll update this if I see issues down the road. Great article…always helpful!

  35. In the steps above you call out License Server 11.14.1 or newer but the latest version I see is 11.14.0.1. Is that just a type or am I missing something somewhere.

  36. Thanks for this great article! I have the problem, that the agent cache sync is not working. Synchronization state shows always an error. Running the agentcacheutility.exe doesn’t help. The logs don’t show anything interesting. How can I completly recreate the agent cache?

      1. In the WEM Console I have a red cross under synchronization state. When I run the agentcacheutility.exe I receive the following error: Local Agent cache synchronization occured, please Check debug log for more details. I checked the debug log but there is no further information about this problem.

        1. We’ve had the local change totally stuff itself, especially when moving between sites. We had to remove the agent via appwiz and the manually remove the local database, and then reinstall the agent.

        2. Hi Enrico, have you been able to resolve your “red cross” issue. I am experiencing the same issue and looking for a fix. Any updates on this post would be greatly appreciated.

  37. Hi,

    What is the process of upgrading from 4.1 to 4.2 please, I couldn’t see it in the above. The was a section about upgrading the database, but I’m sure there are other areas to upgrade.

    Thanks

    1. Every component is in-place upgrade using a standard install. It’s only the database that is separate. I’ll add a section to clarify.

  38. Hey Carl,

    Does the Transformer agent automatically launch a desktop when you configure it? We’re using WI 5.4 and when we connect to the same site in Internet Explorer, the single desktop launches fine. WEM on the other hand, when using the same site, looks like it ties to auto launch it (you see the spinning graphic for a few seconds) but nothing ever happens (the blue play graphic is shown). You can then click on it and see it launch without issue. It’s almost as if the IE frame it’s rendering is sort of incapable of handling the ICA download. Or maybe we’ve broken something.

    Cheers.

    1. We’ve tried the site in both local intranet and trusted and still no dice via WEM, but fine via the full browser. This is 64-bit Windows 10 (1607).

        1. Citrix have confirm they will not release a private for this. They have asked us to submit a business case for a feature enhancement. On we go..

  39. One of Citrix related document mention that in case WEM on XenApp, DFSS or any other CPU optimization should be disabled. Any information on that with right approach? I our case I am trying to load WEM for Windows 2016 and this portion is unclear, if anything should be done prior WEM agent installation.

    Thank you in advance,
    Vladi

      1. Thought WEM was only for XenApp 7.9 (or 7.6) and higher?
        1 off the things that i faced was in the GPO settings, the field for brokername and site-name contained unwanted spaces, cleaing those, made the agents show up in my console.

      2. Got Fixed as we use F: for cache disk

        Have another query though,I have created multiple sites as per my WG but how to do I force site details to agents on their respective sited. Do I need to have a policy at each OU level with respective site names. Or can I edit the reg for site.

  40. I have been trying to make a silent install of the agent, but haven’t been able to find the correct parameters yet.
    I am also using the paramters suggested in this article:
    /v”AgentCacheAlternateLocation=\”D:\WEMCache\” AgentServiceUseNonPersistentCompliantHistory=\”1\””

    And if I add /? so the agent .exe file, it tells me a silent install need this paramters:
    /S /v/qn

    If I then try to install it with these paramters:
    /S /v/qn”AgentCacheAlternateLocation=\”D:\WEMCache\” AgentServiceUseNonPersistentCompliantHistory=\”1\””
    Then it installs silently, but it doesn’t add the AgentCacheAlternateLocation and AgentServiceUseNonPersistentCo… to the registry.

    I also tried with /S /qn /v”AgentCacheAlternateLocation=\”D:\WEMCache\” AgentServiceUseNonPersistentCompliantHistory=\”1\”” – but then it doesn’t make a silent install.

    Has anyone tried making a silent install?

    1. Hi Kim,

      The /v option tells the setup.exe to parse parameters to the Windows Installed (msiexec.exe). The parameter /QN is a Windows Installer parameter. So it has be come after the /v command, like this: Setup.exe /s /v‚ÄĚ/qn /norestart /l ‚Äú\C:\Logs\WEM.log\‚ÄĚ‚ÄĚ
      Please allow me to direct you to an article I wrote this week explaining this in more detail: http://dennisspan.com/scripting-the-complete-list-of-citrix-components-with-powershell/#WEM

      Bye,

      Dennis

  41. We have checked the “Launch Agent for Admins” flag in the Main Configuration, but on some machines (not on all!) the settings for the one and the same admin user are not applied.

    Digging around we then found that the ClientResultantActionsViewer is showing no admin privileges for this admin user, even though the Windows User Manager is clearly stating that he IS domain admin.

    Then, as soon as we start the VUEMUIAgent.exe with administrative privileges from the context menu, suddenly the WEM settings get applied and also the ClientResultantActionsViewer us showing the admin privileges!

    And the strange thing is that on some identically deployed other machines in other subnets, everything is ok without explicitly running the applications with admin privileges.

    Anyone with some insights on this?

  42. Carl – awesome write up on this as usual! You mentioned 3000 users for a 4vCPU & 8 GB RAM server which I can see comes directly from the Citrix WEM administration guide. Do you have any guidance larger environments? Would you just add a 2nd server and load balance them? Or would you have to increase the size of the server? Both? Just curious your thoughts on this. Thanks!

    1. Hal Lange has done several large deployments. I think he said he’s seen 5,000 users on a single server. But yes, you can easily scale out by load balancing. Or you can make it more of a pod architecture.

      1. We spoke to Citrix about this specifically, and the advice was to throw more VMs at it and jam them it in front of a load balancer. It’s all stateless UDP so that’s pretty easy. You can scale the individual VMs further if you wish, but I’m always cautions about the number of vCPUs I allocate to a given VM.

  43. Great Stuff.
    Just facing 1 issue, when a user starts a published XenApp desktop (7.9), the sessions freezes completely, and will only unfreeze when I click “Refresh Workspace Agents” from the administration console. (then the icon in the taskbar pops-up and all works great)
    (using WEM 4.1)
    Any hints or clues?

  44. Anyone use WEM and UPM together? Im having this issue that WEM loads like after 2 minutes when logged on when UPM is enabled. When i disable the UPM service WEM agents start instant on logon.

    1. Check:
      Bypass ie4uinit Check: by default, the Agent service will wait for ie4uinit to run before launching the Agent executable. This setting forces the Agent service to not wait for ie4uinit.

  45. I have an issue with creating application links. On my WEM administration server are not installed any apps (e.g. MS Office). That’s why I have to copy the whole path (e.g. of MS Word) from another server to the wizard. But this path is not available at the WEM server. As a result I can create the application but I don’t have an icon for it.

    1. You can easely start the WEM administration console from your VDI. Logon to you VDI with admin cred’s, and browse to the \\adminserver\c$ and launch the console there.

Leave a Reply