Monthly Archives: November 2016

Deploying a Citrix Cloud – XenApp and XenDesktop Service PoC

The following content is a brief and unofficial overview of how-to front your virtual apps & desktops powered by Citrix Cloud XenApp & XenDesktop Service and the NetScaler Gateway Service using an Azure (IaaS) resource location. The views, opinions and concepts expressed are those by the author of this entry only and do not necessarily conform to industry descriptions, best practises. The views expressed here are my own and do not necessarily reflect the views of Citrix.

Shortened Names
THINWIRE COMPATIBLE MODE – tcm also known as ecm or thinwire+

What is Citrix Cloud?
Firstly this blog post will be updated through-out Nov, Dec 2016 as I still have a few minor additions and adjustments to make but in principle this blog post should help you stand up a Citrix Cloud – XAD Service PoC successfully with your chosen resource location.

Citrix Cloud provides a control plane that includes Citrix technologies as services e.g XenApp and XenDesktop Service that allows Citrix SysAdmin’s to setup, configure and deliver virtual apps & desktops to users on any device, anytime and from any location from your chosen resource location which could be hosts runnings in a data centre running XenServer, Hyper-V, Acropolis*, vSphere vs. hyper-converged appliances (Nutanix*, Atlantis) or it could running in an IaaS or public cloud providers e.g Azure or AWS e.t.c

Your resource location of choice is connected to the Citrix Cloud control plane through something called the Citrix Cloud Connector which is installed onto a supported Windows server OSes that is domain-joined in pairs which runs a services that communicates to the control plane outbound on HTTPS/443 which also has the added benefit of NOT requiring any type of VPN (SSL, R/A or IPSec GRE Tunnel)!

Adopting Citrix Cloud introduces an evergreen or SaaS-style update(s) approach to the Citrix infrastructure components as an example within the XenApp and XenDesktop Service e.g the controller, licensing server, storefront are hosted and managed by Citrix and auto updated (evergreen) thus reducing infrastructure updates, upgrades so IT can focus on other workspace projects e.g implementing Skype for Business – or daily tasks, activities thus reducing System Administration time which equates to cost savings or shifting more IT time onto providing the very best near to local like delivery and user experience as they have more time.

The Goal of this PoC
In this blog post I will describe how-to setup and deploy the “Citrix Cloud – XenApp and XenDesktop Service” using Microsoft Azure as my resource location of choice for this PoC to deliver virtual apps & desktops (Server based) including enabling remote access in its simplest form using the NetScaler Gateway Service which enables secure, remote access to virtual apps & desktops from anywhere with an internet connection using the Citrix Receiver or the HTML5 Receiver all without having to deploy a NetScaler in your resource location – and accesing a published Skype for Business 2015 HDX optimised virtual app powered by the HDX Optimisation Pack 2.x.n – published from a Windows Server 2012 R2 OS server to virtual desktop powered by Windows Server 2016.

Traffic Flows, Metadata & Credential Handling
The following provides insight into the traffic flows when/how users connect to there virtual apps & desktop when using the Citrix Cloud – XenApp and XenDesktop Service.

NetScaler Gateway Service

XAD Service

Comparing services and pricing is available at –

Pre-requisites & System Requirements
0. Trial Checklist – which via the XAD Service eDoc root at –
1. An Azure subscription with sufficient credits and compute resources for your own personal requirements for your own PoC. You’ll also need to understand the concepts of Azure so I’d suggest you begin with reviewing the online documentation available at – or visit VMFocus blog at and scroll to the prepartion text in bold.
2. A Citrix Cloud account with access to the XAD Service check out – for details and information about a trial.
3. Citrix Cloud Connector downloaded from your XAD Service to your Azure resource location onto a shared folder e.g network share on your Windows domain controller or file server. For the basic’s of how-to download and install check out the installation overview at –
4. Download the VDA’s from which is only accessiable once your have sucessfully authenticated at
5. A Windows Server 2012 R2 VM running at a min “Active Directory”, “DNS” and the “Citrix Cloud Connector” and one more VM optional only if you want to keep costs down but preferred to match a real-work scenario would be to have a second Windows Server 2012 R2 VM running the “Citrix Cloud Connector” so that you have a pair of connectors talking to Citrix Cloud.
6. A pair of Windows Server 2012 R2 one to be used for or as a +hosted shared server virtual desktop and the other to deliver virtual apps e.g Skype for Business 2015-16 HDX Optimised Doc’s –, video overview at –
7. A Windows Server 2016 VM to be your second +hosted shared server virtual desktop (Preferred choice for me :-)) so you can demonstrate publishing virtual apps into both +virtual desktops and demonstrate Windows Server 2016 as a DaaS VD or just a show and tell back to your organisations management to begin thinking moving to Windows Server 2016 from 2008 R2 or 2012 R2.

Deploying your Citrix Cloud Connectors
1. Prior to starting your installation please be sure to switch “Enhanced Security Configuration (ESC)” off during the installation.
2. Right-click on the CC Connector and run as Administrator.
3. Enter in your Citrix Cloud Administrator access details and you’ll receive a list of available customer accounts in your case you should only have one so select it and continue.
4. The installation will install the required software components and prior to finishing it will perform “connectivity test” this will take up to 60 seconds.
5. Make some coffee or tea if you’re British or a British South African born while the Citrix Cloud Connector communicates with the Citrix CLoud control plane successfully registers.
6. Navigate to Citrix Cloud select from the menu bar in the top left-hand corner “Identity & Access Management” on the “Domains” tab you should now see your domain with a status of “Ready ” if you see amber anywhere this is because one of your connectors is not in a ready state or you only have 1x connector in your choosen resource location.
7. Don’t proceed until your connector(s) are in a Ready state in Citrix Cloud, this is very important!

Deploy your Virtual Apps & Desktops
1. At select under “Services List” parallel to the “XenApp and XenDesktop Service” click on “Manage” blue button. Note that you can also get to mgmt consoles by clicking the menu icon top left-hand corner and from the list select the service that you wish to administer e.g XAD Service.
2. You’ll now be redirected to and scroll to the bottom of the webpage to identify what your cloud hosted StoreFront server address is e.g, right click and say open in a new tab.
3. Now click on the downwards arrow on “Manage” and you’ll see two options e.g “Service Creation” and “Service Delivery”. Please click on Service Delivery which should take you to and you’ll see the below available options. Simply toggle to select your preferred delivery options for delivery of your virtual apps & desktops choosing in this case to utilise the Citrix Cloud – XAD Service cloud hosted StoreFront and or NetScaler Gateway Service. I will follow-up with another blog post in the future covering off deploying this PoC BUT using StoreFront and NetScaler (Unified) Gateway in your chosen “resource location” BUT for now I am keeping it clean and simple. Please verify that your toggle’s match what you see in the below image prior to proceeding (Also see the 3rd tip!!!). If want to use StoreFront – and NetScaler – in your resource location the read the provided links above.

TIP/HINT 1: You can choose to toggle off “Session Reliability”.
TIP/HINT 2: Where you configure the XAD Controller point this to the Citrix Cloud Connector.
TIP/HINT 3: The NetScaler Gateway Service is sold separately from the XAD Service as of 2017 Q1 ref –

4. Now click on the downwards arrow on “Manage” and now please click on Service Creation which should take you to you’ll notice a spinning icon in the middle of your screen for a few seconds and then your securely hardened Studio console will be avaiable to you published using the latest HTML5 Receiver which includes auto screen resizing dynamically (change the browser window size :-)), copy and paste.
5. Create your “Machine Catalog(s)” as per normal if your unsure then follow the steps as outlined at then return back to Citrix Cloud published Studio. Create three machine catalog’s if following the blog post 1x machine catalog for virtual apps powered by Win Srv 2012 R2, 2x virtual desktops one powered by Win Server 2012 R2 and one by 2016. Once you have created your machine catalog’s then check that the VM within each “Machine Catalog(s)” have a successful Registered State if the VM(s) in your each catalog(s) don’t register then review my quick troubleshooting guidance below at the end of this blog article.
6. Next create a “Delivery Group” almost like normal once agian if your are unsure the how-to is avaiable at – remeber agin if following this blog post 1x delivery group for virtual apps powered by Win Srv 2012 R2 and 2x delivery groups for virtual desktops powered by Win Server 2012 R2 and 2016 BUT there is one very important exception which is that once you select the machines and you get to the user section be very sure to select “⚹Leave user management to Citrix Cloud. This makes the Delivery Group available as an offering when configuring your Citrix Cloud Workspaces.”

6. Now that you have created a Machine Catalog, Delivery Group you need to assign users to these resources so click the menu icon in the top left-hand corner and select “Workspaces“. You’ll see “My First Workspace” just ignore it for now and select the “+ Workspaces” icon it’s large you just cannot miss it! Note that workspaces are now referred service offerings which you assign to users from your Library –
7. Enter in a name for your workspace e.g PoC Workspace.
8. Select “✎ Manage” under your Workspace name and now from the available “Citrix Cloud Services” list select the “XenApp and XenDesktop Service” and you’ll see your delivery group(s) dependant if you completely followed this blog post on the right-hand side so simply select your virtual apps and virtual desktops that you wish to publish to this workspace, it’s your choice but in this PoC we’ll be selecting all avaiable delivery groups to delivery virtual apps & desktops. Once selected click on “Update Workspace” blue button above.
9. Your workspace now contains virtual apps & desktops that can be consumed by subscribers e.g users.
10. Now that you have created your first Workspace e.g PoC Workspace in Citrix Cloud using the XenApp & XenDesktop Service all that is left to do is to add users BUT in a Citrix Cloud world they are known as “subscribers“!
11. Select your e.g PoC Workspace once more and click on “Subscribers” tab and you’ll see a domain list below on your left-hand side so select your “domain” and to your right you’ll see an input field type in your subscriber’s username e.g lynd which will then query your AD via the Citrix Cloud connector securely and it will find and return your user(s) e.g and once it is listed select the user(s) from your query and they will be added to the list below, now repeat the process to add all other test/poc subscribers or AD test/poc security groups to your e.g PoC Workspace and then click on the “Update Workspace” blue button above to save the subscribers to this workspace.

TIP/HINT: You can also select AD Security Groups not just AD users.

Initial Test
Your users/subscribers should now be able to login to the Cloud hosted StoreFront available at e.g using an HTML5 internet browser or Citrix Receiver.

HDX Policies
Please assign your policies as you prefer to users, delivery groups e.t.c. You’ll also notice that I have not applied a FPS limit to every policy only the ones that are balanced as most often these need to adjusted to be fit for purpose for standard office workers to enable user density gains on the backend and bandwidth savings while maintaining a decent and good UX. My personal preference is “HDX Adaptive Display v2“.

HDX Adaptive Display v2 HDX Adaptive Display v2 (Balanced) Thinwire Compatible Mode Thinwire Compatible Mode (Balanced) H.264
1.”Use video codec for compression” then select the option to be “For actively changing regions 1.”Use video codec for compression” then select  “For actively changing regions
2. “Preferred color depth for simple graphics” then select “16 bits per pixel” and also try 24.
1.”Use video codec for compression” then select the option to be “Do not use video codec 1.”Use video codec for compression” then select the option to be “Do not use video codec
2. “Preferred color depth for simple graphics” then select “16 bits per pixel” and also try 24.
3. “Frames Per Second” then enter in a value of “25-30“.
1.”Use video codec for compression” then select the option to be “For the entire screen
2. “Frames Per Second” then enter in a value of “30” (Optional)
My personal preferred choice My 2nd personal preferred choice

Advanced Remote Access using a NetScaler in your Resource Location with(out) StoreFront
The following has been tested using the latest NS firmware 11.1 available in the Azure marketplace as of 05/03/2017.

1. Login to NetScaler admin WebUI using the following firmware 11.1.x.n
2. Check that your appliance is correctly licensed.
3. Select the “Unified Gateway” wizard.
4. Enter in your assigned VIP (private IP addr or in Azure NSIP:8443) and enter in a vServer friendly name e.g myUG
5. Select to “Install Cert” a valid public CA signed cert either *.pfx vs. *.pem.
6. Configure LDAP either use an exciting or add a new server for LDAP auth and choose the “Server Logon Name Attribute” as userPrincipalName .
7. Select “Portal Theme” and select “RfWebUI”
8. Now under the under “Applications” select and add “XenApp/XenDesktop” and now enter in your resource location or Cloud-Hosted StoreFront “FQDN” and select “Test Connection” which should retrieve and auto configure the required settings and thereafter a green bar will appear if successful if not then manually configured based upon the following guidance below.

– Enter in “Site Path” e.g /Citrix/StoreWeb/
– Enter in your Sign Sign-on Domain e.g
– Enter in “Store Name” e.g Store
– Enter in “Secure Ticket Authority (STA) Server” which will be the Citrix Cloud Connector IP addr
– StoreFront server IP Addr:

Option 1 – If using the cloud-hosted StoreFront FQDN e.g https://* then please use the IP addr of the Citrix Cloud Connector in your resource location.
Option 2 – If using a StoreFront server in the resource location please use its IP addr.

9. Do not configure a “Xen Farm” please just select and “Continue” and complete steps to finish the Wizard.
10. The dashboard overview of “Unified Gateway” should indicate all up and green.

Remote PowerShell SDK for the XenApp and XenDesktop Service
Coming but have a read of – in the intermin.

Troubleshooting Guidance
VDA Registration Issue
1. Make sure that forward and reverse DNS is setup correctly for the VDA’s and the CC Connectors.
2. Check that the following Citrix Cloud services “Citrix Remote Broker Provider” and “Citrix Cloud Agent System, Logger & WatchDog“are successfully started on your Citrix Cloud Connector(s) VM instances.
3. Ensure that HTTPS/443 is NOT disabled outbound on any of your CC Connectors either via the Windows Firewall or your hardware or virtual f/w ACL’s.

Setup Pre-Authentication Endpoint Analysis (EPA) Policy with an Azure NetScaler (Unified) Gateway 11.x.n

The following content is a brief and unofficial overview of how-to setup an Endpoint Analysis (EPA) scan of Windows and Mac devices with an Azure NetScaler (Unified) Gateway VPX 11.x.n using Microsoft Azure (ARM). The views, opinions and concepts expressed are those by the author of this entry only and do not necessarily conform to industry descriptions, best practises. The views expressed here are my own and do not necessarily reflect the views of Citrix.

Shortened Names

What is an Pre-Authentication EPA Scan?
Citrix NUG provides an ability to perform and enforce end-point security checks using the NetScaler’s EPA agent which installed onto supported OSes (Windows, OS X) which then sends the results to the NUG to validated against preconfigured “Preauthentication Policy(s)” which check’s if e.g the Windows Firewall enabled? If YESthen the user is allowed to procced to logon page and if NO the user is denied access until all outstanding end-security requirements have been successful meet.

You can create pre-auth policies using Opswat – to check for A/V including min version, precense of exsiting registry entries, file policies and much more so be sure to check out for more in-depth detail.

User Workflow of Pre-Authentication EPA Scans
1. User attempts to login by opening an internet browser e.g Internet Explorer or Google Chrome and navigates to at
2. The user is automatically re-directed to
3. The user will be prompted after 10 seconds if they do not have the EPA agent installed to install it with the download initiating from the NetScaler on
4. The user follows the onscreen instructions to install the EPA agent and after it’s installation the EPA scan begins automatically.
5. The scanned results are sent to the NetScaler at
6. The NetScaler verifies the sent scanned results based upon the pre-auth policy cfg configured in the “Preauthentication Policy(s)” on the NUG and then returns a pass vs. fail to the device. If the device receives a Pass then the user can login with there organisation credentials at – and if its a Fail then the user is redirected automatically to and they should thereafter contact there organisations IT support department with the Case ID presented to the user onscreen to help resolve and validate the end-users required end-point security requirements to be able to login successfully.

The following Image 1 below describes visually the user flow once the end-user has the NetScaler EPA agent installed and a scan is initated if sucessful the user can then attemp to auth against the NetScaler UG and will be presented with various options as configured by the NS & CTX SysAdmins but lets assume they have all three options avaiable to them as part of the NetScaler Unified Gateway offering and the user in this example elect’s to select a virtual desktop from XAD as seen in the Image 2 below.

Image 1

Image 2

Setup Pre-Authentication Policy on your NetScaler 11.x.n+ for a PoC
The following will descirbe’s how-to setup & bound a pre-authentication policy to check the min ClamWin Anti-Virus version installed onto a Windows desktop OS and to check that your Windows Firewall actually ENABLED!

1. Setup your NetScaler Unified Gateway following this detailed Citrix CTX article –
2. Test that you can actually login to your configured NetScal UG and launch a virtual app or desktop or connecting to an internal intranet homepage using the clientless VPN feature prior to proceeding.
3. Go back to the NS Admin WebUi & then navigate to “NetScaler Gateway > Policies > Preauthentication Profiles > Add“.
4. Select “Add” and enter in a name for your policy e.g PreScanPoC and ensure that the “Action” field is set to “ALLOW” then click “Create“.
5. Now in the Expression Editor input field below click on the link entitled “OPSWAT EPA editor“.
6. Now select “Windows” next select “Firewall” then search for and select “Microsoft Windows Firewall” then click on the “+” symbol and configure as follows below:

Version <
Enabled == TRUE
Comment == Microsoft Windows Firewall

7. Next click on “OPSWAT EPA editor” once again & now select “Windows” next select “Antivirus” then search for and select “*YOUR PREFFERD & SUPPORTED ANTI-VIRUS” then click on the “+” symbol and configure as follows below replacing ClamWin Free Antivirus with your *:

Version < 0.99.1
Enabled ==
Comment == ClamWin Free Antivirus

Or if you prefer you could also just copy and paste the following into your expression editor input box “CLIENT.APPLICATION(‘ANTIVIR_177001_VERSION_<=_0.99.1[COMMENT: ClamWin Free Antivirus]') EXISTS && CLIENT.APPLICATION('FIREWALL_6015_ENABLED_==_TRUE[COMMENT: Microsoft Windows Firewall]') EXISTS” or if you only want to configure the pre-auth policy to just detect if your MS Windows Firewall is disabled and deny access then copy and paste the folllwing into the expression editor input box “CLIENT.APPLICATION(‘FIREWALL_6015_ENABLED_==_TRUE[COMMENT: Microsoft Windows Firewall]’) EXISTS“.

8. Once you have finished your inputs then select “Ok“.
9. Now click on the “Action” drop down above and select “Global Bindings“, next select the “pencil icon” and select your created policy e.g “PreScanPoC” as described eariler, once you return back to the Policy Binding view select “Bind” and click “Close”.
10. Now using the menu on the left-hand side navigate to “NetScaler Gateway > Virtual Servers” and select your Unified Gateway configuration and select “Edit”.
11. Scroll to the bottom and look for the “Policies” section and click on the “+” symbol.
12. Next from the “Choose Policy*” drop down list select “Preauthentication” and the “Choose Type*” default should be “Request” and then click on “Continue“.
13. Parallel to “Select Policy*” select the “” then select your Preauthentication Policy e.g “PreScanPoC“.
14. Select “Bind” then click on “Close”.
15. Click on “Done” and now you have setup & configured your first pre-authentication Endpoint Analysis (EPA) policy against your NetScaler Unified Gateway configurtion of your Azure NetScaler (Unified) Gateway 11.x.n VPX.
16. Naviagte to your FQDN e.g and attempt to sign-in and you’ll notice it will prompt you to install the EPA agent and thereafter automatically initate the EPA scan which will either allow or deny your access e.g turn your Windows f/w on an off to test how the EPA scanning works.

As I only have a Windows laptop my suggusted troubleshooting is only relevant to Windows OSes.

1. On Windows click Start -> Run -> enter in “%localappdata%\Citrix\AGEE\” once Windows Explorer opens the window you can open and review each file for errors however in most cases I would sugguest if you are just trying to get an EPA scan to work based upon this blog article then copy and paste the Windows f/w expression only.

Citrix NetScaler How-to Guides
The follow guides and more can be found at the NetScaler Developer Community webpage – which also includes how-to guides for HDX Framehawk, GSLB, L/B DNS traffic and much much more. The below guides are purely focused on configuriung pre-authentication scans on your NUG prior to allowing to attempt to login.

1. How do I configure EPA for Registery Check –
2. How do I configure EPA for Symantec Antivirus Check –
3. How do I configure EPA for Windows Update Check –

Top 10 Suggested Unified Experience Tips for Citrix Users 2016

The views expressed here are my own and do not necessarily reflect the views of Citrix.

Shortened Names
THINWIRE COMPATIBLE MODE – tcm also known as ecm or thinwire+

Suggested Top 10 for 2016
This is numbered 1 through 10 but in reality is in no particular order!

1. E-mail discovery for Citrix Receiver using DNS SRV records – internally and externally on the Gateway –
2. Implement SplitDNS or more technically correct “split-horizon DNS” – my favourite personally over email based discovery :-)!
3. Brand your NetScalers (Unified) Gateway – and App Store (StoreFront) – to match and keep it clear, clean and simple!

4. Implement HDX Adaptive Display v2 available in 7.11+ – as your default Graphics Mode and if you can’t then Thinwire Compatible Mode –

5. If using Skype for Business 2015 or 2016 implement the HDX RealTime Optimisation Pack 2.x.n to offload the video/audio to the local end-points (Windows, Mac and Linux) saving on backend compute and density loss for XenApp.*

6. Implement domain pass-through for internal users –
7. Deploy the (latest) HTML5 Receiver for remote access –

8. When using Citrix Receiver for Windows (with HDX engine 14.4), the GPU can be used for H.264 decoding wherever it is available at the client –
9. Deploy Self-Service Password Reset (SSPR) –

10. The most difficult to justify probably re the cost(s) but assigning a low end vGPU GRID profile or utilising the Intel Iris Pro Graphics with XenServer 7 to provide enough/suitable GPU capacity to all virtual apps & desktops (oldISH and modern) provides a much better experience so setup a PoC to see and try if for yourself and finally NVidia now supports H.264 offloading onto there GRID Cards in 7.11 🙂 –