Virtual channel allow list policy settings
The Virtual channel allow list policy setting enables the use of an allow list that specifies which virtual channels are allowed to be opened in an ICA session.
When disabled, all virtual channels are allowed.
When enabled, only Citrix virtual channels are allowed.
To use custom or third-party virtual channels, add the virtual channels to the list. To add a virtual channel to the list:
- Enter the virtual channel name followed by a comma.
- Enter the path to the process that accesses the virtual channel.
More executable paths can be listed, and the paths are separated by commas.
For example,
CTXCVC1,C:\VC1\vchost.exe
CTXCVC2,C:\VC2\vchost.exe,C:\Program Files\Third Party\vcaccess.exe
Starting with Citrix Virtual Apps and Desktops 7 2109, virtual channel allow lists are enabled by default. For more information on adding virtual channels to the allow list, see Adding virtual channels to the allow list
If you’re using the HDX RealTime Optimization Pack for Skype for Business, add the virtual channel to the allow list. For more information, see the HDX RealTime Optimization Pack documentation.
Important:
The VDA machines must be rebooted for the setting to take effect.
For more information about virtual channels, see ICA virtual channels.
Virtual channel allow list logging
You can use this policy setting to configure the level for Virtual Channel Allow List logging.
The following options are available:
| Options | Description |
| Disabled | Disables all log events. |
| Log warnings only | Events are logged only for custom Virtual Channels that try to open and that are not part of the allow list. |
| Log all events | All events are logged |
Virtual channel allow list log throttling
You can use this policy setting to configure the frequency for logging events for an active session.
All events for each virtual channel will be logged on their first occurrence. Repeated events will be suppressed for the duration of the throttling period while the session is active. If a session is disconnected, the throttling period is reset.
Virtual channel allow list for DVC
Enables the use of an allow list that specifies which dynamic virtual channels are allowed to be opened in an ICA session.
When disabled, all dynamic virtual channels are allowed.
When enabled, no dynamic virtual channels are allowed. To use dynamic virtual channels (DVC) with this feature, the DVCs must be added to the list. To add a DVC to the list, enter the path to the process that accesses the DVC in the session host followed by a comma, then the client-side plugin name followed by a comma and the name of the listener used by the plugin. Multiple listener names can be added separated by commas.
You may use a wildcard to allow all the listeners supported by the plugin.
You may also use a wildcard to replace a single directory name in the process path, part of a directory name in the process path, replace the executable’s name, or replace part of the executable’s name.
Changes to this setting will only apply after restarting the session host.
Example:
Client-side plugins: DvcPlugin1.dll, DvcPlugin2.dll, DvcPlugin3.dll
Allow list entry:
C:\Program Files\App\run1.2.exe,DvcPlugin1,ListenerName1
C:\Program Files\*\run*.exe,DvcPlugin2,ListenerName1,ListenerName2
C:\Program Files\App\run1.2.exe,DvcPlugin3,*