Citrix and SHA2

SHA2 and why do I care?

Time to update those statements of support for your users and customers.  With the move to the more secure certificate algorithm SHA2, things are breaking all over the place.  First off, Microsoft and the Cert powers that be have declared that Certs that expire on or after 1/1/17 must be SHA2.  So if you are picking up a new cert with a 2 year life it will be SHA2.  What does that mean to me, you ask?

• Web Interface will not take your new cert.  
• Citrix Secure Gateway will not work with your new cert.
• Your 11.x or older Citrix recviever does not work

Web Interface:

I know you've been putting off that Storefront migration, but it is time to get it on the books.  You can buy some time if you offload SSL (and your cert) to your Netscaler or other load balancer of choice.

Secure Gateway

It's time to put your SG out of it's misery.  Netscaler VPX is your go-to replacement.

11.x and older Citrix Client

If it connects via SSL you need to upgrade.  If you are at Vista + for your OS, download and install the latest Citrix client.  If you have an older OS, first, shame on you.  Second, the last of the 12.x clients is what you want.  Modern clients are not tested on XP and can be rather inconsistent.

If you are a thin client shop and you protect your connections via SSL, it's time to update that firmware if you can.  I haven't found a lot of vendor "statement of support" type documents, but if you Linux or Windows TCs have a modern (Vista+ OS) and a receiver in the 12.x land, you should be ok.  The various vendors with "ThinOS" products will need to either declare support or issue an updated firmware.

Other Gotchas

Citrix will tell you that you can get a cert today with the old SHA1 and run with your legacy stuff a while longer, which is true but with a massive caveat.  For the older clients to work your entire certificate chain must be SHA1.  If your cert and the root cert are SHA1 and an intermediate cert is SHA2, you are not going to work.  I have seen this and it is not pretty.  The name of the Cert listed in the error will be the first cert in your chain that is SHA2.

Error Text:

Unable to launch your application. Contact your help desk with the following information: Cannot connect to the Citrix Xenapp server. SSL Error 61: You have chosen not to trust "<CERTNAME>", the issue of this server's security certificate.

Happy Certing..

Teaching the XenApp 6.5 Servers to Reboot Themselves

As sleep is a commodity that I have been trying to bank, but all my customers want their servers to reboot at night.  If only there was a way to create an unholy combination of PowerCLI and Citrix Powershell commandlets that could do the work while I sleep.  This needs to be run from a box with both Citrix and PowerCli installed of course and you will need to sub in the IP of your Vcenter server.

asnp Citrix*
Add-PsSnapin VMware.VimAutomation.Core -ea "SilentlyContinue"
connect-viserver 127.0.0.1

do{
$servers=@()
$servers=(get-xazone|get-xaserver -onlineonly|where{($_.logonmode -eq "ProhibitNewLogOnsUntilRestart") -and ((get-xaserverload $_.servername).load -eq 0)}).servername
foreach ($server in $servers){restart-vm -vm $server -confirm:$false}
$servers=""
get-date
start-sleep -s 600
}
while ((get-xazone|get-xaserver -onlineonly|where{($_.logonmode -eq "ProhibitNewLogOnsUntilRestart")}) -ne $null)

Enjoy.

3 Line Pin to the TaskBar via PowerShell

So you want to pin some stuff to the user's taskbar quickly and with minimum code.  What do you do?  There are a whole lot of ugly VBS scripts out there and a few powershell scripts as well.  All are pretty fat.  Here is the minimal version of all them:

$Path = @("C:\Windows\system32\notepad.exe","C:\Windows\System32\shutdown.exe")
$Desktop = (New-Object -ComObject Shell.Application).NameSpace(0X0)
Foreach($itemPath in $Path){Foreach($ItemVerb in (($Desktop.ParseName($itemPath)).Verbs())){If($ItemVerb.Name.Replace("&","") -match "Pin to Taskbar"){$ItemVerb.DoIt()}}}

This is 3 lines of love for the taskbar.  If you switch the 'match' to 'Pin to Start Menu' the magic moves to the start menu.  Happy pinning.

The Missing RDL, Unique Users in Edgesight 5.4

I went looking for one of my old standby EdgeSight reports and it was gone.  I went and found it on an older installation.  So if you are looking for a Xenapp unique user count via edgesight, here it is...

Unique User Logon Counts

VMware Tools Beat Down My PVS-ed Servers

Citrix PVS is a magical technology that allows the OS to be streamed to you servers/desktops but it has a weak spot.  In PVS the network equals the disk.  My VMware goon was performing patching on my ESXi host and one of the patches included updated VMware tools.  VMware is configured to automatically update tools by default when the VMs start back up.  I ended up with servers full of VMs that would boot up and work for a minute or so and then lock up hard.  In troubleshooting, I discovered the tools CD was mounted on every box.  Two ways to avoid this.

Disable updating the tools in the VMware Update Manager

Tag the VMs with "No Update" via PowerCli

Foreach ($v in ( Get-Cluster "<CLUSTER NAME>" | get-vm)) {

$vm = $v | Get-View

$vmConfigSpec = New-Object VMware.Vim.VirtualMachineConfigSpec

$vmConfigSpec.Tools = New-Object VMware.Vim.ToolsConfigInfo

$vmConfigSpec.Tools.ToolsUpgradePolicy = "manual"

$vm.ReconfigVM($vmConfigSpec)

}

Good night and good luck...

OU to Environment Variable Script

So you want to know what OU your server is in to take some kind of action.  I like to load this data into an envrionment varibale so I can have it handy.  Here is my powershell solution:

$DS = New-Object System.DirectoryServices.DirectorySearcher
 $DS.Filter =  "(&(objectCategory=Computer)(Name=$env:computername))"
 $DN = ($DS.FindOne()).GetDirectoryEntry().DistinguishedName
 $ou=$DN[0].substring($DN[0].indexof(",OU=")+4)
 if ($ou.indexof(",OU="))  {$ou=$ou.substring(0,$ou.indexof(",OU="))}
 else  {$ou=$ou.substring(0,$ou.indexof(",DC="))}
[Environment]::SetEnvironmentVariable("OU",$OU,"Machine")

Enjoy.

Exposing PVS data for BGinfo and Edgesight

Using Edgesight in a 6.5 environment with PVS, there are some conditions that need to be alerted on.  The quick and dirty way to get there is using an event log entry.  Described below is a startup script to capture PVS disk data in the event log and an environment variable.

To start, you need an event log source to use.  Creating a source is easy via powershell.  

New-EventLog –LogName Application –Source “Xenapp_Custom”

Technically you only need to this once, but it fails cleanly, allowing the command to be issued multiple times.

Set Some Defaults:

$disk="ID not found"

$file="c:\personality.ini"

Read the data:

if(Test-Path $File){

$data=get-content $file

Foreach ($line in $data) {

if ($line.Contains("DiskName")){$iname=$line.replace("$","").replace("DiskName=","").replace(".vhd","")}

if ($line.Contains("WriteCacheType")){$wc=$line.replace("$","").replace("WriteCacheType=","")}

}

Evaluate the Vdisk mode and log it if we are unhappy:

switch ($wc)

{ 

"0" {$wc1="Private"}

"4" {$wc1="Standard"}

"1" {$wc1="Server";Write-EventLog –LogName Application –Source “XenApp_Custom” –EntryType Error –EventID 911 –Message “PVS ALERT. VDisk is set to Cache on server.  Immediate action is required to prevent an outage if this is a PROD image. Image: $iname”}

default {$wc1="OTHER";Write-EventLog –LogName Application –Source “XenApp_Custom” –EntryType Warning –EventID 911 –Message “PVS ALERT. Nonstandard VDisk configuration has been detected. Image: $iname”}

}

$disk=$iname+"_"+$wc1} 

Capture the exception of a non PVSed disk

ELSE {$disk=$env:computername + "_Local"}

Write it to an environment variable so BGinfo can consume it and put it in the background

[Environment]::SetEnvironmentVariable("PVS_Disk",$disk,"Machine")

Like magic...