Microsoft Archive – Page 2 of 4

FSLogix App Masking in Citrix Environments

What is App Masking and what do we need it for?

App Masking minimize the number of Golden Images required, by allowing all applications to be installed in a single Golden Image. The mapping and separation of applications (as well as printers, fonts, office add-ins, Internet Explorer plug-ins, etc.) is done without packaging, sequencing, backend infrastructure or virtualization.

This is achieved by granular access control of the installed applications through App Masking Rules. These rules can be used to completely hide the application in an user runtime, so that it no longer appears in the file system, registry or under programs and features.

Because no additional ressources are required by the system when using the rules, applications run at their native speed.

Citrix Virtual Apps and Desktops & WEM 2003 is released

The new current releases of Citrix Virtual Apps and Desktops, Workspace Environament Management & Citrix Provisioning are now available. They contains many new features compared to the last LTSR.

ADV190023 – Enable LDAPS in Windows DC and Citrix ADC

Important Info:
The scheduled update (ADV190023), regarding LDAP Signing and Channel Binding for new and existing domain controllers, scheduled for March 10, 2020, has been postponed to the second half of calendar year 2020. The March 2020 update will only provide additional auditing capabilities to identify and configure LDAP systems before they become inaccessible with the later update.

The later update results in no more connections to the domain controller, via unsigned / Clear Text LDAP on port 389. Then it is only possible to use either LDAPS via port 636 or Signed LDAP (StartTLS) on port 389.

FSLogix Container (Office/Profile) in Citrix Environments

Recently, I have been involved more and more in projects where Office365 is to be fully implemented in Citrix environments. This means that the customer not only needs the standard Office applications Outlook, Excel and Word, but also wants to use teams and OneDrive.

But this is exactly where we, without additional software, have big problems in non-persistent desktop environments. For example with our profiles (Team Installer stores its data in the profile) or so that the data is downloaded from the Internet every time (excluding OneDrive Sync data in the profile).

However, we have recently been in the fortunate position of being able to use FSLogix “free of charge” for this purpose, if we meet the following requirements:

Microsoft 365 E3/E5
Microsoft 365 A3/A5/ Student Use Benefits
Microsoft 365 F1/F3
Microsoft 365 Business
Windows 10 Enterprise E3/E5
Windows 10 Education A3/A5
Windows 10 VDA per user
Remote Desktop Services (RDS) Client Access License (CAL)
Remote Desktop Services (RDS) Subscriber Access License (SAL)

Activation of Azure AD Seamless Single Sign-On

For quite some time (Beginning of 2017) it is now possible to solve SSO scenarios with Azure even without ADFS infrastructure. However, it is only recently that companies has started to not insist on ADFS. Now one may finally also point out the alternative solutions of Microsoft.

The possible scenarios for Seamless SSO are:

Pass-through authentication (PTA)
Password Hash Sync (PHS)

Pass-through authentication (PTA)

Disadvantages

No automatic detection of leaked login data
Azure AD DS requires enabled Password Hash Synchronization feature in tenant to work
Is not part of Azure AD Connect Health

Password Hash Sync (PHS)

“Disadvantage“

Password is synchronized to the cloud (as hash value)