SageLike.com

2025 Credit Card Recap and Happenings This Year

2025-12-24T16:56:00.008-07:00

If you have been reading along my series about credit cards, on the last day of 2024, I posted my roadmap for 2025 and you can read that here if you already have not done so. As we close out 2025 all I can say is roadmaps are good for one thing, and that is they are good at getting messed up. My credit card roadmap for 2025 has been nothing but different than what I wrote about here.

I spent the first eight months of the year “gardening” if you are not familiar with that term, it is where people hold off/delay applications or if they do apply, they apply for cards that do not impact personal credit card status (aka getting business credit cards that do not report to personal credit reports).

The main intent of my gardening was trying to get the Capital One Venture X. I held out as long as I could and even cancelled fifteen no-annual fee cards to reduce the number of cards to be more attractive to Capital One’s algorithm.

I did in fact apply for the Venture X on livestream with my friend Joe Barreto and after all of the effort of cancelling cards and gardening; my application was denied. More on Joe later in this blog.

Lets rundown what is in/out and other happenings in 2025.

Here is What is Out:

The Chase Business Ink Cash

The ability to collect multiple Ink cards is over, no real sense in trying as all it does is waste a hard pull on credit.

The American Express Business Gold

My accountant worked his magic and this year I actually ended up with a tax return while in previous years, I owed a substantial amount of taxes. Therefore, there was no need to seek out a no lifetime language link to get the Business Gold card again and paying taxes to hit the high spend requirement.

The American Express Business Platinum

Just like with the Business gold, once my accountant worked his magic and this year, I actually ended up with a tax return while in previous years, I owed a substantial amount of taxes. Therefore, there was no need to seek out a no lifetime language link to get the Business Platinum card againand paying taxes to hit the high spend requirement.

The American Express Business Delta Gold

When looking for alternative airlines that I would be primarily flying, I determined that Delta is not going to be it as there are certain routes that I fly (Denver to Phoenix and Denver to Las Vegas) that Delta does not fly. Therefore, if Delta is not going to be my primary airline, it is not worth using up an Amex slot on for me.

The American Express Hilton Business

The intent of getting the Hilton Business card was more just getting the welcome bonus. Since I already hold three Hilton Aspire cards and have other aspirations with my Amex card slots the is put on hold for now.

Here is What is In:

The American Express Blue Business Plus

The Blue Business Plus does not report to my personal credit and since I hold many American Express cards it is only a soft pull on my credit. It also serves as a catch all card for anything that earns American Express Membership Rewards Points.

Chase Marriott Bonvoy Boundless

Jumping back in and actually making things happen I applied for the Chase Marriott Bonvoy Boundless card when the Signup Bonus was three free nights in August. The Ritz Carlton card has been on the radar for a long time and to me it was as good as time as any to start the clock on being able to get the card.

United Business

I pulled the trigger on the United Business Card and the reasoning came down to two major factors: an elevated offer and a change in my preferred airline when traveling.

Chase recently rolled out an elevated 100,000-mile welcome offer for the United Business Card. I also intend next year to switch over to flying primarily with United so the priority boarding and first checked bag free are perks to be used as well

The Citi Strata Elite

I also pulled the trigger on the Citi Strata Elite. Two primary reasons for this. The elevated 100,000-point offer and the ability to double dip the hotel and Splurge credits.

If you are not familiar, each calendar year the card offers a $300 hotel credit when book through the Citi travel portal and a $200 Spurge credit that works with 1stDibs, American Airlines, Best Buy, Future Personal Training, and Live Nation. Applying for this card in November will allow me to use the credits before the year end and once again in 2026.

More to be discussed on the use of the hotels credit below.

The Morgan Stanley Platinum

Folks may ask, Why the Morgan Stanley Platinum when you already have the Platinum card? My answer is, in February my annual fee will post for my vanilla Platinum card at that time I will have to make a decision on keeping it or downgrading it. With the Morgan Stanley Platinum card, I have the ability to use the Saks Fifth Avenue, the Airline credit, the Fine Hotels and Resorts credit, Lululemon credit and Resy restaurant credit.

If you are not familiar, each calendar year the Platinum card offers $200 in airline credits, each quarter there is a $100 Resy restaurant credit and Lululemon credit. Also, there is a $50 credit with Saks Fifth Avenue each half of the year as well as a $300 credit when booking with the Amex Fine Hotels and Resorts program.

Card Denials

Not every credit card application ends with a "Congratulations!” Here are the application denials for the year:

Capital One Venture X

As outlined above I ultimately was denied for the Capital One Venture X

The Chase Business Ink Preferred

My recent attempt at getting the Chase Ink Business Preferred was met with a denial. Calling reconsideration did not work as well. Generally a polite conversation about your business goals or an offer to move credit from an existing card is enough to turn a "No" into a "Yes." with the Chase reconsideration line.

This time, however, the reconsideration was a no that would not budge. Here’s how it went down:

I offered to shift credit from my Ink Cash and Ink Unlimited to the new Ink Preferred. Usually, this is a winning move because it does not increase Chase's total risk. The agent’s response? A firm "The system has already determined the maximum amount of credit we can extend to your business at this time."

Here is What Else that Happened in 2025:

The Credit Card Meetup in Puerto Rico

In the beginning on November, just like last year, there was a credit card meetup. This time instead of New Orleans, LA; we met up in San Juan, Puerto Rico. The host of the meetup this year was Cesar Joel, again this was a great opportunity to meetup with friends in the community.

Here is a picture from the Casa Bacardi Tour

As well as the annual Wepa we did during the actual meetup

Here is a group photo from the meetup

The meetup in New York/New Jersey

In December, I wanted/needed to use my Amex Fine Hotels and Resorts credit as well as the three free nights at Marriott from the Boundless card. There have been discussions between my Friend Joe Barreto and I, and I locked in the dates. The first night was at The Beekman Hotel in New York City and the following 3 nights were at the Envue, Autograph Collection hotel by Marriott in Weehawken, NJ.
Here is a picture of the meetup I had with Joe Barreto where we had drinks and dinner:

The Amex Lounge at Salt Lake City

With the Citi Strata Elite, there was a $300 hotel credit that I wanted/needed to use by the end of the year as detailed above. I decided to use that on a work cationic Salt Lake City. Going to Salt Lake City would allow me to visit the newest Amex lounge in the Centurion lounge network which just opened on October 28th.

The Centurion Lounge at Salt Lake City is the second largest lounge in the Centurion lounge network at 18,000 square feet. While at the lounge I did not feel crowded. There were multiple bars, a coffee bar with Amex branded pumpkin spice cookies, a sorbet station as well as an outdoor terrace area.

Lounge Entrance near Gate B31

Front Desk/Check-in Area

Lounge Artwork

Blue Roast Coffee Bar

Outdoor Terrace Area

Food/Beverage

Main Room with a Fireplace

Bars

Overall the nicest American Express Centurion Lounge I have been too yet (not surprising as it is the newest). Lots of happenings in 2025. If you are reading this before 2025 is over, wishing you Happy Holidays. Looking forward to 2026 and what the credit card world will bring

Let me know thoughts on my recap in the comments below. I do offer credit card road mapping as a service and am more then happy to map out what make sense for you as well. Interested in working on a credit card roadmap of your own? Reach out to me here to book 1:1 time

Johnny
Connect with me on Linkedin
Minnect with me Today

My Credit Card Roadmap for 2025

2024-12-31T10:26:00.017-07:00

Being that it is the end of 2024, I thought it would be fitting to talk about what is on the credit card roadmap for 2025. This is my second post on this blog what I am doing with credit cards points and miles. To read my previous blog post on how I win with credit card points and miles see the post here.

I am exactly at 5/24 currently. For those that do not know, Chase has a 5/24 rule where if someone has opened five personal credit cards in twenty-four months, they would be automatically denied for credit cards (unless under certain circumstances). The denial of credit cards goes beyond personal credit cards and extends to business credit cards as well.

With that said, in April of 2025 I will once again be under 5/24 as I will be be at 4/24. Here is what I have on the roadmap as of the writing of this post:

Chase Business Ink Cash: Currently there is a signup promotion on the spend for the card where it is tiered. $350 of rewards can be earned for $3,000.00 spend in the first three months and $400 of the rewards can be earned for $3,000.00 in spend for the first six months. Assuming the promotion is still available in April. This will be the next card. Make no mistake, the $750.00 in rewards is not cash back and it is in the form of Chase Ultimate rewards points (which can be cashed out as cash back). It is a marketing play to put the rewards in dollars to make it resonate with more folks.
Chase Marriott Boundless: I aspire to ultimately end up with five or six free night certificates each year from cards. Currently I am spending through the signup bonus for my third American Express Hilton Aspire card. My plan is to start collecting luxury Marriott free night reward certificates and it starts with this card which will eventually be product changed to the Ritz Carlton card after holding this card for a year (which no longer can be applied for anymore).This is going to be a multi year approach which also could lead to me getting lifetime Platinum Status with Marriott as well.
American Express Business Gold: Just like in 2024, with the need to pay taxes. This card would be obtained with a no lifetime language link as well and elevated offers are typically 150,000-200,000 membership reward points range. The current Business Gold card I have would be cancelled when the annual fee is up and swapped out with this one for a year.
American Express Business Platinum: Just link above, with taxes, there should be room to charge across two cards as it would allow for me to collect signup bonus on multiple cards. This card would be obtained with a no lifetime language link as well and elevated offers are typically 175,000-250,000 membership reward points range. The current Business Platinum card I have would be cancelled when the annual fee is up and swapped out with this one for a year.
Chase Business Ink Preferred: The Ink Preferred would allow for the Sapphire Preferred to be cancelled. This card offers basically all of the same perks as the Preferred but on the business side. Folks may ask, "well are you not over 5/24 again and cannot get any more Chase cards after the Chase Marriott Boundless?" In June and July of 2025 I will have two more cards fall off of 5/24 status and it is anticipated that by then I will be at 3/24 after the approval of the Chase Marriott Boundless card.
American Express Blue Business Plus: This card will finally round out the Amex trifecta. This card is much overdue but was never obtainable because of the Amex five card limit. Will try for it and potentially cancel one of my really old Amex cards if necessary. This card is a 2x multiplier on everything and fits the need for a catch all.
American Express Business Delta Gold: Extra in case there is the bandwidth as this would potentially be my seventh card for the year. The main draw here is the Delta Stays credit, free first checked bag and priority boarding. I do fly Delta back from Salt Lake City to be able to go to the Delta Sky Club in SLC airport so on those trips I do not have any status or priority boarding. Once again, would potentially be subject to the Amex five card limit and how much the limit can be pushed.
American Express Hilton Business: As of the time of wrting this the bonus is 175,000 Hilton Honors points. This card has a 5x multiplier for everything up to $100,000 spend on the card per year. Once again, would potentially be subject to the Amex five card limit and how much the limit can be pushed.

Let me know thoughts in the comments below and more importantly what is on your roadmap? I do offer credit card road mapping as a service and am more then happy to map out what make sense for you as well. Interested in coming a credit card roadmap of your own? Reach out to me here to book 1:1 time

Johnny
Connect with me on Linkedin
Minnect with me Today

Winning with Credit Card Points and Miles (A Road Warrior Perspective). 2024 Edition

2024-12-18T08:14:00.038-07:00

This is not a typical blog I would write on this forum. Depending on the reception of this, there could potentially be more to come going forward. One of the biggest things of being a road warrior over the last four years is brought me is insight. It is not insight into the job, it is insight into how deep the rabbit hole can go in the realm of credit card points and miles. At my previous job as a traveling Consulting Architect, I did travel some, but I never spent too much time looking into how I maximize what I get back from all of that spend. To be fair, for my first year at this current job; I did not do too much of that as I put everything on one card and did not apply for an get new cards at the velocity as I do today. For my job, I am a staff Sr. Solutions Architect that travels for onsite customer visits/events and community events/trade shows. On a normal year I can travel fifteen/twenty five times. When I travel for work, all expenses are charged to my cards and I get things submitted for reimbursement.

I wanted to share some of the insight of what I have found, debunk a lot of the bad information and notions that folks have in the credit card space.

The most common thing that folks ask when I tell them I get five-eight new cards a year and I cancel/downgrade cards that no longer work for me that carry an annual fee is that “does that not hurt your credit score?”. Not much. As of this writing my score across all three credit bureaus is ~800. Most lenders consider anything over 720 as very good/exceptional. There are folks out there that preach how people should have a perfect 850 credit score. I have yet to ever be denied a new loan or for a refinance of a loan for as long as I have done this with cards. Since I am already an American Express customer, all new cards are soft credit inquiries after the hard credit inquiry for my first card. Yes, applying for and getting five-eight cards a year elsewhere dings my credit score five/ten points at a time, but the score generally recover in a short period of time. If we examine the breakdown from the three credit bureaus, new credit/inquiries only count for 10% of your credit score.
The second most common thing asked is "how do you get business cards and use them for personal spending?" For issuers, the term business can be used very loosely. If folks periodically sell things on eBay, it can count as a business. There is no formal need to establish things such as LLCs, articles of incorporation, etc... When applying for business credit cards, simply apply as a sole proprietorship and use an SSN/EIN for the tax IDs. "Did you just not say that there is no need to establish business documents? Why would I get an EIN?" An EIN can be obtained from the IRS for the sole proprietorship for free and the process is a few minutes on the IRS website. This can be potentially useful in certain circumstances as some banks want this as opposed to just using an SSN. Be aware that some banks may require establishing a banking relationshitp in order to get business cards (typically easily enough to open a checking account, putting in funds and then apploying for the card).

The big question here is why do I get five-eight cards a year? In my world, getting new card and collecting the signup bonus is the quickest way to ingest large sums of points. An example calculation of this is if we were to take a card like the Chase Sapphire Reserve card, the signup bonus that typically is always there is 60,000 points for $4,000 in spend in three months. One of the big multipliers on that card is 3x multiplier on dining. To organically earn 60,000 points with the 3x multiplier on dining, one would need to spend $20,000 in dining. Now we see that there can be a significant shortcut to get to points. As that $4,000 in spend can be whatever (aka flights, hotels, dining, gift cards, etc..).

What is my card formula? Some folks cannot stomach the high annual fees on cards but living in the credit card space means we must be comfortable playing the game of arbitrage.

As shown in the picture above. I am more then happy to pay X if it means I can get back X + Y in value. In the example it would be something like the Chase World of Hyatt card. It is a $95 annual fee but in return it is a category one-four free night certificate. Also with a card such as the American Express Hilton Aspire; I pay a $550 annual fee and as long as I can get a free night certificate that is over $550, it is considered a win. This also does not include the other perks such as the resort credit, the airline incidental credit, Clear credit etc... Once I found this formula, it became a no brainer for me and my pursuit of points and miles.

Here are some general rules/guidlines I use for aquiring credit cards:

Do not get credit cards without defining the goal outcome from getting credit cards.
Only get credit cards where the signup bonus fits your spending pattern (aka do not get cards and spend like wild and then not have the means to pay them off).
Do not get cards with annual fees unless you can stomach paying the annual fee. Typically annual fees post for new cards a month after opening and then post again every twelve months when a new statement for that month posts.
I do not recomended to get cards unless you can pay the statement balance in full each month (similar to the above rule).

In my setup I always have new cards rolling in, but I also have a core setup that provides me the various statuses that I use when I am traveling for both personal and business.

I have even taken cards far enough to go to a credit card meetup that was organized by a few credit card content creators on YouTube, This meetup was held in the French Quarter in New Orleans back in September.

Here is my core setup or what folks potentially call a “What’s in My Wallet” at this time review.

American Express Personal Platinum Card
American Express Hilton Aspire Card x3 (three cards)
American Express Personal Gold Card
American Express Business Gold Card
American Express Business Platinum Card
Wells Fargo Business Signify Card
Chase Sapphire Preferred
Chase Freedom Unlimited Card

Folks in the know, will tell me that is a lot of money that I am paying in annual fees. They would be correct as that is $3,835.00 in annual fees to be exact.

Here is the annual fee breakdown:

American Express Personal Platinum Card - $695 annual fee
American Express Hilton Aspire Card x3 - $550 annual fee (per card)
American Express Personal Gold Card - $325 annual fee
American Express Business Gold Card - $375 annual fee
American Express Business Platinum Card - $695 annual fee
Wells Fargo Business Signify Card - $0 annual fee
Chase Sapphire Preferred - $95 annual fee
Chase Freedom Unlimited Card - $0 annual fee

Lets breakdown why the cards are in my wallet.

The American Express Personal Platinum card is in my wallet for lounge access. My home airport is in Denver, so I go to the Centurion lounge on a frequent basis. I carry the card in case for whatever reason it needs to be shown at the lounge.
The American Express Hilton Aspire card is in my wallet for the Hilton Diamond status and in a pinch can be used as a catch all as it offer 3x multiplier per dollar in the form of Hilton Honors points. I have three of these as I collect the three annual free night certificates each year and I have used no lifetime language links (American Express signup bonuses are once in a lifetime) to get the second and third cards.
The American Express Personal Gold card is in my wallet for the 4x multiplier on dining and grocery store purchases. This is considered by Amex enthusiasts as the workhorse card of Amex and is used to earn the majority of their membership rewards points.
The American Express Business Gold card is in my wallet as I originally got the card to pay taxes (there potentailly will be another blog on using credit cards to pay taxes) to collect the bonus but since then have been using it monthly at office supply stores for the $20 credit back to offset the annual fee. This card will be cancelled after twelve months/one year mark as it does not align with the long-term goal. In all liklihood, by the time it comes to tax time in 2025, there will be a different no lifetime language link that I will use to get the card again to pay taxes and once again collect another signup bonus.
The American Express Business Platinum card is in my wallet for a lot of the same benefits of the Personal Platinum card. It does offer the same lounge access, and I originally got the card to pay taxes. This card will be cancelled after twelve months/one year mark as it does not align with the long-term goal. In all liklihood, by the time it comes to tax time in 2025, there will be a different no lifetime language link that I will use to get the card again to pay taxes and once again collect another signup bonus.
The Wells Fargo Business Signify card is in my wallet as I just recently hit the threshold for the minimum spend and until the actual signup bonus hits my card it will stay there in case a return or credit happens pushing me below the threshold. This card will go into my folio wallet long term and once a year I will buy a $5.00 amazon giftcard on it to keep the credit alive.
The Chase Sapphire Preferred card is in my wallet if an establishment does not take American Express. It does have some perks such as 3x multiplier on dining, 3x multiplier on online grocery stores. On an annual basis, I will book a hotel through Chase Travel annually to use the $50 credit making the effective annual fee $45. It also offers Primary Collision Damage Waiver coverage on rental cars book throuhg traditional rental car companies such as Hertz, National, etc... and not something like Turo as it is considered peer to peer car rentals. The plan for this is to hold the card for two more years, downgrade the card to something no annual fee and then reapply for the card again or apply for the Sapphire Reserve card to collect a new signup bonus as bonuses for Sapphire cards are available once every four years. By the time that comes, I will be evaluating the usefulness of the Sapphire Reserve as one of the cards I will be looking to have by then is the Ritz Carlton card and the Ritz Carlton card will give me access to the Chase Sapphire airport lounges.
The Chase Freedom Unlimited card is in my wallet as it serves as a second form of ID as that is one of the very few cards, I have signed the signature line on the back. One habit I also have along with credit card points and miles is I collect bank account bonuses as well and some banks require a second form of ID and this card works for that purpose (potentially another blog on bank account bonuses as well).

With these current cards and continuing to apply for new cards to collecting the signup bonuses. Over the course of this year, I have accumulated 425,000 American Express Membership rewards points, 350,000 Hilton Honors points and $1,800.00 in cash back from signup bonuses this year. I not only have spent through the one of my Hilton Aspire cards, Wells Fargo Business Signify card, but prior to that it was the Huntington Business Voice card and U.S. Bank Triple Cash card. If we take the typical valuation of the American Express Membership Reward points at its lowest value of $1.0 cent per point, converting points to dollars they are valued at $4,750. With the valuation of Hilton Honors points at $0.6 cents per point it is worth $2,100.00. This covers the annual fees and some for the cards acquired this year as $6,850.00 is more then the the $3,835.00 that is paid in annual fees. This does not account for the points earned on the spend and things such as free food and beverage credits at Hilton properties, Hilton resort credits, annual airline incidental credits, American Express annual Fine Hotel and Resorts credit, annual Clear Plus membership, free night reward certificates, Amex cash back on offers from various merchants, etc… that come with the cards.

Overall, for me credit cards are easily a big win in 2024. I highly recomend everyone look at their setup and see what can potentially make sense of them, even if they do not travel a substantial amount there is potential justification for some of these cards. The setup does not need to be as extensive as mine. Onwards and upwards in 2025. Let me know thoughts in the comments below and more importantly how are you making credit cards work for you. I do offer credit card road mapping as a service and am more then happy to map out what make sense for you as well. If interested let me know in the comments.

Johnny @mrjohnnyma

Windows Pagefile Done Right

2023-02-08T11:18:00.030-07:00

Over the years there has been a lot of information on configuring the pagefile, paging has gone through the evolution on what size and configuration it should be. With virtual machine RAM allocation going higher and higher and a lot of guidance from the likes of Citrix and VMware to potentially build VMs with 64GB+ RAM. Paging is a very interesting topic as setting the pagefile size too high, wastes disk space; removing the page file entirely is bad as well as Windows needs to have a pagefile even though we do not want the system to page. Not having a pagefile equates Windows complaining about not having enough virtual memory if the actual memory is fully allocated. While no one wants to page and systems should be built to minimize paging aka allocating enough memory to let folks operate their applications without paging but systems should be configured to allow some sort of paging as a "use in case" measure. Lastly the out of box configuration of a system managed pagefile is also a bad idea.

Setting the pagefile to system managed in an enterprise type of environment is a bad practice. The reason why? If there are any monitoring tools a lot of monitoring tools track pagefile utilization and it is typically tracked as a percentage. If the pagefile is set to system managed and the minimum/maximum are not set, it can result in monitoring tools reporting excessive pagefile utilization.

Setting the pagefile with the old school approach of setting the pagefile 1.5x the size of the memory results in this configuration. We will hear a lot of complaints about wanting to capture some sort of dump for Microsoft to "analyze". When was the last time Microsoft successfully analyzed a dump with meaningful results? For me it has never happened.

Here is what the drives would look like if we for instance allocated 64GB of RAM to a VM and are using the old school approach of 1.5x RAM for the pagefile:

Here is the error in the eventlog when the pagefile is completely eliminated as virtual memory is low:

What is the happy medium? Setting the pagefile to either 4096MB/4GB for both the minimum and maximum on single user operating systems and 8192MB/8GB for both the minimum maximum on multi-user operating systems.

Why is this the happy medium? I checks all of the boxes as it allows for Windows to have a pagefile if needed, it allows for a minidump to be configured/captured/analyzed in Windows if needed and it is not too large that we feel like we are wasting space.

What about memory dumps? Well if there is a need for some sort of memory dump to be captured and analyzed, Windows can be configured to generate a minidump. There are plenty or articles/blog posts out on the internet on how to configure Windows to produce a minidump.

If you have any thoughts, we would like to hear from you in the comments.

Johnny @mrjohnnyma

Don't Treat Your Virtual Desktop Security Like Your Physical Desktop Security

2022-07-21T20:06:00.000-06:00

This blog post complements a previous blog post I wrote a bit ago talking about not using your physical image in your virtual environment. To check out that one please refer here.

Are you using anti-virus, anti-malware, data loss prevention (DLP) software or the like on your virtual desktops? Are you treating them the same as you would on a physical desktop? If the answer was yes to both this is the blog for you. If you are not using anti-virus on your virtual desktop that is a whole other conversation and potential can of worms that needs to be addressed. When running any of the various security tools out there we need to consider the need to configure the proper exclusions to ensure everything runs properly and the users are not getting performance degradation because these exclusions are missing. I see this all of the time that folks are not properly implementing the proper security tool exclusions into their virtual desktop images or they configure the exclusions in the various consoles and they can be shown when asked but machines are not landing in the proper container to actually get the exclusions. I recently was working with a customer that was suffering severely slow/long application launch times in applications such as Outlook, Teams, OneDrive, etc... Upon examining they were capturing things like the Outlook OST, Teams Cache and OneDrive cache into virtual disks stored on a network share as VHD/VHDX files. When users would log onto a virtual desktop and these virtual disks mounted they were being actively scanned by anti-virus and when the Outlook, Teams and OneDrive clients were trying to read the data on the virtual disks performance was hampered because of the scan.

The above not only just applies to non-persistent desktops but to fully persistent desktops as well. I know I will get the response of "aren't persistent desktops the same as physical desktops?" The answer is yes and no. While anything that gets written to the disk is fully stateful and there may or may not be any profile management happening on these desktops. There are still the core virtual desktop components installed to deliver folks the remote display capability with the requisite virtual channels to allow for things like audio/video redirection and offloading. Therefore we still need the proper security tool exclusions to ensure everything is as optimized from the security perspective as possible. In addition to this with modern-day laptops/desktops, there are potentially a lot more resources in terms of CPU and RAM compared to what is allocated on the virtual desktop side. So, an un-optimized anti-virus/anti-malware utility's impact on the physical side may not be as noticeable.

Long story short, spending a little bit of extra effort to make sure security tools are configured properly will save the headaches of dealing with complaints about bad experience. Just as I said in the previous blog of the common adage "you can't build a house on a bad foundation." This holds very true on this conversation as well.

If you have any thoughts, we would like to hear from you below in the comments.

Johnny @mrjohnnyma

I Was a Panelist Discussing Challenges of a Hybrid Workforce with Citrix

2021-04-28T11:50:00.004-06:00

Introduction:

For those that are not aware, I recently made the move to join Liquidware as a Sales Engineer and subsequently moved away from my long tenure in consulting, while I am greatful for all of the customers and companies that I worked with. Sales Engineering has always been a goal of mine to formally get into and things have been great so far. In my role as a Sales Engineer, I am always asked to present and discuss not only Liquidware's products but present on past experiances I have had implementing virtualization with customers. Recently I was tab to speak on Liquidware's Unplugged webinar about The Challenges of a Hybrid Workforce with Calvin Hsu who is the V.P. of Product Management at Citrix and Jason Smith VP of Product Marketing at Liquidware.

For those of you that are not aware, Liquidware's Unplugged Webinar series is interactive webinars that are built exclusively for the end-user computing (EUC) community. More information can be found on Unplugged here.

Recording:

Here is the recording of the Unplugged Session with Calvin Hsu.

Hopefully this webinar is a first of many that I will be able to participate in going forward. Please use the link above to stay up to date with future Unplugged sessions.

We would like to hear from you so feel free to drop us a note if you have any questions.

Johnny @mrjohnnyma

Replacing a Self-Signed Certificate on vCenter 7.x +

2021-04-19T08:32:00.002-06:00

Purpose:

Demonstration on how to replace the self-signed certificate on VMware vCenter.

Introduction:

Having valid certificates is not only crucial today and going forward, it has been crucial for the last few years as well. Having valid certificates not only ensures that a certain security posture being maintained, it removes any unsightly certificate warnings that make various products unfriendly to use for the administrators/engineers/architects.

I recently made a transition from Nutanix Community Edition (CE) to VMware vSphere in my home lab due to upgrade issues with the most recent release of CE. VMware vSphere 7.x and above resolved an issue where the NIC in an Intel NUC 10 was not detecting during installation and the driver needed to be sideloaded before CE could be installed. This is a continuation of my blog series where I take a focus in on security from a virtualization standpoint. Here is a similar themed blog about how to replace the self-signed certificate in Nutanix Prism Element and Prosim Central.

Today we will talk about how to replace the certificate on vCenter and how significantly easier it has become to do so. Before I start, I am going to preface this that process only applies to VMware vCenter 7.0 and above at the time of this writing. If folks are still running a vCenter 6.5 or 6.7 this will not work there as the process is completely different. Also this not only affects Citrix, it affects VMware Horizon and any other solutions that integrate into vCenter.

How many of us have in the past or even today check the box on this message to acknowledge and trust the self-signed certificate in an on-prem or cloud based full Citrix Studio?

Most of us probably click through it without second thinking why the warning applies or also just wave it off as “that is not my problem and it is the vSphere team’s problem”. While it may be the vSphere teams problem, security should be a concern from all IT folks as there are always ways that system compromises can easily be fixed if there was a security first mentality. In addition to this, replacing the certificate will remove the warning from vCenter when folks use the vCenter web console.

In vCenter 7.0 and above it is very easy to replace the certificate so that the warning never even pops up when establishing the Hosting connection string from Studio.

Configuration Steps:

First we will need to create a certificate, in my case I will be using a domain certificate authority (CA). A certificate from a 3rd party well trusted CA can also be configured in this manner as well.

I find it easier to generate the CSR on the vCenter and later will have some interesting issues from generating the CSR elsewhere.

Go to vCenter and login as administrator@vsphere.local (this is the only account that has permissions to change the certificate management) On the Top, go to Menu -> Administration

On the left pane -> Click Certificate Management

Under Actions -> Click Generate Certificate Signing Request (CSR)

Fill out the information appropriately -> Click Next

Copy or Download the CSR -> Click Finish

Open a browser and go to https://domainca.fqdn.com/certsrv replacing with your domainca FQDN. In my case it is domain1.domain.lab. -> Click Request a Certificate

Click Advanced Certificate Request

Click Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file

Copy and paste the contents of the CSR file generated earlier into the large field -> Select the appropriate certificate template -> Click Submit

After submitting the certificate may be pending if the CA is configured for approval (as such in my lab). Get the proper approval to issue the certificate

After approval go back to https://domainca.fqdn.com/certsrv -> Click View the Status of a Pending Certificate Request

Click on the Request from earlier -> Click on the Request

Select Base64 encoded -> Download the Certificate

Save with to a location where it can be accessed with an appropriate name –> Click Save

The domain CA’s root and intermediate certificates are required to be exported as .cer as well. In my case, these can be found on the domain controller under Certificate Manager for the Local Machine -> Trusted Root Certificate Authorities Certificates.

Back on vCenter -> Administration -> Certificate Management we need to import the Root and intermediate certificates so that the cert is trusted. -> Click Add

Browse to the root cert -> Click Add

After adding, there are now multiple Trusted Root Certificates

For the Machine Cert section Click Action -> Import and Replace Certificate

Select Replace with external CA certificate where CSR is generated from vCenter Server (private key embedded) as the CSR was generated on the vCenter -> Click Next

On the first field -> Click Browse File and select the certificate that the Domain CA issued. On the second field -> Click Browse File and select the domain CA root certificate that was exported. If there are both root and intermediate certificates they may need to be combined in notepad –> Click Next

vCenter Services will automatically restart which will take a few minutes. It is common to get this message as services are restarted.

When vCenter is back and ready log back in and go to the Certificate Management section. The Machine cert should have an updated expiration date. Track that date and make sure to repeat the process again before the certificate expires to ensure everything continues to run smoothly for any services that integrate with vCenter.

There also are no longer certificate warnings when going to the vSphere web client and when the certificate is viewed, it is the appropriate certificate

The Hosting section in Studio connects to vCenter without a warning now as well.

If you tried to generate the CSR outside of vCenter and went through the process of generating the certificate. You could get this error like I did. There really isn’t a reason why the character was invalid but this is why I recommend generating the CSR on vCenter.

Conclusion:

VMware has made it significantly easier to replace the certificate in vSphere 7.x then it was in 6.x. It makes it almost a no-brainer to do this in my opinion. We didn't need to incure any additional costs as the certificate was generated from a domain CA, but this process would work if you need to get a signed certificate from a third party CA. If we take an overall approoach of focusing in on security in each layer of the infrastructure, we significantly improve the security posture of the entire environment and eliminate as many security flaws in the environment as possible.

We would like to hear from you so feel free to drop us a note if you have any questions.

Johnny @mrjohnnyma

Stop Using Windows 10 LTSC

2021-02-10T08:36:00.001-07:00

Windows 10 comes in all kinds of variations. If you have ever run Windows 10 in a virtual desktop capacity there has no doubt been a consideration of using the Long Term Service Channel (LTSC) as opposed to the Semi-Annual Channel (SAC) that is traditionally used on physical endpoints. The two supported versions of LTSC out there as of this posting are Windows 10 1607 LTSB (this was the channel name before Microsoft changed it from Branch to Channel) and 1809 LTSC. As you see, these are locked in time versions of Windows 10 that have 5 years of support before upgrades are needed and if/when upgrades are performed and you can leapfrog from one version of LTSC to another version of LTSC to remain supported. The Semi-Annual Channel has servicing timeline of 18 months from release. Meaning you should be off that particular version 18 months after it is released to maintain support. If we look at the benefits of LTSC vs SAC, we can clearly see some very appealing things for it.

Here are examples of the big ones:

No Windows Store
No Microsoft Edge (we are talking about classic Edge not Chromium Edge)
No Cortana
No feature updates
Less of the question “Who Moved My Cheese” (If you get that reference)

These few items have had administrators and engineers spend countless hours over the years trying to disable them in their virtual desktop environments via scripts, registry changes and disabling services. If we take a step back and look at it, running Windows 10 LTSC gives all of the good things and none of the bad things of running Windows 10 as a virtual desktop. I used to make the comparison as running Windows 7 with a Windows 10 wrapper and if you were running LTSC in your virtual desktop environment you were probably very happy.

Then on February 1st 2018, Microsoft had to come to mess it all up. They posted an article stating that Office 365 Pro Plus would no longer be supported on any version of Windows 10 LTSC effective January 14th 2020. With the wide adoption of Office 365 and the availability of E3/G3 or E5/G5 licensing and the ability to download the offline office clients from these subscriptions it is imperative to maintain support. Microsoft has always taken a stance that LTSC should only be used where the key requirement is that functionality and features don’t change over time. Examples include kiosks, medical systems, industrial process controllers, and air traffic control devices. These systems can have very detrimental effects on functionality if upgraded or are systems that do not have the ability to be updated due to security and network related reasons.

This caused panic and a need to pivot for the IT departments to shift away from LTSC back to the SAC and now administrators and engineers needed figure out a way to be able to test/accommodate these updates to prevent any issues in their virtual desktop environment.

The long story short or TLDR version of this. When deciding if LTSC or SAC version of Windows 10. This really should be a no-brainer and SAC is the only way to go. For those that say they will never go to Office 365 from their on-prem exchange as I have all of these requirements that prevent it, all I can say is “never say never”. You do not want to be reason why an entire environment is not supported and become the bottleneck towards environmental progress. If you are working with a VAR/partner and they tell you that LTSC is the way to go for your virtual desktop image, you may want to re-evaluate that partner as they may be leading you down a bad path.

Johnny @mrjohnnyma

How to Replace the Self-signed Certificate for Nutanix Prism Element and Prism Central

2020-10-12T11:24:00.011-06:00

Purpose:

Demonstration on how to replace the self-signed certificate on Nutanix Prism Element and Prism Central.

Introduction:

There are many blogs out there about how to replace the self-signed certificate in Nutanix Prism Element and Prism Central with a domain signed certificate. A lot of the blogs reference the need to create the Certificate Signing Request (CSR) in the command line of OpenSSL on a Linux or Windows machine. There are alternatives to this, the certificate can very easily be created using the Microsoft certificate snap-in and then using OpenSSL to convert the certificate into an acceptable format for Prism Element and Prism Central to use. This is useful as a lot of workloads (Citrix, VMware, etc...) are being migrated to Nutanix for the hyper-converged benefits and this eliminates the certificate warning and improves security posture for the environment.

Configuration Steps:

Launch the Microsoft Certificate Snap-in for the Local Computer.

In this case I going to create a custom request as I want to be able to define the Subject Alternative Name and use the same certificate for Prism Central and Prism Element. At a minimum there at least needs to be one Subject Alternative Name which is the Common Name or popular browsers such as Mozilla Firefox, Google Chrome or Chromium Edge will produce a certificate warning stating the Subject Alternative Name is missing.

Clikc on Personal node -> Right Click in the Certificate Snap-in -> go to All Task -> Advanced Operations -> Create Custom Request.

Click Next

Since we are creating a custom CSR and do not want to be dependent on an Active Directory Enrollment Policy, select Proceed without an Enrollment Policy

On the Template dropdown, select (No Template) Legacy Key -> Click Next

Expand Details -> Click Properties

On the Friendly Name fill in the friendly name of the certificate. In my case prism.domain.lab.

Fill in all of the certificate details such as the Common Name, Organization, Organizational Unit, Locality and State under the Subject name section. Under the Alternative Name section fill in All of the Alternative Names, in my case prism.domain.lab, prism, prismcentral.domain.lab and prismcentral. This allows for both short names and fully qualified domain names to not produce certificate warnings.

Under the Private Key tab make sure that the Key Size is 2048 bit (always use this) and that Mark private key exportable is checked or after completing the signing the certificate cannot be exported. -> Click Apply

Save the CSR to a location for easy access

Now head over to your Domain CA Web Enrollment portal, typically from a browser go to: https://domaincafqdn/certsrv. Click Request a certificate.

Click advanced certificate request

Click Submit a certificate request by using a base-64 encoded CMS or PKCS #10 file

Open the CSR generated earlier, copy and paste the contents of this into the base-64 encoded certificate request or PKCS #10 or PKCS #7 field. On the Template select the appropriate Web Server Template defined by your Domain CA administrator. In my case Web Server 2048Bit SHA256.

Once the CSR has been submitted and the request has been answered by the domain CA the file should be saved in a place for easy access. In my case the file is named prism.domain.lab.answer.cer

Now back on the machine where the CSR was generated in the Microsoft Certificate Snap-in Right Click -> All Tasks -> Import

Click Next

Click Browse

Browse to the previous location where the answer file was saved. -> Click Open

Click Next

Make sure the Personal Store is selected -> Click Next

Confirm settings -> Click Finish

Now the certificate needs to be exported as a PFX file which contains the private key. When exporting from Windows the private key is encrypted with a password. This will need to be retained in order to perform the next steps in OpenSSL which will extract the certificate pieces and remove the password on the private key.

We can extract the private key from a PFX to a PEM file with this command:

# openssl pkcs12 -in filename.pfx -nocerts -out key.pem

Exporting the certificate only:

# openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

Removing the password from the extracted private key:

# openssl rsa -in key.pem -out server.key

Open the .key file and remove the bag attributes and issuer information or Prism Element and Prism Central will not be able to use it. In addition the intermediate and root certificates for the Domain CA need be available and if there is both an intermediate and root they should be copied into a single file and simply named with a .cer format.

In the settings, go to SSL Certificate -> Click Replace Certificate

Make sure Import Key and Certificate are selected -> Click Next

RSA 2048 should be selected by default. Select the appropriate files. In my example prsim.domain.lab.key for the Private Key, prism.domain.lab.cert.pem for the public certificate and domain1.ca.cer for the CA certificate chain -> Click Import Files

It may take a few moments and the window should reload and now there no longer is a certificate warning on Prism. The certificate installation is the same for both Prism Element and Prism Central.

The certificate can be viewed and it should be the same certificate from before.

Johnny @mrjohnnyma

Don't Use Your Physical Image in Your Virtual Environment

2020-07-22T16:36:00.001-06:00

Are you using SCCM, WDS or other deployment tools or have been asked to when deploying your virtual desktops or virtual application servers? If so, there can be some serious issues with this. I am often asked about by folks wanting to deploy Citrix or VMware Horizon images using the same image that is used for physical endpoints. Not only is this a bad idea, it can present performance ramifications and also make it so that best practices are not followed.

I always have been a believer that hand building the operating systems for virtual desktops and application delivery servers is the best approach because it ensures we know what went into the image. I understand the grips of manually installing the applications and the extra work but the extra work now can save a lot of headaches later and the reason of "this is how we build out images" is not a good enough reason to justify using the same image in the virtual environment. Often and in most cases the deployment person and the virtual desktop environment are not the same person. They build images on physical endpoints or on a completely different hypervisor, they never optimize the image and just let things fly. Since these are physical endpoints they have dedicated hardware and rarely if ever do they experience any issues from being unoptimized. In the datacenter, on a virtual desktop or an application delivery server which share host resources with other virtual machines we need to optimize things as much as possible.

Here are two examples of recent environments where there were issues with using SCCM to deploy the same image as physical endpoints:

First was in the medical field and the customer wanted to move from persistent Windows 10 desktops to pooled non-persistent virtual desktops as the administrative overhead of having a persistent desktop and having to administer the desktops with deployment tools was not feasible. Also, when presented with justifying the need of having a persistent desktop pool and having the response be “that is how we have deployed it before” there really was no reason to have it. When it came time to build the Windows 10 non-persistent image, the customer completely disregarded my suggestion on building the Windows 10 base image by hand and used WDS to deploy the “standard” image that is deployed on physical endpoints. The end result was that a known bug in the image in which the start menu stopped responding to left clicks. This bug also existed on physical endpoints but was hacked around by copying profiles over the default profile but when this was done on the non-persistent desktop image, it caused Citrix Profile Management to create temp profiles on each login. After countless days of the customer trying to remediate this, the only successful way to do so was to break out the iso and install the operating system by hand and manually installing the applications and everything is functioning correctly.
A second example of this was a large law firm migrating from an on-prem Citrix environment to VMware Workspace ONE. When it came time to build their images for the RDS Linked Clone pool they stressed a need to use an existing task sequence that was built for Windows 10 and force it to target a Window Server 2016 operating system. The issue here is that applications were installed before the RDS Session Host role was installed afterwards. It has commonly been a known and best practice for RDS Session Hosts servers that the RDS Session Host role to be installed prior to installing applications due to the need to potentially capture applications settings into the RDS shadow key. In this environment, there are small abnormalities in application behavior even today due to the incorrect installation sequence.

Long story short, when building the images for your virtual desktops and application delivery servers be careful how you approach this. As the common adage is "you can’t build a house on a bad foundation" and doing things incorrectly could lead to a bad user experience.

Johnny @mrjohnnyma

Citrix License Usage Insights

2020-07-06T15:50:00.003-06:00

Purpose

This article describes a new Citrix Cloud service, License Server Usage Insights, that is available to all Citrix Virtual Apps and Desktop customers. Read on to find out why I think this is a big deal especially for customers that that have not transitioned to Citrix Cloud subscription licensing (aka own perpetual licenses).

Trend View: day view but month and year available

Symptom

If you have a single on-prem Virtual Apps and Desktops license server OR have completely transitioned to the Virtual Apps and Desktops service then this new on-prem License Usage Insights may not be for you because Studio gives you a good view of license consumption.

This new service may be beneficial if you have a larger environment that has gotten complicated over the years and there is not a simple answer to, "how are we doing on Citrix licenses?".

Beneficial Scenarios

You are a Citrix architect or admin and use Excel to calculate Virtual Apps and Desktops license usage across your enterprise
Or you have more than one license server (for whatever reason)
Or you have license servers in completely separated Active Directory forests
Or you have more than one license type and this includes both Virtual Apps vs Virtual Apps and Desktops OR you own both concurrent and user/device licensing
Or your management likes to see pretty graphs of Citrix consumption from time to time
Or you would like to give someone in your organization access to consumption but do not want to give them RDP access to the actual Citrix license servers
Or you spend time logged into citrix.cloud.com and it would be more convenient to view license consumption there

Resolution

If one or more the scenarios above apply to you then read on. License Server Usage Insights connects your on-prem license server(s) to Citrix Cloud. It can then aggregate usage from across many license servers and present them in a pretty dashboard.

Setup

Upgrade your license server. You will need to be running version 11.15.0.0 or newer. Download the license server here https://www.citrix.com/downloads/licensing/. Upgrade instructions https://docs.citrix.com/en-us/licensing/current-release/upgrade.html
Enable Call Home on the license server. If you do not have this enabled you will not get the blue "Register" button shown in the screenshot below. See the link in the next step for the details.
Register the license server with Citrix Cloud https://docs.citrix.com/en-us/citrix-cloud/citrix-cloud-management/citrix-cloud-on-premises-registration.html
Wait 24 hours for it to report in the first time. This is a very important step.
Login to citrix.cloud.com and check. As mentioned above, no matter how many times I refreshed the page, it did take 24 hours to populate. Click on the menu on the left and choose Licensing.

You didn't think I would show a real code?

Click Register

FWIW, Citrix license server upgrades were a standard practice back when I was consulting anytime I was upgrading anything in the environment. Not only would you typically get security improvements and bug fixes but it would ensure that a component upgrade would not get halted due to newer license server requirements.

That is all there is to it. I hope this gives you better visibility into your environment.

SageLike Post ID: SL0025

Applies to:

Citrix Virtual Apps
Citrix Virtual Apps and Desktops

References:

Citrix Blogs "New On-Prem License Server Usage" https://www.citrix.com/blogs/2019/08/29/new-on-prem-license-server-usage-insights-powered-by-citrix-cloud/
Citrix Docs https://docs.citrix.com/en-us/citrix-cloud/citrix-cloud-management/citrix-cloud-on-premises-license-usage.html
Citrix Docs https://docs.citrix.com/en-us/licensing/current-release/citrix-licensing-manager/settings.html#register-and-remove-registration-with-citrix-cloud
More familar with the names XenApp and XenDesktop? Check out our cheat sheet on the 2018 Citrix product renaming SageLike.com "Citrix Product Editions 2019" http://www.sagelike.com/2019/05/citrix-product-editions-2019.html

Brian @sagelikebrian

Virtual Apps and Desktops in 2020

2020-06-15T09:32:00.002-06:00

My colleagues Mayank Singh and Rob Beekmans, both Architects in Technical Marketing, packed a ton of good information into this video If you want to see what's new with Citrix Virtual Apps and Desktops, Citrix Managed Desktops, and Citrix SD-WAN in 2020 (so far) and have 91 minutes, I recommend watching the whole thing. Here are a few demos and sections that I want to provide shortcuts to.

Microsoft Teams Optimization

Starts here https://youtu.be/UcEmqQjdQUY?t=2196
Optimizing Teams requirements

Delivery controller 1906.2 and newer
VDA 1906.2 and newer
Windows 10 x64 1906 - 1909
Windows 2012 R2 and newer
BCR_x64.msi
More info in Citrix Docs

High-Level Architecture https://youtu.be/UcEmqQjdQUY?t=2380
Demo of a video call between the Netherlands and India both unoptimized and optimized https://youtu.be/UcEmqQjdQUY?t=2537
Citrix TechZone article to learn about optimizing a variety of other Unified Communication solutions

Browser Content Redirection (BCR)

Browser Content Redirection renders whitelisted webpages on the endpoint and seamlessly feeds it back into the session. Offloading video rendering to endpoints provides both a great user experience as well as reduces backend VDA resources.
Supported VDA browsers: Internet Explorer, Chrome, and Edge (new Chromium). Edge is in Tech Preview.
Overview and configuration starts here https://youtu.be/UcEmqQjdQUY?t=2925
Configuration and demo video of watching YouTube without and with BCR https://youtu.be/UcEmqQjdQUY?t=3250
Learn more in Citrix Docs

FSLogix and Office 365

FSLogix will only save data for a single session. It does not support accessing multiple sessions and consolidating to its profile container. Use Citrix User Profile Manager to write back profile data to FSLogix when accessing more than one session at a time https://youtu.be/UcEmqQjdQUY?t=1985

Machine Creation Services (MCS)

What is it and how does it work? https://youtu.be/UcEmqQjdQUY?t=656
Machine Creation Services Input-Output (MCSIO). Deeper dive into MCS workings. It was revamped in version 1903 for on-prem hypervisors and Azure. Allows for placement of the master and caching disk on different storage. This allows you to use HDD (vs SSD) which scales higher (more users per machine) and provides better response time for users https://youtu.be/UcEmqQjdQUY?t=1239
Publishing an app or desktop using Citrix Managed Desktop (Citrix TechZone) and MCS. Keep in mind Managed Desktops has a simplified web wizard vs Studio https://youtu.be/UcEmqQjdQUY?t=754
Azure on-demand provisioning using MCS. It creates machines on power-on which means you only pay for what you use. Overview and demo using Apps and Desktop Service https://youtu.be/UcEmqQjdQUY?t=1073

Citrix App Layering

Background on image management and how it was historically done vs the app layering way https://youtu.be/UcEmqQjdQUY?t=1565
Elastic layers https://youtu.be/UcEmqQjdQUY?t=1777
User layers https://youtu.be/UcEmqQjdQUY?t=1820
There are several types:

Full
Office 365
Session Office 365

Learn more in Citrix Tech Zone and check out this User Layer video (8 minutes).
Use Azure Files to store layers https://youtu.be/UcEmqQjdQUY?t=1882 and see Citrix TechZone for more

Business Continuity

Using Remote PC (access to the physical computer at your office). A look at the conceptual architectures available https://youtu.be/UcEmqQjdQUY?t=254

I hope this furthers your understanding of what's new in Citrix Virtual Apps and Desktops. Stay tuned for a bunch of exciting announcements in the second half of 2020.

Brian @sagelikebrian

Citrix Storefront + Netscaler GW Optimal Gateway Routing. 1 Farm - Multiple Zones

2020-03-08T13:24:00.002-06:00

Citrix Storefront + Netscaler GW Optimal Gateway Routing. 1 Farm/Site - Multiple Zones

Purpose:
This post is to share how I setup Optimal Gateway Routing (HDX Routing) using zones. I found a lot of documentation on how to set this up for multiple farms (Noted below). However I wasn't able to really find detailed information on how to set this up for just zones.

A quick run down of the environment I'm working on here.
1 Citrix Virtual Apps & Desktops Farm/Site
Delivery Controllers in 2 geographically separated datacenters
Pairs of Netscalers also in the 2 datacenters noted above
9 zones within the farm. 2 within the above mentioned datacenters and 7 in offices across the nation.
VDI's published out of the datacenters and testing publishing out from the offices

Apps published out of all locations (Initially for local access for each office) I'm sure there may be questions about how/why we are publishing apps and desktops but I don't want to get too in the weeds about that.

Anyway so you probably came here because you ran through the other articles you google'd and didn't get what you were looking for when you were getting ready to configure the zone portion within the Storefront HDX routing settings. If you haven't read those articles yet please go run through them. See below. They have all the prerequisites you'll need to start this process. Once you have your certificates with SAN's for each of your netscaler gateways, have applied them then this is where we will pick up.

Directions

Configure Delivery Controller Zones

In your storefront config highlight your store and manage your delivery controllers for the site. Here I've created 2 different groups of controllers -- one for each datacenter.

Once you have those separated highlight the first set and click Edit

In the Edit Delivery Controller windows choose the Advanced Settings -- Settings button

In the Configure Advanced Settings click on the area next to the Zones field

In the Delivery Controller Zone Names window click on the Add button and fill in the zone names per appropriate site.

Once you fill in each of the zones it should look like below. Click OK. Follow this same procedure for your other zone(s).

Configure Storefront Optimal HDX Routing (AKA - Optimal Gateway Routing)

Complete the next steps after all of your zones have been configured.

Highlight site and then click the Configure Store Settings link on the right.

At this point I'm assuming you have gone through the setup of the location specific netscalers. If you haven't yet this is a good article. (https://support.citrix.com/article/CTX215663)

In the Configure Store Settings window click on the Optimal HDX Routing tab on the left. Then highlight the location that we are configuring.Once the site is highlighted click on the Manage Zones button.

In the Manage Zones window click on the Add button and fill in the zone names per appropriate site.

After you have filled them in they should look like below as appropriate to each location. Click Ok. (This should look familiar as we did this for the delivery controllers earlier. They should mimic those settings per location)

Back in the Configure Store Settings window the settings should be updated like below.

Rinse and repeat this procedure for your other location(s. When completed it should look like this. Click Apply and then Click OK.

Oh and one more thing. Make sure to turn on user mapping and aggregation on Storefront to prevent users from having multiple icons of the same published app/desktop.
https://docs.citrix.com/en-us/storefront/current-release/set-up-highly-available-multi-site-stores.html

References:
https://support.citrix.com/article/CTX215663
https://www.carlstalhood.com/storefront-cr-configuration-for-citrix-gateway/#optimal
https://www.jgspiers.com/storefront-high-availability-optimal-routing/

SageLike Post ID: SL0025

Email Files to ShareFile

2020-02-29T06:00:00.000-07:00

Purpose:
To explain why and how to email attachments to a ShareFile folder quickly and easily.

My team at work has five core members but we occasionally will pull in other resources as needed. One of the ways we collaborate is to share files to a team folder using Citrix ShareFile. We all have access to this folder from any of our devices and can sync the data to have it offline if we need them. Recently, I have been looking for a way to share notes and files with the team but not in an obnoxious email after every meeting kind of way.

A quick note on names, ShareFile is technically called Citrix Content Collaboration but that is a mouthful so I will just call it ShareFile. The ShareFile app got renamed to Citrix Files. They were not the only thing renamed by Citrix recently. If you want to see a list, check out SageLike.com Citrix Product Names 2019 and also Citrix Product Editions 2019.

Symptom:
How can I distribute the occasional whiteboard photo without spamming my co-workers?

Resolution:
You can email files directly to a ShareFile folder. Since everyone already has access to this folder, they can browse it at any time and view the files. We can also share the files right from that folder to other teammates or people outside of the company.

Here is how you do it.

1) Login to your ShareFile account on the web.

2) Create a folder you want files to go. Check the box below if you would like to be notified when files are downloaded from this folder.

3) Click the + and then Request Files to generate a link so anyone can send you files and they will be uploaded to this folder.

4) Click Get a Request Link.

5) Define your security policy on the uploads. In this case, we'll get an email and access will never expire. Click Done.

6) The full URL will give anyone access to upload this folder. For email, we want to concentrate on the characters after .com/. Copy them.

7) Now send an email to the characters above + @mail.sharefile.com. You can share that email address or create a contact in your mail program. Then simply email that address with the files as attachments. The subject and body of the email will be ignored.

8) In summary, this is a quick and easy way to send any kind of file to a ShareFile folder. ShareFile fans will likely point out that you can easily upload files using the Files mobile app. This is true but I think this method is a handy alternative especially if you send files over and over to the same place.

SageLike Post ID: SL0024

Applies to:

Citrix ShareFile

References:

CTX208302

Brian @sagelikebrian

Citrix ADC Virtual Server Hardening - The Right Way

2019-10-29T21:15:00.002-06:00

Regardless of which role we serve in an organization, security should always be top of mind. This is especially critical today as we consistently hear how companies have been compromised leading to leaked data which cost them millions of dollars. Since the Citrix ADC presents traffic to the internet everyone should know how to secure what is presented. I am often working with folks that are accidentally presenting unsecured URLs to the internet. The common URLs are HTTP based sites and those sites are unsecured by design. The SSL based URLs are the one we care about more as the typical reason why we secure sites is that there is some sort of personal information is presented or passed on these sites. This blog post is not to discuss the Citrix Web App Firewall that exists on ADC appliances as that feature can fill multiple blog posts on how to configure and secure sites. In this blog post, we are more concerned with the easy wins that we can configure to provide more security on the ADC appliances.

To set the stage here, all of these items only work if the protocol on a virtual server on the ADC is set to SSL. This means that SSL traffic is terminated at the ADC virtual server and decrypted/re-encrypted before being sent to the backend. Therefore, other protocols such as SSL Bridge would not work as the Citrix ADC only passes the traffic through to the backend server which will handle the SSL requests. This type of hardening works for all editions of Citrix ADC. The next level of hardening such as Citrix Web App Firewall is better and if your appliance is licensed for it most definitely use it, but not everyone has a Premium Edition Citrix ADC appliance.

Out of the box any SSL virtual server created on the ADC will score an A- on SSLLabs.com. An A- is a heck of a lot better than what the ADC used to present in older versions of firmware which was capped based on if the appliance was virtual or physical.

Configuration:

To bump the A- to an A+ there are a few things to add. The easy way to add them come in a form of an SSL Profile.

To create one of these we simply navigate to System – Profiles – SSL Profile

It is easier to take one of the out of box SSL Profiles and Click Add and adjust the settings to what we need it to be

It is suggested to name the profile to something that makes sense such as ns_default_ssl_profile_hsts_tls_1.2_only

Set Deny SSL Renegotiation to NONSECURE

Enable HTTP Strict Transport Security (HSTS), set the age to 15768000 and enable the protocols (TLS1.2 only)

Some folks like to set HTTP Strict Transport Security via a Rewrite Policy and it comes down to preference. If set here, we do not need to bind an additional Rewrite policy and bind it to our SSL Virtual Servers.

For those that like to use the Citrix ADC CLI the command is:

add ssl profile ns_default_ssl_profile_hsts_tls_1.2_only -sessReuse ENABLED -sessTimeout 120 -tls1 DISABLED -tls11 DISABLED -denySSLReneg NONSECURE -HSTS ENABLED -maxage 157680000

Now we need to create a custom SSL Cipher Group that has the strong ciphers arranged at the top

To create one of these we simply navigate to Traffic Management – SSL – Cipher Groups

Select the Default Cipher Group and Click Add

Name the Cipher Group the company name or the company initials

Arrange the 24 Ciphers in this order

TLS1.2-ECDHE-RSA-AES-256-SHA384

TLS1.2-ECDHE-RSA-AES-128-SHA256

TLS1.2-ECDHE-RSA-AES256-GCM-SHA384

TLS1.2-ECDHE-RSA-AES128-GCM-SHA256

TLS1-ECDHE-RSA-AES256-SHA

TLS1-ECDHE-RSA-AES128-SHA

TLS1-ECDHE-RSA-DES-CBC3-SHA

TLS1-AES-256-CBC-SHA

TLS1-AES-128-CBC-SHA

TLS1.2-AES-256-SHA256

TLS1.2-AES-128-SHA256

TLS1.2-AES256-GCM-SHA384

TLS1.2-AES128-GCM-SHA256

TLS1.2-DHE-RSA-AES-256-SHA256

TLS1.2-DHE-RSA-AES-128-SHA256

TLS1.2-DHE-RSA-AES256-GCM-SHA384

TLS1.2-DHE-RSA-AES128-GCM-SHA256

TLS1-DHE-RSA-AES-256-CBC-SHA

TLS1-DHE-RSA-AES-128-CBC-SHA

TLS1-DHE-DSS-AES-256-CBC-SHA

TLS1-DHE-DSS-AES-128-CBC-SHA

SSL3-EDH-RSA-DES-CBC3-SHA

SSL3-EDH-DSS-DES-CBC3-SHA

SSL3-DES-CBC3-SHA

For those that like to use the Citrix ADC CLI the commands are:

add ssl cipher COMPANY

bind ssl cipher COMPANY -cipherName TLS1.2-ECDHE-RSA-AES-256-SHA384 -cipherPriority 1

bind ssl cipher COMPANY -cipherName TLS1.2-ECDHE-RSA-AES-128-SHA256 -cipherPriority 2

bind ssl cipher COMPANY -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384 -cipherPriority 3

bind ssl cipher COMPANY -cipherName TLS1.2-ECDHE-RSA-AES128-GCM-SHA256 -cipherPriority 4

bind ssl cipher COMPANY -cipherName TLS1-ECDHE-RSA-AES256-SHA -cipherPriority 5

bind ssl cipher COMPANY -cipherName TLS1-ECDHE-RSA-AES128-SHA -cipherPriority 6

bind ssl cipher COMPANY -cipherName TLS1-ECDHE-RSA-DES-CBC3-SHA -cipherPriority 7

bind ssl cipher COMPANY -cipherName TLS1-AES-256-CBC-SHA -cipherPriority 8

bind ssl cipher COMPANY -cipherName TLS1-AES-128-CBC-SHA -cipherPriority 9

bind ssl cipher COMPANY -cipherName TLS1.2-AES-256-SHA256 -cipherPriority 10

bind ssl cipher COMPANY -cipherName TLS1.2-AES-128-SHA256 -cipherPriority 11

bind ssl cipher COMPANY -cipherName TLS1.2-AES256-GCM-SHA384 -cipherPriority 12

bind ssl cipher COMPANY -cipherName TLS1.2-AES128-GCM-SHA256 -cipherPriority 13

bind ssl cipher COMPANY -cipherName TLS1.2-DHE-RSA-AES-256-SHA256 -cipherPriority 14

bind ssl cipher COMPANY -cipherName TLS1.2-DHE-RSA-AES-128-SHA256 -cipherPriority 15

bind ssl cipher COMPANY -cipherName TLS1.2-DHE-RSA-AES256-GCM-SHA384 -cipherPriority 16

bind ssl cipher COMPANY -cipherName TLS1.2-DHE-RSA-AES128-GCM-SHA256 -cipherPriority 17

bind ssl cipher COMPANY -cipherName TLS1-DHE-RSA-AES-256-CBC-SHA -cipherPriority 18

bind ssl cipher COMPANY -cipherName TLS1-DHE-RSA-AES-128-CBC-SHA -cipherPriority 19

bind ssl cipher COMPANY -cipherName TLS1-DHE-DSS-AES-256-CBC-SHA -cipherPriority 20

bind ssl cipher COMPANY -cipherName TLS1-DHE-DSS-AES-128-CBC-SHA -cipherPriority 21

bind ssl cipher COMPANY -cipherName SSL3-EDH-RSA-DES-CBC3-SHA -cipherPriority 22

bind ssl cipher COMPANY -cipherName SSL3-EDH-DSS-DES-CBC3-SHA -cipherPriority 23

bind ssl cipher COMPANY -cipherName SSL3-DES-CBC3-SHA -cipherPriority 24

That solves SSLLabs.com, a lesser known site SecurityHeaders.com should be put into consideration. This site examines HTTP based header responses that an SSL site presents. Examining SSL based headers is important because HTTP headers are used by client devices and website to share information as part of the HTTP protocol. When we enter a URL in the browser or click on any link, the web browser sends a HTTP request containing client headers while the HTTP response contains server headers. Common HTTP headers can expose things that we don't necessarily want to expose such as the Powered By or Server header that shows what type of platform that the site is hosted on making it susceptible to targeted attacks. Just imaging if someone knows that a site is hosted on IIS, it makes it easier to only focus IIS based attacks on a site as opposed to presenting no information to them. This is commonly overlooked as most are only concerned with SSLLabs.com.

Out of the box any SSL virtual server created on the ADC will score a D on SecurityHeaders.com. We may ask why is this score so low? The answer is until people focus more on this side of site security there will be nothing out of the box to address it.

How do we add/change the headers? We use the Rewrite feature on the ADC to generate Rewrite policies and actions that we bind to SSL based virtual servers.

If not already enabled enable Rewrite from AppExpert – Rewrite – Right Click Rewrite – Select Enable Feature

Before we can create Rewrite Policies, we need to create the Rewrite Actions that bind to them

Give the Rewrite Action an appropriate name such as REW_ACT-CONTENT_SECURITY_POLICY

Under Type Select INSERT_HTTP_HEADER

Under the Header Name type Content-Security-Policy

Under the Expression type "frame-ancestors 'self'"

Rewrite Actions are needed for the following:

REW_ACT-REFERRER_POLICY with the header name Referrer-Policy and expression "STRICT-ORIGIN"

REW_ACT-X_XSS_PROTECTION with the header name X-Xss-Protection and expression "1; mode=block"

REW_ACT-X_CONTENT_TYPE_OPTIONS with the header name X-Content-Type-Options and expression "nosniff"

REW_ACT-EXPECT_CT with the header name Expect-CT and expression "\"enforce,max-age=30\""

REW_ACT-FEATURE_POLICY with the header name Feature-Policy and expression "vibrate 'self'"

REW_ACT-DELETE_SERVER with the type DELETE_HTTP_HEADER and the header name Server

REW_ACT-DELETE_X-POWERED-BY with the type DELETE_HTTP_HEADER and the header name X-Powered-By

REW_ACT-SERVER with the header name Server and expression "CheeseBurgers"

REW_ACT-X-POWERED-BY with the header name X-Powered-By and expression "CheeseBurgers"

Note that the term CheeseBurgers can be changed to anything else. I typically use CheeseBurgers as an Easter Egg to see if people actually notice it.

When finished there should be 10 Rewrite Actions

Now we create the Rewrite Policies that correspond to the actions

Give the Rewrite Policy an appropriate name such as REW_POL-CONTENT_SECURITY_POLICY

Select the Corresponding Action, in this case it is REW_ACT-CONTENT_SECURITY_POLICY

Leave everything else default and in the Expression type True

Rewrite Policies are needed for the following:

REW_POL-REFERRER_POLICY with action REW_ACT-REFERRER_POLICY and the expression True

REW_POL-X_XSS_PROTECTION with action REW_ACT- X_XSS_PROTECTION and the expression True

REW_POL-X_CONTENT_TYPE_OPTIONS with action REW_ACT- X_XSS_PROTECTION and the expression True

REW_POL-EXPECT_CT with action REW_ACT-EXPECT_CT and the expression True

REW_POL-FEATURE_POLICY with action REW_ACT- FEATURE_POLICY and the expression True

REW_POL-DELETE_SERVER with action REW_ACT- DELETE_SERVER and the expression True

REW_POL-DELETE_X-POWERED-BY with action REW_ACT- DELETE_X-POWERED-BY and the expression True

REW_POL-SERVER with action REW_ACT- SERVER and the expression True

REW_POL-X-POWERED-BY with action REW_ACT- X-POWERED-BY and the expression True

When finished there should be 10 Rewrite Policies

For those that like to use the Citrix ADC CLI the commands are:

add rewrite action REW_ACT-REFERRER_POLICY insert_http_header Referrer-Policy "\"STRICT-ORIGIN\""

add rewrite action REW_ACT-X_XSS_PROTECTION insert_http_header X-Xss-Protection "\"1; mode=block\""

add rewrite action REW_ACT-X_CONTENT_TYPE_OPTIONS insert_http_header X-Content-Type-Options "\"nosniff\""

add rewrite action REW_ACT-CONTENT_SECURITY_POLICY insert_http_header Content-Security-Policy "\"frame-ancestors \'self\'\""

add rewrite action REW_ACT-EXPECT_CT insert_http_header Expect-CT q/"\"enforce,max-age=30\""/

add rewrite action REW_ACT-FEATURE_POLICY insert_http_header Feature-Policy "\"vibrate \'self\'\""

add rewrite action REW_ACT-DELETE_SERVER delete_http_header Server

add rewrite action REW_ACT-DELETE_X-POWERED-BY delete_http_header X-Powered-By

add rewrite action REW_ACT-X-POWERED-BY insert_http_header X-Powered-By "\"CheeseBurgers\""

add rewrite action REW_ACT-SERVER insert_http_header Server "\"CheeseBurgers\""

add rewrite policy REW_POL-CONTENT_SECURITY_POLICY TRUE REW_ACT-CONTENT_SECURITY_POLICY

add rewrite policy REW_POL-X_CONTENT_TYPE_OPTIONS TRUE REW_ACT-X_CONTENT_TYPE_OPTIONS

add rewrite policy REW_POL-X_XSS_PROTECTION TRUE REW_ACT-X_XSS_PROTECTION

add rewrite policy REW_POL-REFERRER_POLICY TRUE REW_ACT-REFERRER_POLICY

add rewrite policy REW_POL-EXPECT_CT TRUE REW_ACT-EXPECTED_CT

add rewrite policy REW_POL-FEATURE_POLICY TRUE REW_ACT-FEATURE_POLICY

add rewrite policy REW_POL-DELETE_X-POWERED-BY TRUE REW_ACT-DELETE_X-POWERED-BY

add rewrite policy REW_POL-DELETE_SERVER TRUE REW_ACT-DELETE_SERVER

add rewrite policy REW_POL-X-POWERED-BY TRUE REW_ACT-X-POWERED-BY

add rewrite policy REW_POL-SERVER TRUE REW_ACT-SERVER

Now we need to bind out configuration to an SSL Virtual Server

Open an SSL Virtual Server and Add in the SSL Policies Section on the Right

Click the Dropdown and select the SSL Policy that was created Earlier

Under SSL Ciphers Click the Pencil

Click the – sign next to the DEFAULT Cipher Group and Click OK

Note, this is important as if the DEFAULT GROUP is not unbound there sometimes is the issue where both Cipher Groups are bound which results in not having an A+.

Click the Pencil again, Click the radio button to Cipher Groups and from the dropdown select the Cipher Group and Click OK

Under the Policies Section click the + sign

On the Choose Policy dropdown select Rewrite, on the Choose Type select Response and Click Continue

Click the Arrow to the right of Click to Select

Select a Policy, it does not matter the order and Click Select

The Priority does not matter as long as policies are not bound at the same priority. Make sure the Goto Expression is set to next with the exception of the last policy needing to be End.

When finished there should be 10 Rewrite Policies bound to the VIP

The URL should be ready to scan the URLs from both SSLLabs and SecurityHeaders.

Feel free to drop us a note if you have any questions.

Troubleshooting:

Not scoring an A+? Common reasons why:

The SSL Ciphers have the default cipher bound in addition to the custom ciphers
One of the Rewrite policies with the exception of the last one was bound with the Goto Expression as End as opposed to Next which stop the processing of the Rewrite policies after that policy.
The Rewrite policies are bound to the SSL Virtual Server as Requests and not as Responses.
A minor typo or flipped " (quotes) in the HTTP header can cause SecuriytHeaders.com to flag the header as incorrect. Make sure the " (quotes) are correct if copying and pasting from this blog.

XenApp and XenDesktop 7.15 Plus

2019-09-25T10:54:00.000-06:00

Citrix released the second Long Term Service Release (LTSR) in the company's history on August 15, 2017. This was a hallmark release in our mind because it closed nearly every feature gap of the wildly successful XenApp 6.5 release. At the same time, it was built on the new Flexcast Management Architecture (FMA) which provided customers with much in terms of choice and security.

Our ambitious plan for this article is to detail the new features and enhancements of each of the quarterly Current Releases (CR). In order to make this more readable, we are putting the full details including things like embedded videos into a separate post. Consider this a living document that will be updated over time to create a single searchable list. Check back here as we add the rest of the Current Releases. Please drop us a comment if we missed something.

Brian @sagelikebrian and Josh @virtualjoshespi

Releases

Released February 27, 2019 - End of Life August 27, 2019 Citrix Docs \| Citrix Product Lifecycle Matrix \| Find more details at XenApp and XenDesktop 7.17 User eXperience: High Definition compression support for 64-bit webcam applications. Watermark your desktop or app independent of the endpoint with this new controller and VDA. My Summit 2018 article has an image of a watermark on a Chromebook (SageLike.com). Webcam compression for 64-bit applications like Skype, GoToMeeting, and others on VDA. NVENC hardware encoding in combination with codec for actively changing regions supported in VDA with NVIDIA GPUs. ThinWire now includes higher compression (~15%) MDRLE encoding which replaces 2DRLE on supported VDAs. "What's New with Workspace in February 2018" has more details (Citrix Blogs). Linux support for Pascal GPUs, pass through authentication with smart cards, dynamic keyboard layout synchronization, adaptive transport (Citrix Blogs). Show or hide the remote language bar Admin eXperience: Azure Managed Disks to be used automatically by MCS starting with this controller. Federated Authentications Services now stores info in an embedded database versus the registry. Controller improvements to double-hop scenarios (launching apps in a published desktop). If the app is available in the desktop it will launch it as local vs a new session. Read "Session Sharing Between a Published Desktop and a Published App Made Easy" (Citrix Blogs) for more information including making this work on previous versions. Content redirection blacklist supported on VDA. Also, a new controller policy to prevent failback to server render. Director now supports PIV smart card authentication. Session Recording improvements to event logging (Citrix Blogs). Deprecation and Platform Support: StoreFront support for TLS 1.0 and 1.1 protocols between XenApp and XenDesktop and Citrix Receiver and Citrix Workspace Hub (see CTX232266.
Released November 28, 2017 - End of Life May 28, 2018 Citrix Docs \| Citrix Product Lifecycle Matrix \| Find more details at SageLike.com XenApp and XenDesktop 7.16 User eXperience: High Definition webcam support. Expanded tablet mode in Windows 10 using Windows Continuum. Adaptive transport enhancement. By default, adaptive transport is now enabled (Preferred), and EDT is used when possible, with fallback to TCP. Browser content redirection. Redirects the contents of a web browser to a client device with a corresponding browser embedded within the Citrix Receiver. See (Citrix Docs) for more information. HDX H.265 encoding. Requires an NVIDIA GPU. Read more, "H.265 Encoding Now Available for XenDesktop Using NVIDIA GPUs" (Citrix Blogs). Requires Receiver for Windows 4.10 and must be enabled. Requires a Platinum license. Unicode keyboard mapping. Without the registry setting, if a user changes the local and the server keyboard layouts, the keyboards might not be in sync and character output is wrong. Admin eXperience: HDX 3D Pro is detected automatically during VDA setup. MCS support for on-demand provisioning with Azure Resource Manager. Support for App-V 5.0 deployment configuration files in single admin method and support for shortcuts in App-V packages. Access Monitor Service data uses version 4 of the OData API. Shadow Linux user sessions running RHEL 7.3 or Ubuntu 16.04. Director connects via noVNC. HDX Insight integration of a new NSAP virtual channel. Nick, from Citrix Consulting, is calling this integration, "HDX Insight 2.0" (Citrix Blogs). Applications analytics added to Director. It provides a consolidated view of the health and usage of all published applications. It shows metrics like the number of instances per application and faults and errors associated with the applications. Deprecation and Platform Support: VDA desktop OS support: Windows 10 1607 or newer. For support of older operating systems (Windows 7, Windows 8) use the 7.15 VDA. VDA server OS support: Windows Server 2012 R2, Windows Server 2016 (also supports server VDI). For support of older operating systems (Winddows Server 2008 R2, Windows Server 2012) use the 7.15 VDA.

XenApp and XenDesktop 7.17

2019-09-24T16:41:00.000-06:00

Released February 27, 2018 - End of Life August 27, 2019

Citrix Docs and Product Lifecycle Matrix

To see all Current Release features since the last Long Term Service Release (7.15 LTSR) see XenApp and XenDesktop 7.15 Plus

User Xperience:

Watermark your desktop or app independent of the endpoint with this new controller and VDA. My Summit 2018 article has an image of a watermark on a Chromebook (SageLike.com).
Webcam compression for 64-bit applications like Skype, GoToMeeting, and others on VDA.
NVENC hardware encoding in combination with codec for actively changing regions supported in VDA with NVIDIA GPUs.
ThinWire now includes higher compression (~15%) MDRLE encoding which replaces 2DRLE on supported VDAs. "What's New with Workspace in February 2018" has more details (Citrix Blogs).
Linux support for Pascal GPUs, pass through authentication with smart cards, dynamic keyboard layout synchronization, adaptive transport (Citrix Blogs).
Show or hide the remote language bar

Admin Xperience:

Azure Managed Disks to be used automatically by MCS starting with this controller.
Federated Authentications Services now stores info in an embedded database versus the registry.
Controller improvements to double-hop scenarios (launching apps in a published desktop). If the app is available in the desktop it will launch it as local vs a new session. Read "Session Sharing Between a Published Desktop and a Published App Made Easy" (Citrix Blogs) for more information including making this work on previous versions.
Content redirection blacklist supported on VDA. Also, a new controller policy to prevent failback to server render.
Director now supports PIV smart card authentication.
Session Recording improvements to event logging (Citrix Blogs).

Deprecation and Platform Support:

StoreFront support for TLS 1.0 and 1.1 protocols between XenApp and XenDesktop and Citrix Receiver and Citrix Workspace Hub removed (see CTX232266).

Citrix MCS - Automate Master Image vCenter Update

2019-09-17T15:45:00.001-06:00

Purpose:
This post is to share a Citrix MCS / VMware PowerShell script I created over the last year or so to automate the process of renaming a master image (Win2K16 or W10), converting it to a template, cloning the template and creating a snapshot of the clone in preparation for MCS updates.

You can use this script if you have a single datacenter or if you have multiple. It's relatively easy to modify it so the master image is copied to multiple vCenter datacenters/clusters and follows the same process.

I currently have 9 different datacenters/clusters running the same master image. I just maintain the core master image in the primary datacenter, perform updates, shutdown, run this script and once the process is done I can update each machine catalog one by one from the same master image.

Download the script from Citrix ShareFile

SageLike Post ID: SL0023

XenApp and XenDesktop 7.16

2019-07-31T23:59:00.002-06:00

Released November 28, 2017 - End of Life May 28, 2018

Citrix Docs and Product Lifecycle Matrix

User eXperience:

High Definition webcam support.
Expanded tablet mode in Windows 10 using Windows Continuum.
Adaptive transport enhancement. By default, adaptive transport is enabled (Preferred), and EDT is used when possible, with fallback to TCP.
Browser content redirection. Redirects the contents of a web browser to a client device with a corresponding browser embedded within the Citrix Receiver. See (Citrix Docs) for more information.
"H.265 Encoding Now Available for XenDesktop Using NVIDIA GPUs" (Citrix Blogs). Requires Receiver for Windows 4.10 and must be enabled. If the GPU at the endpoint does not support H.265 decoding using the DXVA interface, the Citrix Receiver for Windows H.265 Decoding for graphics policy setting is ignored and the session falls back to using the H.264 video codec. Requires a Platinum license. See Receiver 4.10 for more information (Citrix Docs).
Unicode keyboard mapping. Without the registry setting, if a user changes the local and the server keyboard layouts, the keyboards might not be in sync and character output is wrong.

Admin eXperience:

HDX 3D Pro is detected automatically during VDA setup.
MCS support for on-demand provisioning with Azure Resource Manager.
Support for App-V 5.0 deployment configuration files in single admin method and support for shortcuts in App-V packages.
Access Monitor Service data uses version 4 of the OData API.
Shadow Linux user sessions running RHEL 7.3 or Ubuntu 16.04. Director connects via noVNC.
HDX Insight improvement. Integration of the new NSAP virtual channel. Nick, from Citrix Consulting, is calling this, "HDX Insight 2.0" (Citrix Blogs) but 7.17 recommended (CTX239748).
Applications analytics in Director. It provides a consolidated view of the health and usage of all published applications. It shows metrics like the number of instances per application and faults and errors associated with the applications. Requires Delivery Controller version 7.16 or later and VDA version 7.15 or newer.

Deprecation and Platform Support:

VDA desktop OS support: Windows 10 1607 or newer. For support of older operating systems (Windows 7, Windows 8) use the 7.15 VDA.
VDA server OS support: Windows Server 2012 R2, Windows Server 2016 (also supports server VDI). For support of older operating systems (Winddows Server 2008 R2, Windows Server 2012) use the 7.15 VDA.

Citrix Posters and Diagrams

2019-06-11T06:00:00.000-06:00

My Citrix journey started about a decade ago. I was lucky enough to work with some really great people to get me started. These mentors helped me with the "what". Building a farm and publishing applications were great but I really wanted to understand the "how". Where did NetScaler end and Web Interface begin? What really happened after a user put in their credentials and click, "Log On". I eventually figured it out using a combination of Citrix Docs, Google, late nights and fixing broken environments.

If I had to learn this all over again in 2019, I would start with an Instructor-Led Training class or eLearning (training.citrix.com). Spending hundreds of hours learning on the job could have been shortcutted with a class. Both of these options will probably cost you or your organization money. Money that in hindsight would have been worth it in my opinion. Maybe the money or the time is not in the cards right now, so let's move on to a great alternative with a lower price point 😏.

Citrix is making posters and diagrams for a variety of solutions. Allen (Twitter) announced the roadmap for these reference architectures in, "What's ahead for Citrix reference architectures" (Citrix Blogs). I use the Virtual Apps and Desktops on-prem poster each and every week when talking to customers. It helps guide me through any of the following:

Virtual desktop models
5 layers of a VAD deployment
User authentication and resource enumeration*
HDX technologies
ICA protocol
Networking traffic and ports
Session launch*

Last week I sent a customer a link to the posters on techzone.citrix.com and he replied back with the image below. It got a lot of attention when I posted it on Twitter. Anyone have a plotter so I can get one for my office?

A customer sent me this after I told them that https://t.co/tycJmor3Cu (design) has the newest Virtual Apps and Desktop posters. This should help him wrap up his documentation, check it out. Thanks, @MartinZugec and @djfeller pic.twitter.com/FlmyD0rwee
— Brian Olsen (@sagelikebrian) May 14, 2019

Brian @sagelikebrian

See also:
Brian's monthly article on important things in the world of apps, applications, and micro apps that we call TheAppFactory. Use the widgets at the left to have this site delivered to your RSS feed reader or by email.

TheAppFactory 1903

2019-05-31T06:00:00.000-06:00

This is my monthly update on important things in the world of apps, applications, and micro apps. For me, it has always been all about the apps.

Additional Resources

News	Last year Citrix underwent a project to unify the product portfolio. Yes, this means that names have changed. Check out our cheat sheet to learn the new names.
Virtual Apps and Desktops	Citrix Tech Zone has a great article on choosing the provisioning model for image management (PVS or MCS?). Check it out if you are curious about the other method or still managing individual VDAs.
SD-WAN	A new article, "SD-WAN in 2019: The move continues, faster!" on Citrix Blogs
Virtual Apps and Desktops	Let's talk about the Q1 release--1903. Key features IMO: Support for copy and paste files between a session and local endpoint MCS Storage Optimization Surface pen support DPI matching on Windows Server 2016 and 2019 For more details check out: Citrix eDocs Spring into the latest features of Citrix Virtual Apps and Desktops (Citrix Blogs) Session recording 1903 available for Citrix Virtual Apps and Desktops (Citrix Blogs) Linux VDA 1903: Ubuntu 18.04 support, enhanced monitoring, and more (Citrix Blogs)
Citrix Files	I have conversations all the time about the need for ShareFile if you already own OneDrive. It is true there is some overlap but it doesn't mean they are mutually exclusive. "How Citrix and Microsoft Can Help Secure Your Data" (Citrix Blogs) digs into how they can work together.
Cool	SAML. Have you heard the acronym but do not know much about it? The world of user identity has become more complicated recently. We used to have Microsoft AD and that was the end of it. If you want to integrate SaaS offerings like Office 365, Salesforce, or ShareFile then you will want to get more familiar. Our friends at Duo put it into terms that really helped me out: "The beer drinkers guide to SAML" (Duo Blog). Let me know if you would like to learn more about SAML and how Citrix can make it easy.
Previous Issues	TheAppFactory 1902 TheAppFactory 1901 TheAppFactory 1811

Citrix Product Editions 2019

2019-05-14T23:30:00.000-06:00

In the summer of 2018, Citrix set out on the most ambitious rebranding of products arguably since changing Presentation Server into XenApp. You can read more about it in a previous SageLike.com article, "Citrix Product Names 2019".

At the same time this happened, product editions also were changed. On one hand, if old editions are engrained in your memory (like me) then it could cause confusion. On the other hand, the new editions have also been unified across solutions so all teams will be speaking the same language.

There is also the reality that the old editions will live on as they are hardcoded into software created pre-summer 2018. It would be most noticeable in an old license server version but keep this into consideration if you are doing an upgrade.

Here is the breakdown for the old and new edition names. Please note, the edition names are the same for both virtualization and networking solutions.

Citrix Virtual Apps and Desktops

Standard	Advanced	Premium
~~Standard~~	~~Enterprise~~	~~Platinum~~
		For the newest information, always check out (Citrix.com)

Citrix ADC

Standard 500 universal licenses*	Advanced 1000 universal licenses*	Premium unlimited universal licenses*
~~Standard~~ ~~5 univeral licenses~~	~~Enterprise~~ ~~5 universal licenses~~	~~Platinum~~ ~~100 universal licenses~~
* requires firmware 11.1 build 49.16 released September 2016 (FAQs)		For the newest information, always check out (Citrix.com)

2018 also saw the creation of new bundles that combine brand new solutions with existing offerings. Today, there are three Workspace editions that combine some of the solutions above with new offerings like Access Control and Analytics.

Citrix Workspace

Standard	Premium	Premium Plus
		For the newest information, always check out (Citrix.com)

Brian @sagelikebrian

See also:
"Citrix Product Names 2019" (SageLike.com)

TheAppFactory 1902

2019-04-23T09:00:00.000-06:00

This is my monthly update on important things in the world of apps, applications, and micro apps. For me, it has always been all about the apps.

Resources

Event May 21	Save the date for Citrix Synergy 2019 in Atlanta, GA. I promise that we'll be unveiling some really cool stuff. Find out more at www.citrixsynergy.com
General	Last year Citrix started a project to unify the product portfolio. Yes, this means that names have changed. For example, XenApp is now Citrix Virtual Apps. I wrote an article you can use as a cheat sheet to learn the new names and has some of the background on why. If the product name columns to the left look foreign, then this is your guide.
Virtual Apps and Desktops	My teammate in the West, Ben, wrote about toggling between a windowed and full-screen mode in your virtual desktop. He also explains how Citrix hotkeys work in a virtual app or desktop (Citrix Blogs)
SD-WAN	Nearly every Citrix solution requires a decent network connection. Because of that, Citrix SD-WAN is possibly the fastest growing product in the portfolio. Check out this case study on why fishermen in Denmark decided to change the way they deployed their network (ebook).
Virtual Apps and Desktops	There are three options for keeping your environment on supported versions today: Long Term Service Release, Current Release, or Citrix hosted management plane. The current LTSR came out 6 CRs ago and the list of new features is piling up. How do you decide? Nick Rintalan, Citrix Consulting architect, discusses how to make the decision. Spoiler alert: it is not a technical decision. (Citrix Blogs)
Endpoint Management	Apple is changed the way iOS manual enrollment works on their devices. This change had an effect on our Endpoint Management (and all other MDM platforms). Read more about this (Citrix Docs). The same page also has information on TLS 1.0 and 1.1 deprecations that also happened on March 15, 2019.
ShareFile	Did you know that the Cloud Success Center has prerequisite lists, implementation checklists, step-by-step configuration guides, webinars? Read (Citrix Blogs) or jump right into the Cloud Success Center (login required). By the way, ShareFile will be known as Content Collaboration going forward.
Cool	Federik Brattstig has an insane article on his site (Virtual Brat) describing how he built a rig to combine NVIDIA GRID + VR + Citrix + 90 fps to create what he is calling RemoteVR.
Previous Issues	TheAppFactory 1901 TheAppFactory 1811

Brian @sagelikebrian

Citrix VDA Install Error - Unable to start Setup

2019-04-16T16:57:00.002-06:00

Purpose:

This post is to explain how to fix the "Unable to start Setup. Please check your installation media and try again" error when installing the Server VDA with Desktop Flag.

Symptom:

During the installation of the VDA the below error comes up

Check the VDA install log (xendesktop installation.log) in this location
C:\Users\username\appdata\local\temp\citrix\xendesktop installer

You'll see the below error in the log "Server VDI cannot be installed if Windows Remote Desktop Service Roles are installed"

Resolution:

Remove the Remote Desktop Session Host Role and reboot the VM.
Once the VM is rebooted attempt the installation again

Cause:

The Remote Desktop Session Host role is installed and it can't be present for a Server VDI VDA installation.

SageLike Post ID: SL0022

Applies to:

Windows Server VDA's and installing the VDI VDA that previously had the Server VDA installed.

TheAppFactory 1901

2019-03-30T16:23:00.000-06:00

This is my monthly update on important things in the world of apps, applications, and micro apps. For me, it has always been all about the apps.

Additional Resources

Technical	Somewhere between Citrix Docs and Blogs lies a new area for technical info, Citrix Tech Zone. A lot went into this new area to get you better technical content faster. Read "Welcome to the World, Citrix Tech Zone (Citrix Blog) to see what makes this area different or just jump right to Citrix Tech Zone @ techzone.citrix.com.
General	It is hard to do a lot of things in the Citrix world without an account. I wrote a quick post on (SageLike.com) discussing how to do some basic things. I am trying to make things easier but can only experience the Citrix portal as an employee. I would appreciate any feedback on if this helps or what else I could add.
ADC	Have you heard of the Citrix Gateway service? Think of it as an alternative to running your own ~~NetScaler~~ Citrix Gateway. Check out this deep dive on how it works (Citrix Tech Zone).
Virtual Apps and Desktops	Check out the new Virtual Apps and Desktops posters. I use them almost daily to explain architecture or data flow. Virtual Apps and Desktops poster (virtualfeller.com). Virtual Apps and Desktops subscription poster (virtualfeller.com). Workspace poster (virtualfeller.com)
Cool	Vector uses Citrix to launch a business in space (Bloomberg). Check out their infrastructure stack (galacticsky.net).

Brian @sagelikebrian