How to determine the master image of a Machine Catalog in Citrix Virtual Apps and Desktops / Citrix DaaS

While not very frequent, some of my ex-colleagues ask me would ask me about Citrix Virtual Apps and Desktops from time to time and one of the most common question is how to determine the master image of a Machine Catalog in Citrix Virtual Apps and Desktops / DaaS because there still does not seem to be a way to find this information from the GUI. Those who are familiar with the Citrix portal will be aware of the Template Properties tab shown here:

… and while it displays what snapshot the master image virtual machine for this machine catalogue is currently using, it does not indicate the VM name. This appears to have been by-design since the Citrix XenDesktop 5.6 days as shown in one of my older posts here:

How do I find what master image I used for a desktop catalog in Citrix XenDesktop 5.6?
http://terenceluk.blogspot.com/2012/04/how-do-i-find-what-master-image-i-used.html

It was easy to load the PowerShell directly on a Delivery Controller back in the on-premise days but most of the environments I’ve worked in over the past few years has been in Citrix Cloud, which means you’ll need to install the Citrix SDK to remotely connect to Citrix cloud.

Given that I haven’t really written a post on this and I often struggle to remember, this serves as a short write up that I can refer to in the future.

The Virtual Apps and Desktops Remote PowerShell SDK can be downloaded here:

Virtual Apps and Desktops Remote PowerShell SDK
https://www.citrix.com/downloads/citrix-cloud/product-software/xenapp-and-xendesktop-service.html

Once installed, launce PowerShell and execute the following command to add the Citrix PowerShell snapins:

asnp citrix*.

Use the following cmdlet to authenticate against Citrix Cloud (a browser popup with a prompt similar to https://citrix.cloud.com will be displayed):

Get-XDAuthentication

After successfully authenticating, you can use the cmdlet Get-ProvScheme to list all of the Machine Catalogs for the tenant or narrow it down by using the ProvisioningSchemeName to reference the machine catalog you want the details for:

Get-ProvScheme -ProvisioningSchemeName “Machine catalog name”

The screen shot below is a sample output and the field we’re interested in is the MasterImageVM with the following output:

MasterImageVM: XDHyp:\HostingUnits\CC Nimble\CTX-CMComApp-CC.vm\CTX-CMComApp-CC Post Vendor Upgrade

07-11-19.snapshot\Post Vendor Upgrade 08-04-20.snapshot\Updated July 28

2021.snapshot\CTX-CMComApp-CC_vm-3432_1.snapshot\Vendor Update July 4 2022.snapshot

The value ending with .vm represents the virtual machine name and in this example the VM is named:

CTX-CMComApp-CC

If there are multiple vCenters in the environment, the vCenter hosting the VM can be found via the GUI by navigating into the configured resource:

Hope this helps anyone looking for this information.

Attempting to log into a Citrix ADC / NetScaler Gateway portal with Duo configured as MFA fails with: "Additional Information Required Please type your response below"

I recently had to perform routine patching of various Citrix ADC / NetScalers to ensure that they are up-to-date with the latest NS13.1 17.42.nc build (released Feb 23, 2022) and one HA pair in particular displayed the following message when the expected Duo MFA authentication prompt was supposed to be displayed:

Additional Information Required

Please type your response below

Attempting to enter your passcode or other information into the prompt leads to an authentication failure.

Searching on the internet displays the following Duo KB:

Why do I see the Citrix Gateway or Netscaler error "Additional Information Required" during Duo authentication?
https://help.duo.com/s/article/3506?language=en_US

… which did not apply for my situation and other forum posts suggest that the theme configured for the gateway was the culprit and that did not apply for this appliance either. What I ended up having to do was downgrade from the updated firmware:

NS13.1 17.42.nc

… back down to:

NS13.1 12.50.nc

Then I opened up a ticket with Duo and the response I received was the following:

Hi Terence,

Thanks for getting back to me.
As per the docs here:
https://duo.com/docs/citrix-netscaler
If you have Citrix Gateway build 12.1-51.16 or later with an "Advanced" or "Premium" edition license, or Citrix Gateway build 13.0-67.x or later with "Standard", "Advanced", or "Premium" edition license, try adding Duo 2FA with nFactor.
After updating past 13, you must use the nfactor version of the integration.
This involves one single change in the proxy.
the line that is:
[radius_server_iframe]
type=citrix_netscaler
will become:
[radius_server_iframe]
type=citrix_netscaler_rfwebui

The way the Citrix ADC / NetScaler is configured to integrate with Duo is as shown in the following Duo document:

Duo for Citrix Gateway Basic Primary Authentication
https://duo.com/docs/citrix-netscaler#:~:text=Log%20in%20to%20the%20Duo,information%20to%20complete%20your%20setup.

I’ve seen other methods such as configuring Duo as:

Duo for Citrix Gateway - Basic Secondary Authentication Instructions
https://duo.com/docs/citrix-netscaler-alt

… and the nFactor method as the support engineer provided but noticed that the nFactor article indicates that it suggests to “try” so I did not realize it was mandatory. I asked the support engineer to clarify this and the response I receive was:

Hi Terence,

Thanks for getting back to me.
You are not wrong, the wording is definitely ambiguous.
However in all the previous cases with this exact issue I have seen, I’m confident in the solution, given I know it works.
I suspect it was worded this way as there is some overlap where both will actually work for various versions/license editions, however given your experience you do not seem to be in the overlap given it is not working.
Please follow through and make the change and I expect the issue will be resolved.
Please let me know if this helps.
Have a great day!
Kind regards,

Raphael

I haven’t actually tried switching over the nFactor yet but will do so and update this post in the future. Hope this helps anyone who may encounter the same issue as I have.

Generating a network trace capture and analyzing with Microsoft Network Monitor

An ex-colleague recently reached out to me for assistance on how he could perform a network trace and analyze it for a particular Citrix Virtual Apps and Desktop environment and the most common tool I usually recommend is Wireshark. The challenge he had was that the Wireshark installation would error out during the NCAP install so attempting to use that tool was not a viable option.

My ex-colleague’s challenge lead me to remember another method I had used in the past (probably more than 5 years ago) where we could use the native netsh trace command to capture an ETL file without requiring any software installation and after successfully testing the process, I thought I’d write a blog post to demonstrate it.

Creating a network trace capture file on the virtual desktop

1. On the VDI, launch the command prompt in administrator mode and start a trace with the following command:

netsh trace start capture=yes tracefile=c:\net.etl persistent=yes maxsize=4096

2. Replicate issue, note the time stamp, and stop trace with the following command:

netsh trace stop

Analyzing the network trace

1. Download and install Microsoft Network Monitor: https://www.microsoft.com/en-in/download/details.aspx?id=4865

1. Launch Microsoft Network Monitor and open the ETL file:

1. Click Tools > Options:

Navigate to Parser Profiles tab, right click on Windows and click Set as Active:

Drill down to the NDISPacCap node:

For the purpose of this demonstration, we’ll be searching for an SMB path that contains the string college.

Click on Load Filter > Standard Filters > SMB > SmbFileName:

Update the string to look up and click Apply:

Hope this helps anyone who may be looking for a alternative method for capturing network traffic and analyzing it in an environment that may not have Wireshark available.

Releasing NVIDIA RTX Virtual Workstation License(s) on the License Server Manager

One of the frequent questions I’ve been asked in the past for VDI deployments that are accelerated with NVIDIA GPU GRID cards is how we can release assigned licenses to VDIs that no longer exist. Scenarios that can cause this is if a set of virtual desktops were deployed but then had to get redeployed the same evening because of a required change in configuration (I had to do this once when I needed to change the GPU memory allocation for the desktops).

Failure to have sufficient licenses for the VDIs will display the following message upon logging into the virtual desktop:

Failed to acquire NVIDIA license.

Failed to acquire NVIDIA RTX Virtual Workstation license. Click here for more information.

The short answer is that there isn’t a way to do this via the on-premise license server, command line or the NVIDIA Application Hub, and the recommended method is to either reduce the lease time for the license or completely remove all the licenses allocated to the desktops.

The steps to modify the lease time are as follows:

1. Log onto the VDI master image
2. Open the registry editor and browse to HKEY_LOCAL_MACHINE\SOFTWARE\NVIDIA Corporation\Global\GridLicensing
3. Edit the LicenseInterval DWord (REG_DWORD) and configure the interval time that represents how long the license lease is valid for

The integer configured should be within the range 10-10080 that specifies the period of time in minutes for which a license can be borrowed after it is checked out. After this period has elapsed, the client must obtain a new license from the server.
The default is 1440 minutes, which corresponds to a period of 1 day. The value can be reduce to an hour so a new license would be reissued.

The environment I was working with already had the lease time configured to be a day (default) and further reducing it was not ideal in case we ever had a license server failure so I opted to use the 2^nd method, which was to completely remove all the licenses allocated to the desktops so new ones would be issued. It is worth noting that I was told by the NVIDIA support engineer that this does not adversely affect the VDIs currently in use so it can be performed during regular hours.

The following are the steps:

1. Begin by logging into the NVIDIA Application Hub via the URL: https://nvid.nvidia.com/dashboard/

2. Select NVIDIA LICENSING PORTAL:

3. Navigate to LICENSE SERVERS, expand the License Server node and click on Download:

4. The license file representing the licenses will be downloaded:

5. On the on-premise NVIDIA licensing server, stop FlexNet License Server - nvidia service:

6. Navigate to the path: C:\Windows\ServiceProfiles\NetworkService\flexnetls\:

7. Rename the nvidia folder to nvidia-old:

8. Start FlexNet License Server - nvidia service:

9. Open the license portal on the on-premise NVIDIA license server, navigate to License Management, ensure that the server is up, and the following error message is NOT present:

Connection error: Please make sure the FNE server is up and running

10. Confirm that the nvidia folder previously renamed has been recreated:

11. Confirm that there are no licensed clients listed:

12. With the server services up, proceed to upload the previously downloaded license file (.bin):

13. Confirm that the message Successfully applied license file to the license server. is displayed:

14. Navigating back to the Licensed Clients window should initially show an empty list and then new clients being listed:

Enable Security Authentication for NVIDIA License Server Manager

Those who have worked with the NVIDIA License Server Manager that is deployed to provide virtual desktops with GPU licenses will quickly notice that the default install does not provide any security for the management console as navigating to the URL: http://localhost:8080/licserver/ will bring you straight into the console without authentication. Given that I’ve been asked many times in the past about securing this portal, this post serves to demonstrate the process.

Enabling the requirement for logging in as shown in the screenshot below cannot be done via the GUI:

To enable the authentication requirement, we’ll need to use the nvidialsadmin.bat via the command line. The nvidialsadmin.bat can be found in the directory C:\NVIDIA\LicenseServer\enterprise on the licensing server:

Enable Security for the NVIDIA License Server Manager

1. Begin by launching a command prompt as an administrator and navigating to the directory: C:\NVIDIA\LicenseServer\enterprise

2. Execute the following command to set the security flag as true:

nvidialsadmin.bat -server http://127.0.0.1:7070 -config -set security.enabled=true

3. Next, execute the following command with the default password for the admin account (Admin@123) and set the new password (Update the New-Password1 value to the password desired):

nvidialsadmin.bat -server http://127.0.0.1:7070 -authorize admin Admin@123 -users -edit admin New-Password1

4. Proceed to restart the Apache Tomcat 9.0 Tomcat9 service in the services console on the license server:

5. Wait for the license server to be fully started then try to navigate to the console at http://localhost:8080/licserver/ to verify that credentials are required:

Disable Security for the NVIDIA License Server Manager

1. To disable the security login requirement execute the following command with the configured password to authorize the session:

nvidialsadmin -server http://127.0.0.1:7070 -authorize admin New-Password1

2. Then set the security flag to false:

nvidialsadmin.bat -server http://127.0.0.1:7070 -authorize admin New-Password -config -set security.enabled=false

3. Proceed to restart the Apache Tomcat 9.0 Tomcat9 service in the services console on the license server:

4. Wait for the license server to be fully started then try to navigate to the console at http://localhost:8080/licserver/ to verify that credentials are no longer required.

Citrix Virtual Apps and Desktops Machine Catalog displaying "Power State" as "Unknown"

Problem

You have a Citrix Virtual Apps and Desktops environment hosted with Citrix Cloud Connectors connecting to Citrix cloud and noticed that the management portal displays virtual machines in a machine catalog with the Power State as Unknown:

This appears to only affect machines hosted by a specific vCenter because virtual desktops hosted on a different vCenter displays the Power State properly. Monitoring the VDIs also indicate that users are not able to connect to them.

Solution

A quick search on the internet will only return the following Citrix KB that refers to an on-premise deployment without Citrix Cloud connectors:

VM's Power State Does Not Update And Shows As "Unknown" After vCenter Server Reboots
https://support.citrix.com/article/CTX238157

Although not stated in the KB, the issue can be resolved by turning off and turning On the Maintenance mode for the vCenter connection as such:

Determining a Machine Catalog's master image, snapshot and VMware vSphere datacenter with PowerShelll for Citrix Virtual Apps and Desktops

One of the most common administration questions I get asked for Citrix Virtual Apps and Desktops is how to determine the master image currently being used for a Machine Catalog. Those familiar with the Web Studio will be familiar that you can select the Machine Catalog in the administration console:

Then click on the Template Properties tab, then review the name under Disk Image to determine the snapshot being used. In the example below, the snapshot being used is named Citrix_XD_Dev Desktops. However, this does not tell the administrator the actual virtual machine name that is being used:

To retrieve the details of the master image currently being used for the Machine Catalog, launch the PowerShell console and connect to Citrix Cloud with:

asnp citrix*

Get-XDAuthentication

Then proceed to use the follow cmdlet to display the details of the Machine Catalog:

Get-ProvScheme -ProvisioningSchemeName "Dev Desktops"

**We have used the Dev Desktops as the Machine Catalog for this example.

The virtual machine used for the machine catalog is provided in the MasterImageVM setting:

MasterImageVM : XDHyp:\HostingUnits\WorkspaceSTG\MasterImage Feb 2020 v1.vm\Citrix_XD_Dev Desktops.snapshot

With the details of the virtual machine determined, we can look for the VMware vSphere datacenter it is located in by further drilling into the details of the virtual machine by using the CD command as such:

CD "XDHyp:\HostingUnits\WorkspaceSTG\MasterImage Feb 2020 v1.vm"

Then use the DIR command to list the details:

The setting that provides the datacenter is ObjectPath:

ObjectPath: /TechHall.datacenter/Desktops.cluster/MasterImage Feb 2020 v1.vm/Citrix_XD_Dev Desktops.snapshot

The datacenter in this example is named TechHall.

Hope this helps anyone looking for how to retrieve the details of a machine catalog within Citrix Virtual Apps and Desktops.

Duo MFA login prompt does not show up after successfully authenticating username and password with Citrix ADC / NetScaler Citrix Gateway

Problem

You’ve completed configuring a Citrix Gateway with Duo MFA as described in the following configuration documentation:

Duo for Citrix Gateway Basic Primary Authentication
https://duo.com/docs/citrix-netscaler

However, you notice that authenticating through the portal does not display the Duo 2FA prompt as expected:

Note how only a field labeled as Password is displayed:

It should be noticed that entering the passcode from the Duo mobile app would successfully authenticate the identity but the following expected Duo login prompt is the desired outcome:

Solution

One of the common reasons why this behavior would be exhibited is if the portal them RFWebUI is selected (this the default theme in later versions of Citrix ADM / NetScalers) and the quick way to see if this is causing an issue is to switch the them to X1 as shown below:

However, the better solution is to refer to the following KB:

Is the Citrix Gateway RFWebUI theme compatible with Duo?
https://help.duo.com/s/article/3755?language=en_US

Which will refer to the complete instructions for information on how to configure the RFWebUI theme with Duo: https://duo.com/docs/citrix-netscaler#configure-the-proxy-for-your-citrix-gateway

Prior to implementing the configuration, verify that the requirements of having the Citrix ADC / NetScaler and Authentication Proxy at a certain version is met:

citrix_netscaler - Use citrix_netscaler when with the Default, Green Bubbles, or X1 themes.

citrix_netscaler_rfwebui - Use citrix_netscaler_rfwebui with the RFWebUI theme. Requires Authentication Proxy v3.1.0 and NS build 12.1-51.16 or later.