App protection
App protection is an add-on feature for the Citrix Workspace app that provides enhanced security when using Citrix Virtual Apps and Desktops published resources.
Two policies provide anti-keylogging and anti-screen-capturing capabilities for a Citrix HDX session. The policies along with a minimum of Citrix Workspace app 1912 for Windows, Citrix Workspace app 2001 for Mac, or Citrix Workspace app 2108 for Linux can help protect data from keyloggers and screen scrapers.
Anti-keylogging when enabled:
- A keylogger sees encrypted keystrokes.
- This feature is active only when a protected window is in focus.
Anti-screen-capturing when enabled:
- Screen capture is a blank screen on Windows OS and Linux OS. On macOS, only the content of the protected window is blank.
- For Windows OS and macOS, this feature is active when a protected window is visible (not minimized). For Linux OS, the feature is active both when a protected window is minimized or maximized.
You configure the policies through PowerShell only. There is no GUI administration capability. This configuration is required only to enable or disable functionality for a specific delivery group.
After purchasing this feature, ensure you enable the app protection license.
Disclaimer:
App protection policies work by filtering access to required functions of the underlying operating system (specific API calls required to capture screens or keyboard presses). Doing so means that app protection policies can provide protection even against custom and purpose-built hacker tools. However, as operating systems evolve, new ways of capturing screens and logging keys can emerge. While we continue to identify and address them, we cannot guarantee full protection in specific configurations and deployments.
Citrix App protection policies work effectively with underlying operating system components, including ICA files. Citrix would not be able to provide support if intentional tampering or modification of the underlying components is detected, so as to provide the integrity of policies applied.
Limitations
These limitations exist by design:
- No anti-keylogging support inside HDX or RDP sessions. Endpoint protection is still active. This limitation applies to double-hop scenarios only.
- No feature support when using an unsupported version of the Citrix Workspace app or Citrix Receiver. In that case, resources are hidden.
- App protection is supported for on-premises Citrix Virtual Apps and Desktops deployments, and Citrix Virtual Apps and Desktops Service with StoreFront and Workspace.
- No feature support for StoreFront web stores.
- App protection add-on feature for the Citrix Workspace app prevents outgoing screen sharing.
- App protection may prevent outgoing and incoming screen sharing with collaboration apps or features that have optimization enabled.
- Applications with app protection policies are not enumerated in the Connection Leases, hence Service Continuity does not display the app/desktop icons in Citrix Workspace app when in outage/offline mode.
Expected behavior
The expected behaviors depend on how you access the StoreFront store that contains protected resources. You can access the resources using a supported native Citrix Workspace app client.
- Behavior on StoreWeb - Applications with app protection policies are not enumerated on StoreFront web stores.
- Behavior on unsupported Citrix Receivers or Citrix Workspace apps - Applications with app protection policies are not enumerated.
- Behavior on supported Citrix Workspace app versions - Protected resources enumerate and start properly.
Protection is applied under the following conditions:
- Anti screen capture – For Windows and Mac, it is enabled if any protected window is visible on the screen. To disable protection, minimize all protected windows. For Linux, it is enabled if any protected window is active. To disable protection, close all protected windows.
- Anti-keylogging – enabled if a protected window is in focus. To disable protection, change focus to another window.
What does app protection protect?
To capture the screenshot of any non-Citrix Workspace app window, users must first minimize the protected window. For Linux, users must close all protected windows.
By default, app protection protects the following Citrix windows:
-
Citrix logon windows - Citrix Workspace authentication dialogs are protected only on Windows operating systems. For Linux, you must configure the app protection feature in the
AuthManConfig.xmlfile to enable it for authentication manager.
- Citrix Workspace app HDX session windows (example, managed desktop)
-
Self-Service (Store) windows - Citrix Workspace Self-Service windows are protected only on Windows operating systems. For Linux, you must configure the app protection feature in the
AuthManConfig.xmlfile to enable it for Self-Service windows.
What doesn’t app protection protect?
The items under the Citrix Workspace apps icon in the navigation bar:
- Connections Center
- All links under Advanced Preferences
- Personalize
- Check for Updates
- Sign Out
System requirements
Minimum versions of Citrix components
- Citrix Workspace app 2108 for Linux
- Citrix Workspace app 1912 for Windows Long Term Service Release
- Citrix Workspace app 2002 for Windows
- Citrix Workspace app 2001 for Mac
- StoreFront 1912
- Delivery Controller 1912
- Valid Citrix licenses
- App protection add-on license
- A licence valid for Citrix Virtual App and Desktops 1912 or later
Operating system platforms
App protection policies runtime is installed on the endpoint you are connecting from and not on the VDA you are connecting to. Therefore, only the operating system version of endpoint is significant. (App protection can connect to VDAs hosted on any supported operating systems described in Citrix Virtual Apps and Desktops System requirements.)
The App protection feature is supported on endpoints running the following operating systems:
- Windows 10
- Windows 8.1
- Windows 7
- macOS High Sierra (10.13) and higher
- 64-bit Ubuntu 18.04+
- 64-bit Debian 9+
- 64-bit CentOS7.5+
- 64-bit RHEL7.5+
- ARMHF 32-bit Raspbian 10 (Buster)+
Note:
For app protection, Citrix Workspace app for Linux requires Gnome Display Manager along with the supported operating systems.
Configure
Follow these steps to fully configure and enable the app protection feature:
- Import the app protection license†.
- Configure the Workspace app.
- Enable the app protection policies on the Delivery Controllers†.
† In a Citrix Virtual Apps and Desktops service environment, these configuration steps differ slightly. See the notes in these sections.
1. Licensing
Note:
In a Citrix Virtual Apps and Desktops service environment ignore this step because there are no licenses to install. The app protection feature is included as a part of certain Citrix Cloud service packages and licenses are provided directly on Citrix Cloud.
App protection requires that you install an add-on license on the Citrix License Server. A licence valid for Citrix Virtual App and Desktops 1912 or later must also be present. Contact a Citrix Sales Representative to purchase the app protection add-on license.
- Download the license file and import it into the Citrix License Server alongside an existing Citrix Virtual Desktops license.
- Use the Citrix Licensing Manager to import the license file (preferred method) or copy the license file to
C:\Program Files (x86)\Citrix\Licensing\MyFileson the License Server and restart the Citrix Licensing service. For more information, see Install licenses.
2. Citrix Workspace app
Configure app protection on the Citrix Workspace app.
Citrix Workspace app for Windows
You can include the app protection component with the Citrix Workspace app using the following methods:
- During Citrix Workspace app installation.
- Using the command-line interface after the Citrix Workspace app installation.
Ensure the Citrix Workspace app was installed with the /includeappprotection switch enabled.
For more information, see App protection.
Citrix Workspace app for Mac
App protection requires no specific configuration on the Citrix Workspace app for Mac.
Citrix Workspace app for Linux
App protection is supported when Citrix Workspace app for Linux is installed by using the tarball, Debian, and Red Hat Package Manager (RPM) packages. The supported architectures are x64 and ARMHF.
For more information, see App protection.
3. Delivery Groups
Note:
In a Citrix Virtual Apps and Desktops service environment, use the cmdlets in the Citrix Virtual Apps and Desktops Remote PowerShell SDK on any machine (apart from Citrix Cloud Connector machines) to issue the commands in this section.
Enable the following properties for the app protection Delivery Group using the Citrix Virtual Apps and Desktops SDK on any installed Delivery Controller machine or on a machine with a stand-alone Studio installed that has the FMA PowerShell snap-ins installed.
- AppProtectionKeyLoggingRequired: True
- AppProtectionScreenCaptureRequired: True
You can enable each of these policies individually per Delivery Group. For example, you can configure keylogging protection only for DG1, and screen capture protection only for DG2. You can enable both policies for DG3.
Example
To enable both policies for a Delivery Group named DG3, run the following command on any Delivery Controller in the site:
Set-BrokerDesktopGroup -Name DG3 -AppProtectionKeyLoggingRequired $true -AppProtectionScreenCaptureRequired $true
To validate the settings, run this cmdlet:
Get-BrokerDesktopGroup -Property Name, AppProtectionKeyLoggingRequired, AppProtectionScreenCaptureRequired | Format-Table -AutoSize
In addition, enable XML trust:
Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true
Ensure that you secure the network between the StoreFront and the Broker. For more information, see Knowledge Center articles CTX236929 and Securing the XenApp and XenDesktop XML Service.
Recommendation
App protection policies are primarily focused on enhancing the security and protection of an endpoint. Review all other security recommendations and policies for your environment. You can use a Security and Control policy template for a recommended configuration in environments with low tolerance to risk. For more information, see Policy templates.
Contextual App protection
Contextual App protection provides the granular flexibility to apply the App protection policies conditionally for a subset of users - based on users, their device, and the network posture. For more information, see Contextual app protection.
Troubleshoot
Applications are not enumerating or not starting:
- Confirm the affected user is using a supported version of the Citrix Workspace app.
- Ensure the Delivery Group has the proper features enabled.
App protection policies are not applying properly:
- Ensure the Delivery Group has the proper features enabled.
- Ensure the feature is installed on the endpoint.
- Ensure the affected user is using a supported Citrix Workspace app version.
- Ensure the Citrix Workspace app was installed with the /includeappprotection switch enabled.
Screenshots not working on non-Citrix windows:
- Minimize or close the protected Citrix windows, including Citrix Workspace App.