After some digging around in the Citrix XenApp SDK, I decided to make my own Citrix XenApp farm monitor: Farm Nanny!

Farm Nanny is a Citrix XenApp farm monitoring application for XenApp 6 and XenApp 6.5 which will help you with troubleshooting, health checks and resource monitoring.

The following features are currently included:

• Citrix XenApp farm servers & status
• Session counter
• Load by server
• Active ICA sessions by server
• Active ICA sessions by farm
• Disconnected ICA sessions by server
• Disconnected ICA sessions by farm
• Logons enabled / disabled by server
• Load evaluator by server
• Zone by server
• Worker Group by server
• Sortable column view
• IP addresses by server
• Available memory by server
• Available diskspace by server
• Server uptime

.NET Framework 3.5 is required, but if you are running XenApp 6 or XenApp 6.5, you are also running Windows 2008 R2 which comes the correct .NET Framework by default.

I need your help to make Farm Nanny even better, so I would really appreciate your opinions, suggestions, error reports and feature requests.

Farm Nanny is free, but if you like Farm Nanny please consider to 

Download Farm Nanny 1.11 here: Farm Nanny

Symantec provides a knowledge base article in which they go into detail on the problem and propose a workaround that creates unique id’s for every client.
You can find more information here: http://www.symantec.com/docs/TECH123419

The workaround and batch file that Symantec uses is a “one size fits all” solution, meaning it will work for SEP 11 and 12 and for 32 and 64 bits.
The environment I was implementing this for uses Windows 2008 R2 and SEP 11 only and I like to standardize all my scripts to PowerShell, so I extracted only the actions I needed and translated them to PowerShell.

A summary of the steps needed to be taken first (the Symantec article outlines them in more detail):

- Disable tamper protection (very important!)
- Stop the Symantec Management Client service by navigating to the Symantec Endpoint Protection installation directory and use the command: smc -stop
- Set the Symantec Management Client service to start manually in the registry: HKLM\SYSTEM\CurrentControlSet\services\SmcService\Start=3

After these changes the Symantec Management Client service can’t contact the Symantec Endpoint Protection Manager automatically anymore.

The following PowerShell script must be configured to run at boottime to change the hardware id and manually start the Symantec Management Client service.

# Change Symantec Endpoint Protection Hardware ID
# Created by Michel Stevelmans - http://www.michelstevelmans.com

# Delete sephwid.xml
Remove-Item "C:\Program Files (x86)\Common Files\Symantec Shared\HWID\sephwid.xml"

# Delete registry entries
reg delete "HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink" /v HardwareID /f /reg:64
reg delete "HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink" /v HostGUID /f /reg:64

# Get the MAC address of the first NIC
$Nics = Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter "IpEnabled = TRUE"
foreach ($Nic in $Nics)
    {
    $Mac = $Nic.MacAddress
    Break
    }

# Remove colons from MAC Address
$Hwid = $Mac.Replace(":", "")

# Add new HardwareID registry entry
reg add "HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink" /v HardwareID /d "00000000000000000000$Hwid" /f /reg:64

# Start Symantec Management Client
Start-Service SmcService

Like I mentioned earlier: This script is for 64-bit with SEP 11, but with the help of the original Symantec article it is very easy to make this work for SEP 12 or 32-bits.

First install all your required language packs on your XenApp or RDS server or if you’re using Citrix Provisioning, install them in your vDisk.

1 . Security groups

Create a separate active directory security group for each language. I’m going to use these groups as conditions in AppSense environment manager and for security filtering on the active directory GPO’s.
So for example create a security group called “Japanese language” and add all Japanese users to this group.

2. Ignore remote keyboard

When a RDP client connects to a remote desktop server, the client’s input language and keyboard settings are detected, which will obviously cause trouble if you want to push language and keyboard settings for your users.
To disable this feature on your remote desktop or Citrix XenApp server, add a DWORD value called IgnoreRemoteKeyboardLayout with a value of 1 under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout.

3. Regional options

Create a separate GPO for all your languages, remove the “Authenticated Users” from the security filtering and add your corresponding active directory security group to each GPO.
Edit each GPO with the regional options you require and make sure to hit F5 on all tabs so that the dotted red line turns into a green line (only settings which have a green line underneath are applied).

4. Display language

Create a node in your AppSense environment manager policy configuration and add the active directory security groups as a user group conditions.
The registry settings for the display language are located under HKEY_CURRENT_USER\Control Panel\Desktop.
Change the language to your required language an export these two values to a reg file: PreferredUILanguages and PreferredUILanguagesPending.
So if you created an AppSense environment manager user group condition for the Japanese active directory security group, import the Japanese reg file underneath that condition.

5. Keyboard layout

The preferred keyboard layout registry key is located under HKEY_CURRENT_USER\Keyboard Layout\Preload.
The string value named 1 is the one you need. The value will be the keyboard code for your country.
So for a Japanese keyboard we need a string valued named 1 with a value of 00000411
For a complete list of keyboard codes, refer to http://support.microsoft.com/kb/262283

6. Geographical location

The geographical location registry key is located under HKEY_CURRENT_USER\Control Panel\International\Geo.
The value of the string value called Nation determines the user’s geographical location.
For a complete list of geographical location values, refer to http://msdn.microsoft.com/en-us/library/ms912039.aspx
Import this registry key in your AppSense environment manager policy configuration.

7. Hide the language bar

If you are going to push all these language en regional settings to your users, you might as well hide the language bar.
To do this, create a DWORD value named ShowStatus with a value of 3 under
HKEY_CURRENT_USER\Software\Microsoft\CTF\LangBar in your AppSense environment manager policy configuration.

8. AppSense personalization desktop settings

Now that we have all settings in place, we have to tweak AppSense personalization.
When you would remove a user from the Japanese security group and add him to another language security group after he has already logged in at least once, you will see some unexpected behavior.
The desktop settings from AppSense personalization will persist some of his old Japanese settings and the user will now have a mixture of language settings.
Connect to your AppSense personalization server, go to desktop settings and uncheck the following: Keyboard, language and locale.

Everything is now configured properly and ready to go!

Especially for users with large screens and large resolutions, this can be a real problem.

If you would change the text size settings when not connected to a remote desktop session, windows changes the corresponding values in the registry under HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics.

I created a simple tool which lets users change their text size in a remote desktop session.
When starting the tool, users will be presented the following options (which are the same as the display settings in control panel):

After selecting the text size, the tool will change the corresponding values in the registry and the user will be prompted to log off. After logging back in, the new text size will be applied.

The tool can be downloaded here: Change Text Size

To personalize the user’s default printer with AppSense Personalization you have to apply a small workaround.

First, make sure the registry key which contains the default printer is added to AppSense session data (or desktop settings if you have an older AppSense version).
Add the following key:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows

Next, we have to make sure printers are not deleted when the user logs off. This can be accomplished by adding a registry key, depending on your version of XenApp.

For XenApp 5 and below:
Add a DWORD value called DefaultPrnFlags with a value of  0×00800000 under HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Print.
Refer to http://support.citrix.com/article/CTX107059 (page 248) for more details.

For XenApp 6 and 6.5:
Add a DWORD value called DisableNetworkPrinterDisconnect with a value of 1 under HKEY_LOCAL_MACHINE\Software\Citrix\Ica\PrintingSettings.
Refer to http://support.citrix.com/article/CTX124885 for more details.

When a user logs off, the Citrix session printers are not deleted and AppSense Personalization will write the registry information to the personalization database.

If you need to personalize additional printer settings (besides only the user’s default printer), you need to add the following registry keys to personalization:
HKEY_CURRENT_USER\Printers
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Devices
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts

I revisited my old list of registry keys and hiving actions and tested them out with AppSense Environment Manager 8.2 on a Windows 7 client machine.
The list below is an overview of the settings that did not persist. Add the registry keys you need to your session data (or desktop settings, if you have an older version of AppSense) to make the setting persist.

Taskbar properties
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2

Taskbar toolbars
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop

Taskbar notifications
HKEY_CURRENT_USER\Software\Classes\Local Settings\
Software\Microsoft\Windows\CurrentVersion\TrayNotify

Windows explorer preview pane
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
Modules\GlobalSettings

Additional clocks
HKEY_CURRENT_USER\Control Panel\TimeDate\AdditionalClocks

Control panel icon size
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel

Network mappings
HKEY_CURRENT_USER\Network

Desktop icon settings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
HideDesktopIcons\NewStartPanel

Microsoft Office user information
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\UserInfo

Autoplay
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
AutoplayHandlers\EventHandlersDefaultSelection
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
AutoplayHandlers\UserChosenExecuteHandlers

Recently used programs
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Windows Explorer Folder View
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\BagMRU
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU
And for 64-bit:
HKEY_CURRENT_USER\Software\Classes\Wow6432Node\Local Settings\
Software\Microsoft\Windows\Shell\Bags
HKEY_CURRENT_USER\Software\Classes\Wow6432Node\Local Settings\
Software\Microsoft\Windows\Shell\BagMRU

Pinned Items
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Startpage2

In addition to the registry keys, the actual pinned items also have to be copied (to the user home drive for example) at logon/log off.
If you have AppSense Environment Manager 8.2 you can use the mirror action for the folders below. If you have an older version of Environment Manager, just use a copy action

%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu
%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

Recent documents
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

In addition to the registry keys, the actual items also have to be copied (to the user home drive for example) at logon/log off.
If you have AppSense Environment Manager 8.2 you can use the mirror action for the folder below. If you have have an older version of Environment Manager, just use a copy action

%AppData%\Microsoft\Windows\Recent

Update 14 december 2011:
Citrix Session Printers can also be personalized with a little workaround which I have described here.

# PowerShell Robocopy script with e-mail notification
# Created by Michel Stevelmans - http://www.michelstevelmans.com

# Change these values
$SourceFolder = "C:\SourceFolder"
$DestinationFolder = "C:\DestinationFolder"
$Logfile = "C:\Robocopy.log"
$EmailFrom = "michel.stevelmans@domain.com"
$EmailTo = "michel.stevelmans@domain.com"
$EmailBody = "Robocopy completed successfully. See attached log file for details"
$EmailSubject = "Robocopy Summary"
$SMTPServer = "smtp.domain.com"
$SMTPPort = "25"

# Copy Folder with Robocopy
Robocopy $SourceFolder $DestinationFolder /E /ZB /R:1 /W:1 /PURGE /LOG:$Logfile /NP

# Send E-mail message with log file attachment
$Message = New-Object Net.Mail.MailMessage($EmailFrom, $EmailTo, $EmailSubject, $EmailBody)
$Attachment = New-Object Net.Mail.Attachment($Logfile, 'text/plain')
$Message.Attachments.Add($Attachment)
$SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, $SMTPPort)
$SMTPClient.Send($Message)

If you want to use gmail, you have to use a different approach because gmail requires authentication, a different port and SSL.
The script below will allow you to let PowerShell use gmail to send the e-mail notification.

# PowerShell Robocopy script with e-mail notification
# Created by Michel Stevelmans - http://www.michelstevelmans.com

# Change these values
$SourceFolder = "C:\SourceFolder"
$DestinationFolder = "C:\DestinationFolder"
$Logfile = "C:\Robocopy.log"
$EmailFrom = "michel.stevelmans@domain.com"
$EmailTo = "michel.stevelmans@domain.com"
$EmailBody = "Robocopy completed successfully. See attached log file for details"
$EmailSubject = "Robocopy Summary"
$Username = "Your.GmailUsername"
$Password = "YourGmailPassword"

# Copy Folder with Robocopy
Robocopy $SourceFolder $DestinationFolder /E /ZB /R:1 /W:1 /PURGE /LOG:$Logfile /NP

# Send E-mail message with log file attachment
$Message = New-Object Net.Mail.MailMessage($EmailFrom, $EmailTo, $EmailSubject, $EmailBody)
$Attachment = New-Object Net.Mail.Attachment($Logfile, 'text/plain')
$Message.Attachments.Add($Attachment)
$SMTPClient = New-Object Net.Mail.SmtpClient("smtp.gmail.com", 587)
$SMTPClient.EnableSsl = $true
$SMTPClient.Credentials = New-Object System.Net.NetworkCredential($Username, $Password);
$SMTPClient.Send($Message)

Let’s start with setting up the AppSense environment manager browser interface.

I chose to install the environment manager browser interface on my personalization server, so the IIS requirement was already met.
Next make sure you install Microsoft .NET Framework 4.0 and then locate the EMBrowserInterface64.msi (or EMBrowserInterface32.msi if you are on a 32-bit system).

The installation is very straightforward and requires you to enter your existing personalization database, database account and authentication method.
To test the environment manager browser interface, point your browser to http://server/EMBrowserInterface and it will display the home page.

The configuration is just as easy. Suppose you want to delegate personalization administration to the active directory group “Personalization Users”.
Open the environment manager console, connect to the personalization database and go to “Access Rights”. Grant the “Personalization Users” group the “Web User” role like the screenshot below.

The next thing you might want to configure is the archiving settings. Log into the environment manager browser interface and go to the “settings” view. (the settings view will only be available to users who have been granted the “administrator” or “Web Administrator” role)

Check everything you want your web users to be able to administer and click the “update settings” button.
Everything is now all set up and ready to go.

For a “1.0 feature”, the AppSense environment manager browser interface works very well. You can’t do advanced tasks such as edit an application’s registry, but that’s not what it is aimed at.
After playing with it for a while I’m finding it actually easier to do basic administration then the full console and it also seems a lot faster to work with as well.

After doing the mandatory research on the whitebox HCL sites, I decided to order the following:

• Intel Core i7 2600 3.40GHz 8MB
• Asus P8H67-V Mainboard (which has integrated VGA)
• Kingston 16gb Memory

At first I wanted to go for a sata-600 raid controller and place 2 sata-600 Western Digital VelociRaptor 10000rpm disks in raid 0. Instead I decided to take the plunge and go for 1 sata-600 Intel SSD, plugged in directly on the Asus onboard sata-600 controller.

Just like my old whitebox, I wanted to run ESXi 5.0 from a 2GB Kingston USB stick.
My co-worker Gabrie van Zanten pointed me to an incredibly easy way of installing ESXi to USB: Create a VM in VMware workstation, mount the ESXi 5.0 iso and connect the USB stick. Choose to install ESXi 5.0 to the USB stick and you’re done.

I connected the USB stick to my new system, enabled VT in the BIOS and booted off the USB stick.
As expected the onboard Atheros AR8151 NIC was not recognized, but no “vmkctl.HostCtlException Unable to load module /usr/lib/vmware/vkmod/vmfs3: Failure” errors which my old ESXi 4.1 whitebox threw when it did not recognize the onboard NIC.
Instead ESXi 5.0 reported that my network adapter was not supported, so I used the Intel Pro/1000 GT adapter from my old whitebox and tried again.
After that ESXi 5.0 booted without problems and has been running stable with 8 servers for several days.

I created a PowerShell script which lists all installed printers and gathers information like the printer name, driver, share name, location and the IP address (the actual IP address, not the portname without the “IP” prefix).

The script outputs all the information to a new Microsoft Excel sheet which looks like this:

Make sure you change the $Printserver value to reflect your print server. By changing this value and running the script on your local workstation, you eliminate the need to install Microsoft Excel on your print server.

# Print server inventory script
# Created by Michel Stevelmans - http://www.michelstevelmans.com

# Set print server name
$Printserver = "PRINTSERVER"

# Create new Excel workbook
$Excel = new-Object -comobject Excel.Application
$Excel.visible = $True
$Excel = $Excel.Workbooks.Add()
$Sheet = $Excel.Worksheets.Item(1)
$Sheet.Cells.Item(1,1) = "Printer Name"
$Sheet.Cells.Item(1,2) = "Location"
$Sheet.Cells.Item(1,3) = "Comment"
$Sheet.Cells.Item(1,4) = "IP Address"
$Sheet.Cells.Item(1,5) = "Driver Name"
$Sheet.Cells.Item(1,6) = "Shared"
$Sheet.Cells.Item(1,7) = "Share Name"
$intRow = 2
$WorkBook = $Sheet.UsedRange
$WorkBook.Font.Bold = $True

# Get printer information
$Printers = Get-WMIObject Win32_Printer -computername $Printserver
foreach ($Printer in $Printers)
{
    $Sheet.Cells.Item($intRow, 1) = $Printer.Name
    $Sheet.Cells.Item($intRow, 2) = $Printer.Location
    $Sheet.Cells.Item($intRow, 3) = $Printer.Comment
    $Ports = Get-WmiObject Win32_TcpIpPrinterPort -computername $Printserver
        foreach ($Port in $Ports)
        {
            if ($Port.Name -eq $Printer.PortName)
            {
            $Sheet.Cells.Item($intRow, 4) = $Port.HostAddress
            }
        }
    $Sheet.Cells.Item($intRow, 5) = $Printer.DriverName
    $Sheet.Cells.Item($intRow, 6) = $Printer.Shared
    $Sheet.Cells.Item($intRow, 7) = $Printer.ShareName
    $intRow = $intRow + 1
}

$WorkBook.EntireColumn.AutoFit()
$intRow = $intRow + 1
$Sheet.Cells.Item($intRow,1).Font.Bold = $True
$Sheet.Cells.Item($intRow,1) = "Print server inventory - Created by Michel Stevelmans - http://www.michelstevelmans.com"