Glossary

Last published : Oct 12, 2026
This article contains terms and definitions used in the Workspace Environment Management™ (WEM) software and documentation.
on-premises term only
Citrix Cloud™ service term only
Admin Broker Port. Legacy term for "administration port".
administration console. An interface that connects to the infrastructure services. You use the administration console to create and assign resources, manage policies, authorize users, and so on.
In Citrix Cloud, the Workspace Environment Management service administration console is hosted on a Citrix Cloud-based Citrix virtual apps™ server. You use the administration console to manage your WEM installation from the service's Manage tab using your web browser.
administration port . Port on which the administration console connects to the infrastructure service. The port defaults to 8284 and corresponds to the AdminPort command-line argument.
agent. The Workspace Environment Management agent consists of two components: the agent service and the session agent. These components are installed on the agent host.
Agent Host executable. Legacy term for "session agent".
Agent Host machine. Legacy term for "agent host".
Agent Host service. Legacy term for "agent service".
Agent Broker Port. Legacy term for "agent service port".
Agent Cache Synchronization Port. Legacy term for"cache synchronization port".
agent host. The machine on which the agent is installed.
agent host configuration GPO. The Group Policy Object (GPO) administrative template provided with the agent installation as ADM or ADMX files. Administrators import these files into Active Directory and then apply the settings to a suitable organizational unit.
agent port . Listening port on the agent host which receives instructions from the infrastructure service. Used, for example, to force agents to refresh from the administration console. The port default is 49752.
agent service. The service deployed on VDAs or on physical Windows devices in Transformer use cases. It is responsible for enforcing the settings you configure using the administration console.
agent service port . A port on which the agent connects to the infrastructure server. The port defaults to 8286 and corresponds to the AgentPort command-line argument.
Agent Sync Broker Port. Legacy term for "cache synchronization port".
broker. Legacy term for "infrastructure service".
Broker account. Legacy term for "infrastructure service account".
Broker server. Legacy term for "infrastructure server".
Broker Service Account. Legacy term for "infrastructure service account".
cache synchronization port . A port on which the agent cache synchronization process connects to the infrastructure service to synchronize the agent cache with the infrastructure server. The port defaults to 8285 and corresponds to the AgentSyncPort command-line argument.
Citrix License Server port . The port on which the Citrix License Server is listening and to which the infrastructure service then connects to validate licensing. The port default is 27000.
Citrix Cloud Connector™ . Software which allows machines in resource locations to communicate with Citrix Cloud. Installed on at least one machine (cloud connector) in each resource location.
configuration set. A set of Workspace Environment Management configuration settings.
Connection Broker. Legacy term for "infrastructure server".
database. A database containing the Workspace Environment Management configuration settings.
In the on-premises version of Workspace Environment Management, the database is created in an SQL Server instance. On Citrix Cloud, the Workspace Environment Management service settings are stored in a Microsoft Azure SQL Database service.
database server account . The account used by the database creation wizard to connect to the SQL instance to create the Workspace Environment Management database.
DSN. A data source name (DSN) contains database name, directory, database driver, UserID, password, and other information. Once you create a DSN for a particular database, you can use the DSN in an application to call information from the database.
infrastructure server . The computer on which the Workspace Environment Management infrastructure services are installed.
Infrastructure Server Administration Port. Legacy term for "administration port".
infrastructure service. The service installed on the infrastructure server which synchronizes the various back-end components (SQL Server, Active Directory) with the front-end components (administration console, agent host). This service was previously called the "broker."
On Citrix Cloud, the infrastructure services are hosted on Citrix Cloud and managed by Citrix. They synchronize the various back-end components (Azure SQL Database service, administration console) with the front-end components (agent, Active Directory).
infrastructure service account . The account which the infrastructure service uses to connect to the database. By default this account is the vuemUser SQL account, but during database creation you can optionally specify other Windows credentials for the infrastructure service to use.
Infrastructure service server. Legacy term for "infrastructure server".
infrastructure services. Services installed on the infrastructure server by the infrastructure services installation process.
On Citrix Cloud, the infrastructure services are hosted on Citrix Cloud and managed by Citrix. They synchronize the various back-end components (Azure SQL Database service, administration console) with the front-end components (agent, Active Directory).
initial administrators group . A user group which is selected during database creation. Only members of this group have Full Access to all Workspace Environment Management sites in the administration console. By default this group is the only group with this access.
integrated connection . Connection of the database creation wizard to the SQL instance using the current Windows account instead of an SQL account.
kiosk mode. A mode in which the agent becomes a web or application launcher redirecting users to a single app or desktop experience. This allows administrators to lock down the user environment to a single app or desktop.
Monitoring Broker Port. Legacy term for"WEM monitoring port".
mixed-mode authentication . In SQL Server, an authentication mode that enables both Windows Authentication and SQL Server Authentication. This is the default mechanism by which the infrastructure service connects to the database.
License server port. Legacy term for "Citrix License Server port".
network drive. A physical storage device on a LAN, a server, or a NAS device.
resource location . A location (such as a public or private cloud, a branch office, or a data center) containing the resources required to deliver services to your subscribers.
SaaS . Software as a service is a software distribution model in which a third-party provider hosts applications and makes them available to customers over the Internet.
self-service window. An interface in which end users can select functionality configured in Workspace Environment Management (for example icons, default printer). This interface is provided by the session agent in "UI mode."
service principal name (SPN). The unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account.
session agent. An agent that configures app shortcuts for user sessions. The agent operates in "UI mode" and "command line" mode. UI mode provides a self-service interface accessible from a status bar icon, from which end users can select certain functions (for example icons, default printer).
Site. Legacy term for "Configuration set".
SQL user account . An SQL user account with name of "vuemUser" created during installation. This is the default account that the infrastructure service uses to connect to the database.
transformer. A feature in which Workspace Environment Management agents connect in a restricted kiosk mode.
virtual drive. A Windows virtual drive (also called an MS-DOS device name) created using the subst command or the DefineDosDevice function. A virtual drive maps a local file path to a drive letter.
virtual IP address (VIP). An IP address that does not correspond to an actual physical network interface (port).
VUEM. Virtual User Environment Management. This is a legacy Norskale term that appears in some places in the product.
vuemUser . An SQL account created during Workspace Environment Management database creation. This is the default account that the Workspace Environment Management infrastructure service uses to connect to the database.
WEM Broker. Legacy term for "infrastructure service".
WEM monitoring port . A listening port on the infrastructure server used by the monitoring service. The port defaults to 8287. (Not yet implemented.)
WEM UI Agent executable. Legacy term for "session agent".
Windows account impersonation. When a service runs under the identity of a Windows account.
Windows AppLocker. A Windows feature that allows you to specify which users or groups can run particular applications in your organization based on unique identities of files. If you use AppLocker, you can create rules to allow or deny applications from running.
Windows authentication. In SQL Server, the default authentication mode in which specific Windows user accounts and group accounts are trusted to log in to SQL Server. An alternate mode of authentication in SQL Server is mixed mode authentication.
Windows security. Legacy term for "Windows authentication".
Workspace Environment Management (WEM) service . A Citrix Cloud service which delivers WEM management components as a SaaS service.