Resolve Username Being Modified Before Sending to RADIUS Server Using NetScaler nFactor

Introduction nFactor is the next generation authentication framework that offers great flexibility in configuring authentication flows for users. nFactor allows for extensible authentication models thus offering clean separation of workflows. This framework could be used to configure all the...

Citrix SD-WAN Path State Sensitivity Control Overview

Bad Loss Sensitive – Select a setting from the drop-down menu. The options are: Enable– Default If enabled, paths will be marked BAD due to loss, and will incur a path scoring penalty. Disable – Disabling Bad Loss Sensitive can be useful when the loss of bandwidth is intolerable. Custom – Select...

EPA for device certificate check fails on NetScaler

Users get the error "access denied" after EPA scan even with valid certificates available in the store...

How to script removing and rescanning "Ghost NIC" devices in Windows

It's sometimes necessary to run DevMgr in "nonpresent device" mode to remove all nonpresent NIC devices, and sometimes the present NIC too, and then rescan the network to fix problems. It's possible, using the Microsoft Windows Development Kit tool DEVCON.EXE, to script this operation if you know...

SSL Handshake Fails When Server Name Indication (SNI) is Enabled on ADC

SSL handshake fails when Server Name Indication feature is enabled on NetScaler Server Name Indication aka SNI is an extension of the TLS protocol. For SNI to work, the server name in the client hello must match the host name configured on the back-end service that is bound to an SSL virtual...

How to open Secure Mail email links with Native or 3rd party browser on android devices

This article explains how to open secure mail links on a native browser on Android devices...

How to Troubleshoot Browser Content Redirection

This article provides an overview of the Browser content redirection BCR feature and use cases before providing general troubleshooting guidelines. It is highly recommended that you first read through the Browser content redirection and Browser content redirection policy settings sections of the...

Mouse Offset Behavior During Multiple ICA Session in Receiver for Windows and Windows (Store)

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Attempting to run multiple ICA sessions simultaneously, may cause high memory and Disk I/O activity,...

How to disable Interrupt Safe Mode in Provisioning Services

How to disable Interrupt Safe Mode in Provisioning Services The "Interrupt Safe Mode" configuration is a special setting designed to handle bad PXE implementations that do not comply with PXE standards or have bugs. The setting forces a reset on the UNDI Interface after sending every packet into...

How to force HTTPS on the ELM

Many customers have security requirements mandating the use of https. There is no way within the management console of the Enterprise Layer Manager to force https, so Engineering has approved this as the officially supported method to configure the appliance to be https-only...

Error "There is a problem with this Windows Installer package........ Contact your support personnel or package vendor" when Installing Windows Receiver

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Installation of Receiver fails with the following error, "There is a problem with this Windows...

Why cache file size of "Cache on device RAM with overflow on hard disk" is growing faster than "Cache on device hard disk"

Cache Type = "Cache on device hard disk" The block reservation of "Cache on device hard disk" is ONLY 4KB, and it's random I/O. Cache Type = "Cache on device RAM with overflow on hard disk" Since "overflow on hard disk" is vhdx format, the block reservation is 2MB & required for sequential I/O,...

Citrix Provisioned Target Fails To PXE Boot With Infoblox DHCP

When trying to PXE boot provisioning service target Virtual machines, it was failing with the following error Could not start download: operation not supported' Target Virtual Machine able to receive the DHCP IP from Infoblox Appliancebut not able to download ARDBP32.bin from the TFTP server...

StoreFront 3.x MMC Crashes When Editing Multi-Site Aggregation

MMC crashes when trying to remove controller from Multi-Site Aggregation Configuration. This only happens when trying make changes on Multi site aggregation Configuration...

How to Publish XenMobile App Store apps using iOS Volume Purchase Program (VPP)

The Apple iOS Volume Purchase Program VPP solution allows the customer to manage iOS app licensing, therefore simplifying the process to find, buy, and distribute apps and other data in bulk for an organization. With VPP, you can use XenMobile to distribute public app store apps. VPP is not...

App Layering 2.x/3.x: Best Practices

A consolidation of the various layering best practices to apply in the OS and App layers. For App Layering 4.x Best Practices, please refer here:https://support.citrix.com/article/CTX225952 Operating System Layer Have one Operating System layer per Operating System Windows 7 32-bit, Windows 7...

Citrix App Layering 4.x: Best Practices

Table of Contents Operating System Layer Operating System Patching Platform Layers Application Layers - Before Install Installation Applications Application Patching Elastic Layers Maintenance Operating System Layer Have one Operating System layer per Operating System Windows 7 32-bit, Windows 7...

Various Connection Method Behaviours of Mobile Citrix Receiver with StoreFront and NetScaler Gateway

The following scenarios provide an understanding of when to use the StoreFront server FQDN and/or NetScaler Gateway FQDN in an App Controller solution when connecting from a mobile device: Internal Users Connecting to StoreFront Server Scenario 1 – Legacy PNA Site and No Store Available Scenario ...

SSL Handshake Failure on ADC Because of Unsupported Ciphers

SSL connection failsbetween the client and the ADCappliance ADC responds with a fatal alert. The description of the alert message is “Handshake Failure 40”. The above screenshot is from a NetScaler trace packet capture. Procedure to run a trace on the ADC is explained in the following document:...

Application Shortcuts disappear when connecting to server where the profile already exists

When first logging into a server and the user profile is created for the first time, application shortcuts as configured in WEM appears on Desktop. Application shortcuts configured in WEM: Shortcuts created on desktop of new user profile: Shortcuts deleted after subsequent logins...

How to Configure Authentication at StoreFront using NetScaler Gateway - NetScaler Configuration

This article describes how to configure authentication at StoreFront using NetScaler Gateway - NetScaler Configuration...

Backend SSL Connection Fails on ADC due to missing extensions

When using Secure-LDAP which uses port 636 TCPs or while making connection to server listening on secure port,it fails in SSL handshake phase...

KMS is not Activating Windows on PVS 7.1

PVS: 7.1 : KMS is not activating Windows...

Mouse and Keyboard functions become unresponsive when launching or refreshing agent if it is not bound to a WEM Configuration Set.

If the WEM agent, vuemUIAgent.exe, is launched or refreshed when it is not bound to a "Configuration Set" inside the WEM Administration Console, the keyboard and mouse functions lock. The WEM Agent in question is in the following screenshot: This is a known issue where keyboard/mouse hooks are no...

How to enable/collect logs on WEM Agent machine

Type of logs available: There are a number of logs that can be collected from the WEM Agent to help with troubleshooting/diagnosing an issue Note:Please make sure to revert all changes after completing log collection. For logging information related to WEM Brokers, see CTX228742 1. WEM Agent...

Local Application Access With PREFER Keywords

Application will launch within ICA channel even if it's installed locally on VDA itself...

WEM admin console fails to connect with error: Error while connecting to the specified Infrastructure Server

The WEM Administration Console errors out while connecting to the broker with a generic error: "Error while connecting to the specified Infrastructure Server". Looking into the the WEM admin console debug logs %userprofile%\Citrix WEM Console Trace.Log the following error is reported: Exception -...

How to debug icon cannot be displayed in storefront webpage

This article describes how to debug the issue of icon not be displayed in storefront web page...

PVS XDSW, Error: "(vsan) cannot complete file creation operation"

Symptoms: PVS console returns the error "vsan cannot complete file creation operation". CDF traces show exception "CreateWriteCacheDisk failed to CreateBlankVHD : Citrix.Xip.XipException: A general system error occurred: PBM error occurred during PreProcessReconfigureSpec: pbm.fault.PBMFault;Erro...

FAQ: XenMobile Client Properties

Question: What does XenMobile Client properties do? Options to enable/disable client properties Answer : Client properties contain information that is provided directly to Secure Hub on user devices. Client properties are located in the XenMobile console inSettings Client Client Properties. Clien...

XenMobile is unable to identify the group membership of users

Although XenMobile can find both user objects and group objects in Active Directory, XenMobile is unable to enumerate the group membership of user objects. This can result in no MAM resources being deployed unless they are bound to the 'All Users' Delivery Group. You may also find that resources...

Removing application from delivery group.

When I remove an application from delivery group, the application is not uninstalling from device...

Registration Request For Worker Was Rejected Due To An Unknown Error

New machines added to the XenDesktop Site failed to register. From the VDA Application logs it was found that the VDA wasdiscovering the Delivery Controller. On the Delivery Controller the below error is logged in the Application Event logs from Citrix Broker Service : Registration request for...

Secure Web cannot access external websites

Unable to browse external websites. Error " http 1.1 gateway timeout" on Secure Web. VPN mode : Full VPN Internal websites work fine...

WEM 4.4 -Transformer autologon is not launching the Agent at logon

WEM Transformer does not auto-launch after an end user logs onto a WEM Agent machine...

While Launching HDX Applications from Secure Hub WorkStore Getting an Error: "Unsupported file type......."

The hdx applications are enumerated in the secure hub store but while launching the application we get error : "Unsupported file type : the provided ica file is malformed or otherwise invalid. Please ensure that the product you are using for launching is correct. Contact you administrator for...

How to delete the Device Entry for a User directly from the SQL Database

For some reason like datacorruption or some null pointers, device information is not getting removed fromthe XenMobile Console. This can be deleted directly from the Database by running the below SQL command. Please take the DB back up before we run the below SQL query First obtain the Device ID...

Secure App's access on Android devices Hung with the Screen "please wait"

End user accesses Secure App's on Android device which flips to SecureHub forauthentication and will get stuck on the screen 'Please wait' and circle keep on spinning endlessly. Screenshot Below for reference:...

Bypass iCloud/Activation Lock using XenMobile

An end user may return an iOS device to the I.T. department and does not supply their iCloud account information. After a restore, the I.T. department cannot enroll the device as the device cannot be unlocked without iCloud credentials. XenMobile can issue a 'Activation Bypass Code' as per Apple...

Unable to Configure Citrix App Layering ELM PVS Connector

The App Layering Agent PVS Agent on the PVS server is registered with the App Layering ELM virtual appliance, and the PVS Server enumerates on the App Layering PVS connector screen. However,clicking "check credentials" an error is displayed stating that the ELM cannot use the credentials on the P...

Shared device requirements and Prerequisites for Enrolling Shared Devices in XenMobile.

Shared Device Requirements For the best user experience, including silent installation and removal of apps, Citrix recommends configuring shared devices on the following platforms: iOS 10 iOS 9 Android M Android 5.x Android 4.4.x Android 4.0.x MDM-only mode Prerequisites for Enrolling Shared...

Error: "No Entry Found in Database for Device" While booting Target Device

Target devices are unable to PXE boot with the following error message: "No entry found in database for device."...

Citrix Provisioning Services Boot Process

This article explains Citrix PVS boot process in details...

SAML with limit visibility on the application on the Delivery Controller using a Security Group

When we publish new App in Delivery Group that uses SAML and set limit visibility on the application for an Active Directory Security Group, application icon will not enumerate. The application will enumerate when through Storefront Server. If user is added explicitly to the application visibilit...

Enrolled devices continue to show old expiry date certificate even after renewing XenMobile SSL certificate

After renewing the SSL certificates on Netscaler as well on XenMobile, enrolled devices still shows old certificate Note -New devices are getting enrolled successful with the new issuing and root certificates. However already enrolled Devices -- Settings -- General -- Profile & Device Management...

Error Cannot get apps from the store on Storefront

Upgraded Storefront from 3.9 to 3.11. During the test conducted I am able to successfully: - Log in via browser Chrome internally and externally and launch applications. - Open Citrix Receiver internally, log in and launch apps. What no longer works is external receiver access. On launching the...

"Missing intermediate certificates or root anchor" While Scanning Vulnerablity of MDM IP

While customer uses 3rd-party security scanner to scan MDM IP, there is warning:"Missing intermediate certificates or root anchor"...

NetScaler 12.0 51.24 Shows Status of Connectivity Between NetScaler SNIP and AppFlow Collector

With the NetScaler Release 12.0 Build 51.24, NetScaler admin can view the status ofconnectivity between NetScaler's SNIP address and Appflow Collector by checking new information called State NetScaler's SNIP address is used to detect network reachability between NetScaler and AppFlow collector. ...

iOS 11 MDM-enrolled Device Issues with XenMobile in Cluster Mode

MDM commands may try to deploy multiple times on an MDM-enrolled iOS 11 device and may fail to complete successfully. An admin attempting to push MDM policies to an iOS 11 device, deploy applications, or carry out security actions such as Lock or Wipe may not be able to successfully to do. The us...

"Unknown Client Error 1110" error when launching Desktop using Firefox

When launching adesktop, user might get an "Unknown Client Error 1110" error The error is appearing only when using the Firefox browser to connect to the gateway. If used with other browsers, desktop is launching properly. If the ICA file is saved to the disk prior to launch, the desktop...