Description: Disable the address bar on the Internet Explorer

How to use it: Copy the statement below and copy in the text file and save in .ADM or ADMX

What does it do? Restricts the user to use the Internet Explorer and few of Tool bars

Post

**************************************************************

class user

category IESettings

policy "disable command bar"

keyname "software\policies\microsoft\internet explorer\toolbars\restrictions"

valuename "NoCommandBar"

valueon numeric 1

end policy

policy "disable IE nav bar"

keyname "Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions"

valuename "NoNavBar"

valueon numeric 1

end policy

policy "disable Address bar"

keyname "software\policies\microsoft\internet explorer\toolbars\restrictions"

valuename "NoAddressBar"

valueon numeric 1

end policy

end category

**************************************************************

Description: General script for troubleshooting IMA issue

How to use it: copy the script in the notepad and save in the text file in .BAT format

What does it do? It will restart the IMA and Recreate the LHC and as well as restart the MFCOM service

Post

*********************************************************************

sc stop mfcom
sc stop CitrixWMIService
sc stop imaservice
taskkill /IM imasrv.exe /F
taskkill /IM IMAAdvanceSrv.exe /F
taskkill /IM mfcom.exe /F
dsmaint recreatelhc
dsmaint recreaterade

sc start mfcom
sc start CitrixWMIService
sc start imaservice

*********************************************************************

Installing WinSCP ** requires a reboot

The default installation location is recommended. Click [Next].

Select the selected files

The Start Menu folder is simply the name of the sub directory under which your WinSCP shortcuts will be located. The default value should be fine. Click [Next].

Additional tasks include creating shortcuts in various locations to make WinSCP easier to access. The following option set is reasonable. Click [Next].

We recommend using "Norton Commander interface" style since it provides a dual-pane, easy-to-use look. "Show advanced login options" adds some options to the connection pane and may remain checked or be unchecked since most users will not need the additional settings. These settings can be changed later if desired. Click [Next].

The installer will verify the settings. If everything looks as you set it in previous steps, click [Install].

Following a brief installation status screen, you should see the following dialog indicating successful installation of WinSCP. You are now equipped to transfer and manage files remotely. Due to the shell extensions WinSCP provides, a reboot is necessary. Select whether you wish to reboot immediately. Click [Finish].

1. Open the Citrix Access Management Console and run Discovery

2. Expand out the Presentation Server/XenApp Server

3. Right-click on the Farm > Modify Farm Properties > Modify License Server Properties(Check the current license server

The pop-window that displays next will show you the License Server name for Citrix license access, as well as the Port Number (usually 27000).

Now -how to check license usage?

Got to the License server > Start> Program files>Citrix>management Console or Citrix license console

*When you open the License management console > it will re-direct to webpage*

*if you have in place Authentication then Provide the details then Punch it in the console to login*

A similar screen will appear like below

#check the used licenses

#check the available Licenses

#you can also see the Date of issue of licenses

Or

You Can directly View this by Using below Procedure

http://License server name:8082

First step: installing ADMT 3.1 on Windows 2008 Domain Controller

installing ADMT

ADMT installation file can be downloaded from http://www.microsoft.com/downloads/details.aspx?FamilyID=ae279d01-7dca-413c-a9d2-b42dfb746059&displaylang=en

During installation the installation Wizard will ask about the database to be used by ADMT, the wizard can use existing SQL 2005 instance or it can install a new instance of SQL 2005 express, in our case we choose to install a new SQL 2005 instance.

Then, the wizard will prompt us if we need to import data from any previous ADMT database, since this is a new installation we choose not o import any data.

Importing previous ADMT data

Then the installation Wizard completes successfully.

Second Step: Installing Password Export Server

In order to be able to export the user’s passwords, we needto install the password export server.

The password export server will need a password encryption file to secure password migration, to create this password encryption file we use the ADMT utility in the command line to generate the file as follows:

1- We navigate to the location of the installation of the ADMT, in our case it is C:\Windows\ADMT

2- We issue the following command C:\Windows\ADMT>admt key /opt:create /sd:”Source_Domain” /kf:c:\Domain.pes /PWD *

3- The utility will then ask you to provide the password and validate it.

After creating the encryption file we move it the source domain controller where we are going to install and use the password export server as in the following steps:

1-Start the installation wizard

2- Accept the license agreement

Accept License agreement

3- Choose the password encryption key file that we created in the previous steps 4- Insert the password that we used to

encrypt the password encryption file

Password Prompt

5- Start installing the Password Export Server

6- Choose the service account that the PES server will run under , this account should be administrator on the

destinationdomain, we chose the administrator in the source domain and made it a member of the administrators group in

the Windows 2008 domain

Up to this stage the installation is finished, the wizard will require the source server to be restarted, after restarting the

server, the PES server has to be started manually.

Third: running the ADMT Migration wizard

To start the migration wizard, we go to the ADMT console on the destination domain controller, “Windows 2008 DC” and
start the user’s migration Wizard.

Start ADMT Users Migration

Choose next to the welcome screen

Start Migration

Choose the source Domain and domain controller, and the destination domain and domain controller. In our case the
source domain is “radmins.com” and the source domain controller is “RDC01radmins.com”,the destination domain
is“nwtraders.com“
and the destination domain controller is “dc01.nwtraders.com”.

Then we choose to select the users from the domain directly and not from a file:

Selecting Users to Be migrated
After selecting the user accounts to be migrated, we choose to migrate the passwords of the users as well and choose the
password export server on that we installed on the source domain controller.

Password Migration

Then we choose the target OU to which we will migrate the users to:

Then we choose the state of the migrated users, we can select that the users will be enabled, disabled, or the same state of
the source domain, also we can select to migrate the source SID of the users, this will allow users to access the resources
that they used to access in the source domain.

Migrated users state and SID migration

When choosing to migrate the users SIDs, the wizard will prompt to enable auditing and creating a group necessary for
migration of users SIDs, by selecting “yes” the wizard will enable these settings on the source domain controller
automatically ad we can proceed.

Enabling Auditing

The wizard then will prompt for a user account with proper privilege to add SID history.

Administrative Account

The wizard then will prompt for options like migrating users roaming profiles, update user’s rights, migrating associated groups, and fix users group memberships.

Migration Options

Then the wizard gives us an option to exclude some users from migrations:

Users Exclusion

Then we can choose how to handle conflicts when they occur

Dealing with users conflict

And finally the migration wizard will start migrating users.

Start Migration Process

How to Assign a Mandatory User Profile in Windows 2000

To assign a mandatory user profile in Windows 2000, follow the steps that are described in this section.

Step 1: Create a Profile

1. On a domain controller, create a template user account that has the same permissions as the user or the group for which you want to create the mandatory profile.
2. Use the template user account to log on to a workstation computer.
   A user profile is automatically created on the local computer in the Drive:\Documents and Settings\User_name folder.
3. Configure the desktop settings that you want to use in the profile, including shortcuts, appearance, and Start menu options.
4. Log off the computer.

Step 2: Copy the Profile to a Shared Folder

Copy the user profile that you created in the Step 1: Create a Profile section of this article to a shared network folder. To do so:

1. Create a shared folder on the network in which you want to store the mandatory profile, for example, C:\Profiles\Mandatory, and then share this folder. For example, create the following share:

\\Server_name\mandatory

2. Assign at least Read & Execute permissions for the users or groups to whom you want to assign the profile.
3. Log on to the domain as an administrator from the workstation computer.
4. Click Start, point to Settings, and then click Control Panel.
5. Double-click System, and then click the User Profiles tab.
6. Under Profiles stored on this computer, click the profile that you created in the Step 1: Create a Profile section of this article, and then click Copy To.
7. In the Copy profile to box, type the Universal Naming Convention (UNC) path to the share that you created in step 1 (for example, type \\server_name\mandatory), and then click OK.
8. Under Permitted to use, click Change, click Mandatory profile user, and then click OK.
9. On the Windows 2000 Server-based computer, start Windows Explorer, and then locate the shared folder that contains the profile that you copied.
   This folder contains a file named Ntuser.dat.
10. Rename Ntuser.dat to Ntuser.man.

Step 3: Assign the Mandatory User Profile

1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2. Locate the container that contains the user account whose settings you want to modify.
3. In the right pane, right-click the user account that you want to configure, and then click Properties.
4. Click the Profile tab.
5. In the Profile path box, type the location of the profile that you want to assign.
   When you type the location, use the following UNC format, where Server_name is the name of the computer where the profiles are stored and Share_name is the shared folder that contains the mandatory profile:

\\Server_name\Share_name

6. Click OK.
7. On the workstation computer, log on to the domain by using the account to which you have assigned the mandatory profile, and then test to make sure that the profile settings have been successfully applied.

Creating a roaming user profile

Creating a roaming user profile is a two-step process: creating a test user profile and then copying the test user profile to a network server.

Creating a test user profile

In this procedure, you create a test profile for the roaming user:

1. Create a user account to act as a test user account. For example, create an account named Sales Profile.
2. Log on as the test user account. A user profile is automatically created on the local computer in the c:\Winnt\Documents and Settings\username folder.
3. Configure the desktop environment, including appearance, shortcuts, and Start menu options.
4. Log off, and then log on as Administrator.

Copying the test user profile

In this procedure, you copy the test profile to a network server:

1. Create a folder on a network drive in which you can store network profiles. For example:

\\server_name\Profiles\user_name

2. In Control Panel, double-click System, and then click the User Profiles tab. Under Profiles Stored On This Computer, click the profile that you want to copy, and then click Copy To.
3. In the Copy Profile To dialog box, type the network path to the folder. Under Permitted to Use, click Change.
4. Add the appropriate user, and then click OK.
5. In the folder that you created on the network, rename the file Ntuser.dat to Ntuser.man if this is a mandatory user profile.
6. In User Manager for Domains, double-click the user account, and then in the User Properties dialog box, click Profile.
7. In the User Profile Path box, type the UNC path to the network profile folder. For example:

\\server_name\Profiles\user_name

This step-by-step article describes how to restore a user profile as well as the following user profile items:

• Documents
• Desktop settings
• Favorites
• Cookies

By default, when you first log on to a Windows 2000-based computer, Windows creates a user profile folder in the %SystemDrive%\Documents and Settings folder, and you are given Full Control permission. If you lose the Full Control permission for this folder, Windows creates a new user profile folder the next time that you log on and you can no longer access the original user profile folder unless you have local administrative authority on the computer.
If you lose access to your profile folder, Windows creates a new profile folder for you, and places it in the Documents and Settings folder by default. Windows attempts to use your user name as the name of the new profile folder. However, if the old profile folder still exists, Windows modifies the name of the new folder to avoid duplicating the name of the original profile folder. In this scenario, you may see multiple profile folders for your user profile. The following information describes the default naming scheme that Windows 2000 uses for user profiles:

• If the username folder does not already exist, the new profile folder is named:

username

• If the username folder already exists, the new profile folder is named:

username.computername

• If the username.computername folder already exists, the new profile folder is named:

username.computername.000

• If the username.computername.000 folder already exists, Windows uses the next available increment of the username.computername.000 naming scheme.
  For example:

username.computername.001

Another way to keep track of these duplicate profile folders is by the creation date or time, as long as you have not modified the creation date or time.

Back to the top

Requirements

To restore a user profile, the Documents and Settings\username profile folder must still exist, and you must have the Full Control permission for this folder. If you do not have the correct permission for your user profile folder, you (or someone else) must log on to the computer as an administrator and restore the required level of permission to your user profile.

Back to the top

Copy Documents from the Current Profile Folder to the Appropriate User Profile Folder

If you have logged on to Windows since you lost access permission to your original profile folder, there are at least two user profile folders that have your user name. To make these files accessible from the user profile that you are restoring:

1. Log on to the computer as an administrator.
2. Copy all of the documents from your current My Documents folder to the My Documents folder of the profile that you are restoring.
   NOTE: Step 2 is not required if you have moved your My Documents folder to a location outside the Documents and Settings folder; however, after you restore your user profile, you may need to re-specify the target folder location of the My Documents folder.
3. To retain the Internet favorites links, copy all of the Internet shortcut files from from your current Favorites folder to the Favorites folder of the user profile that you are restoring.
   NOTE: Do not copy Desktop.ini file.

Back to the top

Grant Full Control Permission for the User Profile Folder

1. Right-click your old user profile folder, and then click Properties. By default, this folder is %SystemDrive%\Documents and Settings\username.
2. On the Security tab, click your user profile in the Name list, and then click to select Allow for the Full Control permission.
   NOTE: If your user profile is not displayed in the Name list, add your profile: Click Add, click your user name in the list, and then click OK.
3. Click OK to close the dialog box.

Back to the top

Edit the User Profile Registry Key

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 (http://support.microsoft.com/kb/322756/ ) How to back up and restore the registry in Windows

Edit the registry so that the profile image path points to the user profile folder that you worked with in the "Grant Full Control Permission for the User Profile Folder" section in this article:

1. Log on to the computer with the user profile that you want to restore.
2. Click Start, and then click Run.
3. Type regedit, and then click OK.
4. In Registry Editor, navigate to the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList

5. Locate your user profile folder.
   NOTE: When you open the ProfileList folder, you see several folders, each of which belongs to a different user. These folders are named according to the user security IDs (SIDs) and not according to the user names.
   To locate your user profile folder, use one of the following options:
   • For each folder, click the folder, and then look for the ProfileImagePath value that contains the path to your user profile (such as %SystemDrive%\Documents and Settings\username).
     -or-
   • In Registry Editor, press CTRL+F to start the Find tool. Type your user name in the Find what box, click to select the Data check box under Look at, and then click Find.
6. After you locate the subkey folder for your user profile, double-click the ProfileImagePath value.
7. In the Value data box, change the path so that it points to the profile folder that you are restoring, and then and click OK.
8. Quit Registry Editor.

The next time that you log on to the computer, Windows will use your restored user profile.

* Application Performance Monitoring (powered by Citrix Edge Sight)

o Edge Sight Agent to Edge sight Server - TCP 80/443 (Payload and alerts)

o EdgeSight Web console (non-IMA) to RSCorSvc on EdgeSight Agent - TCP 9035

o Edge Sight Agent internal communication - TCP 9036 (client-side database) NOTE: After Edge Sight 4.5, replaced with IPC)

o Edge Sight database - SQL 1433 (configurable)

* Client-side Application Virtualization -

o Streaming Client to Application Hub (File Server/Share) - SMB 445

* Easy Call -

o To client - HTTP(S)-TCP 8443 (PSync)

o To Admin console (non-IMA) - TCP 443

o To LDAP Directory- TCP 389

o To PBX - port varies by vendor

* Independent Management Architecture (IMA) Services - TCP 2512, 2513

* Licensing Service - TCP 27000, 27009 (configurable)

* Server-side Application Virtualization

o Management Console (Using IMA) - TCP 2512, 2513

o Application requests - TCP XML 80, 8080 or 443 (configurable)

o Access to Applications Virtualized on the Server - ICA-TCP 1494, 2598 (Session Reliability)

* Single Sign-on (powered by Citrix Password Manager)

o Management Console (non-IMA) or Agent to Password Manager Service - TCP-443

o Management Console (non-IMA), Agent or Service to credential store

+ Network File Share Credential Store - TCP/UDP 445 (CIFS) or TCP/UDP 135-139 (NetBIOS)

+ Active Directory Credential Store - TCP/UDP - 389, 636, TCP - 3268, 3269

+ Novell File Share Credential Store - TCP/UDP - 524

* SmartAccess (powered by Citrix Access Gateway)

o Standard and Advanced Edition

+ Client connections- TCP-SSL 443 (configurable)

+ Advanced Access Control (AAC) to Appliance communication - TCP 80 or 443 (configurable), 9001, 9002, 9005

+ Management Console

# to Appliance (non-IMA) - 9001, 9002, 9005

# to AAC - IMA-TCP-2513

o Enterprise Edition

+ To client - SSL-TCP 443

+ To internal network - SSL-TCP 443, Native Authentication port (i.e. RADIUS 1812, LDAP 389), Native application ports (i.e. ICA-1494)

+ Management console (non-IMA) - SSH-TCP 22, HTTP(S)-TCP 80/443

* SmartAuditor -

o Management (non-IMA) - Use local console on Agent or on Server.

o Agent to Broker (Recording and Policy Check) - TCP 80/443 (configurable)

o Player to Broker - TCP 80/443 (configurable)

o Agent to Server (Metadata and Video)- Microsoft Message Queuing,

+ Default - TCP: 1801; RPC: 135, 2101*, 2103*, 2105*; UDP: 3527, 1801 (*These port numbers may be incremented by 11 if the initia choice of RPC port is being used when Message Queuing initializes. A connecting QM queries port 135 to discover the 2xxx ports.)

+ Over SSL- TCP 80,443

* WAN Optimizer -Guidance provided was to get it from Admin Guide

o Appliance to Appliance - Pass-through native application port (e.g. ICA-1494, HTTP-80, LDAP-389)

o Management Console (non-IMA) - TCP 80

o Client to Appliance - TCP 443

* Web Interface

o Client connections - TCP 80/443 (configurable)

o Server-to-server - TCP XML 80/8080, 443 (using SSL Relay)

o Management console (partially IMA) - DCOM 135 (+ configurable high port range), IMA-TCP 2513, TCP 80/443

Some Citrix Port Numbers

1494: This port is used by any client using the TCP protocol to communicate with the Presentation Server. You will need to open this port on your firewall for inbound connections unless you are using some form of encapsulation or encryption. You can change the port using the ICAPORT command but I find it to be more trouble than it is worth.

1604: Called the ICA Browser port this is a UDP port that can be used by the Program Neighbourhood to enumerate applications. You probably won t use this though.

80: This is the default port used by the XML service and is used by clients who enumerate applications with the TCP+HTTP or XML protocol. You will thus need to open this port on your firewall for inbound connections if clients will be using it to locate servers. You can change the port easily enough using the CTXXMLSS command.

443: This is the default SSL. The SSL Relay will use it to secure communications between the Web Interface and the server farm. You could also use it to secure client communication to the web Interface or use it for client connections to the Presentation Server.

5000: The Presentation Server uses this port to communicate with the IBM Db2 server hosting the data store.

1521: This port is used to communicate with the Oracle data store.

1433: The port used to communicate with a Microsoft SQL data store.

2512: This port is used for server to server communication such as when load information is communicated. The port used to access the data store is saved in the HKLMSOFTWARECITRIXIMAIMAPORT key on the server containing the data store. All other servers use the port number saved in HKLMSOFTWARECITRIXIMAPSSERVERPORT key in the registry to access the data store. Have a look at IMAPORT to see how to change it.

2513: This port is used by the Presentation Server Console when connection to a server. Have a look at IMAPORT to see how to change it.

2598: This is the session reliability port number and needs to be opened on your firewall if the ICA Clients will be using session reliability when communication with the server.

27000 and a random port number: This is the port used for communication between the Citrix License server and the Presentation Servers. Remember that the Citrix vendor daemon running on the license server uses a random port. It tracks license usage.

Valid till 4.5

1. What is IMA?

IMA is an Independent management Architecture which is used for managing and communication among the citrix servers.

2. What is ICA?

ICA is the Independent communicating architecture it’s a protocol which is used for exchanging the data from server to client desktop and vice versa.

Eg: mouse movements, key strokes etc.

3. What are the Database used in citrix?

a. MS Access

b. SQL

c. IBM DB2

d. Oracle

4. What is a data store?

This is used to store the static data like profiles, licensing etc.

5. What is a ZONE data collector?

Group of servers are called as ZONE. In that one server will act as a zone data collector.

ZDC acts as leader among the servers which manages and stores the dynamic data of the servers like session, load of the server etc.

6. What is LHC?

Local Host Cache acts as a fail over tendency. If there is a lost of connection b/w database and citrix servers its acts like a database up to 96hr

7. How can we recreate LHC?

a. First stop the IMA service.

b. Type cmd dsmaintrecreatelhc.

c. Again start IMA service.

8. What is load evaluator?

The load can be divided equally among the citrix servers depending upon

a. CPU usage

b. Memory usage

c. Bandwidth

d.

9. What are the different types of load evaluators?

a. Default, which is based on the server user load rule.

b. Advance, which is based on the CPU, memory and page swaps utilization rules.

c. Custom. We can assign as per our wish.

10. What is Isolation environment?

It is used to reduce the conflict between application to application or registry to registries.

For ex we can install MS2003 and 2007 in the same system without any conflicts.

11. What is session reliability?

If there is a lost of connection in the server the session reliability will the session alive up to particular period of time.

12. What are the printer terminologies?

Citrix printing can be configured in three ways

a. Client Printing: The printer connected to the workstation & the drivers are installed on the citrix server for printing.

b. Network Printing: The Printer connected to the print server & the drivers should be available on the citrix server.

c. Local Printer: The Printer connected to locally to the citrix server & the drivers are installed for the print operation.

13. What is client lock down?

Client lockdown is a process of securing the endpoint so that users can access only authorized features.

An example of this is turning a device into thin client by locking it down so that the end-users can only use published applications or desktop and cannot use further features.

14. What is speed Screen?

Speed screen is the utility in citrix that enable the speed when the client or user is using low configuration system for better Graphic etc.

15. What are the citrix clients?

a. Program Neighborhood client. (PN)

b. Program Neighborhood Agent.(PNA)

c. Web Interface client.

d. Java Client.

16. What are the pre requisites of the citrix installation?

a. OS

b. Install terminal service

c. Licensing of TS

d. Citrix pre requisites.

e. Citrix installation

f. Installing citrix licensing

17. What is Resource manager?

Resource manager collects stores and displays the data about the performance, application or process use.

18. What are the types of the publish we can do in citrix?

a. Application Publishing

b. Content Publishing

c. Desktop Publishing

19. What do you mean by the Summary database

Summary database is database which is used by the resource manager

20. what do you mean by Load throttling

A general Interview answer is : Load throttling is new parameter of the citrix included from 4.5 which monitor the win logon and *win32 file. Generally it will be helpful when server in production reboot unexpectedly. Load evaluator do not point the server until server getup

ref:http://www.brianmadden.com/blogs/brianmadden/archive/2007/05/04/understanding-the-new-logon-throttling-load-evaluator-options-in-citrix-presentation-server-4-5.aspx

http://support.citrix.com/article/CTX112082

Symptoms

“Shadow failed. Error code 7050” (Error 7050 – The requested session cannot be controlled remotely. This may be because the session is disconnected or does not currently have a user logged on. )

Cause 1

This error was observed when attempting to shadow users across different servers.

Users can shadow using the following methods:

• Citrix Management Console if the user resides on the same server from which the shadow request originates

• Citrix Server Administration

• Shadow Taskbar

• Command line using the command Cshadow.exe

Resolution 1

This issue was first resolved with MetaFrame XP 1.0 Service Pack 1.

Cause 2

The option for shadowing an RDP session from the Management Console shouldn’t be available. Normally the option to shadow an RDP session is grayed out, but after installing Service Pack 4 for MetaFrame XP it is made available.

Resolution 2

Citrix is working on a post Service Pack 4 hotfix to gray out the option.

Cause 3

Shadowing from the Management Console over RDP failed. The issue occurred because of a code error.

Resolution 3

Apply MPSE300W2K3R04 or its equivalent.

If this hotfix is not applied and one is unable to use an ICA session or the Management Console from a remote workstation use a console RDP session (mstsc /console)

This document applies to:

* MetaFrame Presentation Server 3.0 for Microsoft Windows 2000

* MetaFrame Presentation Server 3.0 for Microsoft Windows 2003

* MetaFrame XP 1.0 for Microsoft NT 4.0 Server Terminal Server Edition

* MetaFrame XP 1.0 for Microsoft Windows 2000

* MetaFrame XP 1.0 for Microsoft Windows 2003

* Presentation Server 4.0 for Microsoft Windows 2000

* Presentation Server 4.0 for Microsoft Windows 2003

http://support.citrix.com/article/CTX741852

10 . Any file format changes : You find these kinds of error’s when the file’s format is been changed;Sometimes “Always use the selected program to open this kind of file would be enabled”

Solution : Goto Folder option – Click on File type

Goto to the Open with change option and change the file type

From here :

This will resolve the issue.

1. Start a registry editor (e.g., regedit.exe).

2. Navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon subkey.

3. Double-click DefaultDomainName (or create this value of type String if it doesn't exist), and set the value to the preferred domain.

4. Double-click AltDefaultDomainName (or create this value of type String if it doesn't exist), and set the value to the preferred domain.

5. Close the registry editor.