21. Implement System Policies

The Ultimate Citrix Install Guide

1. Implementation Overview

2. Prepare the Network Environment

3. Add Users to a Terminal Services Environment

4. 3^rd Party IMA Data Store Installation Instructions

5. Install Operating System

6. Install MetaFrame XP

7. Tweak Windows 2000 / MetaFrame XP

8. Rapid Server Deployment

9. How to create a Zone & Move MetaFrame Servers to it

10. ICA Client Update Configuration Utility

11. How to Setup Automatic Reboot for MetaFrame Servers

12. Client Drive Mapping

13. Install Applications

14. Publishing through the Citrix Management Console

15. How to Build a Stable Printing Environment

16. NFuse Integration

17. Citrix Web Console (CWC)

18. How to Secure a Internet Information Services (IIS) Server

19. Citrix Management Console (CMC)

20. Microsoft Terminal Services License Server

21. Implement System Policies

22. Implementation - Checkpoint

6 - Readiness Phase

7 - Rollout Phase

8 - Appendix

When users access a session through a MetaFrame server, by default, they have access to all files, features and applications on the server. This gives a stray user the ability to detrimental effect all other users of the MetaFrame server. In order to prevent this behavior you will want to lockdown the environment through Computer and User Policies.

A Policy is a set of registry settings that defines the computer resources available to an individual or to a group of users. Policies define the various facets of the desktop environment that a system administrator needs to control, such as which applications are available, which applications appear on the users desktop, which applications and options appear in the Start menu, who can change their desktops and who cannot, and so forth. System policies can be implemented for specific users, groups, computers, or for all users.

In the following sections I have documented how to implement Policies in both a Microsoft NT 4.0 and or Novell Netware environment and a Windows 2000 Active Directory environment. You will also find a great Administrative Template (MIAB.ADM) that incorporates most of the changes found throughout this document and a few more and how to add and configure it.

21. 1. MIAB Administrative Template Overview

Keeping with the goal of this project of making things simple, a gent named Tahir Saleem created an awesome Administrative Template (MIAB.ADM) to tweak and configure a MetaFrame server.

MIAB.ADM allows you to configure the following:

 Source Path for windows installation

 Open In Notepad. When right clicking on a file you will have the option to open it in Notepad

 Command Prompt settings. Sets the following command prompt options:

o ScreenBuffer is set to 300 lines.

o WindowSize is set to 40 lines.

 QuickEdit and InsertMode is Enabled

 Set IRPStackSize

 Set SNMP Contact

o Contact Name

o Location

 Disables the configure server wizard

 Report Cached Credentials. When logged on with Cached Credentials report this to the user.

 Default Logon Domain. Sets the Default Logon Domain to the specified value. In a trusted environment this may be useful.

 File name completion enabled in command prompt

 Command Prompt Here. When right clicking on a drive or directory you will have the option to open a Command Prompt at that location

 Configure TCPKeepAlive

 Enable ICAKeepAlive

 Disable Paging of NTExecutive

 Disable Dr. Watson

 Disable Printer Beeps

 Disable Printer Pop-up message

 Disable System Hard Error Messages

 Increase Idle Connections to handle peak logon periods

 Set WinStation UserOverrides:

 AutoEndTasks

 CusrorBlinkRate

 DragFullWindows

 MenuShowDelay

 WaitToKillAppTimeout

 SmoothScroll

 Wallpaper

 MinAnimate

 Active Title Bar Colour for ICA Connections

 Active Title Bar Colour for RDP Connections

 Remove Outlook Express from the Quick Launch bar and Start Menu.

 Prevent last access time stamp from being updated on NTFS partitions

 SAP Settings

 Enable/Disable New Visual Design

 Disable Splash Screen

 Disable Animation

 Disable logging of Print events in Event Log

 Change IM 2.0 default install drive

 Set Default License Server

 Hide Specified drives

 Disable the Configure Server Wizard

; Methodology in a Box

; Terminal Server tunings.

; Version: 1.0

; By Tahir Saleem, NettSpesialisten

; saleem@nettspes.no

#if version <= 2

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CLASS USER ;;;;;;;;;;;;;;;;;;

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CATEGORY !!GPOnly

POLICY !!GPOnlyPolicy

KEYNAME "Software\Policies"

PART !!GPOnly_Tip1 TEXT

END PART

PART !!GPOnly_Tip2 TEXT

END PART

PART !!GPOnly_Tip3 TEXT

END PART

PART !!GPOnly_Tip4 TEXT

END PART

PART !!GPOnly_Tip5 TEXT

END PART

END POLICY

END CATEGORY

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CLASS MACHINE ;;;;;;;;;;;;;;;

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CATEGORY !!GPOnly

POLICY !!GPOnlyPolicy

KEYNAME "Software\Policies"

PART !!GPOnly_Tip1 TEXT

END PART

PART !!GPOnly_Tip2 TEXT

END PART

PART !!GPOnly_Tip3 TEXT

END PART

PART !!GPOnly_Tip4 TEXT

END PART

PART !!GPOnly_Tip5 TEXT

END PART

END POLICY

END CATEGORY

#endif

#if version >= 3

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CLASS USER ;;;;;;;;;;;;;;;;;

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CATEGORY !!MIAB

POLICY !!HideDrives

EXPLAIN !!HideDrives_Help

KEYNAME "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"

PART !!HideDrives_txt NUMERIC

VALUENAME "NoDrives" MAX 1000000000

DEFAULT "0"

END PART

END POLICY

POLICY !!ConfigServerWizard

KEYNAME "Software\Microsoft\Windows NT\CurrentVersion\Setup\Welcome"

EXPLAIN !!ConfigServerWizard_Help

ACTIONLISTON

VALUENAME "srvwiz"

VALUE NUMERIC "0"

END ACTIONLISTON

END POLICY

POLICY !!DisableICW

EXPLAIN !!DisableICW_Help

KEYNAME "Software\Microsoft\Internet Connection Wizard"

VALUENAME "Completed"

END POLICY

POLICY !!Console

KEYNAME "Console"

EXPLAIN !!Console_Help

ACTIONLISTON

VALUENAME "ScreenBufferSize"

VALUE NUMERIC "19660880" ;300 Lines

VALUENAME "WindowSize"

VALUE NUMERIC "2621520" ;40 Lines

VALUENAME "QuickEdit"

VALUE NUMERIC "1"

VALUENAME "InsertMode"

VALUE NUMERIC "1"

END ACTIONLISTON

END POLICY

CATEGORY !!SAP

POLICY !!SAPVisual

KEYNAME "Software\SAP\General\Enjoy"

EXPLAIN !!SAPVisual_Help

PART !!SAPGUIch DROPDOWNLIST REQUIRED

VALUENAME "Active"

ITEMLIST

NAME Off VALUE "Off" DEFAULT

NAME On VALUE "On"

END ITEMLIST

END PART

END POLICY

POLICY !!SAPAnimation

KEYNAME "SOFTWARE\SAP\General\Appearance"

EXPLAIN !!SAPAnimation_Help

PART !!SAPAnich DROPDOWNLIST REQUIRED

VALUENAME "Animation"

ITEMLIST

NAME Off VALUE "Off" Default

NAME On VALUE "On"

END ITEMLIST

END PART

END POLICY

POLICY !!SAPSplash

KEYNAME "SOFTWARE\SAP\General\Appearance"

EXPLAIN !!SAPSplash_Help

PART !!SAPSplach DROPDOWNLIST REQUIRED

VALUENAME "SplashOff"

ITEMLIST

NAME Off VALUE NUMERIC 1

NAME On VALUE NUMERIC 0

END ITEMLIST

END PART

END POLICY

END CATEGORY ;SAP

END CATEGORY ;MIAB

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CLASS MACHINE ;;;;;;;;;;;;;;

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CATEGORY !!MIAB

POLICY !!SourcePath

EXPLAIN !!SourcePath_Help

KEYNAME "Software\Microsoft\Windows NT\Currentversion"

PART !!SourcePath EDITTEXT

VALUENAME "SourcePath"

DEFAULT "\\Servername\I386"

END PART

END POLICY

POLICY !!CompletionChar

KEYNAME "Software\Microsoft\Command Processor"

EXPLAIN !!CompletionChar_Help

ACTIONLISTON

VALUENAME "CompletionChar"

VALUE NUMERIC 9

VALUENAME "PathCompletionChar"

VALUE NUMERIC 9

END ACTIONLISTON

ACTIONLISTOFF

VALUENAME "CompletionChar"

VALUE NUMERIC 64

VALUENAME "PathCompletionChar"

VALUE NUMERIC 64

END ACTIONLISTOFF

END POLICY

POLICY !!InternetMIB

EXPLAIN !!InternetMIB_Help

KEYNAME "System\CurrentControlSet\Services\SNMP\Parameters\RFC1156Agent"

ACTIONLISTON

VALUENAME "sysServices"

VALUE NUMERIC 72

END ACTIONLISTON

PART !!ContactName EDITTEXT REQUIRED

VALUENAME sysContact

END PART

PART !!Location EDITTEXT REQUIRED

VALUENAME sysLocation

END PART

END POLICY

POLICY !!CachedCridentials

KEYNAME "software\Microsoft\Windows NT\CurrentVersion\Winlogon"

EXPLAIN !!CachedCridentials_Help

ACTIONLISTON

VALUENAME "ReportControllerMissing"

VALUE "TRUE"

END ACTIONLISTON

END POLICY

POLICY !!DefaultDomain

KEYNAME "software\Microsoft\Windows NT\CurrentVersion\Winlogon"

EXPLAIN !!DefaultDomain_Help

PART !!DefaultDomain_TXT EDITTEXT

VALUENAME DefaultDomainName

END PART

END POLICY

POLICY !!TCPKeepAlive

KEYNAME "System\CurrentControlSet\Services\Tcpip\Parameters"

EXPLAIN !!TCPKeepAlive_Help

PART !!KeepAliveTime NUMERIC

VALUENAME KeepAliveTime MAX 100000

DEFAULT "60000"

END PART

PART !!KeepAliveInterval NUMERIC

VALUENAME KeepAliveInterval

DEFAULT "1000"

END PART

END POLICY

POLICY !!ICAKeepAlive

KEYNAME "SYSTEM\CurrentControlSet\Control\Citrix"

EXPLAIN !!ICAKeepAlive_Help

VALUENAME "IcaEnableKeepAlive"

VALUEON NUMERIC 1

VALUEOFF NUMERIC 0

PART !!ICAKeepAliveInterval NUMERIC

VALUENAME "IcaKeepAliveInterval"

DEFAULT "60"

END PART

END POLICY

POLICY !!DisablePagingExecutive

KEYNAME "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"

EXPLAIN !!DisablePagingExecutive_Help

VALUENAME "DisablePagingExecutive"