; Copyright 2005-2011 Citrix Systems, Inc. ; All Regions.ini ; ; This file defines the lockdown profile applied to all connections made by the Citrix Presentation Server Client. ; ; ; Lockdown Profiles ; ================= ; ; A lockdown profile is a set of configuration data for the client, consisting of three main parts: ; - The [Top Level] section controlling how the lockdown profile is applied. ; - The lockdown sections that constrain client configuration. ; - The [Preferences] section that list preferred configuration settings. ; ; ; [Top Level] section ; ------------------- ; ; The [Top Level] section contains high level settings controlling the overall ; functionality of the client with respect to this lockdown profile. This includes ; configuration data versioning, preventing invalid or unsafe network connections ; and defining the behaviour of the client when it needs to handle unexpected ; configuration data. ; ; ; Lockdown sections ; ----------------- ; ; The lockdown sections define constraints that are placed on configuration parameters, ; known as the lockdown criteria. The client will only connect using configuration that ; satisfies all lockdown criteria. ; ; When applying a lockdown, each parameter is assigned a type: one of string, integer ; or boolean. The format used by the lockdown criteria is usually dictated by the parameter ; type, but it is acceptable to, for example, restrict an integer value with ; a string lockdown criteria. ; ; String lockdown criteria ; ------------------------ ; ; An unrestricted string parameter is denoted by a lockdown profile entry of the form: ; ; MyParameter= ; ; This is the least restrictive lockdown criteria available as it allows any configuration ; value to be specified, including numeric and boolean values that also have string ; representations. ; ; When restricting string parameters, a comma separated list of allowed values may ; be used. This will have the form: ; ; MyParameter=value1,value2,value3 ; ; This restricts the possible configuration values that the client can use to one of the ; three values: value1, value2 or value3. If the MyParameter has not been specified in any ; configuration data, the first in the list is used as a default, in this case value1. ; ; Any of the lockdown criteria parts may include the wildcard *. This matches an arbitrary ; number of characters in configuration data. The form in this case would be: ; ; MyParameter=value*option ; ; This would allow any parameter value starting with "value", ending with "option". ; ; The character \ is available to escape control characters. ; ; Integer lockdown criteria ; ------------------------- ; ; An unrestricted integer parameter is denoted by a lockdown profile entry of the form: ; ; MyParameter=* ; ; Note that this form will allow boolean values, but not string values. ; ; As with the string lockdown criteria, a comma separated list of values can be used with ; the first being used as a default value. ; ; MyParameter=10,20,30 ; ; This allows MyParameter to take one of three values 10, 20 or 30 with 10 being the default. ; ; Integer ranges may be specified using the hyphen (-) character. ; ; MyParameter=100-,50-75,-25 ; ; This allows values less than 25, between 50 and 75 and above 100 to be specified. Note ; that all configuration data in the client uses unsigned integers. ; ; Boolean lockdown criteria ; ------------------------- ; ; An unrestricted boolean parameter is denoted by a lockdown profile entry of the form: ; ; MyParameter=* ; ; This is shared with integer configuration. It is possible to specify booleans only ; using the form: ; ; MyParameter=true,false ; ; This, however, has the side effect of choosing true as the default value. ; ; When restricting boolean values, use one of the following forms: ; ; MyParameter=true ; MyParameter=false ; ; ; Lockdown violation ; ------------------ ; ; When processing configuration data, the client will consult the lockdown profiles for ; any restrictions that are placed on the parameters. ; ; In the case where a parameter is not allowed by a lockdown profile the client will attempt ; to change the parameter value to something that satisfies the lockdown criteria if the ; [Top Level] parameter "OverrideInvalidICAParamaters" is specified as "true". ; ; If the client encounters configuration data that is not specified in a lockdown profile, ; it will allow configuration data if the [Top Level] parameter "AllowUnrecognisedICAParameters" ; is set as "true". Otherwise it will discard the configuration data if the [Top Level] ; parameter "OverrideInvalidICAParamaters" is specified as "true". ; ; If it is not possible to choose configuration data that satisfies all lockdown profiles, ; the client will fail to connect, displaying an error message. ; ; ; [Preference] section ; -------------------- ; ; The preference section is a list of the recommended configuration settings for this region. ; Unlike the lockdown criteria, these can be overridden by other lockdown profiles or ; client configuration options. ; ; Preference section entries have the form: ; ; MyParameter=preferredValue ; ; ; The Top Level configuration defines the basic functionality of this Profile. ; ; Version Minimum - This is the minimum version of the client that can run using the ; configuration contained in this lockdown profile. Its value is the ; client major version number * 1000 + the client minor version number. ; ; Version Maximum - This value is increased when a client has upgraded the configuration ; data for a more recent version of the client. ; ; EnableLockdown - When set to false, the restrictions in this lockdown profile are not ; applied. ; ; AllowConnection - When set to false, the client is prevented from performing network ; connections. ; ; OverrideInvalidICAParameters ; - When the configuration conflicts with the lockdown criteria in this ; lockdown profile, the client will attempt to chose alternative configuration ; if this parameter is set to true. ; ; AllowUnrecognisedICAParameters ; - When the client encounters configuration not specified in this lockdown ; profile, the client will discard it when this setting is set to "false". ; If this parameter is set to "true", configuration parameters not listed ; in this lockdown profile will be automatically accepted. ; [Top Level] Version Minimum=10000 Version Maximum=10100 EnableLockdown=true AllowConnection=true OverrideInvalidICAParameters=true AllowUnrecognisedICAParameters=false ; ; These settings govern loadbalancing and application lookup functionality. ; ; xxxBrowserAddress - These are the addresses of browsers that the client will contact for ; the selected communication protocol. Multiple browsers can be ; specified in failover order. ; ; [Application Browsing] BrowserRetry=* BrowserTimeout=* ICAHTTPBrowserAddress= ; ; These settings define the Addresses used for HTTP Application Browsing. ; ; [Application Browsing\HTTP Addresses] HttpBrowserAddress= HttpBrowserAddress2= HttpBrowserAddress3= HttpBrowserAddress4= HttpBrowserAddress5= HttpBrowserAddress6= HttpBrowserAddress7= HttpBrowserAddress8= HttpBrowserAddress9= HttpBrowserAddress10= HttpBrowserAddress11= HttpBrowserAddress12= HttpBrowserAddress13= HttpBrowserAddress14= HttpBrowserAddress15= LocHttpBrowserAddress= LocHttpBrowserAddress2= LocHttpBrowserAddress3= LocHttpBrowserAddress4= LocHttpBrowserAddress5= LocHttpBrowserAddress6= LocHttpBrowserAddress7= LocHttpBrowserAddress8= LocHttpBrowserAddress9= LocHttpBrowserAddress10= LocHttpBrowserAddress11= LocHttpBrowserAddress12= LocHttpBrowserAddress13= LocHttpBrowserAddress14= LocHttpBrowserAddress15= ; ; These settings are used to control the core client functionality ; ; Version - the version of the ICA protocol to use (currently 2) ; ClientName - Client name to report to server ; WinstationDriver - Core module to load ; [Client Engine] Version=* ClientName= WinStationDriver= UseSDLVB=* AllowPerUserInstall=* ; ; These settings control aspects of the displayed GUI ; [Client Engine\GUI] Title= ConnectionFriendlyName= AppendUsername= UseIconWindow= CursorStipple= OutputMode=* IgnoreErrors= ; ; These settings are used to control published application launching ; ; InitialProgram - the program commandline or application to launch. ; Published applications have the format # ; ; LaunchReference - Reference token for a specific session on a server ; ; WorkDirectory - the default working directory for the program launched ; ; LongCommandLine - Alternative to InitialProgram for launching programs ; with long commandlines. ; [Client Engine\Application Launching] InitialProgram= WorkDirectory= LaunchReference= LongCommandLine= LongCommandLine000= LongCommandLine001= LongCommandLine002= LongCommandLine003= LongCommandLine004= LongCommandLine005= LongCommandLine006= LongCommandLine007= LongCommandLine008= LongCommandLine009= LongCommandLine010= LongCommandLine011= LongCommandLine012= LongCommandLine013= LongCommandLine014= LongCommandLine015= LongCommandLine016= ; ; These settings control how the ICA file is handled ; ; RemoveICAFile - set to true if the ICA file should be deleted after ; the session has completed. ; [Client Engine\ICA File] RemoveICAFile=* Launcher= ; ; These settings control how the client handles running multiple applications ; on a single server connection. ; [Client Engine\Session Sharing] SessionSharingKey= EnableSessionSharing=* SessionSharingLoose=* EnableSessionSharingHost= EnableSessionSharingClient= SessionSharingLaunchOnly= SessionSharingName= EnableIPCSessionControl= SucConnTimeout= ; ; These settings control the "hot keys" that control the client, rather than ; being sent to the server within a session. ; [Client Engine\Hot Keys] Hotkey1Shift= Hotkey2Shift= Hotkey3Shift= Hotkey4Shift= Hotkey5Shift= Hotkey6Shift= Hotkey7Shift= Hotkey8Shift= Hotkey9Shift= Hotkey10Shift= Hotkey11Shift= Hotkey12Shift= Hotkey13Shift= Hotkey14Shift= Hotkey15Shift= Hotkey1Char= Hotkey2Char= Hotkey3Char= Hotkey4Char= Hotkey5Char= Hotkey6Char= Hotkey7Char= Hotkey8Char= Hotkey9Char= Hotkey10Char= Hotkey11Char= Hotkey12Char= Hotkey13Char= Hotkey14Char= Hotkey15Char= ConnectionBar= EnableCtrlAltEnd= AllowHotkey=0 ; ; These settings handle authentication to servers ; [Logon] AutoLogonAllowed=* SSOnDetected=* ; ; These settings handle Kerberos authentication ; [Logon\Kerberos] SSPIEnabled=* UseSSPIOnly=* SingleSignonDetected= SSPIRealm= SSPIKeyDistributionCenter= ; ; These settings handle local credential passthrough ; [Logon\Local Credentials] UseLocalUserAndPassword=* EnableSSOnThruICAFile=* SSOnCredentialType= LegacyLocalUserNameAndPassword=* SSOnUserSetting=* ; ; These settings handle passwords stored on the client machine. ; [Logon\Saved Credentials] Username= Domain= Password= ClearPassword= SavePnPassword=* NoSavePwordOption=* UIDomain=* NRUserName= NRDomain= ; ; These settings handle opaque credential tickets provided for ; automatic authentication to a server. ; [Logon\Ticket] LogonTicketType= LogonTicket= ; ; These settings handle network topology, security and routing ; [Network] ; ; These settings handle the CGP proxy that is used for routing ; and session reliability. ; [Network\CGP] CGPAddress= CGPSecurityTicket=* MissedKeepaliveWarningTime=* MissedKeepaliveWarningMsg= SessionReliabilityTTL=* [Network\Protocols] Address= UseAlternateAddress=* TransportDriver= ICAPortNumber= PhoneNumber= UseAreaAndCountry=* ; ; These settings handle the proxies used for connections ; [Network\Proxy] ProxyType= ProxyAutoConfigURL= ProxyBypassList= ProxyHost= ProxyPort=* ProxyUsername= ProxyPassword= ProxyTimeout=* WpadHost= AltProxyType= AltProxyAutoConfigURL= AltProxyBypassList= AltProxyHost= AltProxyPort=* AltProxyUsername= AltProxyPassword= AltProxyTimeout=* ICASOCKSProtocolVersion= ICASOCKSProxyHost= ICASOCKSProxyPortNumber=* ICASOCKSrfc1929Username= ICASOCKSrfc1929Password= ICASOCKSTimeout=* ProxyUseFQDN=* ProxyUseDefault=* ProxyFallback=* ProxyFavorIEConnectionSetting=* DoNotUseDefaultCSL=* ProxyAuthenticationBasic=* ProxyAuthenticationPrompt=* ProxyAuthenticationNTLM=* ; ; These settings handle automatic reconnection during network failure ; [Network\Reconnection] TransportReconnectEnabled=* TransportReconnectRetries=* ; ; These settings handle SSL and TLS cryptography ; ; SSLEnable - Enables and disables SSL or TLS ; ; SecureChannelProtocol ; - Choose between SSL or TLS ; [Network\SSL] SSLEnable=* SSLProxyHost= SSLPolicyExtensionOID= SSLCommonName= SSLNoCACerts=* SSLCACert0= SSLCACert1= SSLCACert2= SSLCACert3= SSLCACert4= SSLCACert5= SecureChannelProtocol= SSLCiphers= SSLCertificateRevocationCheckPolicy= SSLClientAuthentication= SSLClientCertificate= SSLSecurityComplianceMode= ; ; These settings handle the trusted server configuration feature which performs ; region identification. ; [Network\ClientSelectiveTrust] EnableClientSelectiveTrust=* ; ; These settings handle SecureICA encryption parameters ; [Network\Encryption] EncryptionLevelSession= EncryptionDLL= [Network\Compression] Compress=* ; ; These settings handle Multi-Stream configuration items ; [Network\Multi-Stream] MSIEnabled=* MSIMaxStreams=* ; ; These settings control the client functionality available to the server ; [Virtual Channels] ; ; These settings control the client audio virtual channels ; [Virtual Channels\Audio] ClientAudio=* AudioBandwidthLimit=* EnableAudioInput=* EnableAudioInputMode=* DisableAudioQueuing=* EnableRtpAudio=* RtpAudioLowestPort=* RtpAudioHighestPort=* EnableUDPThroughGateway=* HostRenderedAudio=* ; ; These settings control the keyboard settings ; [Virtual Channels\Keyboard] TransparentKeyPassthrough= AlwaysSendPrintScreen= LocalIME= KeyboardLayout= KeyboardType= KeyboardSendLocale=* KeyboardTimer=* UseEUKS=* ScancodeEnabled=* KeyboardMappingFile= UnicodeKeyboard= EchoShiftKeys=* KeyboardForceLEDUpdate=* SyncKbdLayoutList= DisableNewIme= ; ; These settings control the mouse settings ; [Virtual Channels\Mouse] ClientMouseDoubleClickDetect=* MouseTimer=* MouseWheelMapping= MouseSendsControlV= KeepUserInputInCGPDisconnect=* RelativeMouse= AllowMouseEventOnNoFocus= [Virtual Channels\Client Update] UpdatesAllowed=* ; ; These settings control the clipboard virtual channel ; [Virtual Channels\Clipboard] ClipboardAllowed=* ; ; These settings control access to client scanner and webcam devices ; [Virtual Channels\Image Capture] TwainAllowed=* [Virtual Channels\DVC_PlugAndPlay] PNPDeviceAllowed=* POSDeviceAllowed=* ; ; These settings control access to client file systems ; ; CDMAllowed - enables or disables filesystem access ; DisableDrives - lists client filesystems that should not be mapped to ; the server ; CDMReadOnly - allow only read only access to client filesystems ; SFRAllowed - enable or disable Client local special folder mapping. ; My Document or My Desktop. ; [Virtual Channels\Drives] CDMAllowed=* DisableDrives= CDMReadOnly=* ClientDrive=* SFRAllowed=* NativeDriveMapping=* DynamicCDM=* ; ; These settings are used only on Unix platforms where the directory ; structure needs to be mapped to a Windows equivalent. ; [Virtual Channels\Drives\Device] DrivePathA= DriveEnabledA= DriveReadAccessA= DriveWriteAccessA= DrivePathB= DriveEnabledB= DriveReadAccessB= DriveWriteAccessB= DrivePathC= DriveEnabledC= DriveReadAccessC= DriveWriteAccessC= DrivePathD= DriveEnabledD= DriveReadAccessD= DriveWriteAccessD= DrivePathE= DriveEnabledE= DriveReadAccessE= DriveWriteAccessE= DrivePathF= DriveEnabledF= DriveReadAccessF= DriveWriteAccessF= DrivePathG= DriveEnabledG= DriveReadAccessG= DriveWriteAccessG= DrivePathH= DriveEnabledH= DriveReadAccessH= DriveWriteAccessH= DrivePathI= DriveEnabledI= DriveReadAccessI= DriveWriteAccessI= DrivePathJ= DriveEnabledJ= DriveReadAccessJ= DriveWriteAccessJ= DrivePathK= DriveEnabledK= DriveReadAccessK= DriveWriteAccessK= DrivePathL= DriveEnabledL= DriveReadAccessL= DriveWriteAccessL= DrivePathM= DriveEnabledM= DriveReadAccessM= DriveWriteAccessM= DrivePathN= DriveEnabledN= DriveReadAccessN= DriveWriteAccessN= DrivePathO= DriveEnabledO= DriveReadAccessO= DriveWriteAccessO= DrivePathP= DriveEnabledP= DriveReadAccessP= DriveWriteAccessP= DrivePathQ= DriveEnabledQ= DriveReadAccessQ= DriveWriteAccessQ= DrivePathR= DriveEnabledR= DriveReadAccessR= DriveWriteAccessR= DrivePathS= DriveEnabledS= DriveReadAccessS= DriveWriteAccessS= DrivePathT= DriveEnabledT= DriveReadAccessT= DriveWriteAccessT= DrivePathU= DriveEnabledU= DriveReadAccessU= DriveWriteAccessU= DrivePathV= DriveEnabledV= DriveReadAccessV= DriveWriteAccessV= DrivePathW= DriveEnabledW= DriveReadAccessW= DriveWriteAccessW= DrivePathX= DriveEnabledX= DriveReadAccessX= DriveWriteAccessX= DrivePathY= DriveEnabledY= DriveReadAccessY= DriveWriteAccessY= DrivePathZ= DriveEnabledZ= DriveReadAccessZ= DriveWriteAccessZ= ; ; These settings handle streaming video and audio features ; [Virtual Channels\Multimedia] SpeedScreenMMA=* SpeedScreenMMAVideoEnabled=* SpeedScreenMMAAudioEnabled=* SpeedScreenMMASecondsToBuffer=* SpeedScreenMMAMaximumBufferSize=* SpeedScreenMMAMinBufferThreshold=* SpeedScreenMMAMaxBufferThreshold=* SpeedScreenMMAPlaybackPercent=* SpeedScreenMMACsfEnabled=* ; ; These settings handle printers connected to the client device ; [Virtual Channels\Printing] CPMAllowed=* VSLAllowed=* Win32FavorRetainedPrinterSettings=* ; ; These settings are used only on Unix platforms where the printing ; infrastructure needs to be mapped to a Windows equivalent. ; [Virtual Channels\Printing\Device] ClientPrinterList= UnixPrintCommand= MFPrintCommand= DefaultPrinter= DefaultPrinterDriver= PrinterQueryRefreshTime= ; ; These settings handle devices connected to the client serial port ; [Virtual Channels\Serial Port] COMAllowed=* VirtualCOMPortEmulation=* ContinueWithoutPDALockFile=* MaxPort=* ; ; These settings are used only on Unix platforms where the COM port ; devices need to be mapped to a Windows equivalent. ; [Virtual Channels\Serial Port\Device] LastComPortNum= ComPort1= ComPort2= ComPort3= ComPort4= ComPort5= ComPort6= ComPort7= ComPort8= ComPort9= ComPort10= ComPort11= ComPort12= ComPort13= ComPort14= ComPort15= ComPort16= ComPort17= ComPort18= ComPort19= ComPort20= ComPort21= ComPort22= ComPort23= ComPort24= ComPort25= ComPort26= ComPort27= ComPort28= ComPort29= ComPort30= ComPort31= ComPort32= ; ; These settings handle the integration of remote application windows ; with applications running on the local machine ; [Virtual Channels\Seamless Windows] TWIMode=* RTWIMode=* DisableMMMaximizeSupport=* TWIIgnoreWorkArea=* SetTWIFocusOnTitled=* DeferredUpdateMode=* UpdateTime=* TWIShrinkWorkArea=* TWITaskbarGroupingMode= TopMostonFullScreen=* EnablePreviewForMultiMonitor=* ; ; These settings handle access to client smartcard devices ; [Virtual Channels\Smartcard] SmartCardAllowed=* DisableCtrlAltDel=* ReadersStatusPollPeriod= ResMngrRunningPollPeriod= ; ; These settings control the graphics compression options ; [Virtual Channels\Thinwire Graphics] DesiredColor=* DesiredHRES=* DesiredVRES=* DesiredHPos= DesiredVPos= DefaultMaximizedPos= SpanMonitors=* DesiredWinType=* ScreenPercent=* UseFullScreen=* TWIFullScreenMode=* NoWindowManager=* PersistentCacheEnabled=* PersistentCachePath= PersistentCacheSize=* PersistentCacheMinBitmap=* TWIDesiredIconColor=* GraphicCacheSize=* SpeedScreenIA=* SpeedScreenBA=* SpeedScreenBACompressionEnabled=* SpeedScreenBADecompressedCacheSize=* SpeedScreenBACompressedCacheSize=* SpeedScreenBAMaximumCompressionLevel=* TW2StopwatchMinimum=* EnableOSS=* TwRedundantImageItems=* EnableAtomicDisplay=* WinSetting=* PreferredLaunchMonitor=* FontSmoothingType=* EnableUDPGraphicsThroughGateway=* UDPGraphicsSTUNAllocRefreshInterval=* UDPGraphicsSTUNPermsRefreshInterval=* UDPGraphicsLowestClientPort=* UDPGraphicsHighestClientPort=* UDPGraphicsSocketBufferSize=* EnableFpsLimit=* PreferredGraphicsMode=* ; ; These settings control third party ICA client extensions ; [Virtual Channels\Third Party] AllowVirtualDriverEx=* AllowVirtualDriverExLegacy=* ; ; These settings control mouse and keyboard prediction ; [Virtual Channels\Zero Latency] ZLKeyboardMode=* ZLMouseMode=* ; ; These settings provide user experience metrics to the server ; [Virtual Channels\End User Experience] startSCD= startIFDCD= endIFDCD= CFDCD= COCD= AECD= RECD= REWD= NRWD= TRWD= LPWD= BUCC= [Virtual Channels\Control] CREnabled=* ClientHostedAppsShortcuts=* ClientHostedApps=* ClientHostedAppsURLEnabled=* ClientHostedAppsFTAEnabled=* NWHostedAppEnabled=* AllowHotKey=* ; ; These settings control XenDesktop features. ; [XenDesktop] DesktopRestartAllowed=* ; ; These settings handle the transport protocol for Receiver ; [Network\EDT] HDXOverUDP= edtMSS=* edtRCVBUF=* edtSNDBUF=* edtFlightFlagSize=* edtUDPRCVBUF=* edtUDPSNDBUF=* edtNSGHAFTimeout=* OutBufLength=* ; ; Region preferences. Note that unlike the lockdown section, these settings are not ; always used for connections. ; [Preferences]