Product documentation
Citrix Workspace app
View PDF

Configure App Protection

March 18, 2024
Contributed by: 
K S

App Protection provides enhanced security when you use the Citrix Workspace app. The feature restricts the ability of clients to be compromised with keylogging and screen-capturing malware. App Protection prevents exfiltration of confidential information, such as user credentials and sensitive information displayed on the screen. The feature prevents users and attackers from taking screenshots and from using keyloggers to glean and exploit sensitive information.

This article explains how to configure App Protection on Citrix Workspace app on different platforms.

App Protection is available on Citrix Workspace app for the following platforms:

Disclaimer

App Protection policies filter the access to required functions of the underlying operating system. Specific API calls are required to capture screen or keyboard presses. App Protection policies provide protection even against custom and purpose-built hacker tools. However, as operating systems evolve, new ways of capturing screens and logging keys might emerge. While we continue to identify and address them, we can’t guarantee full protection in specific configurations and deployments.

Citrix Workspace app for Windows

Prerequisites

  • Citrix Virtual Apps and Desktops Version 1912 LTSR or later.
  • StoreFront version 1912 LTSR or Workspace.
  • Citrix Workspace app version 2203.1 LTSR or later.
  • A valid App Protection license

  • Starting from Citrix Workspace app version 2212, the App Protection component is installed by default during the Citrix Workspace app installation.

    The Enable App Protection checkbox that appears during the installation is replaced with Start App Protection after installation.

    • For Citrix Workspace app versions before 2311:

      Start App Protection after installation - Citrix Workspace app versions before 2311

    • From Citrix Workspace app version 2311 onwards:

      Start App Protection after installation - Citrix Workspace app version 2311 onwards

    When you select this checkbox, App Protection starts immediately after the installation.

    Note:

    If you don’t enable this checkbox, App Protection automatically starts upon the first start of a protected resource or component for customers who are entitled to App Protection.

Configure

Configure the following App Protection features for Citrix Workspace app for Windows:

Limitations

  • This feature is supported only on desktop operating systems such as Windows 11 and Windows 10.
  • Starting with Version 2006.1, Citrix Workspace app isn’t supported on Windows 7. So, App Protection doesn’t work on Windows 7. For more information, see Deprecation.
  • This feature isn’t supported over Remote Desktop Protocol (RDP).

Command-line interface

You can start the App Protection component using the /startappprotection command line parameter. However, the previous /includeappprotection switch is deprecated.

The following table provides information on screens protected depending on deployment:

App Protection deployment Screens protected Screens not protected
Included in Citrix Workspace app Self-service plug-in and Authentication manager / User credentials dialog Connection Center, Devices, Citrix Workspace app error messages, Auto client reconnect, Add account
Configured on the Controller ICA session screen (both apps and desktops) Connection Center, Devices, Citrix Workspace app error messages, Auto client reconnect, Add account

When you’re taking a screenshot, only the protected window is blacked out. You can take a screenshot of the area outside the protected window. However, if you’re using the PrtScr key to capture a screenshot on a Windows 10 device, you must minimize the protected window.

Previously, anti-screen capture and anti-keylogging capabilities were enforced by default for Citrix authentication and Citrix Workspace app screens. However, starting from 2212, these capabilities are disabled by default and need to be configured using the Group Policy Object.

Note:

This GPO policy isn’t applicable for ICA and SaaS sessions. The ICA and SaaS sessions continue to be controlled using the Delivery Controller and Citrix Secure Private Access.

App Protection enhancement:

From Citrix Workspace app for Windows 2305 and later, anti-keylogging is enabled on the authentication and self-service plug-in screens if one of the following criteria is met:

  • You have enabled App Protection using one of the following:
    • Select the Start App Protection checkbox during installation.
    • Start the App Protection component using the /startappprotection command line parameter.
  • If you haven’t selected the Start App Protection checkbox or used the /startappprotection command line parameter during the installation, then the anti-keylogging protection is enabled after launching the first protected resource.

Note:

The Global App Configuration service and Group policy objects settings override the preceding behavior. For example, if you’ve disabled the GACS or GPO policy for these screens, then the anti-keylogging isn’t enabled on the authentication and SSP screens.

Citrix Workspace app for Linux

Starting with version 2108, the App Protection feature is now fully functional. This feature supports the Virtual Apps and Desktops, and is enabled by default. However, you must configure the App Protection feature in the AuthManConfig.xml file to enable it for the authentication manager and the self-service plug-in interfaces.

Prerequisite

App Protection works best with the following operating systems along with the Gnome Display Manager:

  • 64-bit Ubuntu 22.04, Ubuntu 20.04, and Ubuntu 18.04
  • 64-bit Debian 10 and Debian 9
  • 64-bit CentOS 7
  • 64-bit RHEL 7
  • ARMHF 32-bit Raspberry Pi OS (Based on Debian 10 (buster))
  • ARM64 Raspberry Pi OS (Based on Debian 11 (bullseye))

Note:

If you’re using Citrix Workspace app earlier than version 2204, the App Protection feature does not support the operating systems that use glibc 2.34 or later.

If you install the Citrix Workspace app with App Protection feature enabled on the OS that uses glibc 2.34 or later, the OS boot might fail on restarting the system. To recover from the OS boot failure, do one of the following:

  • Reinstall the OS.
  • Go to Recovery mode of the OS and uninstall the Citrix Workspace app using the terminal.
  • Boot through the live OS and remove the rm -rf /etc/ld.so.preload file from the existing OS.

Installing the App Protection component

  1. When you install the Citrix Workspace app using the tarball package, the following message appears: Do you want to install the App Protection component? Warning: You can’t disable this feature. To disable it, you must uninstall Citrix Workspace app. For more information, contact your system administrator. [default $INSTALLER_N]:

  2. Enter Y to install the App Protection component. App Protection isn’t installed by default.

  3. Restart your machine for the changes to reflect. App Protection works as expected only after you restart your machine.

Installing the App Protection component on RPM packages

Starting with Version 2104, App Protection is supported on the RPM version of Citrix Workspace app.

To install App Protection, do the following:

  1. Install Citrix Workspace app.
  2. Install the App Protection ctxappprotection<version>.rpm package from the Citrix Workspace app installer.
  3. Restart the system for the changes to reflect.

Installing the App Protection component on Debian packages

Starting with Version 2101, App Protection is supported on the Debian version of Citrix Workspace app.

To install the App Protection component, run the following command from the terminal before installing Citrix Workspace app:

export DEBIAN_FRONTEND="noninteractive"
sudo debconf-set-selections <<< "icaclient app_protection/install_app_protection select yes"

sudo debconf-show icaclient
* app_protection/install_app_protection: yes

sudo apt install -f ./icaclient_<version>._amd64.deb
<!--NeedCopy-->

Starting with Version 2106, Citrix Workspace app introduces an option to configure the anti-keylogging and anti-screen capturing functionalities separately for both the authentication manager and self-service plug-in interfaces.

Configure

Configure the following App Protection features for Citrix Workspace app for Linux:

Citrix Workspace app for Mac

Configure the following App Protection features for Citrix Workspace app for Mac:

Recommendation

App Protection policies are primarily focused on enhancing the security and protection of an endpoint. Review all other security recommendations and policies for your environment. You can use a Security and Control policy template for a recommended configuration in environments with low tolerance to risk. For more information, see Policy templates.

Configure App Protection
March 18, 2024
Contributed by: 
K S
March 18, 2024
Contributed by: 
K S

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.