Wondering where they hid the default ICA server setting in the Program Neighborhood?

Credit Simon Horn on this one.

Simon noticed that when you run the client, the "Add ICA Connection" entry is highlighted by default. If you click somewhere in the white area where there isn't an entry, and then click on the File menu, you will see an extra entry 'Properties'. This will bring up a screen which is similar to the version 1.0 client where you can specify server location. Brian Cambier also explains this hidden function a little more in depth below.

Some More Notes on Program Neighborhood -By Brian Cambier MCT/CCI ASYNC Technical Institute, Inc.

Program Neighborhood (PN) uses a hierarchical structure. The top level is the default that the user sees. The top level displays the default application set of published applications from the server farm. The second level allows the user to change their application set and is accessible via the "Application Set Manager" icon on the top level. The third level contains custom connections and is accessible via the "Custom ICA Connections" icon on the second level.

All icons at the top level appear as a Seamless Window and NONE of the properties can be modified by any user. The published app properties come from the ICA Master Browser after being set in Published Application Manager by the administrator. If a user needs to modify the properties of a top level app, right click on it and select "copy to custom connections", this will copy the app to the third level where the user is free to change the video/audio, etc. The custom connections are just like Remote Application Manager.

To set server locations like we used to in Remote Application Manager, go to the top level (may have to hit the "Up" toolbar icon to get there), and select File - Properties. Make sure you do not have any apps highlighted when you do this or else you will get that published apps properties (which are basically read-only). You should have a "Farm Properties" window appear. Under the "Connection" tab at the bottom is the "Server Location" settings. The defaults are set to "Auto detect network protocol" and the "Server Group" is set to primary. Press the [Add] button to add the your servers.

You can also define a "Backup1" and "Backup2" list of servers as well in case the primaries are not available. I believe itrix Marketing calls this the "Business Recovery client option".

Trust me, I have to teach this stuff daily and it took me several days to figure this basic stuff out.

My personal opinion is that Program Neighborhood is too complex for the average end user. The top level apps being automatically pushed by the ICA Master Browser is very cool, but there are just too many options that users would wind up calling the administrator about. You can integrate all the apps into their local desktop and remove Program neighborhood from the desktop. But, if you have the client's auto-logon, they need access to it to change their passwords. Don't try renaming pn.exe or deleting it all together, functionality will be lost.

• Brian Cambier
• MCT/CCI ASYNC Technical Institute, Inc.
• http://www.atii.com

Here is another recently posted document by Brian Cambier, Instructor at Async Technical Institute.

How to use Auto Client Update with APPSRV.INI

This procedure describes how to use the Automatic Client Update to replace the client?s APPSRV.INI file from a central pre-configured copy on the server. This only works with ICA Clients from Picasso Beta 2 and newer, not WinFrame Clients. Using this procedure an administrator can push a centrally managed, pre-configured APPSRV.INI during a client software update. This procedure is specific to the Win32 client, but will work with Win16 and DOS clients. A separate appsrv.ini file can be used on each client platform (DOS, Win16 and Win32) if required. Works with both Published Apps and Server connections.

1. Download the new client from Citrix web site to a temp folder on the server. For this example we will use the NE000606.EXE client (WIN32) and the server temporary folder \newclient1
2. Expand the self-extracting zip file by running NE000606.EXE in the \newclient1 folder on the server.
3. Expand and self-extracting zip-files created from the previous step. For our example we have to run ICA_32D1.EXE and ICA_32D2.EXE in the \newclient1 folder on the server.
4. From a workstation, setup the new client by running the \newclient1\setup.exe program. Configure Remote Application Manager for all connection entries that you want specified and propagated to all clients using the new WIN32 client.

5. Copy that APPSRV.INI to the \newclient1 folder as APPSRV.SRC. For our example:

   copy c:\program files\citrix\ica client\appsrv.ini m:\newclient1\appsrv.src

   NOTE: You may have to overwrite/rename the existing version of the file that is created when the self-extracting zip files are executed.

6. Using Notepad, open the file \newclient1\update.ini

7. Locate the section:

   [appsrv.ini]
   DoNotUpdate=yes
   		

8. Change it to:

   [appsrv.ini]
   UpdateImmediate=yes
   		

9. Start the ICA Client Update Configuration utility on the server.
10. Select Client - New. Use the Browse button to navigate to the \newclient1 folder and then press the Open button. The Client Name, Product, Model, Version and Comment are filled in. Press the Next button.
11. Select your preferred Client Download Mode, Version Checking, and other update options. Press the Next button.
12. Select your preferred Event Logging options and then press the Next button.
13. Enable this version of the WIN32 client and then press the Finish button. Files are copied to the database. You now have a new icon for the Citrix ICA Win32 Client.

14. On the server, open the folder \%systemroot%\Ica\Clientdb. You see three folders:

    • 00010001 The DOS clients
    • 00010002 The Win16 clients
    • 00010003 The Win32 clients
15. Open the Win32 folder 00010003. You should have a new folder for the client we just added. Our example NE000606 creates the folder \0400025E. The other folder \04000245 contains the Win32 client that ships on the MetaFrame CD. This folder is created at installation. You can verify the newer folder by viewing the details in Explorer.

16. Open the new folder \0400025E and using notepad, edit the UPDATE.INI file. Near the middle of the UPDATE.INI file is a section containing filenames, file sizes and CRC values. Find the APPSRV.SRC section. Our example looks like this:

    [APPSRV.SRC]
    FileSize=2644
    FileCRC=2743177087
    		

17. Copy the FileSize and FileCRC lines and paste them into the [appsrv.ini] section that is near the top of UPDATE.INI:

    [appsrv.ini]
    UpdateImmediate=yes
    FileSize=2644
    FileCRC=2743177087
    		

18. Save and close the UPDATE.INI file.
19. Open the \Files folder under the \0400025e folder and copy appsrv.src to appsrv.ini
20. Close all folders on the server and then close the ICA Client Update Configuration utility.
21. Have a client login, download the new client and restart Remote Application Manager to verify that the new APPSRV.INI file has been applied.

This procedure won't work with hard-coded usernames and passwords in a connection in Remote Application Manager unless they all use the same username and password combinations. Other limitations may apply with regard to LAN vs WAN vs Dialup users. I am still playing with other ways to use the Auto Client Update to push centrally managed, standardized configuration files to clients. There are several parameters in UPDATE.INI that I have not been able to figure out what they do or how to make them work. These include the MergeFile=Yes/No and FileExistenceRequired=Yes/No, if anyone has information, please let us know.

More On Program Neighborhood from the CITRIX KB.

Program Neighborhood - Refresh of available application sets

Synopsis:

The application set in Program Neighborhood must be updated manually by clicking on the REFRESH button.

Details:

Program Neighborhood contains the application set of available published applications for the currently authenticated user. In order update the set of available applications a user must click on the REFRESH button of the Program Neighborhood client.

What is the difference between a server farm scope and a domain scope?

Synopsis:

You can publish and manage applications using one of two management scopes: Server Farms or Windows NT domains.

Details:

In order to take advantage of the features of Program Neighborhood and the administrative organization of the server farm, you must publish and manage your applications using the server farms management scope.

Use the Windows NT domains scope only if you:

• Cannot add your servers to a server farm
• Need to maintain applications that were both published prior to installation of MetaFrame 1.8 and cannot be migrated into a server farm

Server Farm Scopes

When you use the server farms scope of management, you group your Citrix servers (MetaFrame 1.8 and WINFRAME 1.8) into one or more server farms. When creating a server farm, keep the following in mind:

• Common administrator's rights.

  The individuals responsible for administration of a farm should have administrative rights over each server in the farm. When you log into a Citrix server console or ICA session and run Published Application Manager, you administer applications under the context of your current Windows NT user name. Although you can view the applications on other servers in the farm without having administrative rights over those servers, you cannot publish or edit applications on those servers. For this reason, users who must run Published Application Manager to publish applications should make sure they have administrative privileges on each server in the farm.

• Common base of user accounts.

  Server farms can include servers, and therefore users, from multiple domains. All ICA Client users must belong to a group of users common to all involved domains. Published Application Manager draws a common user account base from the intersection of the trust relationships of all affected Windows NT domains.

• Physical Connection.

  Servers in a farm must be connected by some form of network connection. Some possible network connections include LAN, WAN, and dial-up asynchronous connections. Servers can be on different subnets if an ICA Gateway is in place to connect them. ICA Gateways are administered from Citrix Server Administration.

Windows NT Domain Scopes

If you do not add your servers to a Citrix server farm, Published Application Manager functions in the Windows NT domains scope of management. In this scope, the applications you publish do not support Program Neighborhood features.

The Windows NT domains scope exists for backward compatibility and interoperability with existing WINFRAME 1.7 and MetaFrame 1.0 installations.

============================================================================

Here is some more from the CITRIX KB on how to remove the extra icons in PN.

Customizing the Program Neighborhood Client

Synopsis:

This document explains how to hide the icons for Application Set Manager, Custom ICA Connections, Find New Application Set, and Add ICA Connection from your users.

Details:

To hide the icons for Application Set Manager - , Custom ICA Connections, Find New Application Set, and Add ICA Connection from your users, change the values of the statements below to On (the default value is Off) in the [WFClient] section of the appsrv.ini. By default, the appsrv.ini file is in the directory to which the Program Neighborhood application was installed. On most systems this would be %systemroot%\Program Files\Citrix\ICA Client.

[WFClient]
ApplicationSetManagerIconOff=Off change value to On
CustomConnectionsIconOff=Off change value to On
FindNewApplicationSetIconOff=Off change value to On
AddICAIconOff=Off change value to On
DragoutOff=Off change value to On

NOTE: The DragoutOff=On statement disables dragging the icon to the desktop.

Here's how to prevent PN from saving the password from the CITRIX KB

Save Password Option when Adding a Custom ICA Connection

Synopsis:

This document explains how to override the Save Password option in a custom ICA connection.

Details:

The Save Password option is checked by default when adding a new custom ICA connection. To override the default on the server side, follow the steps below:

1. Open Citrix Connection Configuration in MetaFrame Tools (you can also open Terminal Server Connection Configuration in Administrative Tools).
2. Double-click the type of ICA connection (for example, ica-tcp) utilized by your users to connect to the MetaFrame server. This allows you to edit the properties of the connection.
3. Click Advanced...
4. Check Prompt for Password in the AutoLogon configuration box. This setting overrides the settings for Save Password but will still prompt the user for the password.

Where Does Program Neighborhood Store User's Credentials?

Synopsis:

Details:

User's credentials are saved by encrypting them with a proprietary algorithm. They are then stored in their profile along with their Pn.ini and Appsrv.ini files. This directory is <profile path>\Application Data\ICAClient. Because user credentials are a property of an application set, credentials are stored for each application set independently.

In the Pn.ini file, there are entries that look like this:

[Program Neighborhood]
Company Farm=z1e60g77
Copy of Company Farm=y49t3152
Administrator Farm Apps=171c2m7k

A random filename associated with each farm is generated during application set discovery/creation and is guaranteed to be unique. Two files exist in the profile for each application set; in the example above, the Company Farm application set stores information in these two files:

• z1e60g77.idx - A mini-database containing the published apps that appear in this app set
• z1e60g77.vl - The encrypted username, password, and domain name

The .vl file will be zero bytes if the "Save password" option is not checked.