Product Documentation

Customize

May 06, 2015

After completing the initial setup tasks, you can customize and optimize your VM hosted apps deployment:

  • Create additional administrators for the site, if necessary. See "Delegating Administration Tasks" in the XenDesktop 5 product documentation in the Citrix eDocs Archive. XenDesktop full administrators and assignment administrators can create and edit VM-hosted applications.
  • Set up any general Citrix policies that you require, including policies for printing. See "Working with XenDesktop Policies" in the XenDesktop 5 product documentation in the Citrix eDocs Archive for details of configuring policies.
  • Configure USB support.
  • Configure HDX technologies to optimize users' audio and multimedia experience. See "Enhancing the User Experience With HDX" in the XenDesktop 5 product documentation in the Citrix eDocs Archive.
  • Configure time zone settings to allow users to see their local time when using applications that display a time of day. See "Configuring Time Zone Settings" in the XenDesktop 5 product documentation in the Citrix eDocs Archive.
  • Configure connection timers to provide appropriate durations for uninterrupted connections, idle sessions, and disconnected sessions. See "Configuring Connection Timers" in the XenDesktop 5 product documentation in the Citrix eDocs Archive.
  • Configure workspace control to enable users to roam between different user devices. See "Workspace Control in XenDesktop" in the XenDesktop 5 product documentation in the Citrix eDocs Archive.
    • Workspace control is enabled by default if you installed the Web Interface using the Web Interface autorun.
    • Workspace control is disabled by default if you installed the Web Interface using AutoSelect.exe or XenDesktopServerSetup.exe.
    • If a user accesses a VM-hosted application from a desktop hosted from the same VM hosted apps site as that application, workspace control is not supported.

Configuring USB Support for VM Hosted Apps

You can enable users to interact with a wide range of USB devices during a VM hosted apps session. The level of support provided depends on the client installed on the user device; see the relevant client documentation for further details.

Isochronous features in USB devices such as webcams, microphones, speakers, and headsets are supported in typical low latency/high speed LAN environments. This allows these devices to interact with packages such as Microsoft Office Communicator and Skype.

The following types of device are supported directly in a VM hosted apps session and do not require special configuration:

  • Keyboards
  • Mice
  • Smart cards
Note: Specialist keyboards and mice (for example, Bloomberg keyboards, and 3D mice) can be configured to use USB support. For more information, see http://support.citrix.com/article/ctx119722 in the Citrix Knowledge Center.

By default, certain types of USB devices are not supported for remoting through VM hosted apps. For example, a user may have a network interface card attached to the system board by internal USB. Remoting this would not be appropriate. The following types of USB device are not supported by default for use in a VM hosted apps session:

  • Bluetooth dongles
  • USB network interface cards
  • USB hubs
  • USB graphics adaptors

USB support allows hosted applications access to USB devices that are connected to the user device. In environments where security separation between client and hosted application is needed, users should connect only appropriate USB devices. You can also set policies at the desktop group and user device that restrict the types of USB devices that will be made available to the hosted application.

For information on all USB devices supported, see http://support.citrix.com/article/ctx119861 in the Citrix Knowledge Center.

Double-hop USB is not supported. That is, if a user connects to a VM hosted apps session for a hosted desktop, the VM hosted apps session does not have USB support.

To configure USB support for desktops

To configure USB support for the desktops you are using to deliver applications:
  • Enable the USB policy rule, which is in the USB Devices Policy Settings section of the ICA Policy Settings.
  • Enable USB support when you install the online plug-in on user devices.
  • If necessary, update the range of USB devices supported. To do this:
    • Edit the plug-in registry.
    • Edit the administrator override rules in the Virtual Desktop Agent registry on the computers hosting the desktops. The range specified in the Virtual Desktop Agent must correspond exactly to the range specified on the client; if it does not, then only the devices allowed in both ranges are allowed.

    The product default rules are stored in HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\PortICA\GenericUSB Type=String Name="DeviceRules"

    Do not edit the product default rules.

    The administrator override rules are stored in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\PortICA\GenericUSB Type=String Name="DeviceRules"

    For details of the rules and their syntax, see http://support.citrix.com/article/ctx119722/ in the Citrix Knowledge Center.

    ADM files are included on the installation media to allow you to make changes to the client and the Virtual Desktop Agent through Active Directory Group Policy. The file for the client is:

    dvd root \os\lang\Support\Configuration\icaclient_usb.adm

    and the file for the Virtual Desktop Agent is:

    dvd root \os\lang\Support\Configuration\vda_usb.adm

To configure USB support for applications

In addition to configuring USB support for the desktop, you must also configure USB support for the application being delivered by the desktop.

Caution: Editing the Registry incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.

Set the following registry keys on the user device:

  • Name: HKEY_CURRENT_USER\Software\Citrix\ICA Client\USB\published application name\NewDevices

    published application name is the Desktop Group name in the VM Hosted Apps environment. Create this registry entry for each Desktop Group that supports USB devices.

  • Type: REG_SZ
  • Value: Always or Never

    Setting this key to "Always" enables USB support for USB devices that are connected the user device while the application session is in progress.

  • Name: HKEY_CURRENT_USER\Software\Citrix\ICA Client\USB\published application name\ExistingDevices
  • Type: REG_SZ
  • Value: Always or Never

    Setting this key to "Always" enables USB support for USB devices that are present on the user device when the application session begins.

To update the range of USB devices supported

To change the default range of USB devices, you must update the device rules on both the client and the Virtual Desktop Agent:
  • Edit the client registry (or the .ini files in the case of the Receiver for Linux). For information about how to do this, see the relevant client documentation. An ADM file is included on the installation media to allow you to make changes to the client through Active Directory Group Policy: dvd root \os\lang\Support\Configuration\icaclient_usb.adm.
  • Edit the administrator override rules in the Virtual Desktop Agent registry on the computer(s) hosting the desktops. Information about how to do this is included in the rest of this section.

Device rules are enforced on both the client and the Virtual Desktop Agent, so you must make changes on both sides otherwise devices may not be allowed through.

An ADM file is included on the installation media to allow you to make changes to the Virtual Desktop Agent through Active Directory Group Policy: dvd root \os\lang\Support\Configuration\vda_usb.adm.

The product default rules are stored in HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\PortICA\GenericUSB Type=String Name="DeviceRules"

The default policy configuration is as follows:

DENY: class=02 # Communications and CDC-Control 
DENY: class=09 # Hub devices 
DENY: class=0a # CDC-Data 
DENY: class=0b # Smartcard 
DENY: class=e0 # Wireless controller 
ALLOW: # Otherwise allow everything else

Do not edit the product default rules. The recommended way to change them is to use the GPO overrides described below, because these are evaluated before the default rules.

The administrator override rules are stored in:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\PortICA\GenericUSB Type=String Name="DeviceRules"

When you are creating new policy rules, refer to the USB Class Codes, available from the USB Web site at http://www.usb.org/.

Policy rules take the format {Allow:|Deny:} followed by a set of tag=value expressions separated by white space. The following tags are supported:

Tag Description
VID Vendor ID from the device descriptor
PID Product ID from the device descriptor
REL Release ID from the device descriptor
Class Class from either the device descriptor or an interface descriptor
SubClass Subclass from either the device descriptor or an interface descriptor
Prot Protocol from either the device descriptor or an interface descriptor
When creating new policy rules, be aware of the following:
  • Rules are case-insensitive.
  • Rules may have an optional comment at the end, introduced by #. A delimiter is not required and the comment is ignored for matching purposes.
  • Blank and pure comment lines are ignored.
  • White space is used as a separator, but cannot appear in the middle of a number or identifier. For example, Deny: Class = 08 SubClass=05 is a valid rule; Deny: Class=0 Sub Class=05 is not.
  • Tags must use the matching operator =. For example, VID=1230.
  • Each rule must start on a new line or form part of a semicolon-separated list.
    Important: If you are using the Administrative (ADM) template, you must create rules on a single line, as a semicolon-separated list.

This example shows a set of administrator-defined USB policy rules:

Allow: VID=1230 PID=0007 # ANOther Industries, ANOther Flash Drive 
Deny: Class=08 SubClass=05 # Mass Storage

Support for USB Mass Storage Devices

For mass storage devices only, remote access is also available through client drive mapping, where the drives on the user device are automatically mapped to drive letters on the virtual desktop when users log on. The drives are displayed as shared folders with mapped drive letters. To configure client drive mapping, use the Client removable drives setting in the File Redirection Policy Settings section of the ICA Policy Settings.

The main differences between the two types of remoting policy are:

Feature

Client drive mapping

USB rule

Enabled by default Yes No
Read-only access configurable Yes No
Safe to remove device during a session No Yes, provided users follow operating system recommendations for safe removal

If both client drive mapping and the USB rule are enabled, then if a mass storage device is inserted before a session starts, it will be redirected using client drive mapping first, before being considered for redirection through USB support. If it is inserted after a session has started, it will be considered for redirection using USB support before client drive mapping. Automatic support of devices upon insertion, however, depends on the client being used and the individual user preferences; for further information, see the relevant client documentation.