Disabled Detect version SOCKS v4 SOCKS v5 Detect version TLS1.0 | TLS1.1 | TLS1.2 Detect version Government Commercial Default Disabled Only check locally stored CRLs Retrieve CRLs from network Require CRLs for connection Not Configured Display certificate selector Disabled Use specified certificate Select automatically if possible High Medium Low 16-bit color 32-bit color 50% 75% Other Access Local Desktop Access Remote Session Access Remote Session in full-screen only <Disabled> Alt Ctrl Shift <Disabled> F1 F10 F11 F12 F2 F3 F4 F5 F6 F7 F8 F9 minus plus star tab <Disabled> Alt Ctrl Shift <Disabled> F1 F10 F11 F12 F2 F3 F4 F5 F6 F7 F8 F9 minus plus star tab <Disabled> Alt Ctrl Shift <Disabled> F1 F10 F11 F12 F2 F3 F4 F5 F6 F7 F8 F9 minus plus star tab <Disabled> Alt Ctrl Shift <Disabled> F1 F10 F11 F12 F2 F3 F4 F5 F6 F7 F8 F9 minus plus star tab <Disabled> Alt Ctrl Shift <Disabled> F1 F10 F11 F12 F2 F3 F4 F5 F6 F7 F8 F9 minus plus star tab <Disabled> Alt Ctrl Shift <Disabled> F1 F10 F11 F12 F2 F3 F4 F5 F6 F7 F8 F9 minus plus star tab <Disabled> Alt Ctrl Shift <Disabled> F1 F10 F11 F12 F2 F3 F4 F5 F6 F7 F8 F9 minus plus star tab <Disabled> Alt Ctrl Shift <Disabled> F1 F10 F11 F12 F2 F3 F4 F5 F6 F7 F8 F9 minus plus star tab <Disabled> Alt Ctrl Shift <Disabled> F1 F10 F11 F12 F2 F3 F4 F5 F6 F7 F8 F9 minus plus star tab <Disabled> Alt Ctrl Shift <Disabled> F1 F10 F11 F12 F2 F3 F4 F5 F6 F7 F8 F9 minus plus star tab Disabled Detect version SOCKS v4 SOCKS v5 Detect version TLS1.0 | TLS1.1 | TLS1.2 Detect version Government Commercial Default Disabled Only check locally stored CRLs Retrieve CRLs from network Require CRLs for connection Not Configured Display certificate selector Disabled Use specified certificate Select automatically if possible Disabled Launch Refresh Launch, Refresh Open Launch, Open Refresh, Open Refresh, Open, Launch WinLogon WinLogon, Launch WinLogon, Refresh WinLogon, Refresh, Launch WinLogon, Open WinLogon, Open, Launch WinLogon, Open, Refresh All Options High Medium Low 16-bit color 32-bit color 50% 75% Other Access Local Desktop Access Remote Session Access Remote Session in full-screen only <Disabled> Shift Ctrl Alt <Disabled> tab star plus minus F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 <Disabled> Shift Ctrl Alt <Disabled> tab star plus minus F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 <Disabled> Shift Ctrl Alt <Disabled> tab star plus minus F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 <Disabled> Shift Ctrl Alt <Disabled> tab star plus minus F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 <Disabled> Shift Ctrl Alt <Disabled> tab star plus minus F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 <Disabled> Shift Ctrl Alt <Disabled> tab star plus minus F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 <Disabled> Shift Ctrl Alt <Disabled> tab star plus minus F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 <Disabled> Shift Ctrl Alt <Disabled> tab star plus minus F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 <Disabled> Shift Ctrl Alt <Disabled> tab star plus minus F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 <Disabled> Shift Ctrl Alt <Disabled> tab star plus minus F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 Citrix Components The group policies in this folder can be used to manage your Citrix Systems Access Infrastructure. Citrix Receiver The Citrix Receiver is used to connect to remote applications and desktops in server farms. Network routing These policies can be used to control how the Citrix Receiver routes its connections to a server farm. User authentication These policies control how the Citrix Receiver authenticates its user to a remote application or desktop. Remoting client devices These policies control how the server accesses client machine resources. The Citrix Receiver can be configured to allow remote applications to use disk-drives, printers, etc. as if running on the client machine. User experience The Citrix Receiver can be configured to interact with client machine applications in different ways. These settings can be used to control how client machines present remote applications and desktops to the user. Proxy The Citrix Receiver can be configured to use specific proxy routing for remote application and desktops. These settings allow client proxies to be configured independently of other programs on the client machine. Client Engine The Citrix Receiver can be configured to interact with client engine configuration properties like ICA File Settings Multi-Stream ICA These policies control the Multi-Stream ICA feature. SelfService These policies control SelfServicePlugin settings Real-time transport Real-time transport Real-time transport through Gateway Real-time transport through Gateway Allow client connections Use this policy to enable or completely disable connections from the Citrix Receiver. When this policy is not configured, the client will allow connection to servers. When this policy is enabled, the client will only connect to a server if the "Enable client" option is selected, and if its version number is greater or equal to the "Minimum client version". When the policy is disabled, the client will not allow connections to any servers. Troubleshooting: If a connection is refused because the client is not enabled, the error message "<Server> ERROR: Cannot connect to the Citrix XenApp server. The Server (…) is not trusted for ICA connections. Connections to the (All Regions) Region are not allowed by lockdown settings. Please contact your administrator." appears. If the client does not allow a connection because the version number is too low, the error message "Error number 2321: ICA Client Configuration Manager: The ICA Client version is too low to run using the installed configuration data." appears. Enable client Minimum client version Configure client proxy settings Use this policy to configure the primary network proxies that the client can use when connecting to a remote application or desktop. When this policy is not configured, the client will use its own settings to decide whether to connect through a proxy server. When this policy is enabled, the client will use the proxy configured based on the proxy type selected: Proxy type: None When "None" is selected, the client will attempt to connect to the server directly without traversing a proxy server. Proxy type: Auto When "Auto" is selected, the client will use the local machine settings to determine which proxy server to use for a connection. This is usually the settings used by the Web browser installed on the machine. Proxy type: Script When "Script" is selected, the client will retrieve a JavaScript based ".pac" file from the URL specified in the "Proxy script URLs" policy option. The ".pac" file is executed to identify which proxy server should be used for the connection. Proxy type: Secure When "Secure" is selected, the client will contact the proxy identified by the "Proxy host names" and "Proxy ports" settings. The negotiation protocol will use a "HTTP CONNECT" header request specifying the desired destination address. This proxy protocol is commonly used for HTTP based traffic, and supports GSSAPI proxy authentication. Proxy Type: SOCKS/SOCKS V4/SOCKS V5 When a "SOCKS" proxy is selected, the client will perform a SOCKS V4 or SOCKS V5 handshake to the proxy identified by the "Proxy hostnames" and "Proxy ports" settings. The "SOCKS" option will detect and use the correct version of Socks. For any proxy type, you can provide a list of servers that do not traverse the proxy. These should be placed in the "Bypass server list". Troubleshooting: Some client platforms do not support the "Auto" proxy type due to operating system limitations. See the appropriate Administrator's Guide for details. For these platforms, the proxy settings should be manually set on the client device. When configuring the Web Interface server, an appropriate proxy server can be indicated for the particular location of the client. When configuring proxies via Group Policy, it is important to avoid overriding these settings. Where multiple proxies can be chosen, simply use a comma-separated list of options with the first being the default. Most Intranet client deployments should use the "None" option for the proxy type, otherwise the client may attempt to connect over the Internet. For more advanced deployments the "Bypass server list" option can be used, alternatively ".pac" scripts or Trusted Server Configuration are available to suit the network topology. Some proxy servers will automatically disconnect connections that are idle for a certain length of time. This can cause client sessions to be disconnected when not in use. A server-side option "ICA Keep-Alive" is available to send extra data packets during periods of inactivity that can be used prevent proxies closing connections. Proxy types Proxy host names Proxy ports Proxy script URLs Bypass server list Configure client failover proxy settings Use this policy to configure alternative network proxies that the client can use if the primary network proxy fails to connect to a remote application or desktop. When this policy is not configured, the client will use its own settings to decide whether to connect through a proxy server. When this policy is enabled, the client will attempt a connection using an alternative proxy if connection to a primary proxy fails. The failover proxy settings operate in an identical fashion to the primary proxy settings. If both the primary and alternative proxy fail to service the connection, selecting the "Failover to direct" check box instructs the client to attempt a final direct connection with no proxies. Troubleshooting: Some proxy failures can make the client appear to hang on connection. This is usually due to the proxy server reattempting the connection itself, or having a long time-out period. Depending on the network topology, it may be preferable to configure the Web Interface server to identify the currently functioning proxy, or alter the proxy server time-out settings. Proxy types Proxy host names Proxy ports Proxy script URLs Bypass server list Failover to direct Configure SOCKS proxy settings Use this policy to configure the use of additional SOCKS proxies that are required for some advanced network topologies. When enabled, the client will examine the "SOCKS protocol version" setting. If connection via SOCKS is not disabled, the client will attempt to connect using the SOCKS proxy specified by the "Proxy host names" and "Proxy ports" settings. The client supports connections using either SOCKS v4 or SOCKS v5 proxy servers. Alternatively, it can attempt to automatically detect the version being used by the proxy server. Troubleshooting: The SOCKS proxy settings are designed for traversing a proxy in addition to the primary or alternative proxy server. When traversing only a single proxy, these SOCKS proxy settings should be disabled. SOCKS protocol version Proxy host names Proxy ports Configure proxy authentication Use this policy to control the authentication mechanisms that the client uses when connecting to a proxy server. Authenticating proxy servers can be used to monitor data traffic in large network deployments. In general, authentication is handled by the operating system but in some scenarios, the user may be provided with a specific user name and password. To prevent the user from being specifically prompted for these credentials, clear the "Prompt user for credentials" check box. This will force the client to attempt an anonymous connection. Alternatively, you can configure the client to connect using credentials passed to it by the Web Interface server, or these can be explicitly specified via Group Policy using the "Explicit user name" and "Explicit password" options. Troubleshooting: In general NTLM proxy authentication will be performed under the control of the Domain Controller, and cannot be controlled by the client. Both client and proxy will need to be configured with the appropriate domain level trust relations. Proxy authentication cannot be linked to the pass-through authentication feature of the client. In general, the proxy password will be unrelated to users' passwords. Prompt user for credentials Allow clear text authentication Allow NTLM hash authentication Explicit user name Explicit password Session reliability and automatic reconnection Use this policy to control how the client behaves when a network failure causes a dropped connection. If you select "Enable" and then choose a check box for "Enable session reliability" and/or "Enable automatic reconnection," the client attempts to reconnect to a server. The "Enable session reliability" selection enables reconnection to an SSL/TLS server. Support for this setting depends on the SSL server configuration. The "Enable automatic reconnection" setting enables auto reconnection. If both options are enabled, session reliability has precedence. If session reliability is unable to reconnect, auto reconnection tries to connect. If "Enabled" is selected, but you do not choose one of the check boxes, the policy is not enforced. Troubleshooting: Some proxy servers automatically disconnect connections that are idle for a certain length of time. This can cause client sessions to be disconnected when not in use. A server-side option "ICA Keep-Alive" is available to send extra data packets during periods of inactivity that can be used prevent proxies from closing connections. Enable automatic reconnection Enable session reliability (has precedence if both are selected) TLS/SSL data encryption and server identification Use this policy to configure the TLS options that ensure Citrix Receiver securely identifies the server that it is connecting to and to encrypt all communication with the server. Citrix recommends that connections over untrusted networks use TLS. Citrix supports TLS 1.0, TLS 1.1 and TLS 1.2 protocols between Receiver and XenApp or XenDesktop. When this policy is enabled, you can force Receiver to use TLS for all connections to published applications and desktops by checking the "Require SSL for all connections" checkbox. Receiver identifies the server by the name on the security certificate that the server presents. This has the form of a DNS name (for example, -www.citrix.com). You can restrict Receiver to connect only to particular servers specified by a comma separated list in the "Allowed SSL servers" setting. Wildcards and port numbers can be specified here; for example, *.citrix.com:4433 allows connection to any server whose common name ends with .citrix.com on port 4433. The accuracy of the information in a security certificate is asserted by the certificate's issuer. If Receiver does not recognize and trust a certificate's issuer, the connection is rejected. When connecting by TLS, the server may be configured to require Receiver to provide a security certificate identifying itself. Use the "Client Authentication" setting to configure whether or not identification is provided automatically or if the user is notified. Options include: - never supply identification - only use the certificate configured here - to always prompt the user to select a certificate - to prompt the user only if there a choice of certificate to supply Use the "Client Certificate" setting to specify the identifying certificate's thumbprint to avoid prompting the user unnecessarily. When verifying the server's security certificate, you can configure the plug-in to contact the certificate's issuer to obtain a Certificate Revocation List (CRL) to ensure that the server certificate has not been revoked. This enables a certificate to be invalidated by its issuer should a system be compromised. Use the “CRL verification setting” to configure the plug-in to: - not check CRLs at all - only check CRLs that have been previously obtained from the issuer - actively retrieve an up-to-date CRL - to refuse to connect unless it can obtain an up-to-date CRL Organizations that configure TLS for a range of products can choose to identify servers intended for Citrix plug-ins by specifying a Certificate Policy OID as part of the security certificate. If a Policy OID is configured here, Receiver accepts only certificates that declare a compatible Policy. Some security policies have requirements related to the cryptographic algorithms used for a connection. You can restrict the plug-in to use only TLS v1.0, TLS 1.1 and TLS 1.2 with the "TLS version" setting. Similarly, you can restrict the plug-in to use only certain cryptographic ciphersuites: These ciphersuite include: Government Ciphersuites: TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_256_GCM_SHA384 Commercial Ciphersuites: TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_AES_128_GCM_SHA256 Require SSL for all connections Allowed SSL servers Policy Extension OID SSL/TLS version SSL ciphersuite CRL verification Client Authentication Client Certificate Configure trusted server configuration Use this policy to control how the client identifies the published application or desktop it is connecting to. The client will determine a trust level, called a "trust region" with a connection. The trust region will then determine how the client is configured for the connection. When this policy is enabled, the client can be forced to perform region identification using the "Enforce trusted server configuration" option. By default, region identification is based on the address of the server the client is connecting to. To be a member of the trusted region, the server must be a member of the Windows Trusted Sites zone. You can configure this using the "Windows Internet zone" setting. Alternatively, for compatibility with non-Windows clients, the server address can be specifically trusted using the "Address" setting. This is a comma-separated list of servers supporting the use of wildcards, for example, cps*.citrix.com. Troubleshooting: In the default configuration, when trusted server configuration prevents the client from connecting, the following error message is displayed: "<Server> ERROR: Cannot connect to the Citrix XenApp server. The server (xxx) is not trusted for ICA connections. Connections to the (Untrusted Region) Region are not allowed by lockdown settings. Please contact your administrator." The server identified in the "xxx" must be added to the Windows Trusted Sites zone (as either http:// or https:// for SSL connections) for the connection to succeed. Note that for SSL connections, the certificate common name must be trusted. For non-SSL connections all servers that are contacted must be individually trusted. This means that when using application browsing, both the XML service and the server this redirects to must be trusted. Windows internet zone Address Enforce trusted server configuration Smart card authentication Use this policy to control how the client uses smart cards attached to the client device. When enabled, this policy allows the remote server to access smart cards attached to the client device for authentication and other purposes. When disabled, the server cannot access smart cards attached to the client device. Troubleshooting: When using smart cards in a Citrix environment, the smart card device driver must be installed on the server. When using a different operating system on the client machine, it may be necessary to ensure that the smart card device drivers in use interoperate correctly. Allow smart card authentication Use pass-through authentication for PIN Web Interface authentication ticket Use this policy to control the ticketing infrastructure used when authenticating through the Web Interface. When this policy is enabled, legacy Web Interface ticketing can be disabled by clearing the "Legacy ticket handling" check box. Legacy Web Interface ticketing was implemented by passing a single-use authentication cookie to the server in the ClearText password field. Starting with version 4.5 of the Web Interface, the client handles an authentication token in the form of an opaque LogonTicket with an associated interpretation defined by the LogonTicketType. This functionality can be disabled by clearing the "Web Interface 4.5 and above" check box. Legacy ticket handling Web Interface 4.5 and above Kerberos authentication Use this policy to control how the client uses Kerberos to authenticate the user to the remote application or desktop. When enabled, this policy allows the client to authenticate the user using the Kerberos protocol. Kerberos is a Domain Controller authorised authentication transaction that avoids the need to transmit the real user credential data to the server. When disabled, the client will not attempt Kerberos authentication. Troubleshooting: The machine running the client and the server running the remote application must be in domains that have a trust relationship. The Domain Controller must be aware that the Citrix XenApp server will be performing a full user logon (interactive logon) using Kerberos. This is configured using the "Trust for Delegated Authentication" settings on the Domain Controller. When connecting using the Web Interface, the Web Interface server must be aware that the client will connect using Kerberos authentication. This is necessary because by default the Web Interface server will use an IP address for the destination server whereas Kerberos authentication requires a Fully Qualified Domain Name. Both client and server machines must have correctly registered DNS entries. This is necessary because endpoints will authenticate each other during connection. Local user name and password Use this policy to instruct the client to use the same logon credentials (pass-through authentication) for the Citrix XenApp server as the client computer. When this policy is enabled, the client can be prevented from using the current user's logon credentials to authenticate to the remote server by clearing the "Enable pass-through authentication" check box. The client imposes certain restrictions specifying when pass-through authentication can occur (for details, see Citrix eDocs at http://support.citrix.com/proddocs/). If these restrictions are too strict for your environment, select the "Allow pass-through authentication for all ICA connections" check box to bypass the pass-through authentication restrictions. When run in a Novell Directory Server environment, selecting the "Use Novell Directory Server credentials" check box requests that the client uses the user’s NDS credentials. Troubleshooting: To enable pass-through authentication, the client must have been installed by an administrator, and the "Allow Local Credential Pass-through" option must have been selected at that time. Each user can choose to disable pass-through authentication through the client registry settings, the Program Neighbourhood window, or by editing their copy of AppSrv.ini. To enable pass-through authentication, the user's copy of AppSrv.ini must contain the setting "EnableSSonThruICAFile=true". Enable pass-through authentication Allow pass-through authentication for all ICA connections Use Novell Directory Server credentials Client drive mapping Use this policy to enable and restrict the remote application or desktop's access to the client file systems. When enabled, the client will completely deny client drive mapping (CDM) virtual channel access to the client's file system if the check box "Enable client drive mapping" is not selected. This stops the DLL implementing the client drive mapping virtual channel (vdcdmn.dll) from loading on client start up. At this point, you can delete the DLL from the client package. If CDM is enabled, further options are available to restrict the type of access available to the server. If the "Read-only client drives" check box is selected, the CDM virtual channel only permits read access to client drives. Access to Windows drives can be disabled by entering the relevant drive letter in the "Do not map drives" box. This is a concatenation of all drives that should not be mapped when connecting to a published application or desktop, for example "ABFK" disables the drives A, B, F and K. Troubleshooting: These policies override selections made by users in the File Security dialog boxes of the Desktop Viewer. For information on how to prevent users from changing selections in the Client Connection Center, see the Citrix Knowledge Center. Enable client drive mapping Read-only client drives Do not map drives Client printers Use this policy to enable and restrict the remote application or desktop's access to client printers. When this policy is disabled, the client prevents the server from accessing or printing to printers available to the client device. Map client printers Client hardware access Use this policy to specify maximum number of serial ports supported by the client platform. Also, use this policy to enable and restrict the remote application or desktop's access to the client’s serial, USB, and parallel ports. This allows the server to use locally attached hardware. Troubleshooting: Remote PDA synchronization uses "virtual COM ports". These are serial port connections that are routed through USB connections. It is necessary to enable serial port access to use PDA synchronization for this reason. Maximum serial ports Map serial ports Allow PDA synchronization Map parallel ports Image capture Use this policy to enable and restrict the remote application or desktop's access to scanners, webcams, and other imaging devices on the client device. Client microphone Use this policy to enable and restrict the remote application or desktop's access to local audio capture devices (microphones). Enable client microphone Clipboard Use this policy to enable and restrict the remote application or desktop's access to the client clipboard contents. Enable clipboard USB Plug-n-Play Devices Use this policy to enable and disable published application or desktop access to the client USB Plug-n-Play devices. The Not Configured setting allows device access until you explicitly enable or disable access. Enable PNP USB Point of Sale Devices Use this policy to enable and disable published application or desktop access to the client USB Point of Sale devices. This policy is applied if the USB Plug-n-Play Devices policy is set to Enabled and Not Configured. Enable POS Client audio settings Use this policy to control how sound effects and music produced by remote applications or desktops are directed to the client machine. When this policy is enabled, the "Enable audio" check box can be used to completely disable client audio mapping. This does not affect the client to server audio data, which is controlled through the "Remoting client devices" policy. It is also possible to control the audio quality. Three quality levels are supported: low, medium and high. This setting affects both server to client and client to server audio quality. Note that the bandwidth requirements for high quality audio could make this setting unsuitable for many deployments. Troubleshooting: The server audio options take precedence over these settings, so selecting high quality from the client might not result in a high quality audio being used. The server cannot increase the quality of the audio selected by the client. When using voice dictation software, it is usually necessary to select high quality audio settings. Audio settings are chosen on a per-session basis, not per-application. All applications sharing a session will share the same audio settings." Real-Time Transport: Allows transmission using Real-Time Protocol. Range of RRP/UDP Source Ports to use. The host will attempt to use a UDP port pair starting from the lowest number port first, incrementing by 2 until it attempts the highest port. These UDP ports would be used to send and receive audio data between the host and the client. The port range should start with an even number ending with an odd number. Allow Real-Time Transport through Gateway: Allows real-time audio to be transported through an external gateway, where supported. Enable audio Sound quality Enable Real-Time Transport Lowest Port Number Highest Port Number Allow Real-Time Transport through Gateway Client graphics settings Use this policy to control the quality of graphics presented by remote applications or desktops. Lower quality graphics can help to improve the user experience when there is restricted bandwidth available. Color depth: This specifies the preferred color depth for a session. In general, low color depths give better performance over low bandwidth; however some of the compression technologies available can only be used with full color, so the effective performance depends on the individual application and usage pattern. The server may choose not to honor the color depth setting chosen because higher color depths result in heavy memory usage on the servers. Disk-based caching: For client devices with limited RAM, better compression rates can be achieved by saving temporary graphics objects to the disk cache. Lossy compression: For maximum compression and responsiveness, the server will sometimes allow the transfered image data to degrade in quality. This usually occurs when the connection is slow, or bandwidth is limited and large area updates are taking place. This is not appropriate for all applications and usages. Clearing this setting forces all image data to be transmitted at full quality. HDX 3D browser acceleration: This feature allows images being displayed by Microsoft Internet Explorer to be specially handled by the HDX 3D Browser Acceleration virtual channel. This improves responsiveness when using Microsoft Internet Explorer remotely. HDX 3D browser acceleration lossy compression: This is an extension to the HDX 3D browser acceleration setting, allowing images displayed by Microsoft Internet Explorer to be degraded before transmission to the client. This is not appropriate for all applications and usages. Clearing this option forces all Web browser image data to be transmitted at full quality. Remote Video: The remote video option allows the server to directly stream certain video data to the client. This provides better performance than decompressing and recompressing video data on the computer running Citrix XenApp. SpeedScreen Latency Reduction: Enabling SpeedScreen Latency Reduction settings allows the client to predict how mouse movement and text entry will appear on the server. This results in the user getting immediate feedback when typing or moving the mouse pointer. Color depth Lossy compression HDX 3D Browser Acceleration HDX 3D Browser Acceleration - lossy compression Remote video SpeedScreen Latency Reduction - keyboard local echo SpeedScreen Latency Reduction - mouse pointer prediction Disk-based caching Client display settings Use this policy to control how the client presents remote applications and desktops to the end user. Remote applications can be seamlessly integrated with local applications, or the entire local environment can be replaced with a remote desktop. Seamless windows: When set to false this setting allows the client to disable the use of seamless windows, instead displaying a fixed size window. When set to true it forces the client to request seamless windows, although the server may choose to reject this request. Window width and height: These settings determine window width and height. It is possible to define ranges of preferred values (for example 800-). The server may choose to ignore this value. This setting is ignored when seamless windows is in use. Window percent: This can be used as an alternative to manually choosing the width and height. It selects a window size as a fixed percentage of the entire screen. The server may choose to ignore this value. This setting is ignored when seamless windows is in use. Shrink work area: To reduce the work area for seamless windows, set the value of this property to 3 or more. When the taskbar is set to auto-hide, seamless applications cover the local taskbar preventing access to the Start menu and other taskbar items on computers running Windows 2000 or later. Setting this property makes the auto-hide taskbar accessible. Full screen: This setting switches the client to full screen mode. The server display will completely cover the client display. Seamless windows Window width Window height Window percent Shrink work area Full screen Local App Access settings Use this policy to control how the client presents local applications inside a hosted desktop. Local App Access enables the integration of locally installed applications within a hosted desktop. When users launch locally installed applications using shortcuts, applications appear to be running on their hosted desktop even though it is running on their local device. When this policy is enabled, client presents locally installed applications inside hosted desktop as shortcuts. When disabled, client doesn't present local apps inside hosted desktop. URL redirection is also disabled. Allow URL Redirection: When this is checked, client allows URLs to be redirected from hosted desktop browser to locally installed browser or vice versa. URL blacklist and whitelist on host determine which URLs would be redirected. Browser addons, extensions and plugins required for this feature would also need to enabled. When unchecked, URLs are not redirected from hosted desktop to client or vice versa. Browser addons, extensions and plugins are not disabled. Allow URL Redirection Host to client redirection settings Use this policy to set if Host to client URL redirection needs to support extra protocols. By default only http and https are supported. ExtraURL protocols Keyboard shortcuts Use this policy to configure the combinations of keys that the receiver interprets as having special functionality. When enabled, this policy allows users to control additional functionality of the published application or desktop, such as switching between full-screen and windowed mode. It also allows the user to issue command keystrokes such as Ctrl+Alt+Del to remote resources. Windows key: Specifies how the mapping of certain windows key combinations are used when connecting to ICA sessions. e.g. Alt+Tab, Alt+F4, easy access to the "Start Menu" using windows key, "Windows key + D" to minimize all applications etc. When "Access Local Desktop" is set, the key combinations apply to the local desktop - When "Access Remote Session" is set, the key combinations apply to seamless and non-seamless ICA sessions when their windows have the keyboard focus - When "Access Remote Session in full-screen only" is set, the key combinations apply to the non-seamless ICA session in full screen mode The default value is "Access Remote Session in full-screen only". Command keys: Command keys are key combinations that the local computer's operating system intercepts to provide special functionality, for example: Ctrl+Alt+Del. You can configure the plugin to use alternative key combinations to access similar functionality within a remote published application or desktop. For example, by default Ctrl+F1 instructs the plugin to send a Ctrl+Alt+Del key combination to the published application or desktop. Hot keys: Hot keys are key combinations that are interpreted by the plugin. For example, by default Shift+F2 switches the plugin out of full screen mode. Note: Disabling this policy only disables the ability to change the configured mapping of hotkeys. To disable the individual hotkeys, enable this policy and then explicitly disable the hotkeys. Windows key: Task List: + Close Application: + Toggle Full-screen: + Crtl-Alt-Del: + Ctrl-Esc: + Crtl-Alt: + Alt-Tab: + Alt-Shift-Tab: + Task Manager: + Latency Reduction: + Remote applications Use this policy to configure the client's handling of remote applications. When enabled, this policy uses the list in the "Application" box to determine which published applications can be directly launched by the client. You can request that remote applications share sessions (run in a single ICA connection). This provides a better user experience, but is sometimes not desirable. The session sharing feature can be disabled by clearing the "Session sharing" check box. Troubleshooting: Published applications are denoted by a # in front of the application name. Omitting the # symbol attempts to launch a particular program or desktop. A computer running Citrix XenApp will not allow this by default, and rejects the connection, displaying: "You do not have access to this session." Session sharing is controlled by the SessionSharingKey that prevents applications launched from different Web Interface servers from sharing sessions. In addition, applications with different graphics or security settings are prevented from sharing sessions. Application Session sharing Audio through Generic USB Redirection Use this policy to control audio redirection through Generic USB Redirection. This policy applies only to XenApp host. When this policy is enabled audio can only be redirected via Generic USB Redirection and therefore Generic USB redirection policy must be enabled on host. This policy should only be used for LAN environments. Enable Audio through Generic USB Redirection ICA File Settings Use this policy to configure whether or not the client deletes the ICA file when the session ends. When this policy is enabled, the client deletes the ICA file when the session ends. RemoveICAFile Allow Per-User Install Use this policy to enable and disable a per-user install to run. The Not Configured setting allows the per-user install to execute. Enable Per User Install Allow Legacy Session Sharing Allow session sharing for Program Neighborhood sessions AllowLegacySessionSharing Multi-Stream ICA Use this policy to enable and configure Multi-Stream ICA functionality. 'Maximum Streams' controls the maximum simultaneous streams a session can have. Enable Multi-Stream ICA Maximum Streams Manage SelfServiceMode Allow users to Add/Remove Account Enable application PreLaunch. Note: PreLaunch is implicitly enabled if Receiver is configured for domain pass through (SSON) authentication. Pre-launch is a feature of XenApp/XenDesktop that allows application and desktop sessions to start faster. This is done by pre-launching the resource upon first access and thus making it more responsive on subsequent access. Note: PreLaunch is implicitly enabled if Receiver is configured for domain pass through (SSON) authentication. If you enable this policy setting, the Session/Application Pre-launch functionality is enabled. If you disable this policy setting, also disables the Session/Application Pre-launch functionality. Control when Receiver attempts to reconnect to existing sessions. Choose the appropriate combination of reconnect conditions. If you enable this policy setting, it controls Receiver Reconnect behaviour. Receiver can look for existing, disconnected sessions via the store and reconnect them to the client. It can do this automatically at various times: - Launch : Any time Receiver is launched or opened - Refresh : When the Refresh App command is issued in the UI or after logon - Open : When the Receiver UI is opened - Windows Logon : On First launch The default will be at Launch or Refresh. Select the appropriate combination. Manage App shortcut Startmenu Directory Desktop Directory Enable Desktop Shortcut Disable Startmenu Shortcut Disable Categorypath Remove apps on Logoff Remove apps on Exit Clear the set of applications shown in the Receiver Window on logoff Ignore self service selection of apps and make all mandatory. If Receiver is working with a PNAgent service this will be required to get all apps added automatically. If Receiver is working with a Storefront Store, make the change on the Storefront server to make the Store mandatory. (This setting currently does not apply to Storefront Stores). Prevent Receiver performing a refresh of the application list when opened. Use this policy to enable or disable SelfServiceMode settings of CitrixReceiver. When Enabled you can View SelfServiceUI. When disabled SelfServiceUI will be hidden and all apps are subscribed automatically. If you enable this policy setting: - Clear the set of applications shown in the Receiver Window on logoff. When selected, this option purges user details upon Receiver logoff. Deselecting this option, Receiver may not purge user details on upon Receiver logoff. - Prevent Receiver performing a refresh of the application list when opened. When selected, this option prevents Receiver from performing a refresh of the application list after launching. Deselecting this option, Receiver refreshes the application list when launching Receiver. - Ignore self service selection of apps and make all mandatory. If Receiver is working with a PNAgent service this will be required to get all apps added automatically. If Receiver is working with a Storefront Store, make the change on the Storefront server to make the Store mandatory. (This setting currently does not apply to Storefront Stores). When selected, this option subscribes all applications in SelfService for PNAgent sites. Deselecting this option, the end user must manually subscribe to all the applications or required applications from the PNAgent sites. Use this policy to give users option to add or remove accounts in NonSelfServiceMode Receiver Storefront Storefront Accounts List Enter the Storefront account details here: This policy setting allows you to manage a list of Storefront accounts. If you enable this policy setting, you can enter a list of Storefront Accounts. For each entry that you add to the list, enter the following information delimited by a semi-colon: Store name - The name that the user will see for this Store. Store URL - The url for the Store. Store enabled state - On/Off. Store description - The description that the user will see for this Store. Example: SalesStore;https://sales.mycompany.com/Citrix/Store/discovery;On;Store for Sales staff Fast Connect API Support These policies control Fast Connect API support Manage FastConnectAPI support Fast Connect API facilitates switching among users by providing an API to quickly change a user’s identity in Receiver. If you enable this policy setting, enables the Fast Connect API functionality. - Enable Fast Connect API functionality. When selected, this option Enables API functionality which enables fast user switching by providing an API to change a new user identity. Deselecting this option Fast Connect API call and fast user switching will not function. - Enable Fast Connect Transtion API. When selected, this option disables the following commands: selfservice.exe-terminate, selfservice.exe-fastterminate, and selfservice.exe-ipoll. Deselecting this option enables these commands. - Leave Apps Running On Logoff. When selected, this option allows application sessions to remain open or disconnected upon Receiver logoff. Deselecting this option, applications are disconnected when logging off from Receiver. - Integrate Self Service plugin with Fast Connect. When selected, this option notifies the SelfService plugin of Fast Connect library/SDK use. Deselecting this option, the Self Service plugin is not notified of Fast Connect library/SDK use. If you disable or do not configure this policy setting, Fast Connect library integration with Self Service and the API calls will be disabled. EnableFastConnectTransitionAPI Leave Apps Running On Logoff Integrate Self Service plugin with FastConnect Enable CEIP CEIP Configuration Enable CEIP. CEIP Server URL CEIP Upload class Initialize CEIP Upload frequency in weeks Allow insecure URL (http instead of https) Use this policy to provide custom CEIP URL, Upload frequency in weeks, Upload class, to allow un secure url,to enable ceip logging and to give user option to enable the ceip CEIP is Citrix Customer Experience Improvement Program. More details about CEIP is present in http://www.citrix.com/cms/ws/ceip/ . CEIP CEIP is Citrix Customer Experience Improvement Program. More details about CEIP is present in http://www.citrix.com/cms/ws/ceip/ . Diagnostics Use this policy to continuously collect trace logs from users. Always-On Tracing Use this policy to continuously collect trace logs from users. It is enabled by default. ADMX Migrator encountered a string that is not present in the source ADM string table. ADMX Migrator encountered a policy that does not have a supportedOn value. All Receiver supported platforms Enable client Minimum client version Enter the Storefront account details here: Auto None SOCKS SOCKSv4 SOCKSv5 Secure Script Auto None SOCKS SOCKSv4 SOCKSv5 Secure Script Failover to direct SOCKS protocol version Prompt user for credentials Allow clear text authentication Allow NTLM hash authentication Require SSL for all connections *:443 SSL/TLS version SSL ciphersuite CRL verification 2.5.29.32.0 Client Authentication Enforce trusted server configuration Trusted Trusted,Intranet *.finance.citrix.com,*.sales.citrix.com cps*.citrix.com Enable automatic reconnection Enable session reliability (has precedence if both are selected) Allow smart card authentication Use pass-through authentication for PIN Enable pass-through authentication Allow pass-through authentication for all ICA connections Use Novell Directory Server credentials Legacy ticket handling Web Interface 4.5 and above Enable client drive mapping Read-only client drives C ABCDEFGHIJKLMNOPQRSTUVWXYZ Map serial ports Allow PDA synchronization Map parallel ports Enable client microphone Enable audio Sound quality Enable Real-Time Transport Lowest Port Number Highest Port Number Allow Real-Time Transport through Gateway Color depth Disk-based caching Lossy compression HDX 3D Browser Acceleration HDX 3D Browser Acceleration - lossy compression Remote video SpeedScreen Latency Reduction - keyboard local echo SpeedScreen Latency Reduction - mouse pointer prediction True False 1024- 800- 734- 600- Window percent 5 Full screen Allow URL Redirection Windows key: Task List: + Close Application: + Toggle Full-screen: + Crtl-Alt-Del: + Task Manager: + Alt-Tab: + Alt-Shift-Tab: + Ctrl-Esc: + Crtl-Alt: + Latency Reduction: + #Notepad #* Session sharing RemoveICAFile Enable Multi-Stream ICA Maximum Streams https://rttf.citrix.com callhome_analytics Initialize CEIP Upload frequency in weeks Allow insecure URL (http instead of https) Citrix Citrix Disable Startmenu Shortcut Enable Desktop Shortcut Disable Categorypath Remove apps on Logoff Remove apps on Exit Clear the set of applications shown in the Receiver Window on logoff Prevent Receiver performing a refresh of the application list when opened. Ignore self service selection of apps and make all mandatory. If Receiver is working with a PNAgent service this will be required to get all apps added automatically. If Receiver is working with a Storefront Store, make the change on the Storefront server to make the Store mandatory. (This setting currently does not apply to Storefront Stores). Choose the appropriate combination of reconnect conditions. Enable FastConnect API functionality EnableFastConnectTransitionAPI Leave Apps Running On Logoff Integrate Self Service plugin with FastConnect Enable client Minimum client version Auto None SOCKS SOCKSv4 SOCKSv5 Secure Script Auto None SOCKS SOCKSv4 SOCKSv5 Secure Script false true SOCKS protocol version Prompt user for credentials Allow clear text authentication Allow NTLM hash authentication Require SSL for all connections *:443 SSL/TLS version SSL ciphersuite CRL verification 2.5.29.32.0 Client Authentication Enforce trusted server configuration Enable automatic reconnection Enable session reliability (has precedence if both are selected) Allow smart card authentication Use pass-through authentication for PIN Enable pass-through authentication Allow pass-through authentication for all ICA connections Use Novell Directory Server credentials Legacy ticket handling Web Interface 4.5 and above Enable client drive mapping Read-only client drives C ABCDEFGHIJKLMNOPQRSTUVWXYZ Map serial ports Allow PDA synchronization Map parallel ports Enable client microphone Enable audio Sound quality Enable Real-Time Transport Lowest Port Number Highest Port Number Allow Real-Time Transport through Gateway Color depth Disk-based caching Lossy compression HDX 3D Browser Acceleration HDX 3D Browser Acceleration - lossy compression Remote video SpeedScreen Latency Reduction - keyboard local echo SpeedScreen Latency Reduction - mouse pointer prediction True False 1024- 800- 734- 600- Window percent 5 Full screen Allow URL Redirection Windows key: Task List: + Close Application: + Toggle Full-screen: + Crtl-Alt-Del: + Task Manager: + Alt-Tab: + Alt-Shift-Tab: + Ctrl-Esc: + Crtl-Alt: + Latency Reduction: + #Notepad #* Session sharing RemoveICAFile AllowLegacySessionSharing Enable Multi-Stream ICA Maximum Streams