Tips & Tricks

Group Policy Preferences in a Windows 2003 Domain (and a Windows 2008 Domain)

Al Solorzano — Mon, 02 Jun 2008 03:15:00 GMT

Group Policy Preferences are a great addition to your Windows Infrastructure. Originally, I thought Group Policy Preferences were only if you upgraded your domain to Windows 2008. I was wrong (Thank goodness!) and after much searching, I wasn't able to find a good article on Group Policy Preferences that is up to date (includes all Vista SP1 and R) and covers the what, why and how. So let me try to clear some things up... (if you want the technical stuff, click here)

Microsoft acquired the technology from DesktopStandard and the product was formerly known as Policy Maker (and prior to that as Profile Maker).
Extends the capabilities of Group Policy Objects.
Managed by Group Policy Management Console
Deployed via a Client Side Extension that is available from an optional update from Microsoft Windows Update call "Group Policy Preferences Client Side Extensions".
Group Policy Preferences Client Side Extensions must be installed to all Windows 2003, Windows XP, and Vista. All 32-bit and 64-bit flavors. Windows Server 2008 ships with the Group Policy Preferences Client Side Extensions installed.
Group Policy Preferences Client Side Extensions allow
There is no cost for this feature.

Management Method 1 - Windows 2008 Domain managed by Vista SP1 with Group Policy Management Console (GPMC) with Remote Server Administration Tools (RSAT) or Windows Server 2008
Management Method 2 (Since is the most common, I will cover this later in the article) - Windows 2003 Domain managed by Vista SP1 with GPMC from RSAT or Windows Server 2008

How do Group Policy Preferences differ from Group Policy Settings
First of all, they are simply extending the capabilities of Group Policy Settings by adding additional options in your Group Policy to set application, and environment settings. Group Policy Settings are what we have been using since Windows 2000 and enforce settings each time the user logs in or reboots the server. Some of these settings are application aware such as Internet Explorer or Microsoft Office (with the Office .adm templates added). Group Policy Settings either applied or denied based on security rights (computer and user objects) with the capability to filter out based on a WMI query. These will still be used and won't be going away soon. But it does have some drawbacks.

There is no way to enable one Group Policy Setting for one user/group within an existing Group Policy. This would require an additional Group Policy.
The GUI to manage Group Policy Settings was limited by the capabilities of .ADM templates (also called Administrative Templates). So a "Registry" modification required scripts or custom .ADM templates, and file modifications could only be performed with scripts.
WMI filters are difficult (in my opinion)

Group Policy Preferences are the desired setting by the administrator but also allows the administrator to choose if the user can modify the setting or not. They have multiple actions that can be performed (Create, Update, Replace, and Delete) for the user and computer settings. User Preferences include drive mappings, applications, IE settings, Regional Settings, Registry, Files, .INIs, Shortcuts and more. Computer preferences include Data Source/ODBC Settings, Scheduled Tasks, Registry, Files, .INIs, Shortcuts and more. Additionally, individual preferences can be filtered with Item-Level Targeting to apply the individual preference based on a very simple GUI to apply to about 25 target criteria (Computer name, user names, Memory, IP Range, Registry, Environment variables, etc.) with the ability to perform logical expressions (match first 3 characters, AND, OR, True, False, etc.). So I could have one GPO that 1 drive letter to different locations based on IP Range. The same GPO could create 100 different shortcuts for users based on their roles (AD security group). Then in the same GPO, create .INI and Registry settings for the business critical app based on the organizational unit the user exists. Without Group Policy Preferences, these would all be different GPOs or bunch of VBS scripts to perform the same tasks. Come on... you can clap now.

One GPO to perform 1000s of preferences that no longer need to be done with VBS scripts or multiple GPOs.
The GUI for Group Policy Preferences filtering with Item-Level Targeting is much better than writing your own scripts or your own WMI queries.

Here is a great chart from Microsoft on the quick differences between the two capabilities.

	Group Policy Preferences	Group Policy Settings
Enforcement	· Preferences are not enforced · User interface is not disabled · Can be refreshed or applied once	· Settings are enforced · User interface is disabled · Settings are refreshed
Flexibility	· Easily create preference items for registry settings, files, and so on · Import individual registry settings or entire registry branches from a local or a remote computer	· Adding policy settings requires application support and creating administrative templates · Cannot create policy settings to manage files, folders, and so on
Local Policy	· Not available in local Group Policy	· Available in local Group Policy
Awareness	· Supports non-Group Policy-aware applications	· Requires Group Policy-aware applications
Storage	· Original settings are overwritten · Removing the preference item does not restore the original setting	· Original settings are not changed · Stored in registry Policy branches · Removing the policy setting restores the original settings
Targeting and Filtering	· Targeting is granular, with a user interface for each type of targeting item · Supports targeting at the individual preference item level	· Filtering is based on Windows Management Instrumentation (WMI) and requires writing WMI queries · Supports filtering at a GPO level
User Interface	· Provides a familiar, easy-to-use interface for configuring most settings	· Provides an alternative user interface for most policy settings

Above is from Group Policy Preferences Overview by Microsoft

How to Setup Group Policy Preferences in a Windows 2003 domain

Join a Windows Server 2008 machine or a Vista SP1 workstation to the domain.
To manage from a Windows Server 2008
    - Add the "Group Policy Management" Feature
    - After it has completed, click on the All Programs -> Administrative Tools (if you have unhidden them) and launch the Group Policy Management Console
      OR
      Launch it by entering "gpmc.msc"
To manage from a Vista workstation
    - Make sure SP1 is installed.
    - Download and install the Remote Server Administration Tools (RSAT)
        - Download: Remote Server Administration Tools (x86)
        - Download: Remote Server Administration Tools (x64)
    - After the install has completed, click on the go to the "Control Panel" and open "Program and Features" (I found this randomly in a Technet forum article, but nowhere else after trying to figure out why after RSAT was installed, I still couldn't find the GPMC. This step is VERY important for Vista SP1 or you won't see the GPMC in the Adminstrative Tools. )
        - Click on "Turn on Windows features on or off" on the left side.

        - Click on the + to expand Remote Server Administration Tools -> Feature Administration Tools.

        - Enable the check box next "Group Policy Management Console".
        - Wait a few minutes to get the GPMC installed.
        - After it has completed, click on the All Programs -> Administrative Tools (if you have unhidden them) and launch the Group Policy Management Console
          OR
          Launch it by entering "gpmc.msc"
Now that Group Policy Management Console has been launched, edit any GPO as you normally would and you should now see the Computer and User Configuration sections of the GPO separated into Policies and Preferences (New Stuff!!!).
Note: It is recommended that once you modify or manage a GPO from a Windows 2008 or Vista SP1 with RSAT, you should continue managing from the same level devices. If you try to modify the GPO from a Windows Server 2003 or XP workstation, you will not see the new Preference capability.

How to install the Group Policy Preferences Client Side Extensions to interpret the Preferences section of the GPO

From a Windows Server 2003, Windows XP workstation or Vista SP1 workstation, connect to the Windows Update site.
Once you get to the area where it shows you the updates that are currently available for you, click on "Software, Optional" or "View Available Updates" (See below pictures) and add "Group Policy Preference Client Side Extensions".
Install and then reboot.

Vista

Windows Server 2003 and Windows XP

Note: Alternatively, visit http://support.microsoft.com/kb/943729 for the link to the Group Policy Preferences Client Side Extensions installer for each OS.

How to modify a Group Policy Preference (Example: Adding a Drive Mapping for a user on a certain group of servers - Without any scripting!!!)
For this portion of the article, I will only give one example for now. I'm hoping that the rest of the interface will be self explanatory after that as each one is very similar.

Once the GPO is edited, click on the + next to User Configuration -> Preferences -> Windows Settings and then click on Drive Maps.
On the right, right click and select New and then Mapped Drive.
In the General Tab:

Select the Action to Replace.
Enter the share you want to map (Example: file://servername/share/folder).
Enable "Reconnect" if you want it to reconnect at each logon.
If you want to change the label of the drive, enter something in the Label As field. (Example: HR Dept Folder)
Select to use the first available drive after a certain drive letter or to hard code a drive letter.
Modify any Connect As strings (if necessary).
Select to Hide/Show this drive or all drives. No change is also an option.

Click on the Common tab at the top.

Select if you want to stop processing items if an error occurs. Not recommended unless troubleshooting.
For drive mappings, you should enable "Run in logged-on user's security context". Otherwise, the item will run as SYSTEM and may not have the necessary capabilities to map the drive. Items like registry changes, files, folders, shortcuts, etc, will be better served by enabling this option.
Select if you want the item to be removed when it no longer applies. Depending on the situation, this option makes sense when you don't want the item to take affect when the filter fails.
"Apply once and do not reapply" is the setting you use to decide if want the policy to apply always (unchecked) or only apply once to let the user modify the setting (checked).
Before going on to it "Item-level targeting", you can enter a description in the large box at the bottom. (Example: Mapped drives for HR Dept when they are from the HR subnet, otherwise don't map it).
If you wish to filter the item, check the "Item-level targeting" box and click the Targeting button.

Click on New Item and select Computer Name.
Now in the bottom pane, enter the computer name you wish to only have this apply on.

You can use Wildcards (*) and Single-Character matches (?). So CITRIX-??-* will match anything starting with CITRIX-, then followed by any 2 characters, then a -, and then any number of characters. So CITRIX-LA-001 will match, but CITRIX-TEX-001 will not match.
Note: At this time, you can do a whole lot more stuff.

You can click on Item Options to change it from a IS to a IS NOT statement. Select "Item Options" and select "IS NOT"
You can add another Item to filter on by clicking on New Item, selecting the item and then entering the criteria in the bottom pane.
Once multiple items have been added, you can click on "Item Options" and change it from an AND (default) to an OR.
You can click on Item Options and select Label to be a bit more descriptive on complex filters.
Also once, multiple items have been added, you can click on the up or down arrows to change the order by which the expression will be checked.
Lastly, you can click on Add Collection, then right click on the "this collection is true" and add additional Targeting items for a parenthetical grouping for complex expressions. In plain English, it is similar to creating ( )'s to force evaluation of a certain section before it goes any further. Just like in Math... you have to evaluate the inner ( )'s first. 2*(1+(2-1)). 2-1 = 1. 1+1 =2. Then 2*2 = 4. So in a logical expression, you can group tests in the same manner. That is a collection.

Click OK twice.
Now test your Group Policy Preferences by logging in a user on a workstation/server where the filter should be true for and then test from one where the filter should fail.

For more exact explanations of all the options within a Group Policy Preference, click on Help or visit Group Policy Preferences Overview by Microsoft.

Once you have the hang of the above, you can do so much more. Just a few examples of what you can now do.

Setup shortcuts with different parameters based on the OU the user exists in.
Setup certain registry settings based on the version of the OS installed and the amount of available RAM.
Map a drive based on the IP Range where the computer is located and the user logging in is within a certain time window.
Setup multiple Data Sources for all computers, but set the applications registry to use a certain data source as default based on the User's Language on their PC.
Setup certain files and registry settings, only when the user is connected via a Terminal Service Session for example.

Hopefully this article has opened your eyes to a great feature that you now have access to with Windows Server 2008 or Vista SP1 (even in a Windows 2003 domain). It is a very powerful feature and is worth it to have one Windows Server 2008 machine or Vista SP1 machine on the network just for this. I'm sure most of my script writing days will be behind me now for common user environment settings and preferences. Hopefully your scripting days will be behind you also as you get more comfortable with this feature and as Microsoft extends the capabilities further to applications, and other capabilities of the OS.

References for this article:
Group Policy Preferences Overview - http://www.microsoft.com/downloads/details.aspx?FamilyID=42e30e3f-6f01-4610-9d6e-f6e0fb7a0790&displaylang=en
Group Policy Preferences Frequently Asked Questions - http://technet2.microsoft.com/windowsserver/en/technologies/featured/gp/preferencesfaq.mspx

Multi-Lingual Support for Citrix XenApp (Presentation Servers)

Al Solorzano — Fri, 11 Apr 2008 16:59:00 GMT

The goal of this blog is to give some multi-language information concering Citrix Web Interface and Citrix XenApp (Presentation Server). Also some findings I had while deploying Office, the desktop and IE for multi-language users.

Hope this helps since I didn't find any articles that covered this in Citrix when I started googling for it.

IME, MUI, and Regional Settings - What are the differences?

Input Method Editor, Multilingual User Interfaces and Regional Settings affect different areas of the Operating System and have been separated so that users have the flexibility desired for the requirements. You will see references to each of these in this document and on other web sites.

Input Method Editor (IME) is the language you wish to type in. So when you open Word or Excel, this is the language you will be typing into that application. You can switch between multiple languages if necessary.
Multilingual User Interface Packs affect the OS and/or Office so that dialogs, menus and help documents are in the correct language.
Regional Settings which consist of Time/Display settings, and Keyboard Layout.

An example of why Microsoft would separate these settings would be, an English-Chinese speaking user who prefers English, but needs date/time formats in Chinese and also needs to edit Chinese Simplified and Chinese Traditional documents.

Citrix Presentation Server Specific Information

Web Interface

Lets start from the top. Citrix Web Interface will grab the language of Internet Explorer -> Tools -> Options. On the General Tab, click on the Language button on the bottom. Check the language preference of IE. If the web site is able to identify the language and can display that language.

Note: When testing this function. Make sure to close IE, and clear the IE cache and cookies before testing a connection to Web Interface.

Keyboard Layouts

Description: Each country will have a standard keyboard layout for all their PCs. Keys for common tasks will be moved.

Microsoft Website to show Keyboard Layout in html
http://www.microsoft.com/globaldev/reference/keyboards.mspx
Location: Regional and Language Options Control Panel -> Language Tab -> Details button.
How is it Set on Citrix Presentation Server: Per user setting. HKEY_CURRENT_USER\Keyboard Layout
Modify:

Automated: The Citrix ICA Client should pass this from the client PC to the server. The Citrix ICA Client will only push the default option selected prior to the session being launched.
Manual: Give the user access to a published application the Regional and Language Options Control Panel to set their settings. Only works if using a Roaming Profile otherwise the change will be lost.

How does it get set:

By default, the default keyboard layout is passed from the client workstation to the server. Only the default is passed to the server. To switch languages, you need to logoff of Citrix, change the setting on the local workstation and then log back in.
If Roaming Profiles are used, additional languages can be added to the users profile via the Regional and Language Control panel, but the default will always attempt to be the default settings on the local workstation.
The Program Neighborhood Client can be set to a different keyboard mapping than the workstation's local keyboard mapping. The Program Neighborhood Client can also be set to use the (Server Default) which always take what the server has as its default. It is in the Tools -> ICA Settings are of the Program Neighborhood Client.
The Citrix ICA Web client always assumes the user is using the (User Profile) setting. This grabs the default Keyboard Layout and uses that in the Citrix Session.
Note: If you see the IME display, make sure it is the IME for the Citrix Session you see since it may be the IME from the local workstation also.
Troubleshooting: If you have multiple keyboard layouts on the workstation, the Citrix Presentation Server will only receive the default layout.
Troubleshooting: If the user is always given the wrong keyboard layout, the user's workstation probably has the full Program Neighborhood Client installed and probably has (Server Default) or a specific language selected in the Tools -> ICA Settings area or multiple keyboard layouts are setup on the local workstation.

Regional Settings

Description: These settings are for common displays such date format, default currency, time format, etc. This will also be the display language for Internet Explorer.
Location: Regional and Language Options Control Panel.
How is it Set on Citrix Presentation Server: Per user setting. HKEY_CURRENT_USER\Control Panel\International
Modify:

Automated: It can be modified via a GPO (Loginconsultants.nl - All in One ADM) or scripted to import individual settings. Both would be based on Group Membership.
Manual: Give the user access to a published application the Regional and Language Options Control Panel to set their settings. Only works if using a Roaming Profile.

Language Settings

Description: These settings are for common displays such date format, default currency, time format, etc.
Location: Regional and Language Options Control Panel.
How is it Set on Citrix Presentation Server: Per user setting. HKEY_CURRENT_USER\Control Panel\International
Modify:

Automated: It can be modified via a GPO (Loginconsultants.nl - All in One ADM) or scripted to import individual settings. Both would be based on Group Membership.
Manual: Give the user access to a published application the Regional and Language Options Control Panel to set their settings. Only works if using a Roaming Profile.

Forcing the Menu and Dialog Language (AKA Using a GPO to Restrict Language)

Reference: http://www.microsoft.com/globaldev/reference/win2k/setup/restrict.mspx

Create a GPO for each language you wish to support.
Create a AD Group for each language you users will be using.
Add the necessary users to each group.
Assign the correct AD Group to the correct GPO.
Enable the "Restrict selection of Windows menus and dialogs language" in the GPO -> User Configuration -> Administrative Templates -> Control Panel -> Regional and Language Options
Select the appropriate language in the Settings tab.
Click OK and close the GPO.
Perform a "GPupdate" on the appropriate servers that the GPO will affect.
Test the GPOs using test accounts in each Language Group.

Web Interface Multi-Language Support

Web Interface supports multiple languages and currently supports English, Spanish, German, French, Japanese and Russion (new with Web Interface 4.6.

The language files are located in C:\Program Files\Citrix\Web Interface\4.6.0\languages. The two most used files are common_strings.properties and metaframe_strings.properties for English. Each language has the same files but has _LANGUAGE-ABBREVIATION in the name of the file.

Additionally, the help content for Web Interface 4.6 can also be modified via the C:\Program Files\Citrix\Web Interface\4.6.0\localizedContent folder and then going into the language you wish to modify.

It is common practice for these files to be modified for specific text appropriate to the client. If the English files have been modified (adding Contact Info, company info, support desk hours, etc), and the client is requiring multiple languages, it is highly recommended that the text be localized for each language and then configured in the correct language file.

Note: In the Access Suite Console for Presentation Server, a client may have modified the Default Language or the Text for the Welcome screen via the Text button. If this is done, then no matter what language is selected the Welcome Text will always be English. It is better to modify the text files and localize the text for each language.

What does the user see

Citrix Web Interface will determine the language based on the language IE is set to use on their local system (see picture below). Open IE, Tools -> Internet Options. In the General tab, click on the Languages button at the bottom.

Once connected, the setting is stored in a cookie for later use. When testing this option, make sure to clear the IE Cache and Cookie Cache on the local workstation before connecting to Web Interface.

Additionally, the user can launch to the URL for Web Interface and then click on the Advanced Options link and then select their appropriate language and click Apply if their language is not determined correctly (See below).

Adding additional languages to Web Interface

http://www.brianmadden.com/content/content.asp?ID=463

Removing Languages for Web Interface

http://support.citrix.com/article/CTX107038&searchID=19907332

LoginConsultants.nl All-in-One ADM (AKA True Control Template)
http://www.loginconsultants.com/index.php?option=com_content&task=view&id=127&Itemid=107

Supporting Multi-Language Display in Windows 2003

Windows 2003 Multilingual User Interface Pack (MUI) must be installed

Reference: http://www.microsoft.com/globaldev/DrIntl/faqs/muifaq.mspx

Windows 2003 Multilingual User Interface Pack (MUI) is purchased as an add-on for Windows 2003 and can be acquired via Open/Select/VLP licensing. These MUIs modify the Start Menu and interface that Explorer is using.

Instructions to install the languages

Launch the MUIsetup.exe
Accept the license agreement.
Select the correct languages and click OK.
The MUISetup.exe will need to be performed for all the CDs to gather all of the necessary languages.
After this has been performed, you can go to the Regional and Language Options control panel, click on the Languages tab and see the new languages you can set. It will require a logoff and then back on to receive the new setting until the GPOs have been applied.

Supporting Multi-Language Display in Office 2003/2007

Office 2003/2007 Multilingual User Interface Pack (MUI) + Service Packs must be installed. If you perform the MUI for Office, Office menus and help information will be the language selected. The languages you select for Office should match the languages installed in the Operating System in the prior section.

Reference: http://office.microsoft.com/en-us/assistance/HA011402101033.aspx

Reference: http://www.microsoft.com/globaldev/DrIntl/faqs/lipfaq.mspx (Made for Office XP, but still mostly valid).

Office 2003/2007 Multilingual User Interface Pack (MUI) is purchased as an add-on for Office 2003/2007 and can be acquired via Open/Select/VLP licensing.

Install Microsoft Office as usual.
After the install, launch the MUIsetup.exe from the MUI CD.
Accept the license agreement.
Select the correct languages and click OK.

Select Complete Install
Perform the above step for all versions.
Then visit http://office.microsoft.com and click on Downloads -> Check for Updates for any hotfixes
This may need to be performed multiple times to get all the updates since each Language has Service Packs and then there are Hotfixes to the Service Packs that must be installed.
After this has been performed, you can go to the Regional and Language Options control panel, click on the Languages tab and select the language.

Office 2007

The same procedures and updates can be followed for Office 2007.

How to Install Office 2007 With a Multilanguage User Interface Pack Into an Application Isolation Environment - http://support.citrix.com/article/CTX112984

Reference Site : Microsoft's Dr. International Site

http://www.microsoft.com/globaldev/DrIntl/default.mspx

Technology Potpourri

Al Solorzano — Mon, 10 Mar 2008 21:24:00 GMT

Article from http://www.frameworkx.com/ - A Really Useful List of Rundll32 commands for Windows.
This is a list of Rundll32 commands, which can be used for directly invoking the specified functions from Start Menu/Run, Citrix Workflow Studio, Scripts, Command prompt or simply to create shortcuts of those, which you use and require frequently.
Article: http://frameworkx.com/blogpost.aspx?id=1&c=1235

Article from http://www.rtfm-ed.co.uk/ -
SVMotion is a VI 2.5 client plugin (the FIRST released, third-party plugin in fact) that extends the client’s functionality by providing an integrated, graphical tool that can be used to invoke storage VMotion (SVMotion) operations. This plugin is not supported by VMware. In fact, the plugin is not anywhere close to supported by VMware because it is the result of a two-week dive into the inner-workings of the VI client libraries with popular reflection tools (reverse-engineering). lost creations is working on a white paper that describes how to build VI plugins.”
Article: http://www.rtfm-ed.co.uk/?p=512
Directlr link - http://www.lostcreations.com/code/wiki/vmware/viplugins/svmotion

Article from http://www.brianmadden.com/
Past years, from Windows NT 4.0 Terminal Server Edition timeframe, there is always a discussion about the benefits Citrix XenApp is adding to the Microsoft Terminal Services platform. This discussion is good!
Besides the difference in features between the several solutions there should (also!) be a discussion about the vendors vision of desktop and application delivery. Citrix released a document which describes the feature differences between Windows Server 2003 TS, Windows Server 2008 and Citrix XenApp.
Article: http://www.brianmadden.com/blog/RubenSpruijt/Citrix-XenApp-on-Windows-Server-2008-A-feature-Analysis
Update: http://www.virtuall.nl/articles/productinformation/CitrixTerminalServicesXenAppFeatureAnalysis.pdf

Fun with YouTube
Running Citrix XenServer on VMware Workstation - http://youtube.com/watch?v=RdedmKWPOKU
Citrix SpeedScreen demo (ICA vs. RDP) - http://youtube.com/watch?v=_RMTM7vaMnI
Citrix Workflow Studio Introduction (not in english)- http://youtube.com/watch?v=5V3MaOjdjcU
VMWare vs Production Server (like Mac vs Pc videos) - http://youtube.com/watch?v=EBsw5y5sDKQ

64-bit Windows or 32-bit Windows? : The Pros and Cons of 64-bit and some of the "gotchas"

Al Solorzano — Mon, 04 Feb 2008 05:16:00 GMT

That is the question. Do you start building all servers as 64-bit (AKA x64) or do you stick with the standard 32-bit servers you have been doing for years? Tough question as there is no right answer for everyone. In this article, I will dissect some of implications of choosing 64-bit over 32-bit. We will also be concentrating on the server platform of the Operating Systems. (Note: while 64-bit desktop Operating Systems exist, the support is horrible. Drivers, Printers, WebCams, etc have to researched thoroughly to verify 64-bit support. Frankly, I have better things to do with my time as it is hard enough finding Vista 32-bit support for my home PCs). Then I will address how 64-bit will affect a Citrix Presentation Server Infrastructure (You read that right... Citrix PRESENTATION SERVER. If you don't get the joke, you need to read more Citrix related blogs). Please note that Citrix Presentation Server must be 4.5 or above to fully support 64-bit. 4.0 for 64-bit is no longer supported.

Overview
One major benefit of x64 will be the ability to address more memory space which has been a limiting factor for some time in server sizing. Of course, this will eventually to the next bottleneck (CPU, disk speed or possibly I/O). Its inevitable. Much like a city or start will add another lane for 25 miles and just cause another "parking lot" (this is what we call freeways in Los Angeles) 25 miles down the road. It may not happen immediately, but it will happen eventually.

Anyway, now that more memory can be addressed, applications that are more memory intensive can now address more memory. This benefits database driven servers (Exchange, SQL, Oracle, etc) and high density Terminal Servers/Citrix Presentation Servers. For clients that wish to scale up (fewer, bigger boxes) rather than out (more, smaller boxes), this is a huge benefit. 64-bit may also benefit application servers, web servers, and more, but not to the same extent it will benefit say a Microsoft SQL Server or Citrix Presentation Server. You can also expect 20%-40% more RAM utilization by applications and users due to how memory is handled in 64-bit (I had a AMD/Microsoft reference on this, but can't find it right now). There are other services where 64-bit makes no difference. What would a 64-bit Domain Controller or DHCP Server or DNS Server really get you? Something to think about. But what is really is driving 64-bit

Also 64-bit supports 32-bit applications via WOW64. This is very similar to how Windows 32-bit Operating Systems can run 16-bit apps via WOW (Windows on Windows). In WOW64, the emulation does come with an overhead (though much less than the original implementations of 64-bit). Due to the overhead of emulating 32-bit applications and services, it is recommended to run 64-bit versions of application (if available) on a 64-bit Operating System. However that is not always the case as we will see later.

A big deal to watch out for is no 16-bit support for applications. A fun little problem that we have run into, is when the application is 32-bit, but the installer is 16-bit. Though Windows 64-bit has some workarounds (See the MSDN Article - Understanding 64-bit Windows Programming) for 16-bit installers, there is no guarantee. To workaround this, we've repackaged the installer or sometimes just copied over regkeys and files/folders to get the application to work. Both are not easy, but it can get the job done.

Lastly, you can expect Windows Server 2008 to be the latest 32-bit and 64-bit release of a Windows Server OS. So you better start getting used to 64-bit.

Technical Brief on Important Differences in 64-bit Windows

You will see there is basically a 32-bit registry (HKLM\Software\Wow6432Node) and a 64-bit registry (HKLM\Software\). There are also different folders for some of the system files and program files (example: 32-bit system files are in C:\windows\syswow64 and 64-bit is in C:\Windows\system32; Program Files in 32-bit is C:\Program Files (x86) and 64-bit is in C:\Program Files\).

Whenever a 32-bit application attempts to access %windir%\System32, the access is redirected to a new directory, %windir%\SysWOW64. The registry redirector intercepts 32-bit registry calls to each logical registry view and maps them to the corresponding physical registry location. The reflection process is transparent to the application. Therefore, a 32-bit application can access registry data as if it were running on 32-bit Windows even if the data is stored in a different location on 64-bit Windows.

32-bit and 64-bit versions of Applications
Common applications like Internet Explorer, the command prompt and the ODBC Control Panel have two different versions (a 32-bit version and a 64-bit version) on the same server. So launching the 32-bit version may return different results than the 64-bit version of the same application. So instead of running "iexplore.exe" you may wish to use the full path to access the 32-bit or the 64-bit version you require. I will discuss this later also.

64-bit Caveats

Support
This is probably the biggest factor in deciding whether you will be going 64-bit or sticking with 32-bit. If you call all your application vendor's support line (and I highly recommend you do before proceeding) and:

Ask if they support a 64-bit Operating System with their application?
Are all products used as pre-requisites also 64-bit capable (Examples: Crystal Reports, Custom Print Tool, etc)
Do they have a supported 64-bit version to run on a 64-bit OS?
If not, when will it be available?
Are any portions of the application or installer 16-bit?
Are there any reference documents or knowledge base articles that can be referenced? (Always good to get this in writing or a referencable format)
If the application has more than 1 tier (Example: the application sits on a web server and accesses a database tier and application tier), what components/tiers are supported on 64-bit support?
How many clients are running 64-bit support? (This helps understand their knowledge of 64-bit and if only 1 client out of 20,000 are running it... maybe you should hold off. Don't want to be the guinea pig.)

You never want to be in a situation where you did something that was not going to be supported when you call in for support. You also want to understand your options for a backup plan. Maybe you can't get 100% of the environment in 64-bit, but maybe the database tier can be.

Application Installation and Runtime
All applications and installers must be 32-bit or 64-bit. While there is some support for 16-bit installers as mentioned earlier, there is no workaround for 16-bit portions of the applications. If the application has some out-dated mail merge function with 16-bit code that gets used once a year but is very critical, you will not be a happy camper. So make sure the installer and the application are fully 32-bit. The only way to guarantee this is to TEST, TEST and then TEST again. No way around it. Seen too many companies tell me, their app is 100% 32-bit... that is until I call them and ask about this one part of the application that doesn't work, but only gets used once a year to generate tax forms or something. The most common answer is "Oh yeah, forgot about that one".

Remember Application Compatibility Flags? Well they might be needed again. Applications may not be expecting 32GB of RAM on a server, so the application may fail to launch. Applications may need to be fooled into thinking the server only has X amount of memory so the application can launch. Here is an example registry file to get a 32 bit app to limit the physical memory the application sees:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\APPNAME]
"Flags"=dword:00000808
"PhysicalMemoryLimit"=dword:64000000

Note: Notice the path is in the WoW6432Node folder since it is a 32 bit application.
See http://support.microsoft.com/kb/186499/EN-US/ for more information on the flags.

Lastly, an important WOW64 limitation is that 32-bit applications cannot load 64-bit DLLs and 64-bit applications cannot load 32-bit DLLs. This can result in Context Menus not functioning for some applications. An example would be how Winzip integrates with the right click to allow for unzips. If you are using the 32-bit Winzip, you won't see the context menu for Winzip. If you are using the 64-bit version, the context menus will appear.
System Components/Drivers
System components like backup agents, monitoring tools, anti-virus, etc that uses device drivers or creates services must be the 64-bit version of that system component. Unlike 32-bit applications that run in WOW64 emulation environment on a 64-bit server, device, kernel or services cannot be run this way. Contact the vendor for these products to determine if they have a 64-bit version that is supported. If they don't your options are to not use 64-bit, not use that product on 64-bit servers, or to switch to another product that has 64-bit support.

This can be a budget buster or time killer depending on how critical the product is to your organization (like Anti-virus on all Servers in the datacenter) or if the vendor states the 64-bit version is an additional cost.
Project Timeline and Risk
If reducing risk and meet a very strict timeline, then 64-bit may not be for you. Any bump or hiccup in the project (like finding out the most critical application uses 16-bit code for reporting) can put some major hurt on the timeline. As you can see there is some time and effort to verify vendor support, test, troubleshoot and test some more. If there is no time for testing or the project needs to be very risk averse (tight budget or compliance/governance requirements), you should probably stick with 32-bit for a majority of the infrastructure. You may be able to put portions of the environment on 64-bit (database server for example), but it would be recommended in this case to stick with 32-bit for most of the servers (especially Citrix Presentation Servers in this case).
Application Compatability (Citrix Presentation Server)
I seperated this out from "runtime and install" because I think it deserves its own section. Common applications (Iexplore.exe, CMD.exe, ODBC Control Panel) have a 64-bit version and a 32-bit version. This is very critical in a Citrix Presentation Server environment as it can affect how applications work, are published or existing scripts.

Internet Explorer (64-bit) does not currently support common plug-ins like some ActiveX controls, Flash or Shockwave. Internet Explorer (32-bit) does still support the applications on the same server. If you publish or use IE in a desktop on a Citrix Presentation Server, you may wish to use the 32-bit version (C:\Program Files (x86)\Internet Explorer\Iexplore.exe) to decrease support calls and eliminate any troubleshooting due to a ActiveX or plug-in requirement.
CMD.exe also has two different versions. Each has its own environment variable. So watch out for any scripts that may be running to set variables and checking to see which CMD.exe is being run. If its running in the wrong environment, your applications may not work.
ODBC Control Panel. This one was fun. So you have a 32-bit application, that wants an ODBC to be manually created. So you create it. Application doesn't work due to a missing ODBC entry. You double check. Its there. App still doesn't run. Check to see which ODBCAD32.exe you are running from. If you are running the 64-bit version (C:\Windows\System32), your 32-bit application won't see it. Make sure to run the ODBCAD32.exe from C:\Windows\SysWoW64
Registry Editor. If a 32-bit application tells you to modify a registry key, make sure to modify HKLM\Software\Wow6432Node - otherwise your 32-bit application won't see the change. HKLM\Software\ changes are for 64-bit applications.
Any call from a 32-bit application that creates reg keys or ODBC entries will be put in the correct 32-bit sections, you should be fine, but understanding this process of WOW64 helps a ton. So does Filemon.exe and Regmon.exe from www.Sysinternals.com. These tools are requried for a Citrix Consultant of any worth.

Citrix Presentation Server Specific Recommendations

If you run Citrix Presentation Server now, you must get to Citrix Presentation Server 4.5 now. 4.0 for 64-bit is no longer supported as it was a different code base than 4.0 for 32-bit, which resulted in different hotfixes and major support issues for Citrix. Now the code bases for 64-bit and 32-bit are the same, and the feature sets are a lot closer than they were in 4.0.
Test. Only way to guarantee a product is 100% 32-bit or 100% 64-bit capable. This may delay the project or slow down the testing phase, but it is better than running into the problem when you are in production.
A recommend risk mitigation strategy will be to also build 32-bit Windows Servers for Citrix Presentation Server. The 32-bit servers can hold any applications that are not 64-bit compatible. Depending on the number of applications and users of the application, they can be Virtual Machines on VMware ESX or Citrix XenServer (or your favorite server virtualization platform).
OR
Approach 64-bit Citrix Presentation Servers as a Phase II of the project. Meaning you build all the servers in 32-bit at first, then build a single 64-bit server to test applications and procedures. Then you can be in production, but still have some testing be performed by a select group of users. If tesing goes smoothly, you can decide to rebuild all servers as 64-bit or add 64-bit servers as the environment expands.
Try to force Universal Print Driver (UPD) for all applications. This simplifies trying to find 64-bit drivers for all of the printers. This will require some testing with applications but would make you life a whole lot easier. This also means getting your clients to the latest version of the ICA Client to ensure the latest features are available.
The User Profile Hive Cleanup Tool 2.0 for 64-bit is in Beta currently. It has been since 2005. Don't know why it isn't public yet, but if you open a Microsoft Support Case with issues pertaining to user profiles not cleaning up at logoff, you should be able to obtain it. The 1.6d that is out does not support 64-bit OSes.
Publish the 32-bit Internet Explorer. Saves headaches and support calls related to sites with plugins and what site doesn't use some sort of plugin for something these days.
Test. Only way to guarantee a product is 100% 32-bit or 100% 64-bit capable. This may delay the project or slow down the testing phase, but it is better than running into the problem when you are in production.
64-bit is supported for most Citrix products. Please read the admin guide for the latest support info on 64-bit.

Citrix Presentation Server 4.5 and above are supported on 64-bit.
The DataStore, Resource Manager Database, and Configuration Logging are supprored on SQL Server 2005 64-bit.
Citrix EdgeSight Agents are supported on 64-bit. (I think Citrix EdgeSight Server for 64-bit is coming soon).
Password Manager Agents are supported on 64-bit.
Web Interface 4.5 is supported on 64-bit, however it will may break other web sites that are 64-bit on the same server so procedure with caution (and a good backup).

To enable IIS 6.0 to run 32-bit applications on 64-bit Windows
1. Open a command prompt and navigate to the %systemdrive%\Inetpub\AdminScripts directory.
2. Type the following command:
cscript.exe adsutil.vbs set W3SVC/AppPools/Enable32BitAppOnWin64 “true”
3. Press ENTER.

To enable IIS 6.0 to run 64-bit applications on 64-bit Windows
1. Open a command prompt and navigate to the %systemdrive%\Inetpub\AdminScripts directory.
2. cscript c:\inetpub\adminscripts\adsutil.vbs SET /w3svc/AppPools/Enable32BitAppOnWin64 False
3. Press ENTER.

In Summary

There is no right answer for everyone and each person/organization must weigh the pros and cons of 64-bit. The days of 64-bit only Operating Systems is fast approaching and we won't have a choice very soon. I'd recommend at least getting your feet wet and to start building your server infrastructure for the backend (SQL, Oracle, Exchange, etc) as 64-bit. Or add 1 64-bit Citrix Presentation Server to the mix to start testing your build documents/procedures and to test application with a small subset of users. If you are prepared (doing the steps above) and with a little training (or troubleshooting), you can go fully 64-bit and start reaping the benefits of increased memory capacity and higher density of services.

Here are some articles on 64-bit that I have referenced or read in the writing of the article:
List of limitations in 64-Bit Windows - http://support.microsoft.com/kb/282423
Understanding 64-bit Windows Programming - http://msdn.microsoft.com/library/default.asp?url=/library/en-us/win64/win64/running_32_bit_applications.asp

Baseline Configuration, Auditing and Remediation Reports for Citrix Presentation Server

Al Solorzano — Fri, 11 Jan 2008 18:30:00 GMT

The alternate title was going to be "Citrix Presentation Server (CPS) Configuration Pack for Microsoft System Center Configuration Manager (SCCM) 2007 Desired Configuration Management (DCM) 2.0" but that was way to long. Saw this blurb on Doug Brown's site and I thought this was very interesting but not getting much play. Citrix has recently released a Configuration Pack that integrates with Systems Center (in particular the Desired Configuration Management module) to create a baseline configuration, then run audit reports against servers. Then you get a compliance report and in the same report get remediation steps to get back into compliance. I haven't messed around with this yet (I have been playing with SCOM but not SCCM), but this looks very promising for large organizations with large Citrix Presentation Server Farms.

VMware Sidebar - I know there are companies that are looking to provide SCOM and SCCM integration for VMware Virtual Infrastructure (ESX and VirtualCenter), but VMware needs to stepup here. Citrix has tried to let "3rd parties" add value for years and there is usually a lot of bad products or it takes years to develop something from scratch what Citrix could have done in months. Don't let this happen. Keep developing plugins for the most common management and configuration tools. I know Microsoft is a "competitor", but develop some plugins for SCOM and SCCM. A lot of companies are standardizing on it.

Excerpt from PDF available from download (along with the .MOF files) http://support.citrix.com/article/ctx115268

The Citrix Presentation Server (CPS) Configuration Pack is a tool which you can use to evaluate each Presentation Server’s configuration against predefined security and best practice guidelines. The Configuration Pack is designed to be used in conjunction with the Microsoft System Center Configuration Manager (SCCM) 2007 Desired Configuration Management (DCM) 2.0 module.
The DCM 2.0 module automates configuration management audits. DCM accomplishes this by allowing the user or Independent Software Vendors (ISVs) to define desired hardware, operating system, and application configuration settings in multiple configuration data sources. Then, using the supplied auditing engine, DCM compares desired settings with actual settings and reports on configuration compliance. The DCM reports contain detailed information about which Presentation Servers are out of compliance and how to correct each configuration setting. Using this information, Citrix administrators can rectify the configuration issues on each reported Presentation Server, thus bringing the entire CPS farm back into compliance with Citrix Best Practices.

Excerpt from http://technet.microsoft.com/en-us/library/bb680553.aspx

Desired configuration management in Configuration Manager 2007 allows you to assess the compliance of computers with regard to a number of configurations, such as whether the correct Microsoft Windows operating system versions are installed and configured appropriately, whether all required applications are installed and configured correctly, whether optional applications are configured appropriately, and whether prohibited applications are installed. Additionally, you can check for compliance with software updates and security settings.

Compliance is evaluated by defining a configuration baseline that contains the configuration items you want to monitor and rules that define the compliance that you require. This configuration data can be imported from the Web in Microsoft System Center Configuration Manager 2007 Configuration Packs as best practices defined by Microsoft and other vendors, or defined within Configuration Manager, or defined externally and then imported into Configuration Manager.

Slow Connections to Citrix from Vista

Al Solorzano — Wed, 09 Jan 2008 23:25:00 GMT

So I've been running Vista from 1 laptop for 1 year and a desktop for the last 4 months or so. I mostly use the desktop for work related stuff. One day I needed to work form the laptop about 6 months, and all of my Citrix connections were slow. I'd open Outlook and I could see it paint the toolbars, the e-mail pane view would come 1 line at a time. I tried tweaking a few things on the laptop. Tried updating and tweaking the Citrix Presentation Server 4.0 servers. Nothing. Still slow. I googled all over the place (or so I thought) and found similar complaints but no solutions. I just gave up and went back to my Win XP box (what my desktop was at the time).

Fast forward a few months, and I'm forced to replace my Win XP with a new workstation running Vista. Same exact slowness. But now I notice that it depends on what environment I'm connecting to. All of my clients environments (Mix of Citrix Access Gateway (CAG), Secure Gateway (CSG), Altaddr, IPsec VPN, SSL VPN etc) work just fine. Just not our companies Citrix infrastructure. So I build a new CSG and a new PS 4.5 server. Same slowness. Now I'm banging my head against the wall.

I call Citrix and give them the facts above. The answer was to try and perform a direct ICA via VPN or Altaddr to eliminate CSG. Well I don't have control of the firewall and I know it will take awhile to get done. I get real busy. My wife has our 3rd kid. And I just forget about it. Until now...

So I start googling again. Then I finally hit the right search words "RDP slow vista". I tried "terminal server slow vista", "citrix slow vista", "citrix performance vista", and tons more. But never tired RDP (AKA Remote Display Protocol). (PS hopefuly that teaches people writing articles to put acronyms, full spellings, and nicknames for technologies so that they can indexed/searched with as many common terms as possible).

Anyway not to make this story any longer, I finally ran into this command that has saved me from the pits of slowness hell.

netsh interface tcp set global autotuninglevel=disabled

It must be run from the command line as an Administrator and may require you to Allow its execution (thanks to User Account Control feature of Vista). It should return OK if it completes correctly.

Props to Tom Keating @ http://blog.tmcnet.com/blog/tom-keating/microsoft/remote-desktop-slow-problem-solved.asp for getting it solved. Don't know what AutoTuning really enables for most home users, but I haven't noticed any illl effects otherwise. Some more googles on that command have shown slowness with Outlook 2007, File Transfer, and more. Hopefully this saves people some time.

VMware ESX 3.5 / VC 2.5 Lessons Learned

Al Solorzano — Tue, 08 Jan 2008 16:59:00 GMT

I recently setup ESX 3.5 and VC 2.5 for a client and I had some good lessons learned that I wanted to share.

RTFM Education's VI 3.5 - What Different Guide (This group has quickly become my favorite group of people - Great work!)
http://www.rtfm-ed.eu/docs/vmwdocs/Appendix_C_What's_New_and_Different_in_Vi3-5.pdf

ESX and VC

Storage VMotion is only via the Remote CLI. Eventually will be in the Windows GUI for VC and the VIC, but not yet.
Distributed Power Management – Experimental mode – Using DRS and Vmotion, move VMs to the least number of ESX Hosts needed (with some room), and then put any ESX Hosts into a Standby mode. The ESX Host can be returned from standby mode when needed. Might take upwards of a few minutes to come out of this mode. Must be tested for each piece of hardware.
VCB can now support iSCSI officially.
DRS Recommendation Tab for the Cluster
Installing VMware tools in batch mode for multiple machines.
VC comes with a Eval License option already built-in during the install.
Set NTP and Time Configuration via VC GUI rather then service console.
New web-based Datastore (VMFS Partition) brower
VMs

64 GB of Memory
Guest Customization for 64 bit OSes.
Back to vmdk file only.

Update Manager

This is licensed from Shavlik. It only downloads the updates that it determines are needed after scanning you machines (no need to download SP1 if all your machines are on SP2).

http://vmware.com/support/vi3/doc/vi3_vum_10_sizing_estimator.xls - Calculator to determine the size of the Update Manager database (biggest impact is # of hosts and # of VMs) and the estimated size of the partition you will need to store all the updates (biggest factor is # of OSes X # of Locales X # of Editions X # of Service Pack levels).
Update Manager baselines are all the possible updates that can be needed for the ESX Host, the VM OS or the VM applications. These baselines can be custom built by administrators or by using the defaults listed here:

Critical ESX Host
Non-Critical ESX Host
Critical VM - these contain windows, linux and application updates.
Non-Critical VM - these contain windows, linux and application updates.

First you scan a VM, a host, a folder, a cluster or a data center, then you remediate a VM, a host, a folder, a cluster or a data center.

Be careful in how you assign baselines and perform remediation against a folder, cluster or data center since it will perform remediation against all servers under folder, cluster or data center,.

Be careful, performing a remediation against Update Manager. Mine kinda hung.
If you reboot Update Manager server or restarts its services, you will need to relaunch and possibly re-enable Update Manager in the plugins menu.
Same goes for if restart the Virtual Center Services. May need to re-enable UM via the plugins menu.

Be careful when r the objects you were remiediating to identify the patch or KB article that it failed on. Then visit <selected Path>\VMware\VMware Update Manager\Data folder to look for the patch or KB Article (may require a google to match KB to patch). Then test the patch as it may be corrupted. You can simply replace it by downloading it from the correct site and overwriting the same file. No need to restart anything. Then attempt another Remediation of a server.

You can Scan and Remediate a Template which is pretty cool. Scanning changes nothing. Remediation will automatically convert to a VM, boot the server with no networking, perform the updates, shutdown the VM, and convert back to a template.

If you want to put VMware Update Manager on a separate server, you will not select Update Manager during the install of VirtualCenter. Then on the 2^nd server, install VC Client & Update Manager, configure Update Manager and point it to the VC Server. Then from all VMware Infrastructure Clients that will use Update Manager from Virtual Center, you will need to click on Plugins to install the Update Manager plugin, relaunch VIC, and then enable Update Manager from the plugins -> Installed tab.

Consolidation

Worked on some machines and not on others, but unknown why.
Some Remote Perfmon tests worked and some did not.
So this one may be buggy.
Only do 1 conversion at any given time.

VMware Converter

Integrated into Virtual Center. (don’t know if it was this way in VI 2.0 because I really don’t use Converter that often)
VM to VM Migration across datacenters
Cold migrations across datacenters.

Storage VMotion

Only available via Remote CLI
Download via vmware web site.