wrights

>https://www.duosecurity.com SMS2 will do exactly the same functionality for free, Remote Desktop Services will require either pGINA as a linked to above (also free) or Microsoft's Threat Management Gateway software.

Yubikey should work fine as an authentication device. Using the admin console in SMS2 you can specify a manual OATH-TOTP shared secret, using the Yubikey personalisation tool you can load the same shared secret on your Yubikey. As I understand it you'd need the Yubikey TOTP application installed on the PC, when you reached an authentication screen (in my case the Citrix Web Interface logon screen) you'd doubleclick the Yubikey TOTP application in the system tray and it would query the key and paste the correct code into the token box on the screen. Steve

I've never used it but pGina allows you to use RADIUS for Windows Login, so this should work perfectly with SMS2. If you setup pgina let me know - I'd love to document it and put that on the site for everyone else interested.

Hi, I hope this won't be regarded as advertising (as I'm not charging anything). I've been into loads of schools in the last few years installing XenApp / XenDesktop and two factor authentication seems pretty rare (despite BECTA saying it was a requirement if SIMS and similar were published). My guess is that this is down to costs - £45 - £110 per user isn't going to fly if you have 100 members of staff and 2,000 kids. To solve the above I've written a two factor platform that you're welcome to install for free. It works on XenApp/XenDesktop, SonicWall, etc (pretty much anything. The website is WrightCCS - - Citrix two factor authentication As above, no cost, install it, use it, don't pay for it. It supports hardware tokens (I got mine from Gooze.eu for about 9Euro), software tokens on the iPhone/Android/Blackberry (free), text message (you pay for the texts - the beta version will allow you to use any provider), and in the beta release it also supports voice call authentication (via Twilio). The admin interface does single signon and runs over the network so you'd install the software and publish it via XenApp (or install it anywhere you want) and logged-on users can update their own details. If anyone is interested let me know and I'll give you some help to get it installed (free). Steve

You'll get about 50 VMs running on just 8 disks if the write cache IO actually hits the drives, using something like ZFS L2ARC technology should allow the IO to take place on a solid state disk which allows massively more IOPS and hence substantially decreases the number of normal drives required. The solid state disk wouldn't need to be very large, we'd normally be deleting the write cache when a user logs out.

Multiple PVS (Provision Services) servers can run on the same subnet to allow for failover, when you do this they need shared storage to prevent both PVS servers having to have copies of the VM disks that are being provided. It is quite normal to use two Windows servers with a standard CIFS repository and data (the VM disks) duplicated between the Windows servers using DFSv2, thus the PVS servers don't actually have any real IOPS load. The IOPS load on the Windows servers is read heavy, and as the servers are ideally dedicated and do little other than provide the VM disks the frequency of disk hits can be reduced by increasing system ram available as a disk cache. PVS will also allow you to cache data on the VM (great if you are booting on physical hardware rather than VMs, or deploying XenApp) and to separate the temporary file location (which is write heavy) from the data store used for VM disks (which is read heavy). Believe it or not you don't actually need a lot of hardware for a large scale deployment, the key really is to keep the number of VM disks in use to a minimum and ensure ram is available to decrease hits to the disk. I haven't tried it yet but Sun's ZFS L2ARC technology should really help PVS and further reduce disk requirements.

Keeping traffic such as iscsi separate from the other data by using dedicated interfaces is definitely the way to go. If you have other traffic that doesn't need dedicated NICs and is isolated into VLAN for network management reasons you can configure the bonded interface to support this. Select 'add network' after creating the bonded interface, select 'external network', and create a new virtual 'external network' specify the VLAN number that it should use, and that will allow the bonded interface to support that VLAN.

At the bottom of the screen you will see "management interfaces" with a button to configure, press 'new interface' in the bottom left, add a second management interface using the network that relates to the bonded NICs.

Sorry to bounce an old thread but hopefully it will help when you come back after the Christmas break. If you create a "MyCitrix" account (http://www.mycitrix.com), login, select "Product Previews / Beta releases - License Retrieval", and choose "XenDesktop Evaluation" from the drop down list you'll get a trial licence. After you have a trial licence your "MyCitrix" area will allow you to download XenDesktop - I think the trial is for Enterprise but if you don't deploy XenApp it's very similar. For most setups you would be better to look at Enterprise; a deployment of XenApp will allow you to stream applications into the XenDesktop VDIs so you don't have to maintain a collection of applications in each VDI, it will also allow you to publish a shared copy of commonly used software that runs on central servers thereby decreasing VDI resource requirements and making maintenance much easier.

If you have a Linux server available then a PEM file can be created using OpenSSL. What you actually need the mmc snapin or OpenSSL for is to password the key, if it is already passworded then copying and pasting the certificate and key into the same file will usually work fine. The CAG will not accept the PEM file unless the key has a password.

Citrix Secure Gateway is a Windows application, Citrix Access Gateway (CAG) is an appliance; the process for updating the SSL certificate differs. The CAG's (new) certificate can be uploaded via a browser on port 9001, it must be in PEM format and have a password. A PEM format file contains both a certificate and a key that relates to that certificate, you can produce such a file by exporting the certificate and key from a windows server using the certificate mmc snapin.

Difficult to say if thin clients will work without knowing what software you're going to run, what are the plans? Tizzy's Tools? I would definitely look at NComputing's X550 series devices if the computers will be sitting in small clusters.

This may also help Cool Things to Do with Netsh

I think you will need to script it, the script would look something like this: netsh interface ip set address "Local Area Connection" static 192.168.0.1 255.255.255.0 192.168.0.254 1 netsh interface ip set dns "Local Area Connection" static 192.168.1.200 primary ipconfig /registerdns

It might be worth connecting Wireshark to one of your network ports and looking to see where the incorrect DHCP replies are coming from. If you can see the other DHCP server's MAC address then you can connect to the edge switch and start tracing back the route packets are taking from your end device to the server, you'll pretty quickly discover how it is connected.