First step: installing ADMT 3.1 on Windows 2008 Domain Controller

installing ADMT

ADMT installation file can be downloaded from http://www.microsoft.com/downloads/details.aspx?FamilyID=ae279d01-7dca-413c-a9d2-b42dfb746059&displaylang=en

During installation the installation Wizard will ask about the database to be used by ADMT, the wizard can use existing SQL 2005 instance or it can install a new instance of SQL 2005 express, in our case we choose to install a new SQL 2005 instance.

Then, the wizard will prompt us if we need to import data from any previous ADMT database, since this is a new installation we choose not o import any data.

Importing previous ADMT data

Then the installation Wizard completes successfully.

Second Step: Installing Password Export Server

In order to be able to export the user’s passwords, we needto install the password export server.

The password export server will need a password encryption file to secure password migration, to create this password encryption file we use the ADMT utility in the command line to generate the file as follows:

1- We navigate to the location of the installation of the ADMT, in our case it is C:\Windows\ADMT

2- We issue the following command C:\Windows\ADMT>admt key /opt:create /sd:”Source_Domain” /kf:c:\Domain.pes /PWD *

3- The utility will then ask you to provide the password and validate it.

After creating the encryption file we move it the source domain controller where we are going to install and use the password export server as in the following steps:

1-Start the installation wizard

2- Accept the license agreement

Accept License agreement

3- Choose the password encryption key file that we created in the previous steps 4- Insert the password that we used to

encrypt the password encryption file

Password Prompt

5- Start installing the Password Export Server

6- Choose the service account that the PES server will run under , this account should be administrator on the

destinationdomain, we chose the administrator in the source domain and made it a member of the administrators group in

the Windows 2008 domain

Up to this stage the installation is finished, the wizard will require the source server to be restarted, after restarting the

server, the PES server has to be started manually.

Third: running the ADMT Migration wizard

To start the migration wizard, we go to the ADMT console on the destination domain controller, “Windows 2008 DC” and
start the user’s migration Wizard.

Start ADMT Users Migration

Choose next to the welcome screen

Start Migration

Choose the source Domain and domain controller, and the destination domain and domain controller. In our case the
source domain is “radmins.com” and the source domain controller is “RDC01radmins.com”,the destination domain
is“nwtraders.com“
and the destination domain controller is “dc01.nwtraders.com”.

Then we choose to select the users from the domain directly and not from a file:

Selecting Users to Be migrated
After selecting the user accounts to be migrated, we choose to migrate the passwords of the users as well and choose the
password export server on that we installed on the source domain controller.

Password Migration

Then we choose the target OU to which we will migrate the users to:

Then we choose the state of the migrated users, we can select that the users will be enabled, disabled, or the same state of
the source domain, also we can select to migrate the source SID of the users, this will allow users to access the resources
that they used to access in the source domain.

Migrated users state and SID migration

When choosing to migrate the users SIDs, the wizard will prompt to enable auditing and creating a group necessary for
migration of users SIDs, by selecting “yes” the wizard will enable these settings on the source domain controller
automatically ad we can proceed.

Enabling Auditing

The wizard then will prompt for a user account with proper privilege to add SID history.

Administrative Account

The wizard then will prompt for options like migrating users roaming profiles, update user’s rights, migrating associated groups, and fix users group memberships.

Migration Options

Then the wizard gives us an option to exclude some users from migrations:

Users Exclusion

Then we can choose how to handle conflicts when they occur

Dealing with users conflict

And finally the migration wizard will start migrating users.

Start Migration Process

How to Assign a Mandatory User Profile in Windows 2000

To assign a mandatory user profile in Windows 2000, follow the steps that are described in this section.

Step 1: Create a Profile

1. On a domain controller, create a template user account that has the same permissions as the user or the group for which you want to create the mandatory profile.
2. Use the template user account to log on to a workstation computer.
   A user profile is automatically created on the local computer in the Drive:\Documents and Settings\User_name folder.
3. Configure the desktop settings that you want to use in the profile, including shortcuts, appearance, and Start menu options.
4. Log off the computer.

Step 2: Copy the Profile to a Shared Folder

Copy the user profile that you created in the Step 1: Create a Profile section of this article to a shared network folder. To do so:

1. Create a shared folder on the network in which you want to store the mandatory profile, for example, C:\Profiles\Mandatory, and then share this folder. For example, create the following share:

\\Server_name\mandatory

2. Assign at least Read & Execute permissions for the users or groups to whom you want to assign the profile.
3. Log on to the domain as an administrator from the workstation computer.
4. Click Start, point to Settings, and then click Control Panel.
5. Double-click System, and then click the User Profiles tab.
6. Under Profiles stored on this computer, click the profile that you created in the Step 1: Create a Profile section of this article, and then click Copy To.
7. In the Copy profile to box, type the Universal Naming Convention (UNC) path to the share that you created in step 1 (for example, type \\server_name\mandatory), and then click OK.
8. Under Permitted to use, click Change, click Mandatory profile user, and then click OK.
9. On the Windows 2000 Server-based computer, start Windows Explorer, and then locate the shared folder that contains the profile that you copied.
   This folder contains a file named Ntuser.dat.
10. Rename Ntuser.dat to Ntuser.man.

Step 3: Assign the Mandatory User Profile

1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2. Locate the container that contains the user account whose settings you want to modify.
3. In the right pane, right-click the user account that you want to configure, and then click Properties.
4. Click the Profile tab.
5. In the Profile path box, type the location of the profile that you want to assign.
   When you type the location, use the following UNC format, where Server_name is the name of the computer where the profiles are stored and Share_name is the shared folder that contains the mandatory profile:

\\Server_name\Share_name

6. Click OK.
7. On the workstation computer, log on to the domain by using the account to which you have assigned the mandatory profile, and then test to make sure that the profile settings have been successfully applied.

Creating a roaming user profile

Creating a roaming user profile is a two-step process: creating a test user profile and then copying the test user profile to a network server.

Creating a test user profile

In this procedure, you create a test profile for the roaming user:

1. Create a user account to act as a test user account. For example, create an account named Sales Profile.
2. Log on as the test user account. A user profile is automatically created on the local computer in the c:\Winnt\Documents and Settings\username folder.
3. Configure the desktop environment, including appearance, shortcuts, and Start menu options.
4. Log off, and then log on as Administrator.

Copying the test user profile

In this procedure, you copy the test profile to a network server:

1. Create a folder on a network drive in which you can store network profiles. For example:

\\server_name\Profiles\user_name

2. In Control Panel, double-click System, and then click the User Profiles tab. Under Profiles Stored On This Computer, click the profile that you want to copy, and then click Copy To.
3. In the Copy Profile To dialog box, type the network path to the folder. Under Permitted to Use, click Change.
4. Add the appropriate user, and then click OK.
5. In the folder that you created on the network, rename the file Ntuser.dat to Ntuser.man if this is a mandatory user profile.
6. In User Manager for Domains, double-click the user account, and then in the User Properties dialog box, click Profile.
7. In the User Profile Path box, type the UNC path to the network profile folder. For example:

\\server_name\Profiles\user_name

This step-by-step article describes how to restore a user profile as well as the following user profile items:

• Documents
• Desktop settings
• Favorites
• Cookies

By default, when you first log on to a Windows 2000-based computer, Windows creates a user profile folder in the %SystemDrive%\Documents and Settings folder, and you are given Full Control permission. If you lose the Full Control permission for this folder, Windows creates a new user profile folder the next time that you log on and you can no longer access the original user profile folder unless you have local administrative authority on the computer.
If you lose access to your profile folder, Windows creates a new profile folder for you, and places it in the Documents and Settings folder by default. Windows attempts to use your user name as the name of the new profile folder. However, if the old profile folder still exists, Windows modifies the name of the new folder to avoid duplicating the name of the original profile folder. In this scenario, you may see multiple profile folders for your user profile. The following information describes the default naming scheme that Windows 2000 uses for user profiles:

• If the username folder does not already exist, the new profile folder is named:

username

• If the username folder already exists, the new profile folder is named:

username.computername

• If the username.computername folder already exists, the new profile folder is named:

username.computername.000

• If the username.computername.000 folder already exists, Windows uses the next available increment of the username.computername.000 naming scheme.
  For example:

username.computername.001

Another way to keep track of these duplicate profile folders is by the creation date or time, as long as you have not modified the creation date or time.

Back to the top

Requirements

To restore a user profile, the Documents and Settings\username profile folder must still exist, and you must have the Full Control permission for this folder. If you do not have the correct permission for your user profile folder, you (or someone else) must log on to the computer as an administrator and restore the required level of permission to your user profile.

Back to the top

Copy Documents from the Current Profile Folder to the Appropriate User Profile Folder

If you have logged on to Windows since you lost access permission to your original profile folder, there are at least two user profile folders that have your user name. To make these files accessible from the user profile that you are restoring:

1. Log on to the computer as an administrator.
2. Copy all of the documents from your current My Documents folder to the My Documents folder of the profile that you are restoring.
   NOTE: Step 2 is not required if you have moved your My Documents folder to a location outside the Documents and Settings folder; however, after you restore your user profile, you may need to re-specify the target folder location of the My Documents folder.
3. To retain the Internet favorites links, copy all of the Internet shortcut files from from your current Favorites folder to the Favorites folder of the user profile that you are restoring.
   NOTE: Do not copy Desktop.ini file.

Back to the top

Grant Full Control Permission for the User Profile Folder

1. Right-click your old user profile folder, and then click Properties. By default, this folder is %SystemDrive%\Documents and Settings\username.
2. On the Security tab, click your user profile in the Name list, and then click to select Allow for the Full Control permission.
   NOTE: If your user profile is not displayed in the Name list, add your profile: Click Add, click your user name in the list, and then click OK.
3. Click OK to close the dialog box.

Back to the top

Edit the User Profile Registry Key

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 (http://support.microsoft.com/kb/322756/ ) How to back up and restore the registry in Windows

Edit the registry so that the profile image path points to the user profile folder that you worked with in the "Grant Full Control Permission for the User Profile Folder" section in this article:

1. Log on to the computer with the user profile that you want to restore.
2. Click Start, and then click Run.
3. Type regedit, and then click OK.
4. In Registry Editor, navigate to the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList

5. Locate your user profile folder.
   NOTE: When you open the ProfileList folder, you see several folders, each of which belongs to a different user. These folders are named according to the user security IDs (SIDs) and not according to the user names.
   To locate your user profile folder, use one of the following options:
   • For each folder, click the folder, and then look for the ProfileImagePath value that contains the path to your user profile (such as %SystemDrive%\Documents and Settings\username).
     -or-
   • In Registry Editor, press CTRL+F to start the Find tool. Type your user name in the Find what box, click to select the Data check box under Look at, and then click Find.
6. After you locate the subkey folder for your user profile, double-click the ProfileImagePath value.
7. In the Value data box, change the path so that it points to the profile folder that you are restoring, and then and click OK.
8. Quit Registry Editor.

The next time that you log on to the computer, Windows will use your restored user profile.

* Application Performance Monitoring (powered by Citrix Edge Sight)

o Edge Sight Agent to Edge sight Server - TCP 80/443 (Payload and alerts)

o EdgeSight Web console (non-IMA) to RSCorSvc on EdgeSight Agent - TCP 9035

o Edge Sight Agent internal communication - TCP 9036 (client-side database) NOTE: After Edge Sight 4.5, replaced with IPC)

o Edge Sight database - SQL 1433 (configurable)

* Client-side Application Virtualization -

o Streaming Client to Application Hub (File Server/Share) - SMB 445

* Easy Call -

o To client - HTTP(S)-TCP 8443 (PSync)

o To Admin console (non-IMA) - TCP 443

o To LDAP Directory- TCP 389

o To PBX - port varies by vendor

* Independent Management Architecture (IMA) Services - TCP 2512, 2513

* Licensing Service - TCP 27000, 27009 (configurable)

* Server-side Application Virtualization

o Management Console (Using IMA) - TCP 2512, 2513

o Application requests - TCP XML 80, 8080 or 443 (configurable)

o Access to Applications Virtualized on the Server - ICA-TCP 1494, 2598 (Session Reliability)

* Single Sign-on (powered by Citrix Password Manager)

o Management Console (non-IMA) or Agent to Password Manager Service - TCP-443

o Management Console (non-IMA), Agent or Service to credential store

+ Network File Share Credential Store - TCP/UDP 445 (CIFS) or TCP/UDP 135-139 (NetBIOS)

+ Active Directory Credential Store - TCP/UDP - 389, 636, TCP - 3268, 3269

+ Novell File Share Credential Store - TCP/UDP - 524

* SmartAccess (powered by Citrix Access Gateway)

o Standard and Advanced Edition

+ Client connections- TCP-SSL 443 (configurable)

+ Advanced Access Control (AAC) to Appliance communication - TCP 80 or 443 (configurable), 9001, 9002, 9005

+ Management Console

# to Appliance (non-IMA) - 9001, 9002, 9005

# to AAC - IMA-TCP-2513

o Enterprise Edition

+ To client - SSL-TCP 443

+ To internal network - SSL-TCP 443, Native Authentication port (i.e. RADIUS 1812, LDAP 389), Native application ports (i.e. ICA-1494)

+ Management console (non-IMA) - SSH-TCP 22, HTTP(S)-TCP 80/443

* SmartAuditor -

o Management (non-IMA) - Use local console on Agent or on Server.

o Agent to Broker (Recording and Policy Check) - TCP 80/443 (configurable)

o Player to Broker - TCP 80/443 (configurable)

o Agent to Server (Metadata and Video)- Microsoft Message Queuing,

+ Default - TCP: 1801; RPC: 135, 2101*, 2103*, 2105*; UDP: 3527, 1801 (*These port numbers may be incremented by 11 if the initia choice of RPC port is being used when Message Queuing initializes. A connecting QM queries port 135 to discover the 2xxx ports.)

+ Over SSL- TCP 80,443

* WAN Optimizer -Guidance provided was to get it from Admin Guide

o Appliance to Appliance - Pass-through native application port (e.g. ICA-1494, HTTP-80, LDAP-389)

o Management Console (non-IMA) - TCP 80

o Client to Appliance - TCP 443

* Web Interface

o Client connections - TCP 80/443 (configurable)

o Server-to-server - TCP XML 80/8080, 443 (using SSL Relay)

o Management console (partially IMA) - DCOM 135 (+ configurable high port range), IMA-TCP 2513, TCP 80/443

Some Citrix Port Numbers

1494: This port is used by any client using the TCP protocol to communicate with the Presentation Server. You will need to open this port on your firewall for inbound connections unless you are using some form of encapsulation or encryption. You can change the port using the ICAPORT command but I find it to be more trouble than it is worth.

1604: Called the ICA Browser port this is a UDP port that can be used by the Program Neighbourhood to enumerate applications. You probably won t use this though.

80: This is the default port used by the XML service and is used by clients who enumerate applications with the TCP+HTTP or XML protocol. You will thus need to open this port on your firewall for inbound connections if clients will be using it to locate servers. You can change the port easily enough using the CTXXMLSS command.

443: This is the default SSL. The SSL Relay will use it to secure communications between the Web Interface and the server farm. You could also use it to secure client communication to the web Interface or use it for client connections to the Presentation Server.

5000: The Presentation Server uses this port to communicate with the IBM Db2 server hosting the data store.

1521: This port is used to communicate with the Oracle data store.

1433: The port used to communicate with a Microsoft SQL data store.

2512: This port is used for server to server communication such as when load information is communicated. The port used to access the data store is saved in the HKLMSOFTWARECITRIXIMAIMAPORT key on the server containing the data store. All other servers use the port number saved in HKLMSOFTWARECITRIXIMAPSSERVERPORT key in the registry to access the data store. Have a look at IMAPORT to see how to change it.

2513: This port is used by the Presentation Server Console when connection to a server. Have a look at IMAPORT to see how to change it.

2598: This is the session reliability port number and needs to be opened on your firewall if the ICA Clients will be using session reliability when communication with the server.

27000 and a random port number: This is the port used for communication between the Citrix License server and the Presentation Servers. Remember that the Citrix vendor daemon running on the license server uses a random port. It tracks license usage.

Valid till 4.5

1. What is IMA?

IMA is an Independent management Architecture which is used for managing and communication among the citrix servers.

2. What is ICA?

ICA is the Independent communicating architecture it’s a protocol which is used for exchanging the data from server to client desktop and vice versa.

Eg: mouse movements, key strokes etc.

3. What are the Database used in citrix?

a. MS Access

b. SQL

c. IBM DB2

d. Oracle

4. What is a data store?

This is used to store the static data like profiles, licensing etc.

5. What is a ZONE data collector?

Group of servers are called as ZONE. In that one server will act as a zone data collector.

ZDC acts as leader among the servers which manages and stores the dynamic data of the servers like session, load of the server etc.

6. What is LHC?

Local Host Cache acts as a fail over tendency. If there is a lost of connection b/w database and citrix servers its acts like a database up to 96hr

7. How can we recreate LHC?

a. First stop the IMA service.

b. Type cmd dsmaintrecreatelhc.

c. Again start IMA service.

8. What is load evaluator?

The load can be divided equally among the citrix servers depending upon

a. CPU usage

b. Memory usage

c. Bandwidth

d.

9. What are the different types of load evaluators?

a. Default, which is based on the server user load rule.

b. Advance, which is based on the CPU, memory and page swaps utilization rules.

c. Custom. We can assign as per our wish.

10. What is Isolation environment?

It is used to reduce the conflict between application to application or registry to registries.

For ex we can install MS2003 and 2007 in the same system without any conflicts.

11. What is session reliability?

If there is a lost of connection in the server the session reliability will the session alive up to particular period of time.

12. What are the printer terminologies?

Citrix printing can be configured in three ways

a. Client Printing: The printer connected to the workstation & the drivers are installed on the citrix server for printing.

b. Network Printing: The Printer connected to the print server & the drivers should be available on the citrix server.

c. Local Printer: The Printer connected to locally to the citrix server & the drivers are installed for the print operation.

13. What is client lock down?

Client lockdown is a process of securing the endpoint so that users can access only authorized features.

An example of this is turning a device into thin client by locking it down so that the end-users can only use published applications or desktop and cannot use further features.

14. What is speed Screen?

Speed screen is the utility in citrix that enable the speed when the client or user is using low configuration system for better Graphic etc.

15. What are the citrix clients?

a. Program Neighborhood client. (PN)

b. Program Neighborhood Agent.(PNA)

c. Web Interface client.

d. Java Client.

16. What are the pre requisites of the citrix installation?

a. OS

b. Install terminal service

c. Licensing of TS

d. Citrix pre requisites.

e. Citrix installation

f. Installing citrix licensing

17. What is Resource manager?

Resource manager collects stores and displays the data about the performance, application or process use.

18. What are the types of the publish we can do in citrix?

a. Application Publishing

b. Content Publishing

c. Desktop Publishing

19. What do you mean by the Summary database

Summary database is database which is used by the resource manager

20. what do you mean by Load throttling

A general Interview answer is : Load throttling is new parameter of the citrix included from 4.5 which monitor the win logon and *win32 file. Generally it will be helpful when server in production reboot unexpectedly. Load evaluator do not point the server until server getup

ref:http://www.brianmadden.com/blogs/brianmadden/archive/2007/05/04/understanding-the-new-logon-throttling-load-evaluator-options-in-citrix-presentation-server-4-5.aspx

http://support.citrix.com/article/CTX112082

Symptoms

“Shadow failed. Error code 7050” (Error 7050 – The requested session cannot be controlled remotely. This may be because the session is disconnected or does not currently have a user logged on. )

Cause 1

This error was observed when attempting to shadow users across different servers.

Users can shadow using the following methods:

• Citrix Management Console if the user resides on the same server from which the shadow request originates

• Citrix Server Administration

• Shadow Taskbar

• Command line using the command Cshadow.exe

Resolution 1

This issue was first resolved with MetaFrame XP 1.0 Service Pack 1.

Cause 2

The option for shadowing an RDP session from the Management Console shouldn’t be available. Normally the option to shadow an RDP session is grayed out, but after installing Service Pack 4 for MetaFrame XP it is made available.

Resolution 2

Citrix is working on a post Service Pack 4 hotfix to gray out the option.

Cause 3

Shadowing from the Management Console over RDP failed. The issue occurred because of a code error.

Resolution 3

Apply MPSE300W2K3R04 or its equivalent.

If this hotfix is not applied and one is unable to use an ICA session or the Management Console from a remote workstation use a console RDP session (mstsc /console)

This document applies to:

* MetaFrame Presentation Server 3.0 for Microsoft Windows 2000

* MetaFrame Presentation Server 3.0 for Microsoft Windows 2003

* MetaFrame XP 1.0 for Microsoft NT 4.0 Server Terminal Server Edition

* MetaFrame XP 1.0 for Microsoft Windows 2000

* MetaFrame XP 1.0 for Microsoft Windows 2003

* Presentation Server 4.0 for Microsoft Windows 2000

* Presentation Server 4.0 for Microsoft Windows 2003

http://support.citrix.com/article/CTX741852

10 . Any file format changes : You find these kinds of error’s when the file’s format is been changed;Sometimes “Always use the selected program to open this kind of file would be enabled”

Solution : Goto Folder option – Click on File type

Goto to the Open with change option and change the file type

From here :

This will resolve the issue.

1. Start a registry editor (e.g., regedit.exe).

2. Navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon subkey.

3. Double-click DefaultDomainName (or create this value of type String if it doesn't exist), and set the value to the preferred domain.

4. Double-click AltDefaultDomainName (or create this value of type String if it doesn't exist), and set the value to the preferred domain.

5. Close the registry editor.

CAUSE

Printer Driver not installed / Mapping not done properly

RESOLUTION

Printer Driver Mapping

1. Install the Driver on one Server.

2. After adding a driver on a server we must do this:
Open the Citrix Management Console, right-click the Printer Management icon and select the Update printer and Driver information option. Now it lists drivers we manually install individually on any server.

3. Update Printer and Driver Information by right clicking on Printer Management in the console as well as Refresh Printer Management. (The “Refresh Drivers” option does not produce the intended results. We have to do that after replicating printer drivers to other servers. Sometimes it appears in the list and sometimes it doesn't until I force it too.)

Just in case if you want to know more then find it below

Being around Citrix for a while, one of the things that you’ll notice and continues to hold true is that printing is still one of the biggest challenges. With each release, Citrix touts that printing is better. However, reality sets in and you soon find out that you’re in the same boat again and you’re forced back to old school printing configurations.

Don’t be mistaken, the EMF printing model of Citrix Presentation Server 4 is a good move. It has given back your server’s horsepower from the days of when a single logon or print job would spike your processors, or even worse, clog the user’s virtual channel. Most of the problems occur when administrators expect that printing will work out-of-the-box and are unfamiliar with how to properly set it up. Further, many of the helpful printing sites seemed to have ventured off topic, adding additional content and making it difficult to find a clear, concise, guided approach in how to set up printing.

Once again, if you’ve been around Citrix for a while, you should know these best practices and how to set up printing, but a re-fresher never hurts. This guide is mainly written for the new Citrix administrator either setting up an environment or even trying to fix an existing one. Although you can debate some these recommendations, they have been successfully deployed in environments with 50,000 named users.
Before you start the journey of setting up Citrix printing, you need to know what makes up the system and how they work together.

Printing Components

Basically, there are six main areas or components that you need to be concerned about. These are:

• Server Side Printers, which includes print drivers that are installed on the Citrix server.
• Client Side Printers are printers that are both locally attached and network attached that are defined on each client workstation.
• Management Console Settings are configurations that are made in the Presentation Server Java Console. These include Citrix policies and driver mappings.
• Wtsprnt.inf is a text file that resides on each Citrix Presentation Server that contains the re-mapped printers for the farm.
• Wtsuprn.inf is a legacy text file equivalent of the wtsprnt.inf file. This may still exist if the servers have been upgraded from previous Citrix releases. Unlike the wtsprnt.inf, this file can vary from server to server.
• NTPrint.inf is a configuration file that has information about all drivers that shipped with the server operating system that can be loaded.

Printer Auto-Creation

Now that you’re a little more familiar with the components, it’s time to look at how they interact with each other. When a client first connects, Citrix initiates a sequence to auto create the necessary server side printers. For it to be successful, these printers need to correspond with the client side ones and the printer driver name on the client must match (exactly) a printer that is defined in either the registry or one of the .inf files. It parses these files, listed below (in order): 

• wtsuprn.inf (if it exists)
• wtsprnt.inf
• The registry
• ntprint.inf

If a match is found, it bails out of the sequence. There are several other sub-steps, but they’re really not that important, nor is it necessary that you know them. It should also be noted that:

• The process is done for each printer defined on the client.
• For the most part, locally attached client printers auto-create faster than the network ones.
• The first printer that connects, even though it may not be defined as the user’s default, becomes the temporary default in the session until the actual default is mapped.

Best Practices

Seeing the components and the process Citrix uses to connect printers, it’s still a challenge to have consistent and reliable printing. Yes, EMF performance enhancements have been great, but it’s consistency, or lack there of, that generates the most support calls (which, without a doubt, is the bane of the Citrix admin’s existence). It’s usually easier in a controlled environment, however, in an environment where a strict printing standard can’t be adopted, it’s a nightmare. Properly setting up your environment is a must and regardless of how it’s done, it needs to include the following:

• Avoid loading third-party print drivers--especially drivers that are not specifically documented to be compatible with terminal services. This has, was, and still is the number one cardinal rule. Back in the NT 4.0 TSE days, third-party drivers accounted for most of the BSoDs. These days, the “good” news is that it may only cause your spooler to tank out.    
• Remove all version-2 drivers. These types of drivers run in kernel mode and cause serious issues with the servers. Stick with Version-3 drivers which operate in "user mode."
• Use native Windows 2000 or Windows 2003 OS drivers for all printers, even if some functionality is lost. This includes using them over the Universal Print Driver.
• If additional functionality is really needed, map the client driver to another Windows 2000 or Windows 2003 OS driver that offers similar functionality. This isn’t always possible, but most users are satisfied with just being able to print and don’t mind killing an extra tree or two because duplex printing isn’t available.
• Disable the loading of drivers on demand and/or importation of drivers from the client. This is important in keeping your environment clean and free of third-party drivers or other unwanted drivers.
• Keep the combination of drivers and/or re-mapped drivers to minimum. The more places to parse during printer auto-creation, the longer the logon may take.
• Ensure users have write access to %systemroot%\system32\spool on the server. Problems usually occur with overzealous, Sarbanes-Oxley compliant lock-down admins applying security settings.
• If possible, print directly to the printer or print server and not through the virtual channel. Sorry, Citrix is meant to be thin--why clog the pipe with a print job if you don’t have to?
• Old print jobs in the spooler should be cleaned up periodically. This should be done through a common maintenance script.
• Do not load Hotfixes because they are available. Ensure it fixes something that is actually broke. Basically, if it ain’t broke, don’t fix it.

Step by Step

Using all of this information, it’s time to put it to together and build a solution around it. Working under the assumption that you’re setting up a new environment and a have clean slate. Start by:

• Setting up your policy
• Installing your drivers
• Re-mapping your printers

Create Your Farm Print Policy

Your farm’s print policies will vary in your particular environment and will always be dictated through the needs of your user base. The following settings seem to be the sweet spot for most farms that have users coming in from the Internet on untrusted clients. It uses native drivers over the UPD, and is applied to all servers as a default.

Drivers

Remarkably, you can run your entire farm with less than 25 drivers and all third-party drivers can and should be removed. These drivers ship with the operating system and serve as a good base for any environment.

• Canon Bubble-Jet BJC-210
• Canon Bubble-Jet BJC-4000
• Generic / Text Only
• Epson Stylus COLOR ESC/P 2
• HP Color LaserJet
• HP Color LaserJet 4500
• HP DeskJet
• HP DeskJet 550C
• HP DeskJet 850C
• HP DeskJet 855C
• HP LaserJet
• HP LaserJet Series II
• HP LaserJet 1100 (MS)
• HP LaserJet 2100
• HP LaserJet 4
• HP LaserJet 5
• HP LaserJet 6P
• HP LaserJet 4000 Series PCL
• HP LaserJet 8100 Series PCL
• HP OfficeJet
• Lexmark Optra
• Lexmark 1020 Color Jetprinter

The easiest way to load these is to simply walk through the “Add a printer” wizard one-by-one. You can get creative and write a script however you only need to do this once because they can be replicated. The drivers can also be integrated into your Citrix base build.
So that additional drivers don’t accidentally get installed, it’s also a best practice that you rename %systemroot%\inf\ntprint.inf to ntprint.old.

Replicating Drivers

Using Citrix’s print driver replication feature, the drivers can be loaded on one of your servers and then replicated to all of the servers in the farm. In larger Citrix Farms, replicating drivers can cause performance issues, so you may want to create a print package that can be redistributed.

Creating a package is a simple process:

• Start with a clean, freshly installed server
• Copy the directories and files from %systemroot%\system32\spool\drivers
• Export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3
• Write a wrapper script similar to:

REM Backup Files and Registry
@IF NOT EXIST MD c:\temp\printback
@XCOPY /E /H /Y %systemroot%\system32\spool\drivers c:\temp\printback\
@REG EXPORT "HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3" c:\temp\printback\printers.reg

REM Removing Print Drivers
@REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3" /F
@RD /S /Q %systemroot%\system32\spool\drivers\color
@RD /S /Q %systemroot%\system32\spool\drivers\w32x86

REM Installing New Print Drivers
@XCOPY /E /H /Y color %systemroot%\system32\spool\drivers\color
@XCOPY /E /H /Y w32x86 %systemroot%\system32\spool\drivers\w32x86
@REG IMPORT PrintDrivers.reg

REM Restore
REM @XCOPY /E /H /Y c:\temp\printback\color %systemroot%\system32\spool\drivers\color
REM @XCOPY /E /H /Y c:\temp\printback\w32x86 %systemroot%\system32\spool\drivers\w32x86
REM @REG IMPORT c:\temp\printback\printers.reg

@NET START SPOOLER

• Bundle it all together as a self executing zip file. InstallShield Packager for the Web (if you can still find it) is a great utility for this type of work.

Re-Mapped Drivers

Now that you have a good driver base, it’s time to re-map to them. You can do this a couple of different ways. Downloading and importing somebody else’s remapping file isn’t necessarily the best since your environment is more than likely unique. You’re bound to get a number of unnecessary re-mappings, thus violating best practice #6. Under that premise, the easiest approach is to use Doug Brown’s Advanced Print Manger (APM) from http://www.dabcc.com/apm . If you get the answer “it’s not in the budget,” then the re-mappings will have to be done manually using two different processes:

Manual Process #1

• Filter the event view for printer failures – 1106 and 1007 messages
• Parse through it and just grab the printer name.
• Look up the printer at www.printingsupport.com and find a comparable driver
• Create a text/inf file and manipulate so it resembles a wtsprnt.inf.
• Import using qprinter /IMPRMAPPING C:\MyMappings.INF

Manual Process #2

• Dump the event view for printer failures – 1106 and 1007 messages
• Look up the printer at www.printingsupport.com and find a comparable driver
• Re-map them one-by-one in the CMC.

Six out of Seven Citrix Admins agree: stick with APM. It’s easier to use and you’ll be done in half the time. It polls the event logs for failed mappings and displays them in a consolidated, readable format along with a suggested re-mapping.

If a recommendation isn’t available, the following table can be used as a simple guide or starting point for re-mappings. Of course you’ll need to test them to ensure they work. Further, since support is being added for a printer that is currently unavailable to the user, adding these mappings during production hours is a minimal risk. 

References :-

http://support.citrix.com/article/CTX103247

http://www.brianmadden.com/blogs/guestbloggers/archive/2006/08/22/citrix-printing-brush-up-on-the-basic-best-practices.aspx

http://support.citrix.com/article/CTX107137

1. SSL issues; Security issues with IE; Citrix Client not connecting

CAUSE

If it is Single User

1. Citrix Client not installed
2. IE not configured properly
3. User does not have access to Citrix Site

If it is multiple users then

1. SSL certificate expiry or Mis-configuration
2. Root Certificate Validity
3. SSL and Root Certificate Binding
4. Firewall port issue (https:443 port)
5. Secure gateway certificate issuing issue

you can Ask if you stuck somewhere to me by adding comments

Connect the SSP image like below or copy the SSP pakage on the Server

Click Apply

Run the Setup from the %drive%hp/swpakages/Setup.exe

Click on Start inventory

Build inventory from the location of %drive%hp/swpakages

Select local host for checking installation check list

A similar screen will appear when you have software inventory

Uncheck the option listed below

Then click on install

Once after the installation – Reboot the server and monitor the reboot process from ILO

create a TXT file by Name Servers with the list of Servers you wanted to check. It will automatically created a Output

SCRIPT STARTS FROM BELOW

'==========================================================================
Option Explicit
On Error Resume Next

Dim strComputer, objWMIService, colOperatingSystems, objOS, intSystemUptime, Question
Question = ""
Do Until Question = vbNo
strComputer = InputBox("Please enter servername")

If strComputer <> "" Then
GetTime

Else
Question = MsgBox ("Please try again and enter a valid server name" & vbCrLf & "Try again?", vbYesNo)
If Question = vbNo Then
WScript.Quit


End If
End If
Loop

'===========================================================================
' Sub Procedures
'===========================================================================
Sub GetTime

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colOperatingSystems = objWMIService.ExecQuery _
("Select * From Win32_PerfFormattedData_PerfOS_System")

For Each objOS in colOperatingSystems
intSystemUptime = SplitSec(objOS.SystemUpTime)
'intSystemUptime = Int(objOS.SystemUpTime / 60)
MsgBox "The server has been up for " & intSystemUptime
Question = vbNo
Next

End Sub

Function SplitSec(pNumSec)
Dim d, h, m, s
Dim h1, m1

d = int(pNumSec/86400)
h1 = pNumSec - (d * 86400)
h = int(h1/3600)
m1 = h1 - (h * 3600)
m = int(m1/60)
s = m1 - (m * 60)

SplitSec = cStr(d) & " Days, " & cStr(h) & " Hours, " & cStr(m) & " Minutes, " & cStr(s) & " Seconds."
End Function

Applies for 2003,2008

Few things to Note :

* this script query’s to registry (marked in Blue)of the patch so you need add the Registry key to which it need to query( you can get that details in the download site

*You need to Very particular about the location,Best Classification would be Like this

**location : D drive

**Patch Location : Better if you can save it with MS article number

ex : MS06-017

so the location classification can be \\Server\d$\Ms06-017 this can locate your patches easily

************************************************************************
set inst= Location

echo ***** Hotfix MS06-017 Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting (917627) *****
REM ***** Date of added*****

%windir%\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003\SP2\KB908981\File list"
IF ERRORLEVEL 1 GOTO INSTALLMS06-017
IF ERRORLEVEL 0 GOTO PASSMS06-017
:INSTALLMS06-017
echo Installing Hotfix MS06-017 Vulnerability in Microsoft FrontPage Server Extensions...
%inst%\MS06-017\WindowsServer2003-KB908981-x86-ENU.exe /passive /norestart /log:%inst%\MS06-017\
ECHO Install Complete.
goto ENDMS06-017
:PASSMS06-017
echo Hotfix MS06-017 Vulnerability in Microsoft FrontPage Server Extensions is already installed.
goto ENDMS06-017
:ENDMS06-017
echo.

REM ***** End of Hotfix MS06-017 Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting (917627) *****

You can run below script in IIS for cleaning the logs

***************************************************************************

Dim fso, folder, file, filecollection, dir, days_in, days_dif, filesplit

'Dim WshShell
'Set WshShell = WScript.CreateObject("WScript.Shell")
'WScript.Echo WshShell.CurrentDirectory

If ((Wscript.Arguments.Count < 3) or (Wscript.Arguments.Count > 3)) then
    Wscript.echo "Script requires 3 parameters"
    Wscript.echo "cscript log_clean (directory) (days) (extension)"
    Wscript.echo "cscript log_clean c:\ 30 log"
    Wscript.echo "(directory) is folder to delete logs out of"
    Wscript.echo "(days) sets the age for a file delete, if file older then (days), it is deleted"
    Wscript.echo "(extension) sets which files the tool will look at)"
    Wscript.Quit 3
    end if
   

dir = Wscript.Arguments.Item(0)
days_in = Wscript.Arguments.Item(1)
ext = Wscript.Arguments.Item(2)
    

set fso = CreateObject("Scripting.FileSystemObject")
set folder = fso.GetFolder(dir)
set filecollection = folder.files

For Each file in filecollection
       
        filesplit = Split(file.name, ".")
       
        If (Ucase(filesplit(UBound(filesplit))) = Ucase(ext)) then
       

        days_dif = DateDiff("d", file.DateLastModified, date)       

            if ((cint(days_dif)) > (cint(days_in))) then
       
                wscript.echo file.name&" is "&DateDiff("d", file.DateLastModified, date)&" days old"
                wscript.echo "Will delete "&file.name
                file.Delete[(force)]
            else
       
                wscript.echo file.name&" is "&DateDiff("d", file.DateLastModified, date)&" days old"
                wscript.echo "Will keep "&file.name
       
            end if
        end if

Next