Removing New Profile First Run Items for XenApp, RDS and Terminal Server with GPO

Having deployed numerous Citrix XenApp and Microsoft RDS over the past few years, I’ve found that I constantly refer to my notes for removing new profile first run items and seeing how I haven’t written a blog post for this year, I figured I’d write one now so I can refer my colleagues to it.

Several add-ons are ready for use

There are two ways to disable the Several add-ons are ready for use prompt when Internet Explorer is first launched:

\

The first is to edit the local policy of the server by running gpedit.msc and navigate to:

Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Automatically activate newly installed add-ons

… or:

User Configuration > Administrative Templates > Windows Components > Internet Explorer > Automatically activate newly installed add-ons

Note that both would provide the same result but I prefer using the Computer Configuration because it is applied to the computer rather than the User Configuration which is applied to each user’s profile.

Enable the configuration:

If using a local computer policy is not acceptable, this could be configured using a GPO to modify the following registry key:

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Ext

IgnoreFrameApprovalCheck = 1

Protected mode is turned off for the local intranet zone.

To disable the Protected mode is turned off for the Local intranet zone. message:

… create a new DWORD registry key named NoProtectedModeBanner with a value of 1 at the following location:

HKCU\Software\Microsoft\Internet Explorer\Main

Refer to my previous blog post for more detail:

Notes on Security Banner and IE Settings for Citrix XenApp servers
http://terenceluk.blogspot.com/2013/09/notes-on-security-banner-and-ie.html

Set up Internet Explorer 11

To disable the Set up Internet Explorer 11 prompt:

Create a GPO and enable the following User or Computer Configuration setting:

Administrative Templates > Windows Components > Internet Explorer

Then enable the following setting:

Prevent performance of First Run Customize settings

Office 2013 First Run

To get rid of the First things first. Office 2013 first run prompt:

… load the Office 2013 ADM or ADMX templates and navigate to:

User Configuration > Policies > Administrative Templates > Microsoft Office 2013 > Privacy > Trust Center

Then enable the following setting:

Disable Opt-in Wizard on first run

Welcome to your new Office

To disable the Welcome to your new Office prompt:

… load the Office 2013 ADM or ADMX templates and navigate to:

User Configuration > Policies > Administrative Templates > Microsoft Office 2013 > First Run 

Then enable the following setting:

Disable First Run Movie

Enable the following setting as well:

Disable Office First Run on application boot

Outlook 2013 Cached Exchange Mode

XenApp and RDS servers more often than not operate Outlook in non-cached mode so to ensure that this is disabled, load the Office 2013 ADM or ADMX templates and navigate to:

User Configuration > Policies > Administrative Templates > Microsoft Outlook 2013 > Account Settings > Exchange > Cached Exchange Mode

Then disable the following setting:

Cached Exchange Mode (File | Cached Exchange Mode)

Proceed and also disable the following setting:

Use Cached Exchange Mode for new and existing Outlook profiles

Remove Add Account Citrix Receiver

To remove the Add Account Citrix Receiver prompt for new profiles:

… use the following Citrix KB:

http://support.citrix.com/article/CTX135438

Method 3

Change Registry values post installation to suppress the Add Account window.

1. Under HKLM\Software\Citrix\Dazzle, set AllowAddStore value to N.
   Note: On 64-bit machines, use HKLM\Software\WOW6432Node\Citrix\Dazzle.
2. Restart Citrix Receiver for Windows to apply the new Registry value.

Welcome to Microsoft Office 2010

To disable the Welcome to Microsoft Office 2010 prompt:

… load the Office 2010 ADM or ADMX templates and navigate to:

User Configuration > Policies > Administrative Templates > Microsoft Office 2010 > Miscellaneous 

Then enable the following setting:

Suppress recommended settings dialog

Outlook 2010 Cached Exchange Mode

XenApp and RDS servers more often than not operate Outlook in non-cached mode so to ensure that this is disabled, load the Office 2010 ADM or ADMX templates and navigate to:

User Configuration > Policies > Administrative Templates > Microsoft Outlook 2010 > Account Settings > Exchange > Cachced Exchange Mode

Then disable the following setting:

Cached Exchange Mode (File | Cached Exchange Mode)

Outlook 2010 Do not prompt user to create new profile

If you do not want users to be prompted with the wizard to create their Outlook profile, navigate to:

User Configuration > Policies > Administrative Templates > Microsoft Outlook 2010 > Account Settings > Exchange

Then enable the following setting:

Automatically configure profile based on Active Directory Primary SMTP address

Configuring for Google Earth Pro Direct X mode with Citrix XenDesktop 5.6

It has been awhile since I’ve had to work with a XenDesktop 5.6 as most of the clients I work with have upgraded to 7 but I received a request today to look into why Direct X mode did not work for a new Google Earth Pro installed.  The client told me that they followed the instructions from one of my previous blog posts:

Updated: Starting Google Earth on Citrix XenDesktop 5.6 virtual desktop prompts the message: ‘DirectX’ mode not supported
http://terenceluk.blogspot.co.uk/2014/02/updated-starting-google-earth-on-citrix.html

… but wasn’t able to get Google Earth Pro to start in Direct X mode:

‘DirectX’ mode not supported

The first thought that crossed my mind was that I’ve actually never configured the HDX Optimization Pack for Google Earth for Google Earth Pro so I sort of figured the instructions I had in my blog post probably wasn’t complete.  After an hour of verifying that the d3d9.dll file was copied into the folders for an Google Earth install, I discovered that the following folder also needs the file:

C:\Program Files (x86)\Google\Google Earth Pro\alchemy\ogles20

I was able to start Google Earth Pro in Direct X mode as soon as I copied the d3d9.dll file into the folder.

The version of Google Earth Pro I tested this with is 7.1.2.2041:

Attaching Microsoft Project 2010 and Visio 2010 AppStacks to a virtual machine causes applications to display the message: “Microsoft Office cannot verify the license for this product. You should repair the Office program by using Control Panel.”

Problem

You have installed Office 2010 directly onto your base virtual machine master image then continue to create two separate AppStacks in VMware App Volumes.  With the AppStacks created, you proceed with assigning Microsoft Project 2010 to a VMware Horizon View VDI but notice that the following error message is presented when you try to launch Project 2010 or Visio 2010:

Microsoft Office cannot verify the license for this product. You should repair the Office program by using Control Panel.

Attempting to launch word no longer works either:

Unassigning either the Visio 2010 or Project 2010 AppStack removes the error.

Solution

As per the VMware App Volumes User’s Guide (https://www.vmware.com/pdf/app-volumes-26-users-guide.pdf) on page 47:

There are strict guidelines on how many AppStack with Office components can be attached at a time:

App Volumes with Microsoft Office 11

App Volumes supports KMS based licensing for Office. As result, MLF ISO media (available from the Microsoft Volume Licensing Service Center) must be used. KMS server/license details can be added during the provisioning process (by running ospp.vbs with appropriate options), or the default KMS discovery process will be used along with the default KMS license keys typically embedded in MLF ISO media.

The entire suite of Microsoft Office applications stores its product and license information in a common data file. No special user interaction is required and this process is completely seamless to the user. All product information is stored in a single data file. The following limitations exist:

To deliver Office applications via App Volumes, all Office applications must be in a single AppStack.
Note: Use Windows 2008 R2 based RDSH for best functionality results.

Note: To ensure search works with Outlook across different virtual machines, disable the "Windows Search" service. Email search will still work with the service disabled.

Only one AppStack with Office components can be attached at a time. However it can be
used in many different configurations.

Example 1: Office in the base, and Visio as an AppStack
Example 2: Office in the base, and Project as an AppStack
Example 3: Office in the base, and Visio AND Project together as one AppStack
Example 4: Office and Visio in the base, and Project as an AppStack
Example 5: Office and Project in the base, and Visio as an AppStack
Example 6: Office, Visio, and Project as ONE AppStack

Hope this helps anyone who may come across this issue.

Configuring Citrix NetScaler VPX to publish StoreFront services for Citrix Receiver, Android and Apple device access

One of the questions I get asked quite often is how to properly configure the NetScaler to publish StoreFront services for Citrix Receiver, Android and Apple device access so I thought I’d write a quick blog post demonstrating this.

Before you begin, it is important to be aware that Android and Apple devices are very sensitive to the certificate presented by the NetScaler and what I’ve found most times is that while it may seem you are presented with the option to accept an untrusted certificate, attempting to launch an application would fail with various errors.  If you are not familiar with linking certificates, please see the following blog post:

Android and Apple devices is presented with an “Invalid Server Certificate” warning and are unable to launch applications published through a NetScaler VPX
http://terenceluk.blogspot.com/2015/04/android-and-apple-devices-is-presented.html

Begin by creating a new Session Profile for Citrix Receiver access:

The settings for the Network Configuration tab would look as such:

The Client Experience tab would be configured as such:

The Security tab would be configured as such:

The Published Applications tab would be configured as such:

Note that the Web Interface Address should point to the Store URL which does not end with a “Web” for the URL.

With the Session Profile created proceed to the Session Policies tab and create a new policy and select the Session Profile that was created earlier:

Note that the Expression used is:

REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver

**More information about expressions can be found at the following Citrix documentation:

Configuring Session Policies and Profiles for CloudGateway
http://support.citrix.com/proddocs/topic/access-gateway-10/agee-clg-session-policies-overview-con.html

Complete the configuration by binding the new Session Policy to the Virtual Server:

Note that the Priority does not matter because the Expression does not actually overlap.

You should now be able to access StoreFront resources via the Citrix Receiver, Android or Apple devices.

Attempting to commit changes to new Windows Server 2012 R2 server throws the error: “STATUS_SUCCESS”

Problem

You’ve deployed a new Windows Server 2012 R2 KMS server and completed configuring a KMS host key in the Volume Activation Tools wizard:

You proceed to commit the changes:

… but receive the following error:

The following error has occurred. Please resolve the error and try again.

Description:

STATUS_SUCCESS

Solution

The reason why this error is thrown is because the default value for the KMS TCP listening port is specified with the value of 0:

To correct the issue, change the value to the default 1688 KMS port as such:

Proceeding to commit the changes will be successful once the port is defined:

Once the wizard completes, ensure that the KMS server is activated properly by executing the following command:

slmgr.vbs /dlv

To verify that the VLMCS DNS record is published, use the following command:

nslookup -type=srv _vlmcs._tcp.<yourDomain>.com

If you notice that a VLMCS record is not created, you can either manually create the record as such:

… or configure the proper permissions if you notice an error logged in the applications logs similar to the following:

Log Name: Application

Source: Security-SPP

Event ID: 12293

Level: Error

Publishing the Key Management Service (KMS) to DNS in the 'tokiomillennium.com' domain failed.

Info:

0x8007232D

Attempting to activate an Active Directory-Based Activation throws the error: “Access is denied.”

Problem

You attempt to activate a new Windows Server 2012 R2 KMS server as an Active Directory-Based Activation:

… but receive the following error:

The following error has occurred. Please resolve the error and try again.

Description:

Access is denied.

Solution

The reason this error is presented is because the KMS server is not a domain controller.  The following TechNet article describes the requirements for setting up an an Active Directory-Based Activation KMS server:

Activate using Active Directory-based activation
https://technet.microsoft.com/en-us/library/dn613828.aspx