Citrix Workspace Environment Manager

Workspace Environment Manager 4.0 (previously Norskale as many people may be familiar with) is the most recent aquisition by Citrix that will fill the gap when it comes to Citrix offereing a UEM solution. WEM although not officially baked in to the XenApp & XenDesktop product yet will be available for all Enterprise and Platinum XA/XD customers with active Software Maintenance and is available for download today.

Citrix quote using WEM in a Citrix environment could boost server scalability by 70% and reduce logon times by up to 80% so it would be rude not to have a look at this product and see what it is all about! I probably wouldn’t be writing this of course if it wasn’t for Pierre Marmignon and all the team at Norskale so many thanks for the innovation!

Citrix WEM consists of a Management Console, an Agent Host, a Broker and depends on Active Directory and SQL. For the sake of more detail:

• Citrix WEM Administration Console – This can be installed on a Windows client or Server OS. This console will be used to manage the WEM installation such as creating and managing policies, assigning and creating resources and so on. The WEM Administration Console connects to the broker.
  • Software Prerequisites: .NET 4 (full package or client profile), Microsoft Sync Framework 2.1.
  • OS Prerequisites: Windows XP SP3 32/64bit, Windows Vista SP1 32/64bit, Windows 7, 8 & 10 32/64bit, Windows Server 2003 32/64bit, Windows Server 2003 R2 32/64bit, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012.
  • Hardware Prerequisites: Dual core processor at minimum with 2GB RAM. Disk space usage is also low at 40MB minimum and 100MB during install required.
• Citrix WEM Agent Host – The Agent Host connects to the broker or Infrastructure Services and enforces the settings configured through the WEM Administration Console. This can be installed on Windows Desktop OS VDAs to manage those VDAs or Server OS VDAs. This component cannot be installed on the Infrastructure Services server.
  • Software Prerequisites: .NET 4 (full package or client profile), Microsoft Sync Framework 2.1.
  • OS Prerequisites: Windows XP SP3 32/64bit, Windows Vista SP1 32/64bit, Windows 7, 8 & 10 32/64bit, Windows Server 2003 32/64bit, Windows Server 2003 R2 32/64bit, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012.
  • Hardware Prerequisites: Average RAM consumption for the agent is 10MB. Disk space usage is also low at 40MB minimum and 100MB during install required.
• Citrix WEM Infrastructure Services – WEM Broker or Citrix WEM Infrastructure Services is installed on a Windows server acting as the connector between the Agent Host/Adminsitration Console and SQL/Active Directory. This component cannot be installed on an Active Directory server.
  • Software Prerequisites: .NET 4.5.2, SQL Server Compact Edition 3.5 SP3 (installed during setup), Microsoft Sync Framework 2.1 (installed during setup).
  • OS Prerequisites: Windows Server 2008 R2, Windows Server 2012.
  • Hardware Prerequisites: 4vCPUs, 8GB and a minimum of 80MB disk space for up to 3000 users.
• SQL Server – WEM stores all settings within a SQL database. The SQL database must be a minimum of 50Mb in size. WEM requires sysadmin access to the SQL server instance during creation of the database and read/write access going forward for usage. SQL Server 2008 R2 or later is supported.
• Active Directory – To push settings to your users AD is required. WEM required read access to AD to push configured settings out to users.
• Citrix License Server – WEM requires Citrix License Server 11.14 or later for the current WEM 4.0 release.
• XenApp/XenDesktop – Any currently supported version of XenApp and XenDesktop will work with WEM 4.0.

Antivirus requirements – The entire installation directory for the WEM Agent Host and WEM Infrastructure Services must be excluded from on access scanning. If not possible, the following services must be excluded from on access scanning.

• Infrastructure Services – NorksaleBrokerService.exe, NorksaleBrokerServiceConfigurationUtility.exe, NortksaleDatabaseManagementUtility.exe.
• Agent Host – NorksaleAgentHostService.exe, VUEMDesktopInitMsg.exe, VUEMUIAgent.exe, AgentLogParser.exe, AgentCacheUtility.exe, AppsMgmtUtil.exe, PrnsMgmtUtil.exe, VUEMAgentMsg.exe, VUEMAppCmd.exe, VUEMAppCmdDbg.exe, VUEMAppHide.exe, VUEMCmdAgent.exe, VUEMMaintMsg.exe, VUEMRSAV.exe.

Installation Procedure

WEM Infrastructure Services:

Launch the Citrix Workspace Environment Management Infrastructure Services v4.00.00.00 Setup.exe installer.Click Install. Some of the prerequisites are installed for you. Click Next. Accept the License Agreement, click Next. Click Next. Click Next. If you want to change the install directory choose Custom. Click Install. Now click Finish. If you want to specify the Agent Port, Admin Port or AgentSyncPort during install you can do so using the command line. The following switches are available to be used:

• AgentPort – Default agent port is 8286 however using this switch you can specify a different port. This port will be opened locally on the firewall of the Windows Server during install.
• AdminPort – Default admin port is 8284 however using this switch you can specify a different port. This port will be opened locally on the firewall of the Windows Server during install.
• AgentSyncPort – Default agent sync port is 8285 however using this switch you can specify a different port. This port will be opened locally on the firewall of the Windows Sever during install.

Eample command line install: “Citrix Workspace Environment Manager Infrastructure Services v4.00.00.00 Setup.exe” /v”AgentPort=\”8288\””

If you are going to use Windows Authentication and load balance Infrastructure Services you must create an SPN using the following command:

setspn -C -S Norskale/BrokerService [hostname]

If you are just going to use Windows Authentication you must create an SPN with the following command:

setspn -U -S Norskale/BrokerService [accountname]

Now on the Start Menu locate and launch Database Management. Click Create Database. Click Next.Enter your SQL server name and choose the database name for WEM. Analyse the Log File and Data File location. The wizard best estimates the location of the SQL server data folder however this may be incorrect. Make sure these paths are correct and match your SQL server to avoid database creation failure. Click Next. The Database Creation Wizard requires an account with sysadmin rights on the SQL instance to create the database. By default the account you use to run the Database Creation Wizard will be used however you do have the option to specify a SQL account that has sysadmin rights.Specify the VUEM Administrators Group for users who are Full WEM Administrators and can use the WEM Administration Console. Use a service account for the Broker Service Account which will be used to run the Norskale Infrastructure Service service. Make sure you are not running this wizard from the Broker Service Account. If your SQL Users require strict complex passwords you can set a specific password for vuemUser and then click Next. The default password set is 8 characters in length consisting of lower and uppercase characters including digits and punctuation. If you specify a password then you will need to configure the same password for the vuemUser account when running through the Broker Configuration. Make sure the broker service account has Log on as a service rights on the WEM Infrastructure Services server. Review all settings and then click Create Database. The database creation occurs. Click OK. Click Finish. Next you have to configure the Infrastructure Services using the Broker Service Configuration utility found i the Start Menu of your Infrastructure Services server. Enter the Database Server and Name as below on the Database Settings tab including failover database if you are using mirroring. On the Network Settings tab if you changed any of the ports during the Infrastructure Services install such as the Admin Broker port then enter the same port numbers here. On the Advanced Settings tab tick to enable Windows Account Impersonation and use the Broker account if you are not using SQL Mixed Mode Authentication. If you are using MMA you can leave this option unticked and the vuemUser SQL account created during database creation will be used for connections to the database. Specify the SQL user password if you manually specified one during database creation. If you did not leave this unticked. You can also change the:

• Broker Cache Refresh Delay (15 minutes by default) and the cache is used if SQL is offline/unavailable.
• Broker SQL State monitor (15 seconds by default) which is how often the broker attempts to poll the SQL server.
• Enable debug mode to enable verbose logging on WEM Infrastructure Services.

Use Cache Even if Online meaning WEM Infrastructure Services reads site settings from its cache even when SQL is available.Over on the Database Maintenance tab you can specify to enable scheduled database maintenance cleaning up any old statistic records from the database every number of days. The default retention for statistic data is 365 days. The system monitoring retention period is 90 days and the maintenance occurs at 2AM.Using the global license override setting to specify a Citrix license server which overrides what is set within the WEM Administration Console. Once you have specified all your required settings across all tabs click the Save Configuration button.  The broker service will restart and we are now ready to install the Management Console.WEM Administration Console:

Launch Citrix Workspace Environment Management Console v4.00.00.00 Setup.exe.Click Next. Accept the License Agreement. Click Next. Click Next. Select Next. Choose Custom if you wish to specify an install location manually. Click Install. Click on Finish. Now launch the management console. Click Connect. Enter the broker server name and port. Click Connect. Click OK on the below warning. We can configure the license server shortly using the Administration Console. Click on Congigure license server. Enter the Citrix license server name and port. Click OK. Next we can import quickstart settings from templates that will configure WEM with default recommended settings giving us a good baseline to get started from and environmental settings based on best practice such as a client lockdown template. Click Import Settings. Click Next.

Browse to the Configuration Templates folder located within the installation media. There are three templates that you can import:

• Default Recommended Settings – This template imports recommended System Optimization, Agent Configuration and System Monitoring settings for CPU and memory management, agent offline mode, asynchronous printers processing etc.
• Environment Lockdown Example – This template imports Environmental Settings specifying lockdown actions based on best practice such as hiding administrative tools, control panel and the recycle bin.
• Sample Applications – This template imports sample application shortcuts however doesn’t seem to be working at this time.

Check the boxes next to each type you want to import and click Next.

Click Import Settings. Click Yes. Cick Finish.

Finally install the WEM Agent Host component.

WEM Agent Host:

This piece of software will be installed on the VDA making sure anything configured within WEM is enforced on the client.

Launch the Citrix Workspace Environment Management Agent v4.00.00.00 Setup.exe.

Click Install. Some prerequisites are installed for you. Click Next. Accept the License Agreement. Click Next. Click Next. Click Next. Choose Custom if you want to specify an installation directory. Click Install.Click Finish. A number of command line arguments are available to be used when installing the Agent Host. Some example arguments:

• WaitForNework – Accepted values are 0 or 1, 0 meaning inactive and 1 meaning active. By default this key is not created.
• SyncForegroundPolicy – Accepted values are 0 or 1, 0 meaning inactive and 1 meaning active. By default this key is not created.
• GpNetworkStartTimeoutPolicyValue – By default the value is 30 (seconds). You can specify a different number during install using this argument.

All three keys above are designed to make sure the VDAs receive the broker address GPO before logon. All keys are created under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon during installation.

• APPSYSTEMCOMPONENT – Presents the Agent Host as a System component and removes the Agent Host listing from Add/Remove Programs.
• AgentCacheAlternateLocation – The cache file will be saved to the specified location rather than the Agent install directory. Useful for non persistent machines.
• AgentServiceUseNonPersistentCompliantHistory – The agent service’s process optimisation history will be saved externally to an XML file in the same location as the Agent cache file rather than in the machine’s registry. Accepted value is 1. Useful for non persistent machines.

Example command: “Citrix Workspace Environment Management Agent Setup.exe” /v”AgentCacheAlternateLocation=\”E:\AgentCache\”” /v”AgentServiceUseNonPersistentCompliantHistory=\”1\””Changes to the registry values are made based on specified arguments. The cache now resides on E:\AgentCacheThe Netlogon service is made dependant on the Norskale Agent Host service to ensure that the host service is always running before logons can be made.Clients (VDA) need to know where to find the broker server. For this we will use Group Policy. Grab the ADMX configuration files from the WEM install media. Paste them in to the PolicyDefinitions Group Policy central store folder within SYSVOL on your Domain. Remove the ADM file as it is not needed. Also import the language file. Now navigate to Computer Configuration -> Administrative Templates -> Citrix -> Workspace Environment Manager -> Agent Host Configuration -> Connection Broker Name. Change the Connection Broker Name to Enabled and specify the broker server. The other settings such as Agent Port can be used to specify port numbers other than the default. For now I do not need to use these so will leave the rest alone. If you want to manually force a cache update/rebuild on a VDA or create the cache before the Agent runs for the first time after an install, you can use the following command:

AgentCacheUtility.exe -RefreshCache -BrokerName servername. The Agent Cache Utility is found within the WEM Agent Host install directory. An optional switch -brokerport:port should be used if you have changed the default port of 8285 for Infrastructure Services.

Managing WEM

Firstly launch he Citrix WEM Administration Console. Click Connect, enter your Infrastructure Services server name and specify the broker service port (default 8284).

Once connected click the About tab. Click Configure license server. Enter the Citrix license server and port. Click OK. Clicking Options on the About tab allows you to configure options such as:

• Auto Admin Logon – Console connects to last broker it was connected to automatically).
• Enable Debug Mode – Enables verbose logging for the administration console. Logs are created in the root of the currently logged on user’s profile.
• Console Skin – Change the skin (graphical look) of the administration console.

Port Number – Allows you to change the port number used for administration console connection to broker service. Remember to update the port configured on the broker (Infrastructure Services) server.Click on the Home tab. Here you will perform all of your WEM configurations. You have several directories listed such as:

Actions – Configure registry entries, virtual drives, printers etc. on agent host machines.

Filters – Filter actions based on rules and conditions such as if user if part of group then apply these rules.

Assignments – Assign created actions to configured users.

System Optimization – Configure CPU management, memory management, fast logoff for agent hosts etc.

Policies and Profiles – Configure UPM (Universal Profile Management), client lockdown settings i.e. hide administrative tools.

Configured Users – Import users from Active Directory to be used with WEM.

Advanced Settings – Agent logging options, printer processing, network drive cleanup options etc.

Administration – ConfigureWEM administrators, manage agents etc.

Monitoring – Login reports, boot reports, user and device reports.

Click on Applications, click Add.Enter the application name, location and where the application will exist on the users Start Menu etc. I am just creating a basic notepad application. Clicking on the Options tab allows you to change the icon, application state (enabled/disabled), maintenance mode presents the icon as normal to the user but with a warning icon beside it and a warning message if the user tries to launch it. Hotkeys allow users to launch the application using keyboard shortcuts. Advanced Settings controls how the application will appear when launched such as maximized. By default applications appear within the WEM self-service window of the agent however you can disable this using the Do Not Show in Self Services checkbox. Enable Automatic Self-Healing will recreate application shortcuts if they have been deleted or moved by the user. Click OK. The application now appears within the Application List view. Just to show you the maintenance mode feature. When an application is in maintenance mode it will display as below to the user.When application is launched the following error is displayed. The application also receives a warning icon within the WEM Administration Console.

Click on Registry Entries under Actions and click Add. Registry entries can only be created under HKEY_CURRENT_USER. So let’s create an entry to suppress the Citrix Receiver client add account popup on restart. Note that Target Path does not require HKEY_CURRENT_USERS to be entered at the start as this is handled automatically by WEM. Run Once as the name suggests runs this once which may be desireable if you have lots of Registry entries as you would not want this key being recreated during every Agent refresh. The Options tab allows you to specify if you are deleting, creating or setting an existing key. Click OK.You also have the option to import registry keys from a reg file. WEM reads the .reg file and gives you the option to import any value. Use the Import Registry File action to import values.To import printers you can either do so manually or simply connect to a Print Server using the Import Network Print Server button.

Enter the print server name and specify alternate credentials if the ones you are currently using for the WEM Administration Console do not have the appropriate permissions. Click Connect.Select one or multiple printers and click Import Selected.You can then edit imported printers changing the name, printer state (enabled/disabled) and if the printer will recreate if deleted using self-healing etc.Click on Folders and Files followed by Add. Here we can copy folders and files to the user’s environment and create directories etc. I’ll be creating a folder so the Target Path is blank.On the Options tab you have several action types. Select Create Directory. To apply these settings to the user environment we need to first configure a set of users or group of users who will receive them followed by some rules and assignments. Navigate to Configured Users -> Add. Enter a user name, multiple user names or preferrably a group as I have done.Next click on Filters -> Conditions. By default an Always True Condition and Rule is created however not in use. Click Add. Enter a name, and select a condition type. A single or multiple conditions make up a rule. Conditions can be based on things such as the IP address of the VDA machine, the client OS version etc. Here I will choose Client IP Address Match so that VDA’s within the range specified will match this condition. Enter the IP address range of your VDA machines and click OK. I created another condition which matches for users who are in the Citrix Desktop Users security group. Now we can use these conditions against a rule. Click on Rules and click on Add. Enter a rule name and toggle the two created conditions to the right. Click OK. If these two conditions match the rule is activated and allowed. Now click on Assignments. You will see any configured user/group here. Double click the entry and the list ofavailable actions appear. Highlight an action and click the right-arrow to move it across to the Assigned section. Specify the Allow Rule filter we just created. This means that the action will apply if the Allow Rule is matched. All actions I have created are now assigned to the Citrix Desktop Users group. Any user who is a member of that group and logs on to a VDA within the 192.168.0.0/24 range should receive the actions. Navigate to Administration -> Agents, right-click your VDA and click Refresh Cache… to force a refresh of the cache. Next log on to the VDA, the conditions and rules should match and WEM will apply any assigned actions. The Copy folder appears within E:\. The printer appears. The test application appears within the Start Menu. The registry entry appears. You can also use the modeling wizard to check what actions will apply to a user (groups not allowed). Click Assignments -> Modeling Wizard. Click Next. Enter a user and click Next. The list of actions that will apply shows. Navigate to System Optimization. Here you have a number of options. Firstly on the Fast Logoff tab you can enable fast logoff. Fast Logoff logs a user off instantly and performs any additional logoff tasks in the background. You can enable this and exclude specific groups. On the CPU Management tab you have options such as:

Enable CPU Spikes Protection – Configured by the Default Recommended Settings template if imported. This option limits all processes from using more than the specified processor value. Limit Sample Time decides for how long a process can exceed the CPU Usage Limit before it’s priority is lowered.

Enable Intelligent CPU Optimization – Keeps a history of processes and the amount of times they have triggered spikes protection. The more a process triggers a spike protection the lower priority the process will be assigned at launch.

Exclude specified processes – Allows you to exclude specific processes from spike protection.Over on the CPU Priority tab you can specify processes (by name) such as iexplore.exe and assign a priority.On the CPU Affinity tab you can set process affinity against processes. The CPU Clamping tab allows you to clamp a process to a certain amount of CPU i.e. only 10% CPU can be used by this process. Click Memory Management. Here you can enable WSO which withdraws excess memory from idle applications if they have not been used for a certain amount of time. You can exclude processes from WSO. On the Io Management module you can set I/O priority for processes. Click Processes Management. If you enable processes management you can whitelist or blacklist certain processes. If you enable blacklisting, you can add certain processes to the blacklist meaning the won’t be run. If you enable process whitelisting any process not in the whitelist is automatically blacklisted so be careful. You can exclude local administrators and/or specific groups from both white and blacklists Click Policies and Profiles -> Environmental Settings. A lot of these settings are configured if you import the Environment Lockdown Sample template. For example the taskbar can be locked and the run button can be removed from the Start Menu. You can exclude administrations by ticking the Exclude Administrators check box. This picture shows the system clock having been removed. The Desktop portion allows you to hide the My Computer icon, hide the Recycle Bin and more. Windows Explorer allows you to hide the Porgrams Control Panel and prevent access to CMD etc. Control Panel allows you to hide the Control Panel all together, only show specific Control Panel applets or hide specific applets. Known Folders Management gives you the ability to disable known folders within the users profile. SBC/HVD Tuning allows you to optimise performance when using Session Hosts such as XenApp Shared Desktops. Some of the options are designed to increase performance however may slightly degrade the user experience as a result. Microsoft USV Settings allows you to integrate WEM with Microsoft Roaming Profiles, configuring Roaming Profiles from the WEM Administration Console. Citrix UPM Settings allows you to integrate WEM with Universal Profile Mangement, configuring UPM from the WEM Administration Console. Note that some options only work with specific versions of UPM based on new or retired options.Most familiar options will be present. To see a guide on configuring UPM read http://www.jgspiers.com/citrix-profile-management-overview/ Click on Advanced Settings -> Configuration -> Main Configuration. Here you can check or uncheck the processing of actions. If you don’t have any port actions for example then disabling the processing will reduce unneeded overhead and boost overall agent processing time. Other options include:

Launch Agent at Logon – A default, launches the agent at logon.

Launch Agent at Reconnect – Launches the agent if a user reconnects to a published Desktop.

Launch Agent for Admins – Launches the agent even for administrators.

Agent Type – UI (GUI) or CMD (no GUI).

Enable (Virtual) Desktop Compatibility – Leave this enabled when using physical desktops or VDI.On the Cleanup Actions tab, you can specify to delete printers, network drives, Start Menu shortcuts etc. whenever the WEM agent refreshes. On the Agent Options tab, you can specify where agent logging will reside. Other options include:

Enable Offline Mode – You can also enable offline mode which allows the agent to use the local cache in the event access to the WEM Infrastructure Services server is lost.

Use Cache Even If Online – As the name suggests, the local cache will be used even when the WEM agent is online.

Refresh On Environmental Setting Change – When an environmental setting is changed the Agent will trigger a Windows refresh.

Async Prnters Processing – Asynchronously process printers.

Async Network Drives Processing – Same as above only for network drives.

Broker Service Timeout (ms) – The local cache will be used if the broker service cannot connect within the specified time.

Directory Service Timeout (ms) – The local cache of user group associations will be used if the directory service times cannot connect within the specified time.On the Advanced Options tab you can enforce actions even changes have not been made for example to any of the printer actions. You can also configure to revert any printer, virtual drive, application actions etc. once they have been unassigned the next time the agent refreshes. At the bottom you can specify how often the agent refreshes which is 30 minutes by default (UI only). On the Reconnection Actions tab similar to the processing options on the Main Configuration tab you can allow or disallow processing of certain or all actions when a user reconnects.On the Advanced Processing tab you can enable or disable processing of action filters when the agent refreshes. The Service Options tab allows you to specify how often the agent will refresh the cache (15 min default), how often the agent will refresh its SQL connection and other options such as enabling debug mode for the agent and setting a delay on the agent executable launch on a desktop. You can also exclude the agent from running for specific groups of users.The Console Settings tab allows you to exclude drive letters when creating drive assignments which may help prevent a WEM administrator using a drive letter that is used globally for something else for example. The UI Agent Personlization tab simply allows you to adjust the look and feel of the agent, helpdesk and self-service tools running on VDA. You can set help links and allow users to take a screen capture including the option to send the screen capture via email to support. Power Saving can allow the agent to shut down the device it is running on afer a specified time or when the machine is idle for so many seconds. Click on Administration. The Configured Administrator List section shows WEM Administrators and allows you to add more using the Add button or edit exsting users or groups. Editing a group or user you can set permissions such as read only access to the WEM Administration Console.The Users portion shows a list of users who have connected and reserved a WEM license within the past 24 hours and 1 month.Agents shows a list of the machines that have the Agent Host component installed including some machine information such as Device Name and IP Address.  Right-clicking on an agent provides you with a number of options such as manually forcing a cache refresh or uploading statistics to the WEM database. The Administration Log presents a history of changes made by a WEM administrator. As you can see actions such as assigning tasks and refreshing an agent cache are recorded. Click on Monitoring -> Daily Reports. This shows an overview of the login times over the past 24 hours. If you double-click one of the bar graphs you are presented with a list of individual logons and their logon times. This is exteremely useful for baselining activities and comparing boot times between mulitple minor or major changes/customisations both within WEM and outside of WEM i.e. Group Policy. Click on User Trends. The Login Trends Report shows an overview of login times across all users connected to this site for the specified dates. If you double-click the graph bar you are presented with a more detailed view of login times including user logging on and their individual login times. Device Types present a list of the different devices connecting to this WEM site over the specified time period. Double-clicking any of the graph bars show more detail such as the device name and OS version. Click on User and Device Reports. On the User Report tab you can use the User drop-down box to select a WEM configured user and view the login times for that user over a certain time period. Note that all these different reporting features are exportable to Excel, PDF, HTML etc. Click on Configuration. You can specify the work days so that reporting focuses only on the days your business is in operation.

WEM Upgrade Procedure

Administration Console – Run the latest WEM Administration Console installer over the top of the existing installation.

Agent Host – Run the latest Agent Host upgrade installer or patch installation over the top of the existing installation on machines which have no users logged on and then perform the following steps:

1. C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update
2. C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe eqi 3

If your using a 32bit OS use the same path above ony with 64 removed.

This ensures the Agent Host .dll files are correctly. Agents are backward compatible within the same major release i.e. v3.0 or v3.5 agents work with a v4.0 broker. Some functionality will however be lost until all components are on the same major and minor version.