TS + Citrix Troubleshooting

TS & Citrix FAQ - Applications

My application runs fine for Administrators, but not for normal users
My application runs only for the Administrator who installed the application, but not for normal users or other accounts with Administrator rights
User sessions don't logoff when users quit their starting or published application
How can I run a DOS application in full screen?
I need to have an application running on the console. How can I monitor it?
How can I prevent my users from surfing the Internet in their TS sessions?

Q: My application runs fine for Administrators, but not for normal users
Last modified: July 31, 2007

A: Download Process Monitor.
Run Process Monitor as Administrator on the Terminal Server (when no user is connected), start a TS session as a normal user and try to run your application.

Process Monitor will show you all "access denied" errors that occur in both the registry and the file system, so that you can give your users the necessary permissions on a file-to file or registry subkey basis.

Known application permission issues:

QuickBooks

Macromedia Flash Player: give users Read permissions on these keys and their subkeys:

   HKEY_CLASSES_ROOT\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}
   HKEY_CLASSES_ROOT\CLSID\{D27CDB6B-AE6D-11CF-96B8-444553540000}

Top of page | FAQ | Home

Q: My application runs only for the Administrator who installed the application, but not for normal users or other accounts with Administrator rights
Last modified: June 17, 2007

A: Some applications create HKEY_CURRENT_USER registry settings the first time a user runs the program, rather than during installation.

The way to avoid this problem is to run the application for the first time from the Administrator account, immediately after installation, and WHILE THE SERVER IS STILL IN INSTALL MODE.

If you do so, the registry key and ini-file creation is monitored by the server and put into the shadow area of the registry. All users then receive the registry entries and a personal copy of the ini file in their windows folder, when they run the application for the first time.

What you can do now to solve the problem is:

make sure no other user is logged onto the server
put the server into install mode (change user /install)
run the application under an administrative account THAT HAS NEVER RUN THE APPLICATION BEFORE (create a new one if needed)
exit the application
put the server back into execute mode (change user /execute)

Further information:
186498 - Terminal Server Application Integration Information

Top of page | FAQ | Home

Q: User sessions don't logoff when users quit their starting or published application
Last modified: July 3, 2008

A: If you define a Starting application, either in Terminal Services Configuration, a GPO or in the RDP client, the session should be automatically logged off when users quit the application. Sometimes, this doesn't happen and users are left with a session which only shows the desktop background, without the possibility to log off the session manually. The cause for this problem is a process which is still running in the session, preventing it from closing and logging off. The same can happen after quitting a Citrix published application.

To solve the problem, open a connection to the Terminal Server and check in Task manager which process is keeping the session from closing.

For a list of known processes which cause this behaviour, check:

CTX891671 - Graceful Logoff from a Published Application Keeps Sessions in Active State

If you are running native Terminal Services without Citrix, you can still use the method described in the "Resolution" section of the Citrix article, albeit with another registry entry. Windows Terminal Services keeps its list of system processes in the following location in the registry:

   HKLM\CurrentControlSet\Control\Terminal Server\SysProcs

If you have identified the process which keeps the session from logging off, you can create a new REG_DWORD value under the SysProcs key, with the name of the process as the value name.

Top of page | FAQ | Home

Q: How can I run a DOS application in full screen?
Last modified: June 17, 2007

A: Full screen mode for DOS applications is not supported in Terminal Services, as explained here:

192190 - MS-DOS window does not allow full-screen option

The best you can get is an emulated full screen mode, by using a special font.
Details are here: How to run a DOS application in full screen

Top of page | FAQ | Home

Q: I need to have an application running on the console. How can I monitor it?
Last modified: March 9, 2008

A: If the application is running on a Windows 2003 Server, you can connect to the console (=session 0), by starting the rdp client from a command prompt. The flag needed to connect to the console depends on the version of the rdp client you are using. If you run rdp client version 6.0 or earlier, use:

   mstsc /console

If you are using rdp client version 6.1 (included in Server 2008, Vista SP1 and XP SP3), use:

   mstsc /admin

When you have finished your work on the remote console, start a command prompt within the remote session and type:

   tscon 0 /dest:console

This will disconnect your remote session and 'push' it back to the console.

Note that in Windows Server 2008, session 0 is not an interactive session anymore, it is reserved for services. The console session is like any other session. Documented here:
947723 - Changes to remote administration in Windows Server 2008

Top of page | FAQ | Home

Q: How can I prevent my users from surfing the Internet in their TS sessions?
Last modified: November 17, 2007

A: If you want to prevent users from running Internet Explorer alltogether, you can use a Software Restriction Policy:

   Computer Configuration - Windows Settings - Security Settings
   - Software Restriction Policies - Additional Rules - New path rule
   Path: "%programfiles%\internet explorer\iexplore.exe"
   Security level: Disallowed

For a detailed description, check this article:
324036 - How To Use Software Restriction Policies in Windows Server 2003

Another way to achieve the same effect is to change the NTFS permissions on iexplore.exe.

Both methods described above have the disadvantage that users cannot start IE at all, which will probably break other applications. And they won't be able to use your Intranet either.
If you want to avoid these problems, but still disable surfing the Internet, you can set a proxy address pointing to your local Intranet webserver, or the localhost:

   User Configuration - Windows Settings - Internet Explorer Maintenance - Connection - Proxy settings

You can even list allowed websites under "Exceptions".

Top of page | FAQ | Home