Citrix ComponentsThe group policies in this folder can be used to manage your Citrix Systems Access Infrastructure.Citrix ComponentsThis group policy can be used to to manage your Citrix clients.Remoting client devicesThese policies control how the server accesses client machine resources. The Citrix Workspace app can be configured to allow remote applications to use disk-drives, printers, etc. as if running on the client machine.Enable ICA File SigningOnly allow signed launches (more secure)Prompt user on unsigned launches (less secure)Use this policy to enable and configure ICA File Signing.Generic USB RemotingUSB Device RulesUsed to specify which USB devices are allowed or denied.
Each rule is case-insensitive and of the form {Allow: | Deny:} followed by any number of <tag>=<value> qualifiers. Multiple rules should be separated by semicolons. Comments start at '#' and continue until a semicolon.
For example 'Allow: VID=1234 PID=5678 # Comment ; Deny: Class=03'.
Supported tags are VID, PID, REL, CLASS, SUBCLASS, PROT.RemoveOnLockSpecifies devices or classes to remove when the client machine is locked.
Syntax:
Each device is case-insensitive and of the form
VID=XXX PID=XX;VID=YYY PID=YY
Each class is case-insensitive and of the form
class=XXX subclass=XX prot=X
Example:
class=03 subclass=01 prot=01;VID=173E PID=0046
Default Behavior:
HID Keyboards and Mouse (class=03 subclass=01 prot=01;class=03 subclass=01 prot=02;class=03 subclass=00 prot=01;class=03 subclass=00 prot=02) are removed and auto redirected during client lock and unlock.
SplitDevicesSplit Interfaces of composite device as separate devices.Semicolon-separated list of USB device rules.USB Device RulesRemoveOnLockSplitDevicesExisting USB DevicesEnableUSBForceRedirectionAllows automatic force redirection of devices which are in use on the client. EnableUSBForceRedirection_ValueChoose what happens to available USB devices when a session is started. This setting overrides the user's preference.When desktop startsConnect all available USB devicesDisplay message and let user chooseDo nothingNew USB DevicesChoose what happens when a USB device is inserted during a session. This setting overrides the user's preference.When a USB device is insertedConnect the USB deviceDisplay message and let user chooseDo nothingUSB Devices List In Desktop ViewerChoose whether USB devices that can be connected using alternative HDX technologies should appear in USB Devices list.
Devices that can be connected using other HDX technologies include simple USB drives, webcams, scanners, printers, and audio devices.
This setting overrides the user's preference.Hide USB devices that can be connected using other HDX technologiesRedirect Unknown USB DevicesAllow/Reject Redirecting Unknown USB Devices.
USB devices for which device drivers are not installed on the endpoint will be shown as unknown USB devices in Windows Device Manager.
Redirect Unknown USB DevicesDisabledDetect versionSOCKS v4SOCKS v5Detect versionTLS1.0 | TLS1.1 | TLS1.2Detect versionGovernmentCommercialDefaultDisabledOnly check locally stored CRLsRetrieve CRLs from networkRequire CRLs for connectionNot ConfiguredDisplay certificate selectorDisabledUse specified certificateSelect automatically if possibleHighMediumLow16-bit color32-bit color50%YesNo, use the native resolution75%OtherAccess Local DesktopAccess Remote SessionAccess Remote Session in full-screen only<Disabled>AltCtrlShift<Disabled>F1F10F11F12F2F3F4F5F6F7F8F9minusplusstartab<Disabled>AltCtrlShift<Disabled>F1F10F11F12F2F3F4F5F6F7F8F9minusplusstartab<Disabled>AltCtrlShift<Disabled>F1F10F11F12F2F3F4F5F6F7F8F9minusplusstartab<Disabled>AltCtrlShift<Disabled>F1F10F11F12F2F3F4F5F6F7F8F9minusplusstartab<Disabled>AltCtrlShift<Disabled>F1F10F11F12F2F3F4F5F6F7F8F9minusplusstartab<Disabled>AltCtrlShift<Disabled>F1F10F11F12F2F3F4F5F6F7F8F9minusplusstartab<Disabled>AltCtrlShift<Disabled>F1F10F11F12F2F3F4F5F6F7F8F9minusplusstartab<Disabled>AltCtrlShift<Disabled>F1F10F11F12F2F3F4F5F6F7F8F9minusplusstartab<Disabled>AltCtrlShift<Disabled>F1F10F11F12F2F3F4F5F6F7F8F9minusplusstartab<Disabled>AltCtrlShift<Disabled>F1F10F11F12F2F3F4F5F6F7F8F9minusplusstartabDisabledDetect versionSOCKS v4SOCKS v5Detect versionTLS1.0 | TLS1.1 | TLS1.2Detect versionGovernmentCommercialDefaultNoCheckCheck with no network accessFull Access CheckFull access check and CRL requiredNot ConfiguredDisplay certificate selectorDisabledUse specified certificateSelect automatically if possibleDisabledLaunchRefreshLaunch, RefreshOpenLaunch, OpenRefresh, OpenRefresh, Open, LaunchWinLogonWinLogon, LaunchWinLogon, RefreshWinLogon, Refresh, LaunchWinLogon, OpenWinLogon, Open, LaunchWinLogon, Open, RefreshAll Options<Disabled>AltCtrlShift<Disabled>F1F10F11F12F2F3F4F5F6F7F8F9minusplusstartabHighMediumLow16-bit color32-bit color50%75%OtherAccess Local DesktopAccess Remote SessionAccess Remote Session in full-screen only<Disabled>ShiftCtrlAlt<Disabled>tabstarplusminusF1F2F3F4F5F6F7F8F9F10F11F12<Disabled>ShiftCtrlAlt<Disabled>tabstarplusminusF1F2F3F4F5F6F7F8F9F10F11F12<Disabled>ShiftCtrlAlt<Disabled>tabstarplusminusF1F2F3F4F5F6F7F8F9F10F11F12<Disabled>ShiftCtrlAlt<Disabled>tabstarplusminusF1F2F3F4F5F6F7F8F9F10F11F12<Disabled>ShiftCtrlAlt<Disabled>tabstarplusminusF1F2F3F4F5F6F7F8F9F10F11F12<Disabled>ShiftCtrlAlt<Disabled>tabstarplusminusF1F2F3F4F5F6F7F8F9F10F11F12<Disabled>ShiftCtrlAlt<Disabled>tabstarplusminusF1F2F3F4F5F6F7F8F9F10F11F12<Disabled>ShiftCtrlAlt<Disabled>tabstarplusminusF1F2F3F4F5F6F7F8F9F10F11F12<Disabled>ShiftCtrlAlt<Disabled>tabstarplusminusF1F2F3F4F5F6F7F8F9F10F11F12<Disabled>ShiftCtrlAlt<Disabled>tabstarplusminusF1F2F3F4F5F6F7F8F9F10F11F12NONEFIPSSP800-52AnyTLSRegulated(Secure)AnyTLS1.3TLS1.2 | TLS1.3TLS1.0 | TLS1.1 | TLS1.2TLS1.2TLS1.1 | TLS1.2Full access check and CRL required AllDisable Application Display TabDisable Reconnect Options TabDisable Entire UIA:AlwaysS:SecureN:Never<Disabled>ShiftCtrlAlt<Disabled>tabstarplusminusF1F2F3F4F5F6F7F8F9F10F11F12AutoNoneSOCKSSOCKSv4SOCKSv5SecureScriptTrustedIntranetTrusted,IntranetCitrix Workspace UpdatesNot Configured – Citrix Workspace Updates is enabled.
Enabled – Citrix Workspace Updates is enabled with the additional options listed in this dialog.
Disabled – Citrix Workspace Updates option is hidden from the Advanced Preferences sheet and you will not receive any update notifications.
Enable Citrix Workspace Update Policy:
Auto = Citrix Workspace checks for updates automatically.
Manual = User checks for updates manually.
LTSR ONLY:
True = Only LTSR updates will be available.
Migrate 32-bit application to a native 64-bit version on 64-bit operating systems:
When checked, the auto-updates upgrade Citrix Workspace from 32-bit to 64-bit application to ensure compatibility and optimal performance on 64-bit systems. By default, updates keep the current architecture.
AutoManualSet the Delay in Checking for UpdateThis policy is used to set the preference when the Citrix Workspace-update is rolled-out to the users.
- (fast)- Available updates are rolled-out to the users at the beginning of delivery period.
- (Medium)- Available updates are rolled-out to the users at mid-delivery period
- (Slow)- Available updates are rolled-out to the users at the end of delivery period.
FastMediumSlowAutomatic update timeframeSpecify the time of day when Workspace updates get pushed to end users.
- Start Time- Time from which Citrix Workspace can begin to check for updates (Time format : 24 hour in HH:MM).
- End Time- Time beyond which Citrix Workspace shouldn't do any check for updates(Time format : 24 hour in HH:MM).
- Defer Count- Number of times Citrix Workspace app can defer updates within a specified time period, if the app is not idle. The default value for this policy is 3.
Example:
Start Time - 17:30
End Time - 18:30
Defer Count - 6
Workspace app versionWhen enabled, Citrix pushes an automatic update to end users when the Citrix Workspace app is installed. The update can be the latest or a specific version.
- Workspace App Version- To manage the version, specify the Citrix Workspace App version.
- Upgrade To Latest Version- If enabled, the most recent version will be installed and above parameters will be ignored.
- Preferred Start Date- The date on which Citrix Workspace can begin pushing updates. (Date format : YYYY-MM-DD).
- Preferred Delivery Period- Delivery window in days.
Example:
Workspace App Version - 24.10.1.5
Preferred Start Date - 2024-11-27
AllowPreventCitrix WorkspaceThe Citrix Workspace app is used to connect to remote applications and desktops in server farms.Network routingThese policies can be used to control how the Citrix Workspace routes its connections to a server farm.User authenticationThese policies control how the Citrix Workspace authenticates its user to a remote application or desktop.User experienceThe Citrix Workspace can be configured to interact with client machine applications in different ways. These settings can be used to control how client machines present remote applications and desktops to the user.Hardware Acceleration for graphicsUse this policy to enable or disable the use of hardware acceleration (GPU) for remote graphics. When not configured the use of hardware acceleration is enabled on non-embedded GPUs. When enabled, Citrix Workspace will attempt to use the client GPU to accelerate the remote graphics. On client devices that do not support this feature it is disabled silently.H265 Decoding for graphicsUse this policy to enable or disable the use of H265 decoding for remote graphics. When not configured the use of H265 decoding is not attempted.When enabled, Citrix Workspace will attempt to use the client GPU to decode using H265 decoder as long the as server supports H265 encoding. On client devices that do not support this feature it is disabled silently and reverts back to H264ProxyThe Citrix Workspace can be configured to use specific proxy routing for remote application and desktops. These settings allow client proxies to be configured independently of other programs on the client machine.Advance Preferences OptionsEnable/Disable Options present in Advance PreferencesTroubleshooting OptionsEnable/Disable Options present in TroubleshootingClient EngineThe Citrix Workspace can be configured to interact with client engine configuration properties like ICA File SettingsMulti-Stream ICAThis policy allows you to configure multiple connections to carry the ICA traffic between the client and the server.SelfServiceThese policies control SelfServicePlugin settingsApp ProtectionThese policies control App Protection settingsAnti-DLL InjectionThese policies control Anti-DLL Injection settings for Citrix ComponentsCitrix Enterprise BrowserThese policies control Citrix Enterprise Browser settingsReal-time transportReal-time transportReal-time transport through NetScaler GatewayReal-time transport through NetScaler GatewaySecurity preferencesThese policies control security aspects for citrix workspace.Allow client connectionsUse this policy to enable or completely disable connections from the Citrix Workspace app.
When this policy is not configured, the client will allow connection to servers.
When this policy is enabled, the client will only connect to a server if the "Enable client" option is selected, and if its version number is greater or equal to the "Minimum client version".
When the policy is disabled, the client will not allow connections to any servers.
Troubleshooting:
If a connection is refused because the client is not enabled, the error message "<Server> ERROR: Cannot connect to the Citrix XenApp server. The Server (…) is not trusted for ICA connections. Connections to the (All Regions) Region are not allowed by lockdown settings. Please contact your administrator." appears.
If the client does not allow a connection because the version number is too low, the error message "Error number 2321: ICA Client Configuration Manager: The ICA Client version is too low to run using the installed configuration data." appears.Enable clientMinimum client versionConfigure client proxy settingsEnable this policy to configure the primary network proxies that the client can use to connect to remote application or desktop.
From the Proxy Type drop-down menu, select:
- Auto: To enable the client to use the local machine settings to determine the proxy server.
- None: To enable the client to connect to the server directly without using a proxy server.
- Script: To enable the client to retrieve a Java based .pac file from the URL specified in the proxy script URLs. The .pac file is executed to identify the proxy server used for connection.
- Secure: When "Secure" is selected, the client will contact the proxy identified by the "Proxy host names" and "Proxy ports" settings. The negotiation protocol will use a "HTTP CONNECT" header request specifying the desired destination address. This proxy protocol is commonly used for HTTP based traffic, and supports GSSAPI proxy authentication.
- SOCKS/SOCKS V4/SOCKS V5: When a "SOCKS" proxy is selected, the client will perform a SOCKS V4 or SOCKS V5 handshake to the proxy identified by the "Proxy hostnames" and "Proxy ports" settings. The "SOCKS" option will detect and use the correct version of Socks.
To enable proxy server bypass, select Bypass Server list.
Troubleshooting:
Some client platforms do not support the "Auto" proxy type due to operating system limitations. See the appropriate Administrator's Guide for details. For these platforms, the proxy settings should be manually set on the client device.
When configuring the Web Interface server, an appropriate proxy server can be indicated for the particular location of the client. When configuring proxies via Group Policy, it is important to avoid overriding these settings. Where multiple proxies can be chosen, simply use a comma-separated list of options with the first being the default.
Most Intranet client deployments should use the "None" option for the proxy type, otherwise the client may attempt to connect over the Internet. For more advanced deployments the "Bypass server list" option can be used, alternatively ".pac" scripts or Trusted Server Configuration are available to suit the network topology.
Some proxy servers will automatically disconnect connections that are idle for a certain length of time. This can cause client sessions to be disconnected when not in use. A server-side option "ICA Keep-Alive" is available to send extra data packets during periods of inactivity that can be used prevent proxies closing connections.Proxy typesProxy host namesProxy portsProxy script URLsBypass server listConfigure Client failover proxy settingsUse this policy to configure alternative network proxies that the client can use if the primary network proxy fails to connect to a remote application or desktop.
When this policy is not configured, the client will use its own settings to decide whether to connect through a proxy server.
When this policy is enabled, the client will attempt a connection using an alternative proxy if connection to a primary proxy fails. The failover proxy settings operate in an identical fashion to the primary proxy settings.
If both the primary and alternative proxy fail to service the connection, selecting the "Failover to direct" check box instructs the client to attempt a final direct connection with no proxies.
Troubleshooting:
Some proxy failures can make the client appear to hang on connection. This is usually due to the proxy server reattempting the connection itself, or having a long time-out period. Depending on the network topology, it may be preferable to configure the Web Interface server to identify the currently functioning proxy, or alter the proxy server time-out settings.Proxy typesProxy host namesProxy portsProxy script URLsBypass server listFailover to directConfigure SOCKS proxy settingsUse this policy to configure the use of additional SOCKS proxies that are required for some advanced network topologies.
When enabled, the client will examine the "SOCKS protocol version" setting. If connection via SOCKS is not disabled, the client will attempt to connect using the SOCKS proxy specified by the "Proxy host names" and "Proxy ports" settings.
The client supports connections using either SOCKS v4 or SOCKS v5 proxy servers. Alternatively, it can attempt to automatically detect the version being used by the proxy server.
Troubleshooting:
The SOCKS proxy settings are designed for traversing a proxy in addition to the primary or alternative proxy server. When traversing only a single proxy, these SOCKS proxy settings should be disabled.SOCKS protocol versionProxy host namesProxy portsConfigure proxy authenticationUse this policy to control the authentication mechanisms that the client uses when connecting to a proxy server. Authenticating proxy servers can be used to monitor data traffic in large network deployments.
In general, authentication is handled by the operating system but in some scenarios, the user may be provided with a specific user name and password. To prevent the user from being specifically prompted for these credentials, clear the "Prompt user for credentials" check box. This will force the client to attempt an anonymous connection. Alternatively, you can configure the client to connect using credentials passed to it by the Web Interface server, or these can be explicitly specified via Group Policy using the "Explicit user name" and "Explicit password" options.
Troubleshooting:
In general NTLM proxy authentication will be performed under the control of the Domain Controller, and cannot be controlled by the client. Both client and proxy will need to be configured with the appropriate domain level trust relations.
Proxy authentication cannot be linked to the pass-through authentication feature of the client. In general, the proxy password will be unrelated to user's passwords.Prompt user for credentialsAllow clear text authenticationAllow NTLM hash authenticationExplicit user nameExplicit passwordSession reliability and automatic reconnection"This policy configures client behaviour in case of network failure.
To set the reconnection to , select:
Enable automatic reconnection : In case of network failure, the client automatically attempts to reconnect to a server
Enable session reliability: In case of network failure, the client attempts reconnection to an SSL/TS server.
NOTE: If both Enable Automatic reconnection and Enable session reliability is selected, the client by default selects the option Enable session reliability in case of network failure.
NOTE: If this policy is enabled and none of the options are selected, the policy is not enforced.
Transparency Level: The transparency level applied to XA/XD session during session reconnection.
Setting 0 indicates that XA and XD will be turned to black window at the session reconnection.
Setting 100 indicates that no transparency layer will be applied (frozen screen)
Troubleshooting:
Some proxy servers automatically disconnect connections that are idle for a certain length of time. This can cause client sessions to be disconnected when not in use. A server-side option ""ICA Keep-Alive"" is available to send extra data packets during periods of inactivity that can be used prevent proxies from closing connections. "
Enable automatic reconnectionEnable session reliability (has precedence if both are selected)Transparency LevelTLS and Compliance Mode ConfigurationDeprecated cipher suitesThis option enables Citrix Workspace to identify secure connections and encrypt communication within the server.
Following are the type of TLS secure connection between Citrix Workspace and XenApp and XenDesktop that Citrix supports:
1. TLS 1.2
2. TLS 1.3
TLS 1.0 and 1.1 support has been dropped, but the options are still offered via the policy for compatibility purposes.
The Security Compliance Mode values are:
- FIPS - Enabling FIPS mode forces Windows operating system and its sub-systems to use only FIPS-validated cryptographic algorithms.
- None - No compliance mode is enforced.
- SP800-52 - NIST SP800-52r1 compliance is enforced.
When you select SP800-52 from the Security Compliance Mode drop down , the following Certificate Revocation Check Policy (CRCP) is allowed:
-Full Access Check And CRL Required. This is the default option.
-Full Access Check And CRL Required All
You can restrict Citrix Workspace to connect only to a specified server/s by a comma separated list in the Allowed TLS servers option Wildcards and port numbers can be specified here, for example, *.citrix.com:4433 allows connection to any server whose common name ends with .citrix.com on port 4433. The accuracy of the information in a security certificate is asserted by the certificate's issuer. If Citrix Workspace does not recognize and trust a certificate's issuer, the connection is rejected.
The TLS version can be restricted to any combination of:
- TLS 1.2 or TLS 1.3 (Any supported TLS)
- TLS 1.2 only
- TLS 1.3 only
TLS cipher set is a group of cipher suites allowed by the client. The TLS cipher set can be configured to one of the following:
Note: The TLS_RSA_* cipher suites can be disabled using the Deprecated cipher suites policy.
- Any : When "Any" is set, the following cipher suites are allowed in the NONE compliance mode by default:
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_EMPTY_RENEGOTIATION_INFO_SCSV
- Commercial: When "Commercial" is set only the following cipher suites are allowed:
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_EMPTY_RENEGOTIATION_INFO_SCSV
- Government: When "Government" is set only the following cipher suites are allowed:
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
* TLS_EMPTY_RENEGOTIATION_INFO_SCSV
The Certificate Revocation Check is used to improve the cryptographic authentication of the Citrix server and improves the overall security of the TLS connections between a client and a server.
Note: Certificate Revocation Check is valid only when SP800-52 Security Compliance mode is set.
When you enable this setting, the client checks whether or not the server’s certificate is revoked. There are several levels to checking certificate revocation list. For example, the client can be configured to check only its local certificate list, or to check the local and network certificate lists. In addition, certificate checking can be configured to allow users to log on only if all Certificate Revocation lists are verified.
Certificate Revocation Check is an advanced feature supported by some certificate issuers. It allows an administrator to revoke security certificates (invalidated before their expiry date) in the case of compromise of the certificate private key.
Applicable values for this setting are:
- NoCheck - No Certificate Revocation check is performed.
- Check With No Network Access - Certificate revocation check is performed. Only Stores in the local certificate revocation list are used. All distribution points are ignored. Finding a Certificate Revocation List is not critical for verification of the server certificate presented by the target SSL Relay/Secure Gateway server.
- Full Access Check - Certificate Revocation check is performed. Local Certificate Revocation List stores and all distribution points are used. If revocation information for a certificate is found, the connection will be rejected. Finding a Certificate Revocation List is not critical for verification of the server certificate presented by the target server.
- Full Access Check And CRL Required - Certificate Revocation List check is performed, excluding the root CA. Local Certificate Revocation List stores and all distribution points are used. If revocation information for a certificate is found, the connection will be rejected. Finding all required Certificate Revocation Lists is critical for verification.
- Full Access Check And CRL Required All - Certificate Revocation List check is performed, including the root CA. Local Certificate Revocation List stores and all distribution points are used. If revocation information for a certificate is found, the connection will be rejected. Finding all required Certificate Revocation Lists is critical for verification.
Organizations that configure TLS for a range of products can choose to identify servers intended for Citrix Workspace by specifying a Certificate Policy Extension OID as part of the security certificate. If a Policy Extension OID is configured here, Citrix Workspace accepts only certificates that declare a compatible policy.
When connecting using TLS, the server may be configured to require Citrix Workspace to provide a security certificate identifying itself. Use the "Client Authentication" setting to configure whether or not identification is provided automatically or if the user is notified. Options include:
- Disabled - Client Authentication is disabled
- Display certificate selector - Always prompt the user to select a certificate.
- Select automatically if possible - Prompt the user only if there a choice of certificate to supply
never supply identification
-Not configured - Client Authentication is not configured. Default behaviour is applied.
- Use specified certificate - Use the Client Certificate specified in the setting below
Use the "Client Certificate" setting to specify the identifying certificate's thumbprint to avoid prompting the user unnecessarily.
Require TLS for all connectionsAllowed TLS serversPolicy Extension OIDTLS versionTLS cipher setCertificate Revocation Check PolicyClient AuthenticationClient CertificateConfigure trusted server configurationConfigure trusted server configuration for x86 machinesConfigure trusted server configuration for x64 machinesUse this policy to control how the client identifies the published application or desktop it is connecting to. The client will determine a trust level, called a ""trust region"" with a connection. The trust region will then determine how the client is configured for the connection.
When this policy is enabled, the client can be forced to perform region identification using the "Enforce trusted server configuration" option.
By default, region identification is based on the address of the server the client is connecting to. To be a member of the trusted region, the server must be a member of the Windows Trusted Sites zone. You can configure this using the "Windows Internet zone" setting.
Alternatively, for compatibility with non-Windows clients, the server address can be specifically trusted using the "Address" setting. This is a comma-separated list of servers supporting the use of wildcards, for example, cps*.citrix.com.
Troubleshooting:
In the default configuration, when trusted server configuration prevents the client from connecting, the following error message is displayed:
"<Server> ERROR: Cannot connect to the Citrix XenApp server. The server (xxx) is not trusted for ICA connections. Connections to the (Untrusted Region) Region are not allowed by lockdown settings. Please contact your administrator."
The server identified in the "xxx" must be added to the Windows Trusted Sites zone (as either http:// or https:// for SSL connections) for the connection to succeed.
Note that for SSL connections, the certificate common name must be trusted. For non-SSL connections all servers that are contacted must be individually trusted. This means that when using application browsing, both the XML service and the server this redirects to must be trusted.
Windows internet zoneAddressEnforce trusted server configurationSmart card authenticationUse this policy to control how the client uses smart cards attached to the client device.
When enabled, this policy allows the remote server to access smart cards attached to the client device for authentication and other purposes.
When disabled, the server cannot access smart cards attached to the client device.
Troubleshooting:
When using smart cards in a Citrix environment, the smart card device driver must be installed on the server. When using a different operating system on the client machine, it may be necessary to ensure that the smart card device drivers in use interoperate correctly.Allow smart card authenticationUse pass-through authentication for PINWeb Interface authentication ticketUse this policy to control the ticketing infrastructure used when authenticating through the Web Interface.
When this policy is enabled, legacy Web Interface ticketing can be disabled by clearing the "Legacy ticket handling" check box. Legacy Web Interface ticketing was implemented by passing a single-use authentication cookie to the server in the ClearText password field.
Starting with version 4.5 of the Web Interface, the client handles an authentication token in the form of an opaque LogonTicket with an associated interpretation defined by the LogonTicketType. This functionality can be disabled by clearing the "Web Interface 4.5 and above" check box.Legacy ticket handlingWeb Interface 4.5 and aboveKerberos authenticationUse this policy to control how the client uses Kerberos to authenticate the user to the remote application or desktop.
When enabled, this policy allows the client to authenticate the user using the Kerberos protocol. Kerberos is a Domain Controller authorised authentication transaction that avoids the need to transmit the real user credential data to the server.
When disabled, the client will not attempt Kerberos authentication.
Troubleshooting:
The machine running the client and the server running the remote application must be in domains that have a trust relationship. The Domain Controller must be aware that the Citrix XenApp server will be performing a full user logon (interactive logon) using Kerberos. This is configured using the "Trust for Delegated Authentication" settings on the Domain Controller.
When connecting using the Web Interface, the Web Interface server must be aware that the client will connect using Kerberos authentication. This is necessary because by default the Web Interface server will use an IP address for the destination server whereas Kerberos authentication requires a Fully Qualified Domain Name.
Both client and server machines must have correctly registered DNS entries. This is necessary because endpoints will authenticate each other during connection.Single Sign-on for NetScaler GatewayUse this policy to allow the Workspace to use the same log on credentials (pass-through authentication) on NetScaler Gateway.Enhanced Domain passthrough for single sign-onThis policy allows Citrix Workspace app to use Enhanced Domain passthrough for single sign-on. When this policy is enabled, the sign-in credentials (pass-through authentication) from the local machine are used to authenticate to the remote server without exchanging the actual username and password.
This policy requires VDA version 2308 or later.Disable all file type association stub creationWhen enabled, all stub types are not created by default when an application has a file type association. When disabled, stubs are created for applications and desktops with a file type association (legacy behavior).Prevent storing persistent cookiesThis policy disallows storing persistent cookies on stores that use WebView authentication.
This policy is effective even when you select the option to store credentials.
Enabled indicates that the cookies are not stored or used across sessions. The user credentials are not saved. Also, Citrix Workspace app does not clear the Internet Explorer (IE WebBrowserControl) cookies.
Disabled or Not Configured indicates that the persistent cookies are stored and credentials are saved during authentication.Local user name and passwordUse this policy to instruct the client to use the same logon credentials (pass-through authentication) for the Citrix XenApp server as the client computer.
When this policy is enabled, the client can be prevented from using the current user's logon credentials to authenticate to the remote server by clearing the "Enable pass-through authentication" check box.
The client imposes certain restrictions specifying when pass-through authentication can occur (for details, see Citrix eDocs at http://support.citrix.com/proddocs/). If these restrictions are too strict for your environment, select the "Allow pass-through authentication for all ICA connections" check box to bypass the pass-through authentication restrictions.
When run in a Novell Directory Server environment, selecting the "Use Novell Directory Server credentials" check box requests that the client uses the user’s NDS credentials.
Troubleshooting:
To enable pass-through authentication, the client must have been installed by an administrator, and the "Allow Local Credential Pass-through" option must have been selected at that time.
Each user can choose to disable pass-through authentication through the client registry settings, the Program Neighbourhood window, or by editing their copy of AppSrv.ini. To enable pass-through authentication, the user's copy of AppSrv.ini must contain the setting "EnableSSonThruICAFile=true".Enable pass-through authenticationAllow pass-through authentication for all ICA connectionsUse Novell Directory Server credentialsClient drive mappingUse this policy to enable and restrict the remote application or desktop's access to the client file systems.
When enabled, the client will completely deny client drive mapping (CDM) virtual channel access to the client's file system if the check box "Enable client drive mapping" is not selected. This stops the DLL implementing the client drive mapping virtual channel (vdcdmn.dll) from loading on client start up. At this point, you can delete the DLL from the client package.
If CDM is enabled, further options are available to restrict the type of access available to the server. If the "Read-only client drives" check box is selected, the CDM virtual channel only permits read access to client drives.
Access to Windows drives can be disabled by entering the relevant drive letter in the "Do not map drives" box. This is a concatenation of all drives that should not be mapped when connecting to a published application or desktop, for example "ABFK" disables the drives A, B, F and K.
Troubleshooting:
These policies override selections made by users in the File Security dialog boxes of the Desktop Viewer. For information on how to prevent users from changing selections in the Client Connection Center, see the Citrix Knowledge Center.Enable client drive mappingRead-only client drivesDo not map drivesClient printersUse this policy to enable and restrict the remote application or desktop's access to client printers.
When this policy is disabled, the client prevents the server from accessing or printing to printers available to the client device.Map client printersClient hardware accessUse this policy to specify maximum number of serial ports supported by the client platform.
Also, use this policy to enable and restrict the remote application or desktop's access to the client’s serial, USB, and parallel ports. This allows the server to use locally attached hardware.
Troubleshooting:
Remote PDA synchronization uses "virtual COM ports". These are serial port connections that are routed through USB connections. It is necessary to enable serial port access to use PDA synchronization for this reason.Maximum serial portsMap serial portsAllow PDA synchronizationMap parallel portsImage captureUse this policy to enable and restrict the remote application or desktop's access to scanners, webcams, and other imaging devices on the client device.Client microphoneUse this policy to enable and restrict the remote application or desktop's access to local audio capture devices (microphones).Enable client microphoneClipboardUse this policy to enable and restrict the remote application or desktop's access to the client clipboard contents.Enable clipboardDragDropUse this policy to enable and restrict the remote application or desktop's access to the drag and drop functionality.Enable DragDropUSB Plug-n-Play DevicesUse this policy to enable and disable published application or desktop access to the client USB Plug-n-Play devices. The Not Configured setting allows device access until you explicitly enable or disable access.Enable PNPUSB Point of Sale DevicesUse this policy to enable and disable published application or desktop access to the client USB Point of Sale devices. This policy is applied if the USB Plug-n-Play Devices policy is set to Enabled and Not Configured.Enable POSConfigure Foreground Status of the Progress BarClient audio settingsThis option controls how the sound from the remote application or desktop is directed to the client machine.
Select 'Enable Audio' to disable client audio mapping. This does not affect the client to server audio data, which is controlled through the "Remoting client devices" policy.
The audio quality between client and server can be set from the Sound Quality drop-down menu. The available options are High, Low and Medium.
The lowest and highest port number ranges must be between - 16384 to 65535
Troubleshooting:
The server audio options take precedence over these settings, so selecting high quality from the client might not result in a high quality audio being used. The server cannot increase the quality of the audio selected by the client.Enable audioSound qualityEnable Real-Time TransportLowest Port NumberHighest Port NumberAllow Real-Time Transport through NetScaler GatewayClient graphics settingsThis option enables the quality of graphics displayed by the remote application or desktop.
From the color-depth drop down menu, select the preferred range. The available options are 16-bit color and 32-bit color. NOTE: Low color depth is more effective when using low bandwidth.
Enable 'Disk based caching' to allow the graphics to be temporarily saved to the local disc cache.
Enable Lossy compression to degrade the quality of graphics for maximum compression and responsiveness.
Enable HDX 3D Browser acceleration to allow Microsoft IE to be handled by HDX 3D virtual acceleration channel.
Enable HDX 3D browser acceleration lossy compression to allow Microsoft IE to degrade the quality of graphics for maximum compression and responsiveness.
Enable Remote Video to allow the server to stream video data to the client. Color depthLossy compressionHDX 3D Browser AccelerationHDX 3D Browser Acceleration - lossy compressionRemote videoSpeedScreen Latency Reduction - keyboard local echoSpeedScreen Latency Reduction - mouse pointer predictionDisk-based cachingClient display settingsThis option controls how the client displays remote application and desktop to the end user.
From the Seamless Window drop down menu, select True to enable the client to request for seamless windows. Select False to enable the client to disable the seamless window display.
NOTE: The server may reject the client request even when the setting is set to True.
From the Window width, select the preferred values. The available options are 1024 and 800.
NOTE: This feature will not take effect if the option Seamless Window is enabled.
From the Window height, select the preferred values. The available options are 600 and 734.
NOTE: This feature will not take effect if the option Seamless Window is enabled.
From the Window percent drop-down menu, select the preferred values. The available options are 50%, 75% and Other. This is a manual method of setting the windows height and width.
NOTE: The selected value is applicable to entire screen.
From the Shrink work area, select the preferred range. The recommended values are between 3 - 5.
Enable Full screen to display the client in a full screen mode. Seamless windowsWindow widthWindow heightWindow percentShrink work areaFull screenLocal App Access settingsUse this policy to control how the client presents local applications inside a hosted desktop.
Local App Access enables the integration of locally installed applications within a hosted desktop. When users launch locally installed applications using shortcuts, applications appear to be running on their hosted desktop even though it is running on their local device.
When this policy is enabled, client presents locally installed applications inside hosted desktop as shortcuts.
When disabled, client doesn't present local apps inside hosted desktop. URL redirection is also disabled.
Allow URL Redirection:
When this is checked, client allows URLs to be redirected from hosted desktop browser to locally installed browser or vice versa. URL blacklist and whitelist on host determine which URLs would be redirected. Browser add-ons, extensions and plugins required for this feature would also need to enable.
When unchecked, URLs are not redirected from hosted desktop to client or vice versa. Browser add-ons, extensions and plugins are not disabled.Allow URL RedirectionHost to client redirection settingsUse this policy to set if Host to client URL redirection needs to support extra protocols. By default only http and https are supported.ExtraURL protocolsKeyboard shortcutsHotkeys for Desktop viewerThis feature allows you to toggle between a full-screen mode and windows-mode in a desktop session. You can now switch to the preferred mode using customized keyboard shortcuts that can be used as hotkeys.
Customize fullscreen toggle hotkeys lets you to select the key combinations that you prefer to use to toggle
Note : This hotkey works independant of "AllowHotKeys" Registry value. This option enables configuring key combinations that the Citrix Workspace can use.
From the Windows Key drop down menu, select the preferred option. The available options are Access Local Desktop, Access Remote Session and Access Remote session in full screen only.
When Access Local Desktop is selected, the key combination is applicable only to the local desktop.
When Access Remote Session is selected, the key combination is applicable only to the remote session.
When Access Remote session in full screen only is selected, the key combination is applicable to non-seamless ICA sessions in full screen mode. By default, this option is selected. Windows key:Task List: +Close Application: +Toggle Full-screen: +Ctrl-Alt-Del: +Ctrl-Esc: +Ctrl-Alt: +Alt-Tab: +Alt-Shift-Tab: +Task Manager: +Latency Reduction: +Relative Mouse: +Remote applicationsUse this policy to configure the client's handling of remote applications.
When enabled, this policy uses the list in the "Application" box to determine which published applications can be directly launched by the client.
You can request that remote applications share sessions (run in a single ICA connection). This provides a better user experience, but is sometimes not desirable. The session sharing feature can be disabled by clearing the "Session sharing" check box.
Troubleshooting:
Published applications are denoted by a # in front of the application name. Omitting the # symbol attempts to launch a particular program or desktop. A computer running Citrix XenApp will not allow this by default, and rejects the connection, displaying: "You do not have access to this session."
Session sharing is controlled by the SessionSharingKey that prevents applications launched from different Web Interface servers from sharing sessions. In addition, applications with different graphics or security settings are prevented from sharing sessions.ApplicationSession sharingPower managementUse this policy to configure the whether the client system and its display are allowed to enter power-saving (sleep) mode.
When enabled, this policy controls whether the system and display are allowed to automatically enter sleep mode while a Citrix session is active.
Enable 'Prevent system sleep' to prevent the system from sleeping while a session is active.
Enable 'Prevent display sleep' to prevent the system's display from sleeping while a session is active.
Audio through Generic USB RedirectionUse this policy to control audio redirection through Generic USB Redirection. This policy applies only to XenApp host.Enable Audio through Generic USB RedirectionICA File SettingsUse this policy to enable deletion of ICA file when the client session ends. RemoveICAFileAllow Legacy Session SharingAllow session sharing for Program Neighborhood sessionsAllowLegacySessionSharingDesktop Viewer Toolbar OptionsThis policy controls which toolbar options to show in Desktop Viewer.Manage Connection Strength Indicator NotificationsAdmins can enable or disable Connection Strength Indicator (CSI) notifications for users on managed devices.
When enabled, users are notified about network disruptions.
When disabled, they will not receive these notifications.Multi-Stream ICAUse this policy to configure Multi-Stream ICA settings. This feature is enabled by default.EnableFTUSilent authentication for Citrix WorkspaceQuick Desktop Launch SupportDo not allow desktop launch when InitialProgram setting is missing or empty in ICA fileAllow desktop lock on machineEnable desktop lockEnable desktop lock for all standard usersSingle sign-on to Citrix Secure Access clientSecure ICA file session launchEnable NPSEnable FTAvPreferAllow all appsAllow network appsAllow installed appsEnable Default FTAAllowHide SettingsHide Configuration CheckerHide Delete Saved PasswordsHide Data CollectionHide Local Keyboard Layout SettingHide Connection CenterHide DPI SettingsHide Advanced PreferencesHide TroubleshootingHide Send FeedbackSmartcard Removal Policy for x86 machineSmartcard Removal Policy for x64 machinePick UI displayManage SelfServiceModeAllow users to Add/Remove AccountEnable application PreLaunchPre-launch allows the application and desktop sessions to start faster. This is done by launching the resource on first access and making it more responsive on subsequent access.
When you set the policy to Enabled, the Session/Application Pre-launch functionality is enabled.
When you set the policy to Disabled, the Session/Application Pre-launch functionality is disabled.
Allow/Prevent users to publish safe contentAllow/Prevent users to publish unsafe contentControl when Citrix Workspace attempts to reconnect to existing sessionsChoose the appropriate combination of reconnect conditions.If you enable this policy setting, it controls Citrix Workspace app Reconnect behaviour.
Citrix Workspace can look for existing, disconnected sessions via the store and reconnect them to the client. It can do this automatically at various times:
- Launch : Any time Citrix Workspace app is launched or opened
- Refresh : When the Refresh App command is issued in the UI or after logon
- Open : When the Citrix Workspace UI is opened
- Windows Logon : On First launch
The default will be at Launch or Refresh. Select the appropriate combination.
Manage App shortcutStartmenu DirectoryDesktop DirectoryEnable Desktop ShortcutDisable Startmenu ShortcutDisable Categorypath for startmenuEnable Categorypath for desktopEnable to have different category path for desktop and startmenu. Disable to align the category path of desktop as that of startmenuRemove apps on LogoffRemove apps on ExitExclude Workspace resources from Windows apps listSilently Uninstall Removed ResourcesClear the set of applications shown in the Citrix Workspace app Window on logoffIgnore self service selection of apps and make all mandatory. If Citrix Workspace is working with a PNAgent service this will be required to get all apps added automatically. If Citrix Workspace is working with a StoreFront Store, make the change on the StoreFront server to make the Store mandatory. (This setting currently does not apply to StoreFront Stores).Prevent Citrix Workspace performing a refresh of the application list when opened.Use this to enable\disable the FTU dialogUse this policy to enable silent authentication for Citrix Workspace. This policy is functional only if self-service mode is disabled and is recommended when domain pass through (single sign on) is configured for Citrix Workspace on domain-joined devices.
Enabled indicates that Citrix Workspace app attempts to login to Citrix Workspace automatically at system start up. You must enable silent authentication for this option to work.
Disabled or Not Configured indicates that Citrix Workspace app does not reattempt login to Citrix Workspace automatically at system start up. You must login to Citrix Workspace app manually even if single sign-on is enabledBy enabling this feature, you can open your previously disconnected desktops instantly. Once this feature is enabled, Citrix Workspace app launches the disconnected sessions in hidden mode. The session is instantly presented as soon as you launch the desktop.
Do not allow desktop launch when InitialProgram setting is missing or empty in ICA fileAllows desktop lock functionality to be available on the machine.
This functionality will let end user to directly access the virtual desktop instead of the local desktop.Enable desktop lock functionality for user if allow desktop lock policy is enabled.Enable desktop lock functionality for all standard users on the machine if allow desktop lock policy is enabled.When this policy is enabled and when already signed on to Citrix Workspace app, the same user is single signed on to Citrix Secure Access client using the store configured on the Citrix Workspace app.
When disabled, users are required to provide sign-in credentials on Citrix Secure Access app.This policy allows session launch from Citrix-signed executables only.
It blocks session launch from any other untrusted processes and disables direct session launch using the ICA file.
The Net Promoters Score (NPS) helps you to rate and provide feedback on your experience with Citrix Workspace for Windows (Store). This feedback service aims to improve Citrix Workspace for Windows (Store). The rating and feedback help to provide a better user experience. By default this feature is enabled.
Note: If you select 4 or 5 as the rating, you are redirected to rate the Citrix Workspace app in the Microsoft Store. If you select 3 or lower, you are redirected to a feedback form where you can provide more details on your rating.
Options:
1. Enabled – The NPS dialog appears on every sixth successful connection.
2. Disabled – The NPS dialog does not appear.
You can now control whether the remote Citrix Workspace app launches the instance of an application installed on first hop server/desktop (if available) in preference to launching a remote application.
Select any of the following options:
1. Allow all apps: Launches the client instance of all apps.
2. Allow installed apps: Launches the client instance of installed apps only.
3. Allow network apps: Launches the instance of an app that is published on a shared network.
Use this option to change the FTA (File Type Association) settings.
By default, this policy is set to Not Configured.
Select Enabled to enable FTA.
Select Disabled to disable FTA.Use this option to change the default FTA (File Type Association) settings.
By default, this policy is set to Not Configured.
Select Enabled to enable the default FTA.
Select Disabled to disable the default FTA.
When the 'Enable FTA' is disabled, setting this policy will take no effect. The policy will be treated as disabled.Use this to hide/unhide the Configuration Checker Dialog from Advanced PreferencesUse this to hide/unhide the Delete Password Dialog from Advanced PreferencesUse this to hide/unhide the Data Collection Dialog from Advanced PreferencesUse this to hide/unhide the Local Keyboard Layout Setting Dialog from Advanced PreferencesUse this to hide/unhide the Connection Center Dialog from Advanced PreferencesUse this option to hide/unhide the Advanced Preferences option from the Citrix Workspace app icon in the notification areaUse this option to hide/unhide the Troubleshooting option from the Citrix Workspace app icon in the notification areaUse this option to hide/unhide the Send Feedback option from TroubleshootingUse this to hide/unhide the DPI Settings from Advanced PreferencesUse this policy to control the behaviour for Smart Card Removal Action when User Authenticates to Citrix Web Interface 5.4 PNAgent Site with Smart Card through Windows Citrix Workspace app.
This option enables the user to set the user session behaviour on removing the Smart Card from the client.
NOTE: This option is available only on 32bit Operation System.
To be able to enable this policy, ensure that the Smart Card Removal option is set on WI XenApp Services. Refer to XenApp documentation for the procedure on setting Smart Card Removal on XenApp. When the policy is Enabled, the user will continue to be logged in to the Citrix Workspace despite removing the smart card from the client. The user, however, will be logged off from the XenApp session.
Use this policy to control the behaviour for Smart Card Removal Action when User Authenticates to Citrix Web Interface 5.4 PNAgent Site with Smart Card through Windows Citrix Workspace.
This option enables the user to set the user session behaviour on removing the Smart Card from the client.
This policy is applicable only to 64 bit OS. To check the OS bit type for Windows Machine, Click Start button, right Click on Computer and click the Properties. Check System Type under the System section to know the OS type that is being run. This is policy is applicable if the 64-bit Operating system is displayed for System Type.
To be able to enable this policy, ensure that the Smart Card Removal option is set on WI XenApp Services. Refer to XenApp documentation for the procedure on setting Smart Card Removal on XenApp. When the policy is Enabled, the user will continue to be logged in to the Citrix Workspace despite removing the smart card from the client. The user, however, will be logged off from the XenApp session.
When the Policy is disabled, User’s XenApp session will always be disconnected if the Smart card is removed from Client device and Smart Card removal on the WI XenApp Services does not have any effect.
This policy allows you to manage application shortcuts on desktop and startup along with workspace settings via UI. End user needs control over how the apps are spread out in the start menu. The UI provides an option to place the shortcuts in a start menu folder chosen by the user. The same control is also given for desktop shortcuts. Also provides an UI for managing workspace control settings. By doing this, we uplift the usability attribute of windows Citrix Workspace app.
If you enable this policy setting, you can opt out from the three choices provided i.e. disable entire UI, disable Applications Tab or disable Workspace Tab. (Please note after enabling this policy setting, on Endpoint you need to Reset Citrix Workspace app for settings to take place)
Disabling this policy setting is equal to Not Configured state.
Use this policy to enable or disable SelfServiceMode settings of Citrix Workspace.
When Enabled you can View SelfServiceUI.
When disabled SelfServiceUI will be hidden and all apps are subscribed automatically.
Use this policy to allow or prevent users to publish safe content.
Use this policy to allow or prevent users to publish unsafe content.
Use this policy to disable ADS.If you enable this policy setting:
- When enabled, resources in your store are not displayed in the Windows Add or remove apps list (default is false).
- When enabled, shortcuts and the Citrix Workspace icon for an application are automatically removed from the store when the application is no longer available (default is false).
- Clear the set of applications shown in the Citrix Workspace Window on logoff. When selected, this option purges user details upon Citrix Workspace logoff. Deselecting this option, Citrix Workspace may not purge user details on upon Citrix Workspace logoff.
- Prevent Citrix Workspace performing a refresh of the application list when opened. When selected, this option prevents Citrix Workspace from performing a refresh of the application list after launching. Deselecting this option, Citrix Workspace refreshes the application list when launching Citrix Workspace.
- Ignore self service selection of apps and make all mandatory. If Citrix Workspace is working with a PNAgent service this will be required to get all apps added automatically. If Citrix Workspace is working with a StoreFront Store, make the change on the StoreFront server to make the Store mandatory. (This setting currently does not apply to StoreFront Stores). When selected, this option subscribes all applications in SelfService for PNAgent sites. Deselecting this option, the end user must manually subscribe to all the applications or required applications from the PNAgent sites.
Use this policy to give users option to add or remove accounts in NonSelfServiceModeCitrix WorkspaceStoreFrontNetScaler Gateway URL/StoreFront Accounts ListEnter the NetScaler Gateway URL/StoreFront account details here:This policy setting allows you to manage a list of StoreFront accounts or NetScaler Gateway URL.
If you enable this policy setting, you can enter a list of StoreFront Accounts and NetScaler Gateway URL. You can provide only one NetScaler URL and multiple StoreFront URLs. For each entry that you add to the list, enter the following information delimited by a semi-colon:
Store name - The name that the user will see for this Store.
Store URL - The url for the Store.
Store enabled state - On/Off.
Store description - The description that the user will see for this Store.
Example for StoreFront:
SalesStore;https://sales.mycompany.com/Citrix/Store/discovery;On;Store for Sales staff
Example for NetScaler Gateway URL.
HRStore;https://ag.mycompany.com#Storename;On;Store for HR staff
#Storename is the name of store behind NetScaler Gateway for which we need to configure.
Note: NetScaler Gateway URL configured using this method doesn't support PNA Services site behind NetScaler Gateway.
Trusted Store Accounts ListEnter the trusted Store account details here:This policy lets you add a list of trusted store account URLs.
Adding a store account to the list prevents the prompt that asks you to trust the store from appearing when you configure the store by using the provisioning file.
Here is an example of a Store account URL:
https://sales.mycompany.com/Citrix/Store/discovery
Fast Connect API SupportThese policies control Fast Connect API supportManage FastConnectAPI SupportFast Connect API facilitates user switching by providing an API to quickly change a user’s identity in Citrix Workspace.
-Enable Fast Connect API: This options enables fast user switching by providing an API to change new user
-Enable Fast Connect Transition API: Enabling this will disallow the following commands : selfservice.exe-terminate, selfservice.exe-fastterminate.
-Leave Apps Running On Logoff: This option allows applications session to remain connected even if user has disconnected from the Citrix Workspace.
-Integrate Self Service plugin with Fast Connect: This option enables notification to SelfService plugin on Fast Connect library/SDK use. EnableFastConnectTransitionAPILeave Apps Running On LogoffIntegrate Self Service plugin with FastConnectEnable Engine Error MessagesEnable CEIPHigh DPICEIP ConfigurationEnable CEIP.CEIP Server URLCEIP Upload classInitialize CEIP Upload frequency in weeksAllow insecure URL (http instead of https)1. To provide CEIP Server URL
2. To provide CEIP Upload class
3. To set upload frequency
4. Allow insecure URL This will enable specific engine error messages. It will replace generic Protocol Driver Errors with specific error messagesCEIP is Citrix Customer Experience Improvement Program. More details about CEIP is present in http://www.citrix.com/cms/ws/ceipUse this policy to manage session scaling.
Enabling the policy makes the Citrix Workspace DPI aware along with the flexibility for the session to change according to the DPI applied in the multi monitor session.
Enabling the policy provides two options
1. Yes - Scale the session
2. No - Use the native resolution
The policy is enabled by default with option No. Disabling the policy lets the operating system scale the resolution. Makes the Citrix Workspace DpiAware. This setting is enabled by default. It enables the Citrix Workspace to scale the session according to the DPI applied in multi monitor sessions. More details about DPI Awareness are available at https://support.citrix.com/article/CTX230017CEIPDPICEIP is Citrix Customer Experience Improvement Program. More details about CEIP is present in http://www.citrix.com/cms/ws/ceip/ .Scale the session for High Resolution .DiagnosticsUse this policy to continuously collect trace logs from users.Always-On TracingThis option is enabled by default to collect trace logs from users continuously.ComplianceUse this policy to disable sending data to 3rd party services e,g Google analytics.
Disable: When this is disabled, anonymous data may be sent to 3rd party services.
Enable: When this is enabled, no data will be sent to 3rd party services.
Disable sending data to 3rd partyADMX Migrator encountered a string that is not present in the source ADM string table.ADMX Migrator encountered a policy that does not have a supportedOn value.All Citrix Workspace supported platformsSupported on Citrix Workspace app 4.5 and aboveSupported on Citrix Workspace app 2011 and aboveOffOnPreferredTransport protocol for Citrix Workspace
Off: Use TCP only.
Preferred: Try UDP first, fallback to TCP.
On: Force UDP, no fallback to TCP.
Bidirectional Content Redirection is the feature that allows URLs to be redirected from client to server and vice versa based on configuration.
-Published Application/Desktop Name : Indicates the name of the published application / desktop used to launch the redirected URL. This is not used when Bidirectional Content Redirection is enabled on any of the active ICA sessions. Whether its Desktop or Application is decided based on the Type specified below.
-Above Name is for Published Type : This indicates the above Name is whether Application or Desktop.
-Allowed URLs to be redirected to VDA : This indicates the list of URLs that will be opened on VDA. Semi Colon ";" acts as a delimeter. "*" can be used as wild card. For example *.xyz.com.
-Allowed URLs to be redirected to Client : This indicates the list of URLs that will be opened on Client. Semi Colon ";" acts as a delimeter. "*" can be used as wild card. For example *.xyz.com.
Note:
1) If there is a URL that is put in both the places, then it will be launched from wherever it originated.
2) If the URL is in neither of them, in that case as well it will be launched from wherever it originated.
Bidirectional Content RedirectionPublished Application/Desktop Name: Above Name is for Published Type:ApplicationDesktopAllowed URLs to be redirected to VDA:Allowed URLs to be redirected to Client:Bidirectional Content Redirection OverridesBidirectional Content Redirection Overrides are URL-specific overrides that apply to the Bidirectional Content Redirection feature.
-URL-specific published application or desktop overrides : This indicates the URL-specific overrides for Published Application/Desktop Name. The "Value name" should exactly match an entry in the "Allowed URLs to be redirected to VDA" list, and the "Value" will specify a Published Application/Desktop Name specific to that URL.
URL-specific published application or desktop overrides:OAuth Redirection allows configuring URL patterns to allow OAuth logins to be redirected over Bidirectional Content Redirection.
-OAuth Pattern : This indicates the list of URL regular expressions that, when redirected to the client via Host-to-Client URL redirection, will be tracked as if an OAuth authentication flow has begun, and when the flow completes that resulting URL will be redirected back into the Host VDA that initiated that flow.. Semi Colon ";" acts as a delimeter.
-OAuth Scheme : This indicates the scheme of URLs .If a Scheme is specified, the terminating URL is expected to be of the form: scheme://something. If Scheme is not specified (empty), then the original resulting URL pattern is extracted from the Pattern via a regular expression capture group (must be specified in the Pattern). Semi Colon ";" acts as a delimeter.
Note:
1)Number of Patterns and scheme entries should match .If no scheme is specified for pattern just porvide ';' for empty scheme
2)OAuth Redirection works only if BidirectionalContentRedirection is enabled
OAuth RedirectionPattern:Scheme:Citrix Workspace Updates-10123456789101112131415161718192021222324252627282930Configure NetScaler LAN proxy manuallyCitrix Workspace app supports session launches using the NetScaler LAN proxy.
If both static proxy and dynamic proxies are configured, the dynamic proxy configuration takes precedence.
You can configure static proxy: Select the Configure NetScaler LAN proxy manually policy. Select Enabled and then provide the host name and port number. Click Apply and OK.Configure NetScaler LAN proxy using DLLCitrix Workspace app supports session launches using the NetScaler LAN proxy.
If both static proxy and dynamic proxies are configured, the dynamic proxy configuration takes precedence.
You can configure Dynamic proxy: Select the Configure NetScaler LAN proxy using DLL policy. Select Enabled and then provide the full path to the DLL file. For example, C:\Workspace\Proxy\ProxyChooser.dll.
Click Apply and OK.Adaptive Gateway SelectionAdaptive Gateway Selection enables Citrix Workspace app to automatically detect and connect to the best Citrix Gateway Service Point of Presence (PoP) based on current connection conditions.
If latency exceeds the Latency Threshold (expressed in milliseconds) for longer than the Latency Breach Duration (expressed in seconds), the app initiates a new Gateway Selection.
The Wi-Fi Signal Strength Threshold defines the minimum signal needed to perform a gateway selection (expressed as a percentage). If the signal falls below this level, gateway selection will not occur.
Citrix Secure BrowserCitrix Secure Browser is used to connect to SaaS applications.CacheUse this policy to enable/disable browser cache.
By default caching is enabled.
When Enabled browser cookies and resources are cached on local disk.
When Disabled browser cookies and resources are not stored.
Keyboard settingsThe keyboard layout synchronization feature lets you switch among keyboard layouts on the client device. This feature synchronizes the client keyboard layout to the server.
This feature provides you with the following options:
• Allow dynamic sync - Synchronizes the client keyboard layout to the server when you make any changes. When selected, this option also enables the client IME for East Asian languages.
Selecting Yes for this option overrides the following two options.
• Sync only once – when session starts – Synchronizes the client keyboard layout to the server when the session launches. Any changes you make to the client keyboard layout during the session do not take effect immediately. To apply the changes, log off and log back on.
• Don’t sync - Indicates that the client uses the keyboard layout present on the server.
This policy is not configured by default. When you disable this policy, the client keyboard layout is synchronized to server only when the session is launched.
YesNoDon’t syncSync specific keyboard layout only once when the session is launchedSync only once – when session startsNo, hide the language barLanguage barSelect the required option to display the language bar in a session. The language bar displays the preferred input language in a session.
This policy is not configured by default. When you disable this policy, the language bar is displayed in an app session.
Enable Citrix Enterprise Browser shortcutThis feature enables the Citrix Enterprise Browser shortcut on the Start menu.Manage App ProtectionThis policy helps user to enable/disable Anti-Keylogging and Anti-ScreenCapture on Authentication screen. By default both Anti-Keylogging and Anti-ScreenCapture are disabled.
-Enable Anti-Keylogging: Enabling this option will prevent keyloggers from capturing keystrokes.
-Enable Anti-ScreenCapture: Enabling this option will prevent user from taking screenshots and sharing screen.
Note: This policy doesn’t apply to your virtual app and web/SaaS app sessions.
IMPORTANT: Citrix Workspace App needs to be restarted for changes to take effect.
Enable Anti-Keylogging Enable Anti-ScreenCapture Manage App ProtectionThis policy helps user to enable/disable Anti-Keylogging and Anti-ScreenCapture on Citrix Workspace App enumeration screen. By default both Anti-Keylogging and Anti-ScreenCapture are disabled.
-Enable Anti-Keylogging: Enabling this option will prevent keyloggers from capturing keystrokes.
-Enable Anti-ScreenCapture: Enabling this option will prevent user from taking screenshots and sharing screen.
Note: This policy doesn’t apply to your virtual app and web/SaaS app sessions.
IMPORTANT: Citrix Workspace App needs to be restarted for changes to take effect.
Store authentication tokensUse this policy to store authentication tokens. Authentication tokens are encrypted and stored on the disk so that you don’t need to reenter the credentials in case of a system reboot or when Citrix Workspace App is restarted.
Enabled or Not Configured indicates that the authentication tokens are stored. This is the default option.
Disabled indicates that the authentication tokens are not stored and that you must re-enter the credentials in case of a system reboot or when Citrix Workspace App is restarted.
This policy is only applicable to cloud deployments.
Microsoft Edge WebView for StoreFront authentication Citrix Workspace app for Windows 2302 and above.Requirements:
Microsoft Edge WebView2 Runtime version 131 or later.
This policy allows to control the webview in which StoreFront authentication related web content is loaded.
When this policy is enabled, Citrix Workspace app uses Microsoft Edge WebView2.
Microsoft Edge WebView2 provides support for authentication mechanisms like Windows Hello based authentication, FIDO2 Security Keys based authentication, Single Sign-On (SSO) to Citrix Workspace app from Microsoft Azure Active Directory (AAD) joined machines with AAD as an identity provider, and Conditional Access.
When this policy is disabled, Citrix Workspace app uses Internet Explorer WebView.
Allow Single Sign-On for Edge WebViewCitrix Workspace app for Windows 2411 and above.
When the policy is disabled, single sign-on (SSO) is disabled for devices that are Entra ID-joined or registered. The end user must authenticate in the Workspace app if Entra ID is used as the identity provider.
When the policy is not configured, single sign-on (SSO) is enabled.
By default,policy is enabled.
Persistent ICAMaximum number of retries during launch failureApp which needs to be configure for persistent ICA.Persistent ICA for relaunching sessions.
When this policy is enabled then on closing or during launch failure of session or application which is configured, it retriggers the launch.
In case of launch failure, maximum number of retries will be based on the configured value in the policy.
Log off user on session disconnectLog off user on session disconnect.
When enabled, users are automatically logged off from Citrix Workspace app when they disconnect from their session.
In case of multiple sessions, after all the sessions disconnect, user should be logged off.
Show Disabled ShortcutCitrix Workspace app for Windows 2411 and above.When enabled, show disabled app and desktop shortcuts to the end user.
Global App Config ServiceUse this policy to manage the Citrix Global App Config Service.Manage Global App Config ServiceThe Citrix Global App Config Service for Citrix Workspace allows Citrix administrators to deliver Workspace service URLs and Citrix Workspace App settings through a centrally managed cloud service. Citrix Global App Config Service is a set of preconfigured settings you can apply to Citrix Workspace app. Using this policy, Citrix Workspace app retrieves the settings from the Citrix Global App Config Service and applies them in the environment.
When you set this policy to Disabled, the settings from Citrix Global App Config Service are not retrieved and honored in Citrix Workspace app.
When you set this policy to Enabled, the settings from Citrix Global App Config Service are recognized as a configuration method in Citrix Workspace app.
GACS Discovery RegionCitrix Workspace app for Windows 2507 and above.Select the region from which Citrix Workspace app retrieves discovery endpoints from the Citrix Global App Config Service. If US Gov is selected, the discovery endpoint comes from the U.S. region. If Default is selected, the discovery endpoints are retrieved from the default global endpoint.
DefaultUS GovLocal app discoveryThis policy helps integrate locally installed Windows operating system apps with Citrix Workspace app.
When you set this policy to Not Configured, Citrix Workspace app is not integrated with the locally installed apps.
When you set this policy to Enabled, Citrix Workspace app integrates with the apps that are locally installed only when Enable local app discovery option is also enabled.
When you set this policy to Disabled, Citrix Workspace app is not integrated with the apps that are locally installed.
The whitelist field lets you add the location of the apps that your administrator would like to pin to the Workspace app.
For example:
[
{
"arguments": "www.citrix.com",
"name" : "Company Pages - Citrix Home",
"path" : "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"
},
{
"arguments": "www.microsoft.com",
"name" : "Company Pages - Microsoft Home",
"path" : "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"
},
{
"arguments": "",
"name" : "Company Office - Word",
"path" : "C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\winword.exe"
},
{
"arguments": "",
"name" : "Company Office - Excel",
"path" : "C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\excel.exe"
},
{
"arguments": "",
"name" : "Company Office - PowerPoint",
"path" : "C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\POWERPNT.exe"
}
]
Local Application ProtectionThe Local Application Protection policy provides Anti-Keylogging and Anti-ScreenCapture protection to the locally installed applications on the Microsoft Windows operating system.
When the policy is:
- Not Configured - The Local Application Protection feature isn't integrated with the locally installed applications.
- Enabled - Citrix Workspace app enables the Local Application Protection feature for the locally installed applications.
- Disabled - Citrix Workspace app disables the Local Application Protection feature for the locally installed applications.
The List of protected local applications field allows the administrator to add information of the local applications that must be protected.
For example:
{
"containers": [
{
"containerID": "4F402876-AB1A-4E9A-8B54-DE3CA0BFC23F",
"containerName": "Text Editors",
"antiKeyloggingEnabled": "true",
"antiScreenCaptureEnabled": "false",
"applications": [
{
"applicationName": "notepad",
"filePath": "C:\\windows\\system32\\notepad.exe",
},
{
"applicationName": "word",
"filePath": "C:\\Program Files\\Microsoft Office\\root\\Office16\\winword.exe",
"publisher": "Microsoft Corporation",
"signature": "f9a36937c16d0a69a43981dacb6b5686fad84543",
"fileMinVersion": "16.0.0.1",
"fileMaxVersion": "16.0.15601.20148"
}
]
},
{
"containerID": "GUID",
"containerName": "container name",
"antiKeyloggingEnabled": "true",
"antiScreenCaptureEnabled": "false",
"applications": [
{
"applicationName": "application name",
"filePath": "path-to-exe",
"publisher": "signer name",
"signature": "certificate thumprint",
"fileMinVersion": "Minimum file version",
"fileMaxVersion": "maximum file version"
}
]
}
]
}
Anti-DLL InjectionUse this policy to enable/disable Anti-DLL Injection for Citrix Auth Manager, Citrix Workspace app UI and Citrix Virtual Apps and Desktops.
By default Anti-DLL injection is disabled.
When the policy is:
Not Configured - Anti-DLL injection is disabled.
Enabled - User can configure Anti-DLL injection individually for Citrix Auth Manager, Citrix Workspace app UI and Citrix Virtual Apps and Desktops.
Disabled - Anti-DLL injection will be disabled for Citrix Auth Manager, Citrix Workspace app UI and Citrix Virtual Apps and Desktops.
Citrix Auth ManagerCitrix Workspace app UICitrix Virtual Apps and DesktopsAnti-DLL Module Allow List The DLL Allow List policy allows admins to exclude any DLL from the Anti-DLL protection.
When the policy is:
Not Configured - No DLL is part of the allow list. Includes all the DLLs during the Anti-DLL protection.
Enabled - Excludes DLLs mentioned in the allow list from the Anti-DLL protection.
Disabled - Clears the DLL allow list. DLLs need to be configured again when policy is enabled.
The Module Allow List field allows admins to add DLL information that can be excluded from the Anti-DLL protection.
Sample format to add DLL to the allow list:
[
{
"filePath": " C:\\Program Files (x86)\\trusted\\messagebox.dll"
},
{
"filePath": "%PROGRAMFILES%\\trusted\\logging.dll"
}
]
USB Filter Driver Exclusion ListThis feature is to exclude the USB devices which have compatibilty issues with App Protection feature.
When the policy is:
Not Configured - None of the USB devices are part of the exclusion list. USB Filter attaches to all the USB devices if App Protection is active.
Enabled - Excludes the USB devices(Pairs of vendor ID and product ID) mentioned in the exclusion list from the App Protection.
Disabled - Clears device exclusion list.
The USB Filter Driver Exclusion List field allows admins to add pairs of vendor ID and product ID information that can be excluded from the App Protection.
Sample format to add vendor IDs and product IDs to the exclusion list:
[
{
"deviceName": "Device1",
"vendorID": "FFFF",
"productID": "FFFF"
},
{
"deviceName": "Device2",
"vendorID": "FFFF",
"productID": "FFFF"
}
]
Block DoubleHop LaunchIf Enabled, Virtual Apps and Desktops configured with App Protection policies cannot be launched from within a Virtual Desktop.Screen Capture Notification
If "Disabled", screen capture notifications will not appear when a tool tries to capture/record a protected window.
If "Enabled" or "Not configured", screen capture notifications will appear when a tool tries to capture/record a protected window.
In-Session Reconnect Feature
If "Disabled" or "Not configured", in-session reconnect will not show reconnection notification after a failed ACR attempt and consequently will not attempt to reconnect session.
If "Enabled", in-session reconnect notification will show on failed ACR attempt providing the user a method to get back into their session quickly.
Enable clientMinimum client versionEnter the NetScaler Gateway/StoreFront account details here:Enter the trusted Store account details here:Proxy typesProxy typesFailover to directSOCKS protocol versionEnable Citrix Workspace Update PolicyLTSR ONLYMigrate 32-bit application to a native 64-bit version on 64-bit operating systemsDelay GroupUpgrade To Latest VersionPreferred Delivery PeriodPrompt user for credentialsAllow clear text authenticationAllow NTLM hash authenticationRequire TLS for all connectionsSecurity Compliance ModeTLS versionTLS cipher setCertificate Revocation Check PolicyClient AuthenticationEnforce trusted server configurationWindows internet zoneEnforce trusted server configurationWindows internet zoneEnable automatic reconnectionEnable session reliability (has precedence if both are selected)Transparency LevelAllow smart card authenticationUse pass-through authentication for PINEnable pass-through authenticationAllow pass-through authentication for all ICA connectionsUse Novell Directory Server credentialsLegacy ticket handlingWeb Interface 4.5 and aboveEnable client drive mappingRead-only client drivesMap serial portsAllow PDA synchronizationMap parallel portsEnable client microphoneEnable audioSound qualityEnable Real-Time TransportLowest Port NumberHighest Port NumberAllow Real-Time Transport through NetScaler GatewayColor depthDisk-based cachingLossy compressionHDX 3D Browser AccelerationHDX 3D Browser Acceleration - lossy compressionRemote videoSpeedScreen Latency Reduction - keyboard local echoSpeedScreen Latency Reduction - mouse pointer predictionWindow percentFull screenScale the session for high resolution? Allow URL RedirectionWindows key:Task List: +Close Application: +Toggle Full-screen: +Ctrl-Alt-Del: +Task Manager: +Alt-Tab: +Alt-Shift-Tab: +Ctrl-Esc: +Ctrl-Alt: +Latency Reduction: +Relative Mouse: +Allow dynamic syncSync mode on session launchDisplay the language barSession sharingRemoveICAFilePrevent system sleepPrevent display sleephttps://rttf.citrix.comcallhome_analyticsInitialize CEIP Upload frequency in weeksAllow insecure URL (http instead of https)Above Name is for Published Type:URL-specific published application or desktop overrides:Choose to allow/prevent users to publish safe content.Choose to allow/prevent users to publish unsafe content.AllowChoose the appropriate display of settings UI.CitrixCitrixDisable Startmenu ShortcutEnable Desktop ShortcutDisable Categorypath for startmenuEnable Categorypath for desktopEnable to have different category path for desktop and startmenu. Disable to align the category path of desktop as that of startmenuRemove apps on LogoffRemove apps on ExitExclude Workspace resources from Windows apps listSilently Uninstall Removed ResourcesClear the set of applications shown in the Citrix Workspace Window on logoffPrevent Citrix Workspace performing a refresh of the application list when opened.Ignore self service selection of apps and make all mandatory. If Citrix Workspace is working with a PNAgent service this will be required to get all apps added automatically. If Citrix Workspace is working with a StoreFront Store, make the change on the StoreFront server to make the Store mandatory. (This setting currently does not apply to StoreFront Stores).Choose the appropriate combination of reconnect conditions.Enable FastConnect API functionalityEnableFastConnectTransitionAPILeave Apps Running On LogoffIntegrate Self Service plugin with FastConnectEnable clientMinimum client versionProxy typesProxy typesSOCKS protocol versionPrompt user for credentialsAllow clear text authenticationAllow NTLM hash authenticationRequire TLS for all connectionsSecurity Compliance ModeTLS versionTLS cipher suiteCertificate Revocation Check PolicyClient AuthenticationEnforce trusted server configurationEnable automatic reconnectionEnable session reliability (has precedence if both are selected)Transparency LevelAllow smart card authenticationUse pass-through authentication for PINEnable pass-through authenticationAllow pass-through authentication for all ICA connectionsUse Novell Directory Server credentialsLegacy ticket handlingWeb Interface 4.5 and aboveEnable client drive mappingRead-only client drivesMap serial portsAllow PDA synchronizationMap parallel portsEnable client microphoneEnable audioSound qualityEnable Real-Time TransportLowest Port NumberHighest Port NumberAllow Real-Time Transport through NetScaler GatewayColor depthDisk-based cachingLossy compressionHDX 3D Browser AccelerationHDX 3D Browser Acceleration - lossy compressionRemote videoSpeedScreen Latency Reduction - keyboard local echoSpeedScreen Latency Reduction - mouse pointer predictionWindow percentFull screenAllow URL RedirectionWindows key:Task List: +Close Application: +Toggle Full-screen: +Ctrl-Alt-Del: +Task Manager: +Alt-Tab: +Alt-Shift-Tab: +Ctrl-Esc: +Ctrl-Alt: +Latency Reduction: +Relative Mouse: +Allow dynamic syncSync mode on session launchDisplay the language barCustomize fullscreen toggle: + +Session sharingRemoveICAFileAllowLegacySessionSharingUSB DevicesConnection Strength IndicatorCtrl+Alt+Del (Lock)DisconnectFullscreenMulti-MonitorPreferencesTrusted Certificates:Security policy:Disable for Trusted LaunchersProxy portLatency ThresholdLatency Breach DurationWi-Fi Signal Strength ThresholdSemicolon-separated list of USB device rules.Semicolon-separated list of USB devices to be removed on lock.class=03 subclass=01 prot=01;class=03 subclass=01 prot=02;class=03 subclass=00 prot=01;class=03 subclass=00 prot=02When desktop startsWhen a USB device is insertedHide USB devices that can be connected using other HDX technologiesWhen desktop startsWhen a USB device is insertedHide USB devices that can be connected using other HDX technologiesSelect Communication Protocol for Citrix WorkspaceEnable Anti-KeyloggingEnable Anti-ScreenCaptureEnable Anti-KeyloggingEnable Anti-ScreenCaptureMax Launch RetriesApp config service discovery region for Citrix WorkspaceEnable local app discoveryList of whitelisted local apps:List of Protected Local Applications:Citrix Auth ManagerCitrix Workspace app UICitrix Virtual Apps and DesktopsAnti-DLL Injection Module Allow ListUSB Filter Driver Exclusion List