|  Login
share this page - email email | del.icio.us del.icio.us | digg digg | technorati technorati | reddit reddit | stumbleupon stumbleupon | newsvine newsvine | google bookmarks google bookmarks | yahoo bookmarks yahoo bookmarks | yahoo myweb yahoo myweb | slashdot slashdot | backflip backflip | live live | fark fark | blogmarks blogmarks | linkagogo linkagogo | wink wink
Upcoming Events
 
Citrix App Delivery Expo (iForum) 5/20 - 5/23
Tuesday, May 20, 2008

Houston, TX


BriForum US 2008 6/16 - 6/18
Monday, June 16, 2008

Chicago, IL


DefCon 16 8/8 - 8/10
Friday, August 08, 2008

Las Vegas, NV


Brian Madden Advanced Citrix Training 8/18 - 8/22
Monday, August 18, 2008

Chicago, IL


VMworld 9/16 - 9/18
Tuesday, September 16, 2008

Las Vegas, NV



 
   
     
What's new on shawnbass.com
 
shawnbass.com - Server Based Computing blog

Vishal Ganeriwala from Citrix has recently posted a blog entry about a social networking contest that's being conducted at the Citrix Synergy event next week in Houston.  If you happen to be attending, here's how the process goes:

  1. You comment on Vishal's blog entry stating that you'd like to borrow one of the FlipVideo cameras.
  2. You record some 5 minute video segment capturing your thoughts (or someone elses if you don't have any LOL) regarding the Citrix Synergy event.
  3. You turn the camera back into Vishal the following day.
  4. All the videos get uploaded to YouTube.
  5. The top 5 most viewed submissions will receive the FlipVideo camera for free.

I'll be at Citrix Synergy, and this blog gave me a good idea to bring my FlipVideo camera.  Only I won't have to adhere to all those crazy "rules".  I'm such a rebel... Oh yes, I will be videotaping analysts...oooh.....  And I might even upload videos to my site, or maybe even some other site....   Uh-oh  now I've gone and said it...

5/14/2008 11:09:41 PM

shawnbass.com - Virtualization blog

Justin Zarb recently blogged about a video he found from a TechEd session where John Sheehan gave an overview of the new features in SoftGrid / MAV 4.5.  I'd love to give all sort of nice comments about the video, but I'm plagued by the Silverlight Download Error 4001 so I can't even watch the video.  Anyway, I'm passing it along in case you haven't seen Justin's blog entry about it.

5/14/2008 9:39:35 AM

shawnbass.com - Network Administration blog

Microsoft has officially re-released Windows XP Service Pack 3 today.  Get the full download here.

5/6/2008 3:47:44 PM

shawnbass.com - Server Based Computing blog

Vishal Ganeriwala from Citrix sent me a tip that Dr. SDK (head Citrix MFCOM jockey) has updating his SDK Guide "Scripting MetaFrame".  The new guide can be found here and is a must read for anyone attempting to use MFCOM from VBScript/PowerShell, etc.

5/2/2008 10:36:45 AM

shawnbass.com - Server Based Computing blog

Gus Pinto has blogged recently about a utility developed by the internal IT organization at Citrix that was used to assist in minimizing the amount of time required to get people into their Citrix apps.  You can see a "veedio" [ LOL @Gus ;) ] of this in action here.  Gus also did a follow up interview with the creators of the utility here.

One thing to know up front about this utility is that it will be released to the web as an unsupported utility on CDN.  It won't be an "official" Citrix product.

Now before I comment on this, let me first state that I have no inside knowledge of how this thing was developed, nor am I an expert at the inner workings of it.  That being said, let me state some assumptions about how I *think* this thing is working and some potential shortcomings of it.  I'm certainly encouraging any/all corrections/clarifications to these assumptions.

First an overview of my understanding of the utility:

1) Windows boots up and the user logs in.

2) There's a Start Menu startup folder shortcut that links to this utility written by the Citrix IT guys.

3) The executable starts up and initializes a connection to a Citrix server.  If the user had existing disconnected apps on that server, the apps would immediately show.  If the user didn't have any apps running, they would just see their desktop.

4) Upon launching their next Citrix application, it would immediately appear via the magic of session sharing.

Ok, so what's the catch?

1)  First of all, since this is a utility that runs in the startup menu of the client system, you've got to have some way to get it there.  If you're using PN/Web client you're a bit SOL since you'd need some type of ESD or script solution for pushing the shortcut in their start menu.  If you're using PNA, you could use the Citrix infrastructure and PNAgent to place the shortcut into the Start Menu, but you'd still need to stage the utility onto the machine.  That means there needs to be some type of out of band management mechanism of getting it there.  For most people with internal corporate desktops, this would be pretty easy through their existing ESD and/or Group Policy.  For external users, you probably don't want sessions auto-launching in the background for security reasons.

2) What this utility is actually doing is automatically invoking an ICA session on a Presentation Server oops I mean XenApp server.  This has implications in a few different areas:

    a) Licensing.  Unless Citrix has developed a way of not actually counting these "auto-launch sessions" you'll need to have enough licensing to accomodate every single user that has this utility deployed.  At the client site I'm at right now, they have about 1500 ccus of PS4.5e, but a pool of about 6k total users.  So if this is really an issue, then they would need to buy 4500 more licenses.

    b) Server capacity.  Everyone knows that one of the biggest hits to a Terminal Server environment is session initialization.  All of the logon script processing, printer mapping, and process initialization is brutal on the Citrix server front.  I see two issues here.  One is major blackhole effect when shifts change.  If you've suddenly got two to three thousand simulatanous Citrix logins vs normally seeing 500 max, that's a pretty significant rise that you might not be ready for.  Secondly, does your Citrix farm have the capacity to accomodate the number of users that have FastLaunch deployed?  Going back to my example of having 6k total users with 1500 max ccus.  If the farm can handle 1500 total users, but you've just thrown 6k sessions at it are you going to stress it beyond it's capabilities?

    c) Reliance on the magic of session sharing.  Session sharing is a beautiful thing.  It's a technology that in it's most basic form instructs the Citrix server to simply spawn a new user process for XYZ application within the existing TS/Citrix session instead of launching a whole new session.  Now, there a many reasons why session sharing might fail.  But the first (and most obvious) reason is that the application being requested isn't installed and published on the server that your session is running on.  There are still many Citrix environments that are highly silo'd.  The reason why an organization is in a silo situation may vary from company to company, but the bottom line here is that if your in a silo'd architecture, this FastLaunch may offer you no benefit on launch wait time if the application requested has to be fulfilled from an alternate server silo.  Now, if your infrastructure is built such that you're using application virtualization (a.k.a. Citrix Streaming, Microsoft Softgrid, VMware Thinstall), then you might be able to get by with about 80% of your apps being serviced by the same server that you've initialized your startup session on.

Overall I think the concept behind FastLaunch is a good one.  I think it could get even better if Citrix was to start tracking user experience patterns to know that XYZ user typically launches these applications initially and therefore we should spin up a session on XYZ silo, etc.  But considering that this is an internally developed utility and is being provided for free, you can't exactly complain.

To wrap up I want to say the following things:

1) I'm not an expert on this particular utilty so I'm certain that at least 1-99% of this blog entry is completely wrong. :)

2) The type of thinking behind this utility is EXACTLY what Citrix needs to keep doing.  There are tons of people out there with similar ideas/concepts.  Citrix needs to find the ones that are game changing (or disruptive technology as they like to call it) and jump on them.

3) Offering this stuff for free is cool and all, but come on....this kind of stuff deserves real consideration for corporate backing.  If the licensing, server performance, and session sharing issues are problematic then you just haven't thought hard enough about alternatives to make it better.

 

 

5/1/2008 3:39:24 PM

shawnbass.com - Security blog

For those not familiar with SQL injection, it's in it's simplest form a method of injection a SQL statement into a database server by way of hiding it in a web parameter.  There's a more detailed explanation here.

Anyway, I wanted to throw together a quick blog entry on this because SQL injection is a very common issue that affects a large number of public websites.  Most of the webmasters are not even aware that their web site exposes them to SQL injection.  Recently, there's been a flurry of activity and news on the Internet about a large amount of SQL injection attacks that are being used to spread malware.

This particular form of SQL injection appears to have been done by a bot and it also appears that most of the sites were targetted by their page rank in search engines.  Hah!  Sometimes it pays to be the little guy.  Anyway, there's various mentions on the Internet on how to know if you've been compromised so I'm not going to go into that.  What I would like to bring up is that this is NOT a Microsoft problem per se.  It's a problem with poorly written web applications, which one could possibly attribute to Microsoft for making development so easy but I don't think that helps the situation.  Microsoft did publically acknowledge this issue here and stated that it's not a particular vulnerability with IIS or SQL (which is actually true).  However, what they don't state is that this is a developer education issue and people need to start taking responsibility for teaching their developers safe coding practices.

For those interested in learning more about SQL injection, check out the links I posted above.  Also check out some of the SQL injection toolkits located here.

Finally, for information on how to combat SQL injection, here's a few things that may help:

Scott Guthrie on Guarding Against SQL Injection

MSDN Patterns & Practices on How-To Protect Against SQL Injection in ASP.NET

One final thing:  While most of this article talks about things from a Microsoft ASP/SQL point of view, SQL injection is not exclusive to Microsoft products and can occur on a variety of web and SQL platforms.  Things just tend to get a bit more sensationalized when dealing with MS products.

4/29/2008 4:56:57 PM

shawnbass.com - Server Based Computing blog

With only three weeks to go before the Citrix Synergy event in Houston, TX Barry Flanagan has posted up a list of technical sessions from the Citrix Synergy conference.  While anything could happen, I'm getting the general feeling like this might just be the most technical Citrix iForum ever.  Even if not, I'm just happy that Citrix is actually publically recognizing the Citrix Technology Professional program as opposed to treating it like the ugly red-headed stepchild (no offense to ugly red-headed stepchildren).

View the list of technical sessions in Barry's blog entry.

4/29/2008 8:26:56 AM

shawnbass.com - Server Based Computing blog
I have been a long time supporter of the Citrix Online GotoAssist product as an excellent way for organizations to provide remote support to their internal associates, but specifically for their remote office workers, work from home employees, and third party customers/partners.  Whenever I'm able

4/27/2008 1:31:51 PM

shawnbass.com - Server Based Computing blog

Never in a million years did I ever expect to hear a reference to Brian Madden in a public video from Mark Templeton, but that day has come.  I was reading a blog item from Jeffrey Muir where he mentioned a video that Citrix was sending throughout the company as a commercial advertisement to re-enforce the reasons why people should attend Citrix Synergy.  Jeff posted a link to the video and I gave it a listen.  Surprisingly, Mark talks about the Geek Speak Live section of the conference that several of the Citrix Technology Professionals (including myself) will be speaking at.  This is a great thing as it's becoming clear that Citrix is really beginning to recognize the CTP program and evangelize it within the organization.  If you're going to Synergy, I recommend you stop in on the Geek Speak Live sessions.  I'm sure they will be great.

Back to the Brian Madden reference.  If you watch the video Mark mentions Brian's name at 1:19.  Who would have thought?

4/16/2008 10:26:23 AM

shawnbass.com - Server Based Computing blog

I have a customer that is performing an upgrade to Presentation Server 4.5 right now.  The way I setup their deployment is that the server is built with 2003 SP2 and then an unattended build of PS 4.5.  Then after the server is joined to the farm, there's an Installation Manager package group of about 50 core components that are pushed to the server.  From a Citrix hotfix perspective, the following items are deployed:

PSE450W2K3R01.msp  - Hotfix Rollup Pack 1

PSE450R01W2K3003.msp
PSE450R01W2K3004.msp
PSE450R01W2K3007.msp
PSE450R01W2K3008.msp
PSE450R01W2K3009.msp
PSE450R01W2K3010.msp
PSE450R01W2K3029.msp
PSE450R01W2K3033.msp
PSE450R01W2K3036.msp
PSE450R01W2K3042.msp

PSE450R01W2K3032.msp -  Limited Release hotfix

These hotfixes were generally deploying well to all servers, but I've noticed an odd situation that's sometimes occurring when I push the entire package group to a brand new server.  It seems that during the deployment of PSE450R01W2K3008.msp it sometimes stalls the installation of the IM Package Group (i.e. it does ever seem to finish).  Upon further investigation of the MSI log, I'm seeing where the problem is occurring.  Here's a snippet of the MSI log with the relevant MSI action that's hanging the install:

MSI (s) (08:30) [11:11:00:350]: Executing op: ActionStart(Name=CtxComPlusAppRegister.E289452F_B008_4882_ABB2_77E22692D9C4,,)
MSI (s) (08:30) [11:11:00:350]: Executing op: CustomActionSchedule(Action=CtxComPlusAppRegister.E289452F_B008_4882_ABB2_77E22692D9C4,
ActionType=3073,Source=BinaryData,Target=CtxComPlusAppRegister,
CustomActionData=CitrixLogServer.E289452F_B008_4882_ABB2_77E22692D9C4=key_app_name=CitrixLogServer
key_type=2
key_component=C:\Program Files\Citrix\System32\CitrixLogServer.dll
component_tlb=C:\Program Files\Citrix\System32\CitrixLogServer.tlb component_psdll= component_install_state=3 component_action_state=3
key_role=__all role_install_state=3 role_action_state=3 key_user=networkserviceuser_domain=nt authority
key_property=Identityproperty_value=nt authority\networkserviceproperty_type_value=6)

 

So the stall in deployment seems to occur when the COM+ Registration for CitrixLogServer.dll is attempting to happen.  So what now?

So I've narrowed down my issue to a COM+ registration issue, now what?

One word....Google :)

After search for this COM+ registration issue, I came across a Citrix Support Forum thread with the same MSI error that's happening to people when trying to install PS 4.5 straight up.  So people seem to have this problem during the installation of PS4.5 and not from a specific hotfix like I'm having.

In response to that support thread, Citrix has published CTX113639 where they acknowledge an issue with PS 4.5 installation during the COM+ registration of the CitrixLogServer.dll.  Citrix supplies a custom MSI transform (MST) to install PS 4.5 with if you're having this issue.

So there's definitely a COM+ issue, but why?

I opened a private support thread with Citrix to find out what specifically is contained in that MSI transform that's allowing the installation to proceed where it otherwise would not.  I received a response from Citrix that stated the issue with the original install and what is being resolved by the transform is that the installation routine is attempting to resolve the SID of the Network Service account using a Win32 API call named LookupAccountName.  According to Citrix, when this call is being made there are certain situations within AD environments that will cause this lookup to take a long time to resolve.  Something about broken domain trusts, blah blah blah.  Well I was pretty certain that there weren't any domain trusts in this environment, but I wanted to try and validate what Citrix was telling me.  So I got some source code that utilized LookupAccountName from Advapi32.dll.  I ran the code and performed a SID lookup on NetworkService.  It returned S-1-5-20 within a fraction of a second.  Well, either I was misled or there's something else going on.

Dealing with the stalled hotfix deployment

Since I was unable to determine the root cause of the COM+ registration issue in my first attempts, I decided to see what I could do to resolve this issue without having to spend tons more time debugging it.  I began with the obvious choice, I rebooted the server with the stalled deployment.  To my surprise, after the reboot Installation Manager re-targetted PSE450R01W2K3008.msp against the server where it was previously stalled, but this time the installation completed within seconds.  Hmmmmmm.  So now what?

Bring on HRP02

Considering the combined issue that I really didn't want to reboot the servers during the IM package group deployment AND Citrix recently released HRP02 which includes PSE450R01W2K3008.msp, I decided to at least investigate using HRP02 as a solution to my issue.  I'm pleased to say that HRP02 installed on both existing servers with the older hotfixes, as well as fresh servers without any Citrix hotfixes without a hitch.  The other great news is that Citrix seems to have resolved the issue that plagued HRP01 where MSI self-healing would trigger because of Speedscreen Browser Acceleration when deployed on servers that had a larger E: drive than C: drive.  I know it's an obscure problem, but it happened to me and at least a few other people out there based on the support forum threads.

So now I'm rolling with HRP02 and PSE450R02W2K3001.msp.  So far, there's been no issues. 

 

4/16/2008 8:21:57 AM

Page:   of 5