It amazes me in this day and age that something as fundamentally simple as the clipboard in a windows environment can have issues, but it does happen… Especially in a multi user environment.

If you experience clipboard issues with office, Lotus notes and other copy and paste capable programs you have have a session memory issue!

The session View size and pool size have a massive part to play in 32 bit citrix environments, these size options dictate the amount of graphical memory that can be assigned to each session. The ceiling for these options in 32 bit are just 16mb, which rediculously low in modern days.

Taking equal parts of graphically heavy applications like Office 2007 and Known citrix killers like lotus notes, it really isn’t long until these limits spill over into horrible clipboard and copy / paste disasters. Take one step further and implement Microsoft App-V and you are in serious trouble.

If alike me, you run an environment that requires all the above nasties, help is at hand. After 12 months of continued troubleshooting I’ve found a happy medium of 64mb between low limits and too high limits.

To test the same, simply bash these off the following command lines and reboot, waving goodbye to your horrible clipboard issues:

reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management” /v SessionPoolSize /t reg_dword /d 64 /f
reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management” /v SessionViewSize /t reg_dword /d 64 /f

Disclaimer:

We currently run with 10gb of memory, allowing us to allocate this extra 112mb of memory per user. If you require these options, consider a lower value or upgrade your ram capacity

Just a quick post to share a fundamental performance increase to any citrix server out there running on local disk. If your disk supports caching, enable it now!

Get a copy of dskcache.exe from here:

run the following command: dskcache.exe +w +p

Enjoy your new disk performance!

We recently had a problem after a Citrix rebuild where we were seeing thin clients intermittently disconnect from the citrix servers. Nothing in the event logs, just a lovely error on the Thin Client (Igel) reporting a Driver protocol error. The users could immediately reconnect, but 10-15 disconnects a day was getting a bit annoying for poor Joe Soap.

The problem was very difficult to track down due to absolutely no logging or even acknowledgement of the problem in any event logs.

We found that the reinstall was enabling the advanced IP features in Windows server 2003 involving TCP Offloading from the Nic to the CPU, Citrix and particularly thin clients do not like this feature one bit.

To disable these options, enter the following keys into the registry and reboot.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
“EnableTCPA”=dword:00000000
“EnableRSS”=dword:00000000
“EnableTCPChimney”=dword:00000000

On a side note, I’ll be disabling these keys going forward on all server builds, its not a nice feature to implement unless the application is aware of the offload.

Had a weird one over the weekend. A colleague of mine accidentally approved Internet Explorer 8 to all servers in our domain via wsus and it left our Citrix servers in a bit of a sad state. We set about removing it as soon as possible but after the uninstall / restart we were faced with this very strange problem. When we double clicked internet explorer on the desktop, the application wouldnt launch and a new shortcut to Internet Explorer would be created on the desktop.

We also had these logged every thirty minutes or so in the event logs:

Event Type:    Error
Event Source:    Userenv
Event Category:    None
Event ID:    1041
Date:        06/09/2009
Time:        21:50:38
User:        NT AUTHORITY\SYSTEM
Computer:    LPGPCTXXA0008
Description:
Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE} and it will not be loaded. This is most likely caused by a faulty registration.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

And:

Event Type:    Error
Event Source:    Userenv
Event Category:    None
Event ID:    1041
Date:        06/09/2009
Time:        21:50:38
User:        NT AUTHORITY\SYSTEM
Computer:    LPGPCTXXA0008
Description:
Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} and it will not be loaded. This is most likely caused by a faulty registration.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

If you face the above problems, delete the following registry keys and open internet explorer as an administrator:

“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}” /f
“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}” /f
“HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage” /v legacydisable /f

That should fix that!

There’s very litte more annoying in a windows environment than having to go to a console of a server because some idiot has disabled remote administration on a server 2003/2000 server. I was in this situation recently and decided not to go to the console out of principle.

I wrote the following program in order to get around this issue. Its called RDPon.exe and you can get it here:

With this you can:

• Query RDP status
• Enable RDP
• Disable RDP

I have sealed it as an exe so that you can right click it and choose run as to get at your admin account easily.

Our challenge recently was seperating the reboots of our citrix servers to ensure that half of our farm is always available. This is particularly useful if you are a 24/7 house and need to know exactly what servers restart and when they restart.

So to begin, our server names consist of “servername00xx” where xx is the number of the server, the task at hand was to ensure that 0001, 0003, 0005 etc restarted on one night and 0002, 0004, 0006 etc restarted the second night. To do this i needed to use the system variable “hostname” and read the last digit in the name to determine if the number was odd or even.

To get determine whether a number is odd or even i used the following logic. If you divide an even number by 2 then multiply it by two you will get the same number back, e.g. 8/2 = 4, 4*2 = 8, 8 is equal to 8 .

An odd number in batch is treated as follows 9/2=4, 4*2=8 ,9 is NOT equal to 8.

Rem Begining Logic Check for even or odd server
for /f “tokens=1-2 delims=00″ %%a in (‘hostname’) do set compnumber=%%b
set /a divnumber=%compnumber%/2
set /a sum=%divnumber%*2

With the above excerpt, i set three variables, %compnumber% (which is the number after the 00), divnumber (a variable for the result of the computernumber divided by two) and sum, which is the resulting divnumber * 2.

This divides compnumber by 2 and multiplys divnumber by 2 setting the resulting number to sum.

Rem Running if checks
if %compnumber% NEQ %sum% goto odds
if %compnumber% EQU %sum% goto evens

This next step is our determiner:

If the number divided by two and multiplied by two is not the same as the original number, the number is odd, the if statement then sends the script to the odds labeled portion of our script.

If the number divided by two and multiplied by two is the same as the original number, well you get the idea, its even and jumps down.

dds
<—Do something for odd servers here—>
exit

:evens
<—Do something for even servers here—>
exit

Recently while installing Zetafax 11, we noticed that some of our maintenance scripts on our XenApp servers were causing the zetafax printer to fall offline on reboot. Below is a simple to use (built in to server 2003) script that can be used to force a printer online.

The Following will force “Printer Name” to work online:

cscript C:\WINDOWS\system32\prncnfg.vbs -t -p “Printer Name” -workoffline

As an extra function, the below will rename a local printer:

Cscript %windir%\system32\Prncnfg.vbs -x -p “old printer name” -z newprintername

Just a quick entry as i got an email requesting this today, “How can i schedule a restart on a remote server to run out of hours?”

This script uses at.exe which is soon replaced by schtasks.exe. This can only be run by an administrator of the server you wish to restart, obviously.

Rem setting vars:
set server=servertorestart
set time=05:00

REM performing check for previous file and deleting it:
if exist \\%server%\c$\rebootme.bat del \\%server%\c$\rebootme.bat

Rem Creating reboot batch file:
echo shutdown -r -t 03 >> \\%server%\c$\rebootme.bat

Rem Schedueling the job:
at \\%server% %time% c:\rebootme.bat

To Create a reuseable, error checking script with idiot proof options! save  the following as a .bat file:

@echo off
cls
Rem setting vars:
set /p server=[Please enter the name of the server you wish to restart:]
cls
echo Selected server = %server%
set /p time=[Please enter the time  in HH:MM format at which you wish to restart the server: e.g. 05:00]
cls

REM performing final idiot check
echo Are you absolutely sure you wish to restart %server% at %time%?
Pause

REM performing check for previous file and deleting it:
if exist \\%server%\c$\rebootme.bat del \\%server%\c$\rebootme.bat & echo deleted previous file

Rem Creating reboot batch file:
echo shutdown -r -t 03 >> \\%server%\c$\rebootme.bat

Rem Ensuring reboot file exists:
if exist \\%server%\c$\rebootme.bat echo reboot script created successfully.
if not exist \\%server%\c$\rebootme.bat goto Failed

Rem Schedueling the job:
at \\%server% %time% c:\rebootme.bat
Echo Job schedueled, Script complete.
pause

:failed
echo something failed, I’d look into that if i were you.

pause
exit

We had this problem recently with our XenApp servers, as part of the latest service pack DEP (or Data Execution Protection) has now been enabled for all applications accross all platforms and this can cause havok in a terminal services environment.

The problem with Dep is simple, its not a Reg Key, its not an environment variable its a system setting loaded on startup from the boot.ini file. To make matters worse its a kinda complicated setting as it sounds opposite to what it is exactly doing.

Take this for example, this is a server with DEP enabled:

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Windows Server 2003, Standard” /NoExecute=OptOut /fastdetect

What confuses me with the above statement is why Opting out means DEP is enabled? To disable DEP you need to change this switch to OptIn, which makes no sense to me at all.

To automate this change, i used a tool called RPL.exe, this is a direct translation of the Unix command/tool to replace text inside of a text file. Using RPL i could search the boot.ini for the optout statement and replace it with the optin (aka turn off Dep).

Because boot.ini is a system and read only file by default, i needed to use the attrib command so first i set about removing the read only, hidden and system file attributes on the file in order to edit it:

attrib -r -h -s c:\boot.ini

once the file was editable, i now performed the rpl command to search and replace:

rpl.exe -i /noexecute=optout /NoExecute=OptIn c:\boot.ini

Once the file had been changed if neccessary it was time to set the file back to read only, hidden and system before closing the script:

attrib +r +h +s c:\boot.ini

And voila, next reboot and Dep is gone

We had a problem recently with the adobe professional suite installing a local printer on the XenApp server, this was great for users licensed to use Adobe Professional, but for users that weren’t it gave them a possibility to infringe the licensing simply by printing to this printer.

To limit the printer, you simply need to assign custom permissions to the printer. Allowing members of a group the ability to print to it (i.e. adobe professional users) and restricting everyone else. This works brilliantly as if the user has no permissions to the printer the user cant even see it!

This can be done manually if you wish, but you can also script it using SetAcl.exe.

The documentation on their website is shockingly bad for printers, so below is an example of how to remove the permissions from a local printer:

setacl.exe -on “adobe pdf” -ot prn -actn clear -clr dacl,sacl

The following will grant the “local administrators” group full control of the printer for troubleshooting:

setacl.exe -on “adobe pdf” -ot prn -actn ace -ace “n:administrators;p:full”‘

And the following will grant the domain group “apps acrobat writer” the ability to view and print to the printer

setacl.exe -on “adobe pdf” -ot prn -actn ace -ace “n:domain\Apps Acrobat Writer 9;p:print”

 The whole lot together is below in Enteo scripting format:

Execute(‘.\extern$\setacl.exe -on “adobe pdf” -ot prn -actn clear -clr dacl,sacl’)/?
Execute(‘.\extern$\setacl.exe -on “adobe pdf” -ot prn -actn ace -ace “n:administrators;p:full”‘)/?
Execute(‘.\extern$\setacl.exe -on “adobe pdf” -ot prn -actn ace -ace “n:emea\LPGP CTX Apps Acrobat Writer 9;p:print”‘)/?