Product Documentation

Determining Which Policies Apply to a Connection

Apr 28, 2015

Sometimes a connection does not respond as expected because multiple policies apply. If a higher priority policy also applies to a connection, it can override the settings you configure in the original policy. You can determine how final policy settings are merged for a connection by calculating the Resultant Set of Policy.

You can calculate the Resultant Set of Policy in the following ways:
  • Use the Citrix Policy Modeling Wizard to simulate a connection scenario and discern how Citrix policies might be applied
  • Use Group Policy Results to produce a report describing the Citrix policies in effect for a given user and server.

You can launch both tools from the Group Policy Management console in Windows. If your XenApp environment does not include Active Directory, you can launch the Citrix Group Policy Modeling Wizard from the Actions pane of the Delivery Services Console.

Using the Citrix Policy Modeling Wizard

With the Citrix Group Policy Modeling Wizard, you can specify conditions for a connection scenario such as domain controller, users, Citrix policy filter evidence values, and simulated environment settings such as slow network connection. The report that the wizard produces lists the Citrix policies that would likely take effect in the scenario.

If you are logged on to the server as a domain user and your environment includes Active Directory, the wizard calculates the resultant set of policy by including settings from Active Directory Group Policy Objects (GPOs). If you run the wizard from the Delivery Services Console, the farm GPO residing on the server is included in this calculation as well. However, if you are logged on to the server as a local user and run the wizard from the Delivery Services Console, the wizard calculates the Resultant Set of Policy using only the farm GPO.

Using Group Policy Results

The Group Policy Results tool helps you evaluate the current state of GPOs in your environment and generates a report that describes how these objects, including Citrix policies, are currently being applied to a particular user and server.

To simulate connection scenarios with Citrix policies

  1. Depending on your XenApp environment, open the Citrix Group Policy Modeling Wizard:
    • From the Delivery Services Console, click the Policies node in the console tree and then click Run the modeling wizard from the Actions pane.
    • From the Group Policy Management console, right-click the Citrix Group Policy Modeling node in the console tree and then select Citrix Group Policy Modeling Wizard.
  2. Follow the wizard to select the domain controller, users, computers, environment settings, and Citrix filter criteria you want to use in the simulation.

When you click Finish, the wizard produces a report of the modeling results. In the Delivery Services Console, the report appears as a node in the console tree, underneath the Policies node. The Modeling Results tab in the middle pane displays the report, grouping effective Citrix policy settings under User Configuration and Computer Configuration headings.

Troubleshooting Policies With No Configured Settings

Because settings configured in some policies can conflict with settings configured in others and policies can have multiple filters, a policy may not behave as expected or it may not run at all. Users, IP addresses, and other filtered objects can have more than one policy that applies to them simultaneously. In this case, XenApp merges these policies’ settings to effectively form a new policy resulting from the existing ones. This combination of settings is known as the resultant policy. When there are multiple policies that can apply to a session, it is the resultant policy that XenApp enforces.

When you run the Citrix Group Policy Modeling Wizard or the Group Policy Results tool, you might create a resultant policy that has no configured settings. When this happens, users connecting to their applications under conditions that match the policy evaluation criteria are not affected by any policy rules. This occurs when:
  • No policies have filters that match the policy evaluation criteria
  • Policies that match the filter do not have any settings configured
  • Policies that match the filter are disabled
If you want to apply policy settings to the connections that meet the specified criteria:
  • Make sure the policies that you want to apply to those connections are enabled
  • Make sure the policies that you want to apply have the appropriate settings configured