Home Sitemap Feedback About... Print
Custom Search

TS + Citrix Troubleshooting


TS & Citrix FAQ - Client resources

  1. How can I verify that my local COM ports are redirected?
  2. How can I prevent my users from redirecting their local resources, like drives and clip board?
  3. How can I allow only a subset of my users to redirect their local printers and drives?
  4. How can I copy files to my local disk drive from the command prompt / with a batch file?
  5. How can I see the free disk space on my redirected local drive?
  6. How can I prevent the security warning when I use local drive redirection?
  7. How can I connect to my local scanner or digital camera in a TS session?
  8. Can I use multiple monitors with my rdp session?
  9. How can I roll out Custom ICA Connections to use with Citrix Program Neighboorhood to all my users?

Other FAQ sections: Installation | Server configuration | Client resources | User issues | Licensing | Printing | Connectivity | Profiles | Performance | Applications | Administration & Monitoring | More FAQS


Q: How can I verify that my local COM ports are redirected?
Last modified: June 17, 2007

A: Start a command window and type the following command at the prompt:

   change port /query
The output will look something like this:
   AUX = \DosDevices\COM1
   COM1 = \Device\RdpDrPort\;COM1:15\tsclient\COM1
   COM2 = \Device\RdpDrPort\;COM2:15\tsclient\COM2
   COM3 = \Device\RdpDrPort\;COM3:15\tsclient\COM3
   LPT1 = \Device\RdpDrPort\;LPT1:15\tsclient\LPT1
   PRN = \DosDevices\LPT1

From the above, you can see that COM1-3 and LPT1 are redirected. The number 15 is the session id, so that will change depending on the current session id.

If they are not redirected, the output will look something like this:

   AUX = \DosDevices\COM1   
   COM1 = \Device\Serial0
   COM2 = \Device\Serial1

For a different solution, check:
314354 - How To Programmatically Determine Whether Serial Ports Are Redirected to a Terminal Server Client Computer

If your COM ports are redirected correctly, but you cannot connect to the device on the local COM port, check this:
938645 - You cannot communicate with the local device by using a redirected COM port in a Windows Server 2003-based terminal-server session

Top of page | FAQ | Home


Q: How can I prevent my users from redirecting their local resources, like drives, printers and clip board?
Last modified: June 17, 2007

A: If you are running the Terminal Server, you can disable local resource redirection here:

   Terminal Services Configuration - Connections - RDP-tcp - Client Settings
   Disable the following: 
      Drive mapping
      Clipboard mapping
      Windows printer mapping
or use a Group Policy:
   Computer configuration - Administrative templates - Windows Components - Terminal Services - 
   Client/Server data redirection
   "Do not allow drive redirection" 
   "Do not allow clipboard redirection" 
   "Do not allow client printer redirection" 
If you are not in control of the Terminal Server (it is run by your ASP), then you can disable redirection on the clients by adding these keys to the registry:
   HKLM\SOFTWARE\Microsoft\Terminal Server Client\
   "DisableDriveRedirection"=dword:00000001
   "DisableClipboardRedirection"=dword:00000001
   "DisablePrinterRedirection"=dword:00000001
Or disable all redirection:
   HKLM\Software\Microsoft\Terminal Server Client\Default\AddIns\RDPDR\
   "DisableDeviceRedirection"=dword:00000001

If your users have only User rights on their local PC, they will have read-only access to the above key. This will prevent them from overriding this setting.

Top of page | FAQ | Home


Q: How can I allow only a subset of my users to redirect their local printers and drives?
Last modified: July 30, 2007

A: On a Windows 2003 Server, the settings in Terminal Services Configuration or GPO to restrict printer and drive redirection are server-wide settings. They don't allow you to configure redirection based on user group membership. You can, however, achieve this by creating multiple RDP listeners and enable/disable printer and drive redirection on a per listener basis.
The only disadvantage of this method is that each listener must use a unique port. For example, you could have the redirection disabled listener on port 3389 and the redirection enabled listener on port 3390.

The Terminal Services Configuration tool doesn't support creating more than a single listener per network card, but there's a way around this: export this registry key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
modify the key name (i.e. change "RDP-Tcp" to "RDP-Custom"), the PortNumber (i.e. change from 00000d3d to 00000d3e), add a descriptive comment to the "Comment" value, save the .reg file and double-click it to import the new key into the registry.

The new listener is ready to receive connections immediately, and you will be able to edit the settings from within Terminal Services Configuration tool.
Modify the permissions on the rdp-tcp connections so that *only* the redirection enabled User Group and Administrators have permission to connect via the redirection enabled listener.

187623 - How to Change Terminal Server's Listening Port
304304 - Configuring the Remote Desktop Client to Connect to a Specific Port
326945 - How to Change the Listening Port in the Windows Terminal Server Web Client

On a Windows 2008 Server with TS Gateway you can use multiple Terminal Services Connection Authorization Policies (TS CAPs) to accomplish selective restriction of local resource redirection, based on security groups.

Top of page | FAQ | Home


Q: How can I copy files to my local disk drive from the command prompt / with a batch file?
Last modified: November 15, 2007

A: In My Computer, your redirected local drives are shown as "C on <your_client_name>" and you can use the normal techniques for copying files in the GUI between your TS drives and your local drives. To copy files to your local drives from a command window or with a batch file, use the following command:

   copy <path_on_TS> \\tsclient\<drive_letter_on_client>\<path_on_client>
Example: if you want to copy C:\test\test.txt on the Terminal Server to D:\user1\data on your client, use the following command:
   copy C:\test\test.txt \\tsclient\D\user1\data
If you are connecting from a Macintosh client, the syntax is:
   copy <path_on_TS> \\tsclient\<HD_name_on_Mac>\<path_on_client>

Top of page | FAQ | Home


Q: How can I see the free disk space on my redirected local drive?
Last modified: June 17, 2007

A: In My Computer, your redirected local drives are shown as "C on <your_client_name>" and you can use the normal techniques for copying files in the GUI between your TS drives and your local drives. But Explorer won't show you the properties of your redirected drives, and it won't show you the available free disk space. To be able to see those properties, you will have to assign a drive letter to your redirected drive. This can be done with use the following command (which you also can put in your login script):

   net use <drive_letter_on_TS> \\tsclient\<drive_letter_on_client>
Example: if you want to assign the letter U to your redirected USB drive, which has been assigned the letter D: on your client, use the following command:
   net use U: \\tsclient\D

Top of page | FAQ | Home


Q: How can I prevent the security warning when I use local drive redirection?
Last modified: March 9, 2008

A: When you connect to a remote computer with local drive redirection enabled, you receive a security warning: "This maybe potentially unsafe. You should proceed only if you trust the computer you are connecting to".

You can prevent the security warning by adding a registry key with a value that says to not prompt for redirection.

In regedit.exe, navigate to this key:
   HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\LocalDevices
For each remote server, create a REG_DWORD value with a data value of 1.
For example, if the server is named myserver.mydomain, you would create a REG_DWORD named myserver.mydomain with a data value of 1.

Top of page | FAQ | Home


Q: How can I connect to my local scanner or digital camera in a TS session?
Last modified: January 20, 2008

A: That depends on both the client and the server OS.

Windows rdp version 6 has native support for redirection of Windows Portable Devices – this includes media players based on the Media Transfer Protocol (MTP) and digital cameras based on the Picture Transfer Protocol (PTP). It does not support scanner redirection.
A requirement for PnP device redirection is that you are running Vista Enterprise or Vista Ultimate on the client and are connecting to a Vista or Windows 2008 remote computer.

Windows rdp version 5 does not support redirection of scanners or digital cameras. This is documented here:
931946 - The "From Camera or Scanner" menu option is unavailable in Office XP and Office 2003 programs during a terminal server session

So if you need scanner redirection, and/or your server is running Windows 2003, you will need some 3rd party software.

Citrix Presentation Server 4.0 (Enterprise and Advanced Editions only) provides TWAIN support; redirection of local scanners and USB attached digital cameras are supported. If you want to use a scanner connected to a thin client, make sure that the thin client runs XP embedded. You need XPe because you need to install the scanner driver on the client.

Other solutions are based on sharing the scanner on the network. This can be done with a number of 3rd party utilities:

Other devices, such as keyboards and printers, work perfectly well when connected to a local USB port, thanks to Device Level redirection. For an explanation of Device versus Port Level redirection, see Citrix KB article CTX816193 - USB Support in MetaFrame Products, which applies to Citrix PS 3.0 and native Windows 2003 Terminal Services.

Top of page | FAQ | Home


Q: Can I use multiple monitors with my rdp session?
Last modified: March 25, 2008

A: Unfortunately a RDP 5.x session does not support multiple monitors. The session window itself can be stretched across multiple monitors if it is not in Full Screen mode but it does not support multiple monitors within the session. This is documented here:

302090 - Cannot View Program with a Remote Desktop or Terminal Services Connection

A workaround is to open 2 different sessions and run each one on a separate monitor.

The Remote Desktop client in Vista and XP SP3 (rdp version 6.x) does support multiple monitors. Read the details on the Terminal Services Team Blog : Multi Monitor support in the Vista TS Client and Using Terminal Services RemoteApp™ programs on multi-monitor client computers

You might also need this
942610 - The color depth is unexpectedly changed to 8-bit when a high screen-resolution setting is used in a terminal-server session that is connected to a Windows Server 2003-based computer

Matrox sells a device called Matrox EpicA, a hardware and software multi-display solution for thin computing environments. More information: http://www.matrox.com/graphics/epica/.

Top of page | FAQ | Home


Q: How can I roll out Custom ICA Connections to use with Citrix Program Neighboorhood to all my users?
Last modified: January 25, 2009

A: Custom connections are defined in 2 ini-files: appsrv.ini and pn.ini.
There are 3 sets of ini-files: the installer set, the client set and the profile set.

Short description:
You modify the installer set on a test client, copy it to the client set on each client and delete the profile set for each user. When users start PN without the profile set, they take a copy from the client set and place it in their profile set.

Long description:
Create your custom connections on a test client. Exit PN and copy the newly modified appsrv.ini and pn.ini (from %userprofile%\Application Data\ICAClient on your test client) to a network share, rename them to appsrv.src and pn.src. Verify that these files contain your new settings. They are plain text files, you can open them with notepad.
Then create a logon script for your users. In this logon script, you have to do 2 things:

  1. copy \\server\share\appsrv.src and pn.src to C:\Program Files\Citrix\ICA Client on each user's client
  2. delete appsrv.ini and pn.ini from each user's profile, i.e. from %userprofile%\Application Data\ICAClient
When the user starts PN, it will notice that appsrv.ini and pn.ini are missing from its normal location in the user profile. PN will copy new appsrv.ini and pn.ini template files from the *.src files in C:\Program Files\Citrix\ICA Client.

Note that this method will delete any custom settings that the users might have made themselves. If that's a problem, then you will have to do the update a bit more sophisticated, by creating a script which merges your modifications with the existing .ini files in the users' profiles.

Useful reading: Chapter 2 of the .ini/.ica File Reference

Related issue: How Do I Get a Modified WEBICA.INI Pushed Out for Citrix ICA Clients 10.1 and Higher - by Carl Webster

Top of page | FAQ | Home