But as always I figured I’d share this feature in case anyone else needs it.

So RDP files encrypt a password in a very specific way and details online are cagey.This is something I set about doing myself and I’m happy to annouce I’ve included it in the following Free Powershell module for your use!

The module is very simple:

Importing the module:

Import-module RDS.Password.dll

Converting a string to a password:

Get-RDPPassword -Password "SomethingSecure"

This will give you an rdp password, pre formatted for an rdp file.

Optionally, you can include -ToClipboard to copy the text to the clipboard for easy copy -> paste into an RDP file.

Get-RDPPassword -Password "SomethingSecure" -ToClipboard

And that’s it, simply import the module and off you go.

If there is anything further you want to do with this, i.e. providing an RDP file to enter it into, accepting PSCredential as an argument or anything like that, get in contact and we’ll see what we can do!

Consent:

This module is provided absolutely free of charge, using this module in a commercial product on the other hand is not condoned!

Also, don’t ask me to reverse it, i’m not going to do it.

Download:

Here:

So VMware Horizon 6.2 was announced at VMworld just a week ago and the one feature I sorely wanted to see was automated provisioning (golden image management) of a Microsoft Remote Desktop Services farm.

The provisioning process is fairly straight forward, so in this blog post I’ll walk you through the steps to avoid any issues.

Prerequisites:

• Download the Agent, Connection Server and Composer software.
• Upgrade your Connection Servers to 6.2.
• Upgrade your Security Servers to 6.2 (remember you’ll need to repair with the connection servers).
• Upgrade your Composer.
• A Microsoft RDS server.

Once the upgrade is complete of the core infrastructure, lets hop to the Customisation Specification.

Creating a Customisation Specification:

So I originally missed this step completely and was left red faced after hours of troubleshooting and pestering some names in VMware (Sorry Ben, Pat, I’ll RTFM next time!).

I’m going to do this demo in the “God Awful” web client, but its the same in the GUI Console anyway.

Open the web console, and select Policies:

Select Customisation Specification > new:

Select Windows, Create a Logical name and description, then click next:

 Enter some organisational specific info, or not, who cares, click next:

On the Computer name Tab, for the sake of convenience, choose “use the virtual machine name”, click next:

Enter a product key if you wish, or rely on KMS, click next:

Enter the local administrators password for after the sysprep, then click Next:

• Select the relevant timezone, click next:
• Do not configure a “run once”, click next:
• Select which ever networking method you like, DHCP is probably easier,click next.
• Enter the domain name and credentials to domain join. Then Click Next:

Ensure to select “Generate New Security ID” then click Next:

Click finish on the Final page and ensure your new template shows (mine disappeared the first time, sneaky so and so):

Preparing the target:

Now lets hop first to the Remote Desktop Services target and install / upgrade the agent software!

Select the agent on the RDS server and kick off the installer:

Select Next, Agree to the license, choose IPV4, IPV6 if you’re crazy and click Next:

On the next screen, ensure to enable the “VMware Horizon View Composer Agent” and select Next:

after that, finish the install. Restart once, Shutdown and snapshot the VM.

Onwards!

Creating the Automated Farm:

Open the Horizon console and head to Resources > Farms > Add:

Select Automated Farm and click Next:

Select the vSphere server, select  Next:

Enter the Farm Name, click Next:

Enter the naming pattern for the farm servers, select Next:

Enter your Vsan details if you opted in to that sort of thing, click Next:

On the vCenter settings, choose the VM we configured in the target section earlier, select OK:

On the SnapShot selection, choose the Snapshot we created and click OK:

After that, just select whatever you want and click Next:

On the storage selection, choose your own settings then click Next:

Select The guest settings, including the Specification we created earlier:

Once finished, simply click finish and pray you’ve gotten everything right:

And that’s it! go have a coffee and check to ensure you have a VM after the deployment:

Now to create a pool:

Select catalog > Desktop Pools > Add:

Choose RDS Desktop Pool, Select Next:

• Name the Pool something useful, then select Next:
• Set the Pool settings, then select Next:

Select the newly created farm, then select Next:

Select “Entitle users after this wizard finishes” then select Finish:

Click Add, enter the group you wish and click OK once selected:

Click Close:

Now open the horizon client, tada!

• ThinIO facts and figures, Part 1: VDI and Ram caching.
• ThinIO facts and figures, Part 2: The Bootstorm chestnut.
• ThinIO facts and figures, Part 3: RDS and Ram caching.

In the final blog post in this series, we’re going to discuss storage design and a frequent problem face when sizing storage. Lets get right into it:

“Designing for average, is designing for failure”

Peak IOPS:1015, Average IOPS: 78

A frequent mistake I see customers and consultants alike make is taking an average of a sizing requirement and using that as a baseline for sizing environments.

Looking at the figures produced from our internal load tests, we saw just an average of 78 IOPS required on write from a vanilla server without ThinIO to provide storage from this XenApp server.

Now frequently, people will take a figure like that, throw in 25% for growth and bob’s your uncle, ‘order the hardware Mr SAN man’. When I have questioned them about that assumption, they’ll often respond “oh it will be a bit slow if theres contention but it’ll even itself out”.

Right? Wrong.

Things don’t go slow when they are over subscribed, they stop.

Don’t take my word for it! Lets do some simple theoretical math:

If you take a storage device and allocate 100 IOPS to this machine, what’s going to happen when a peak like 1000 IOPS is requested? A lot of queuing. 

In theory, keeping to the 100 IOPS figure, that 1 second burst IO is now taking over 10 seconds to satisfy (1000 / 10).

But it gets worse, all subsequent IO that is requested after that spike occurred is going to also be haulted waiting for this task to occur.

Assuming you’re now mid spike and 10 seconds later the request is finished… taking your average figure, you now have 10 seconds worth of 100 IO’s per second potentially queued up behind…

Low and behold another login occurs and? STOP. Storage timeouts, twirly whirlies, application crashes, hour glasses and the good old “logins are slow”.

Oh ok, So how do I size to accommodate this? 

Well you’re between a rock and a hard place aren’t you. You can’t tell users when to login, the price tag of a SAN sized for peak activity + 20% is going to cost you more than your entire desktop estate. And as you can see, it’s never safe to assume it will run slow. 

Buying into shared storage is a tricky business 

Storage is expensive. Very expensive. It always annoys me when you hear vendors in this space refering to themselves as ‘reassuringly expensive’. To me this directly translates to ‘We can charge what we want, so we will and you can be reassured we feel the price tag is worth it.’

Storage was never written with desktop workloads in mind, it was written for ‘steady state’ server workloads and was in the progress of going the way of the ‘dodo’ (extinct) up until that first release of vMotion requiring shared storage, which some say was the saving of the market.

Many vendors are going with software or hardware intelligent tiering. This is a great feature, but the real question to ask is how frequently data is moved from the hot tier to lower tier? Press your vendor on this as they more than likely wont know! Microsoft storage spaces is a prime example of this with a really poor optimisation process of just once a day!

Then ask yourself what happens when a base image update occurs and changes the disk layout of the base golden image? Further, stateless technologies from the bigger vendors delete the differencing disk on restart, can you be sure the new disk is going to end up in the smaller, faster SSD or RAM tier? Or is data up there already in contention?

RAM is far less tricky

RAM is commodity, available in abundance and throughout every virtual desktop project I’ve architected and deployed, you run out of CPU resources in a ‘fully loaded’ host way before you will run out of RAM. RAM has no running maintenance cost, Ram is an upfront CAPEX cost and requires little to no maintenance.

The beauty of what ThinIO does with the little resources you assign it, is turn that desktop workload into a healthier and happier server workload of minimal burst IO and a low steady state IO requirement.

Note the peak of just 40.5 IOPS and average IOPS of less than 2.

with as little as just 200mb cache for each of the 10 users logging in, within an aggressive 3 minute window, we reduced the peak from 1000 to 40. That’s a 96% reduction in burst IO.

With ThinIO, you:

• reduce your exposure to massive IO spikes.
• Improve user logon times.
• significantly reduce your daily IOPS run rate.
• Increase user productivity by spending less time waiting for the storage.
• Commit to nothing up front, test it and see how well it works. If you are happy, then buy in.

Lots of Intelligence baked in:

ThinIO is acutely aware of key operating system events that will cause these kind of spikes and react accordingly to reduce the spikes in IOPS created. ThinIO constantly watches the behavior and IO pattern of the storage and tunes itself accordingly.

Unlike other technologies, ThinIO is a true caching and performance solution. We do not move useful data in and out of the cache on demand when cache availability is contencious. We track patterns and frequency of block access to respond accordingly, delivering all the benefits we have mentioned, even with the tiniest cache, without EVER reducing the capability of the storage when overwhelmed.

And on the opposite side of the scale, when underworked, we leverage our cache to deliver deeper read savings as above.

ThinIO also has a powerful API and PowerShell interface to allow you to report and interact with the cache on demand.

Wrap up:

And with the end of the series looming, allow me to finish on some easy points:

 ThinIO Allows you to:

• size your SAN outside of the Lamborghini category & price tag for your desktop estate.
• rapidly achieve far deeper density on your current hardware when you are feeling the Pinch.
• guarantee a level of performance by assigning cache per VM, disallowing other users to steal or hamper caching resources.
• Improve user experience and login times immediately.
• Reduce the impact of boot storms and similar IO storm scenarios.

No other vendor can offer as quick a turn around time with their product. ThinIO installs in seconds and offers a huge range of compatibility.

One more thing:

In case you missed ThinIO’s launch day at E2EVC Barcelona, ThinIO is now in GA, available from our website and production ready! More marketing to follow! But grab your copy now and get playing!

To recap, below you will find the previous articles:

• ThinIO facts and figures, Part 1: VDI and Ram caching.
• ThinIO facts and figures, Part 2: The Bootstorm chestnut.

Off topic note:

two years ago at an E2EVC event, the concept behind ThinIO was born with just a mad scientist idea amongst peers.

If you are lucky enough to be attending E2EVC this weekend, David and I will be there presenting ThinIO and maybe, just maybe there will be an announcement. Our session is on Saturday at 15:30 so pop by, you won’t be disappointed.

Back on topic:

So here’s a really interesting blog post. Remote Desktop Services (XenApp / XenDesktop hosted shared) or whatever you like to call it. RDS really presents a fun caching platform for us, as it allows us to deal with a much higher IO volume and achieve deeper savings.

We’ve really tested the heck out of this platform for how we perform on Microsoft RDS, Horizon View RDS integration and Citrix XenSplitPersonality with Machine Creation Services.

The figures we are sharing today are based on the following configuration and load test:

• Citrix XenDesktop 7.6
• Windows Server 2012 r2
• Citrix User Profile Manager.
• 16gb of Ram.
• 4 vCpu.
• LoginVSI 4.1 medium workload 1 hour test.
• 10 users.
• VMFS 5 volume.

Fun figures!

Diving straight in, lets start by looking at the volume of savings across three cache types.

Reviewing the details for a moment:

Running repetitive tests of at least 3 per cache type, we found even at the lowest entry point we would support (50mb per user) we saw phenomenal savings of over 70% on write IO.

No pressure no diamonds!

To put that into perspective, at a 512 MB cache for 10 users, our cache reached maximum capacity at the second user login. With 8 users still left to login, cache full and still an hours worth of load testing left, our ThinIO technology was under serious pressure.

This is key to why ThinIO is such a great solution. We won’t just perform great until we fill our cache, we don’t require architecture changes or care about your storage type, we have no lead times or install days, we will carry on to work with what is available to use, to take a large ammount of pressure off storage IOPS and data throughput.

With the figures above, you can see just how well the intelligence behind our cache can scale even when it faces such a steep workload.

Below you will find a breakdown of each test:

512 MB cache:

Breaking down into the figures, on the 512mb cache test, it’s clear to see just how well ThinIO deals with the tiniest of caches:

When we side by side this with our baseline averages, you can see we take a huge chunk out of that Spiky login pattern and continue to  reduce the steady state IO as the test continues:

So lets move up and see how we get on!

1024 mb cache:

Doubling up our cache size we see a great increase in both read and write savings as you’d expect.

With 100mb of cache per user, and the average user profile in the test 3 times that size. We are still under pressure. As we will natively favour optimisations to write IO over read, you’ll see the bulk of improvements happen in write when we’re under pressure as illustrated in this test:

With more cache available during the peak IO point, we make further savings on write:

2048 mb cache:

and at our recommended value of 200mb per user in Remote Desktop Services, the results are phenomenal! With this size, even still below the 300mb mark per user profile, the read IO gets a really good boost and the write IO saving well over the 95% mark!

And the side by side comparison is every bit as good as the savings illustrated above, reducing that peak bursty IO to just 41 IOPS:

But there’s more! 

As i pointed out in the previous blog, IOPS are just one side of the story. A reduction of data throughput to the disk is also a big benefit when it comes to storage optimisation, and as you can see we make a big difference:

Wrap up:

So there you have it, with ThinIO, a simple, in VM solution, you can you seriously reduce your IO footprint, boost user performance and achieve greater storage density per virtual machine or on Remote Desktop Services technology.

In the mean time:

If you would like a chance to test ThinIO pre-release, find access to the public beta below. Thank you for your time and happy testing!

Thinkiosk Version 4.0 is the culmination of 9 months hard work, rebuilding ThinKiosk in a new development style to include the enterprise features many of you requested, adding a management server, secure key redirection technologies, local group policy control and a number of other features. After weeks of rigorous testing we’re delighted to announce the availability of ThinKiosk version 4… Today!

With the release of Version 4.0 we’re lifting the cloak on the company we’ve setup in order to support and further develop ThinKiosk, ThinScale Technology. We’ve set up ThinScale as a little software company to publish applications to the virtualisation community, tackling the smaller issues and annoyances we face day to day as consultants and administrators. More clever little products are in the pipeline, but for now enough about the company!

ThinKiosk Versions:

The largest change around ThinKiosk 4.0 is the version introduction. ThinKiosk will ship in two editions, Enterprise edition and Community edition. Remko and I took a look at the product back in October last year and identified area’s that the project needed investment in order to reach and fulfill it’s full potential. We also noted that a number of customers really wanted the support and functionality offered by a professional product. After much deliberation we took the decision at that point to invest the time and resources into the product to ensure it fulfils it’s potential, this in turn justified the need for a chargeable Enterprise product.

ThinKiosk Community Edition.

• The community edition is free and will always remain free, we want to make sure the community will always have the benefit of the product.
• The Community edition is still one of the most powerful Windows alternatives on the market, including paid for products.
• The Community edition is an extremely powerful piece of software with one or two limitations in comparison to the Enterprise product.
• The Community edition will receive functionality from the enterprise edition over time.

We’re extremely proud of the community edition and we do recommend it if you do not require the functionality of the Enterprise Version.

Enterprise Edition.

ThinKiosk Enterprise Edition will include all the current functionality you know and use in ThinKiosk, along with loads of additional features and benefits. The enterprise version of ThinKiosk delivers far more value than the competitor products and from a functionality perspective beats them hands down even in its first release.

An exact side by side comparison can be found along with pricing and details on the ThinScale Licensing page.

Some of the New goodies are listed below!

Central Management:

ThinKiosk 4.0 new central management server. With this central management console, you can:

• Manage off domain machines.
• Push updates.
• Perform remote power commands.
• Remote Control end users.
• Report on your current ThinKiosk hardware.
• and much more.

MagicFilter:

Allow me to introduce our new ‘dynamic key pass-through technology’ MagicFilter. Magic filter will now block local Ctrl + Alt + Del and windows + L keystrokes and “magically” send them on to the remote desktop environment as if the user is working locally. This gives the user an immersive, native feeling desktop experience from the ThinKiosk client.

We are extremely proud to say we are the only Windows Thin Client vendor on the market who can do this.

Integrated Browser:

ThinKiosk 4.0 is a fully fledged browser, so you can allow your users access to web resources without compromising on security. You can layer in as many bookmarks as you like to the browser or you can simply allow the users to browse the sites they wish via the address bar.

And so much more!

I covered a lot of the functionality previews back in April in the feature teaser.

Want to learn more?

Remko and I will be doing a webinar with the good folks over in www.xenappblog.com next week, sign up to hear our story and get some insider information on the product road map!

And without further ado:

I’ve taken enough of your time for now, to jump right in click the download button below and we’ll send you everything you need to get started.

Everyone having a Good Citrix Synergy week? Some great new products announced! Ready for more announcements?

Great!

After 5 months of coffee, tears of frustration and hair pulling we’re absolutely delighted, thrilled and relieved to announce ThinKiosk 4.0 is nearly ready. Complete with my new partner in crime Remko Weijnen (I’ve been saying ‘we’ for ages, now you know who… awesome eh?) we’ve worked some long nights to get this version out the door.

With that out of the way, we’re proud to announce some of the new features coming in 4.0. Bear in mind this is just a preview, the final features and details of the product are still being hammered out, but below is a taster of some of the functionality you can expect to see shortly.

Back to the drawing board:

ThinKiosk 4.0 is a complete rewrite and refactor of ThinKiosk. It’s built on the 4.0 .Net framework which has brought a lot of simplicity and new features to our tool-set. ThinKiosk 4.0 was built with three main aims:

• Enterprise Ready.
• Fool Proof.
• Secure by Design.

With ThinKiosk 4.0, your setup time will go from days to minutes. Out of the box, ThinKiosk is ready for the following technologies without any local machine tuning:

• Citrix XenDesktop / XenApp.
• Citrix VDI in a Box.
• VMware View.
• Microsoft Remote Desktop Services.

For the exact details of each of these optimizations, follow the subsequent blog posts / documentation.

New Look and Feel:

Without further ado, lets start with the new look and feel:

ThinKiosk 4.0 has also been built on the industry leading graphical interface DevExpress giving us a really shiny, professional and sleek interface. Finally giving us an Interface we can be proud to put on your desktops.

ThinKiosk’s interface has been further improved giving you an Applications tab for Publishing desktops for VMware View, Microsoft Remote Desktop services or Citrix Desktops via ICA file or local applications.

This Applications tab has been modelled after the windows 8 Metro err, I mean Windows 8 UI. This provides a similar look and feel to the new Windows start menu and it really breathes new life into old hardware. With this tab, you can publish shortcuts to VDI Desktops or local applications making it a one stop shop for applications.

You can flick from one tab to another easily, or disable the one you do not wish to use.

It’s all about the customization!

Beauty is in the eye of the beholder right? Agreed!

Themes:

 ThinKiosk 4.0 will ship with over 8 themes and wallpapers, customization of the splash screen, buttons… everything!

The Applications tab can also be completely customized to your tastes:

Lock down:

As with Previous versions of ThinKiosk, every button and object in ThinKiosk can be locked down to exactly what you wish, for example here’s a stripped back browser session:

Or a stripped back application window:

Anyway… Enough about the appearance, Lets talk tech!

Introducing the new ThinKiosk Broker Service and Management console:

The ThinKiosk Broker, Management Console and ThinKiosk clients use an all new ThinKiosk TCP protocol (I never ever, ever want to see a tcp socket again for as long as I live, writing this protocol was a killer!) to allow you to centrally manage, catalog and report on your ThinKiosk devices. The protocol is lightening fast and secure by design.

This new framework will form a long blog post itself, but some quick fire information is below:

• Complete off domain management.
• Auto device registration, just point ThinKiosk at the broker and it will check in and download the default profile.
• Remote Control / Shadowing of end point devices via the console.
• Device Grouping for profiling multiple devices or creating an organisation structure.
• Remote actions (power off, restart, update).
• Device Reporting.
• No Enterprise database software necessary.
• Audit logging.

Unlike other Thin Client protocols and software, ThinKiosk does not accept any inbound connections, in user or system context. Removing the ability to hijack thin clients… which is all too possible with certain vendors!

The console is simple, and quick to navigate:

Installation of the broker takes roughly 5 minutes and is ready to serve your Devices as soon as you configure the default profile.

New Profile Handler:

The ThinKiosk client has received an overhaul and with it we’ve streamlined the profile. ThinKiosk no longer requires group policies or the clunky offline config tool, we have a new profile system based on XML files with a fitting profile editor to match:

No more configuring 5 group policies for one url, the new policy manager is clean, self explanatory, full of new functionality and uses the same interface whether you are using the ThinKiosk management console or modifying the local profile.

If you want to still use group policy to deploy configuration? No problem! just drop the file on the client via group policy preferences!

And the Client!

Lets talk about the 4.0 client.

Supported platforms:

Windows XP – Windows 8

Browser Ahoy!

ThinKiosk is now a fully fledged browser, complete with address bar. If you want to allow your users to browse around, now you can.

Browser improvements:

The ThinKiosk 4.0 browser will:

• Supress scripting errors.
• Allow you to add your sites to the trusted sites via policy.
• Auto tunes the browser for VDI portals.
• Auto circumvent silly SSL untrusted or mismatched errors (great for POC’s *cough* VDI in a Box *cough*)
• ThinKiosk now runs as an Internet explorer executable. No more flicking between iexplore.exe and thinkiosk.exe.

VDI Improvements:

Now to the nuts and bolts!

Local login pass through:

Now that you have the ability to add direct VDI connections. ThinKiosk will handle the log in experience and pass the credentials to the responsible technology:

This integration allows ThinKiosk to better manage the desktop experience and provide your users with a single login pane rather than the recurrent login screens you can experience with Microsoft / Citrix file connections.

These connection files can also be auto launched, to remove that pesky click first thing each day.

Citrix Technologies:

• Log off screen redirection for Web interface, storefront and VDI in a box.
• Log off the web portal when a desktop launches for the above platforms.
• Support for Adding ICA file connections.
• Auto configuration of Single sign on from local pc to remote desktop. (Nightmare previously).
• VDI in a Box auto browser tuning for compatibility.
• Optionally disable the Citrix Desktop viewer (CDviewer.exe).

VMware View:

• Support for publishing multiple pool connections
• Support for publishing multiple direct desktop connections.
• Support for PassThrough.
• Disables Certificate checking by default for quick POC’s.
• Pass through ctrl alt del / Windows + l (more on this later).

Microsoft Remote Desktop Services:

• Support for publishing multiple connections.
• Support for 2012 RDS and VDI.
• SSL Certificate warning suppression.
• Support for login once.

Improved local application handling:

ThinKiosk 4.0 has an improved local application engine, When you add an application to the Applications tab, it will automatically pull in the icon window and you can also specify to launch apps but hide them (think run key entries). If ThinKiosk is restarted via admin task, it’s smart enough to know not to relaunch them.

Environment variables for paths and arguments are fully supported and i’ve also added a variable for 32bit program files paths… I always wondered why Microsoft didn’t do this, but I digress.

Windows secure keystroke blocking and passthrough:

You asked… (and asked and asked and asked and asked). It’s done, with ThinKiosk 4.0 you will be able to block CTRL + Alt + Del, [Windows] + [L] etc.

Pass through of these keystrokes to the remote desktop is available for VMware View already and will be coming shortly after 4.0 for Citrix and Microsoft connections.

Group Policy Lockdown:

By default when you install ThinKiosk 4.0, it will arm the PC with the most restrictive policies via the local group policy engine, disabling access to all admin utilities and even local disks. This lockdown can be tuned or turned off via policy if required.

ThinKiosk performs privileged actions via the ThinKiosk Machine service which installs as part of the installation.

Auto log in account:

ThinKiosk will ship with it’s own user account for fast deployment. This account will be created on the local machine and gives you a quick an easy method to manage local accounts on non domain joined PC.

The accounts password is synchronized with the ThinKiosk unlock password you specify.

This account is completely optional and you can turn it off or substitute it with a domain account of your choice.

ThinKiosk will also manage the Windows Shell replacement policy itself via policy, so no more mucking around with local group policy or registry keys.

ThinKiosk also now encrypts the auto login account using LSA.

Active Setup:

With ThinKiosk as shell, you can now run Active Setup with ThinKiosk’s improved Active Setup Async.

Active setup Async is a utility we have implemented into ThinKiosk that will perform active setup 60% faster than standard Microsoft active setup via a threading and queuing engine, the end result is active setup support ( for example: HDX flash redirection) with a much faster (and prettier)  interface.

Start up Script:

ThinKiosk can now implement the local group policy engines start-up script to allow you to manage off domain PC’s. With the start-up script, you can install software, updates, disable services, uninstall software, delete files, profiles… anything!

The only limitation here is your own imagination or scripting abilities.

If the latter is a concern? worry not, we’ll be creating a scripting library where ThinKiosk enthusiasts can share and collaborate on similar tasks.

Local session control:

ThinKiosk 4.0 offers you the ability to control local volume, printers, screen saver and even background color.

Improved debug logging:

ThinKiosk logs everything, every action, command, hiccup… everything.

If something isn’t quite working as expected, chances are the debugging window will announce in triumphant glory exactly what is broken!

Redundant profile management:

ThinKiosk takes a copy of it’s profile on each check in to an FTP server or Broker server.

In the event of the server being offline ThinKiosk attempts five times to connect before failing back to the local profile allowing your users to continue working without an outage.

If the broker server becomes available again throughout the day, ThinKiosk will check back in to allow management but will not disturb the user.

And so much more!

I’m not going to go on and on, but as you can see… It’s awesome!

Check back in a few weeks for the release as we ready the build.

Hi Guys and Gals. I’m currently fighting the good fight with Microsoft support and require your help and backing in order to close down a long standing bug in the Windows Explorer Shell.

As you are all aware, hiding the c: drive and restricting access has been a utility we use frequently in shared computing and VDI environments. Restricting this functionality removes views of the shared drive from users and adds a layer of security and complexity* to ensure the users in question have access to only what they need in order to do their jobs day to day.

*I’m not looking to argue the merit of doing this either, it really depends on the business case or environment to dictate whether this option is set. I’m NOT saying it should be done in every case.

We all know it’s not fool proof, there are certain ways for users to circumvent this layer and I particularly don’t want to discuss them here to give potential devious users a landing page for idea’s!

The problem:

Prior to windows Vista, when you hide the c: drive and an application requests access to a c: drive folder, be it from an “open save dialog” or otherwise, Windows detects this event knows that the folder is restricted and merely redirects them to the desktop which they can see then browse to where they wish to open or save a document. This has worked fine to memory since windows server 2000.

But with the changes to Windows Vista’s windows explorer, repeating the above steps will result in the following annoying, unnecessary and interrupting error message “This operation has been cancelled due to.. bla bla blah”:

This issue can be easily recreated, simply hide and restrict the c: drive, then click start > run > browse… bang.

The more annoying problem here, is after the error message, windows simply redirects back to visible folder. In most cases this is the documents library. So the error message is simply poping up then reverting to the functionality seen in previous operating systems.

So to review:

• Issue introduced in Vista / 2008 and above.
• error message displays.
• Previous redirect functionality is still there and occurs after ok is pressed.

To Microsoft!

Being a pedantic individual, along with my colleague we brought this to Microsoft support and somehow lost months in the conversation as follows:

1. Microsoft then redirected us to RES Software.
2. Who (although very nice about it) sent us back to Microsoft.
3. At which point I got involved.

Now with the correct audience and suitable severity, this problem has been identified as “introduced in Windows Vista” as an “Added Security feature“. How an annoying pop up box, masking previous functionality is a security feature is anyones guess, but it’s bloody annoying…

We have raised this as a bug and have requested Microsoft to fix it. The change in question was deemed as large change or substantial change due to WIndows explorer being used by all of the operating systems and basically told, without significant backing, this change wont be implemented.

Bureaucracy and broken policies, yes but that doesn’t help my customer.

Here’s where I need you:

In order to bolster this change and fix an issue in our beloved operating systems for Server Based Computing and VDI environments I need to hear from you and your customers to confirm they have had this issue, or currently face the issue and wish for a fix.

• If you are a customer and suffer this issue, email me.
• If you are a consultant and have customers with this issue, email me.
• If you or your customer have enterprise support with Microsoft, I ESPECIALLY want to hear from you.

What’s in it for you?

Microsoft have provided us a work around, as a process that watches window messages and suppresses this dialog box when it occurs. If you get in touch, I’ll recompile this application with Microsofts permission and pass it on to you for use in your environment while we get “The Man” to fix it!

This fix is a bit of hack, as it’s scraping window messages but it’s light weight and scalable. Use this process for now and I’ll provide you with updates on a fix as and when I get them.

How do you contact me?

Please drop me and email on andrew{at}andrewmorgan{dot}ie with the following information:

• Customer name:
• Affected users:
• Has enterprise support: (yes/no)

Once I have that information, I’ll send you back an executable via dropbox and keep you updated on the call process. This information is merely going to be fed straight to Microsoft with my personal guarantee of confidentiality. No funny business.

If you can’t share customer information, but have suffered this issue in the past, no problem! Please comment on this blog post the number of seats that were affected and roughly how many times you’ve seen it.

That’s it!

Thanks for entertaining my request for help and hopefully you too want to get this issue fixed as much as I.

Not happy with the Irk, and still on my app developing buzz, i decided to write SBC Printers:

SBC-Printers is a simple little .net 4 application, leveraging WMI for printer enumeration and control.Because SBC Printers is an executable, it can published as a XenApp application. Sbc Printers can also be installed as the default printers interface on the start menu:

So really your users won’t know the difference or care for that matter!

SBC-Printers also comes with securable options for adding or deleting local printers:

The display of add or delete can be controlled via the settings file in the installation directory:

Installation:

1. Download the following MSI
2. Install the MSI to the default directory.

To restrict the standard printers dialog from users, but leaving it accessible to administrators:

• Browse to c:program files (x86)SBC-Printersbin

• run the powershell script below, make sure to run it as an administrator!

That’s it, once the Powershell script runs. it removes the users access to the registry classes giving them access to the standard devices and printers interface. Which means we’re now ready to provision SBC-Printers to replace it.

Provisioning the replacement to the user:

Now just import the userkey.reg into the users profile on login, you can do this via your user profile manager of choice, or use Group Policy preferences.

That’s it!

As you can see I haven’t streamlined the install process too much, this is mostly down to the simplicity of the tool. If you like SBC-Printers but would like a better installer, just drop me a comment below.

Roll back:

if you need to restore the standard interface, uninstall SBC-Printers then add the (local computerusers) group back to the following registry keys ACL:

•  HKCRsoftwareclassesCLSID{A8A91A66-3A7D-4424-8D24-04E180695C7A}
• HKCRsoftwareWow6432NodeCLSID{A8A91A66-3A7D-4424-8D24-04E180695C7A}

ThinKiosk 3.0 is another ground up redevelopment of the tool, 2 months ago I broke the program beyond recognition to add support for shared libraries and reduce the number of active components in the program. It’s fast, lightweight, it’s been a long time coming and I am absolutely thrilled with the result! 

WIth that out of the way and without further ado, there are hundred’s of changes to ThinKiosk, below are just the highlights:



Additional support:

• Added support for Citrix StoreFront services 1.2 (Cloud Gateway).
• Added support for VDI in a Box 5.1 (no open prompt!)
• Added support for internet Explorer 10 as the local browser.
• Added support for Windows 8 as an end point.
• Added support for Windows Embedded Standard 8 as an end point.

New Features:



EULA:


This isn’t exactly a new feature, but I want to be as forthcoming about this as possible. I’ve added an EULA to ThinKiosk. There is nothing untoward, there’s no lock in, it just says its free to use, you can’t resell it, and you can’t sue me if you do something stupid.

Ultimately, it just protects me (a free tool developer) from lawsuits.


Languages:


The Norwegian language has now been added, thanks Thomas!

All current languages have been updated (spanish, french, dutch, italian, German)

Startup marquee:

 


On particularly old or slow pc’s the startup time for ThinKiosk can be quite lengthy while ThinKiosk loads the embedded browser.

To address this delay, a splash screen with progress marquee has been added to provide feedback and keep the user entertained.

Screenshot and email functionality:

You can now allow ThinKiosk register the [PrintScreen] key, which in turn will allow the user to use this key to send an error or issue directly to the helpdesk, including support information via SMTP.

By default, email and screenshot functionality is disabled, until you add SMTP options via policy or offline config too.

Thanks Shane for the idea!



Progress bar:

When loading slow to load URL’s, it can be difficult to tell whether the website has hung, or it has just taken some time to load. By default ThinKiosk 3.0 will ship with an “on demand” progress bar to tell you when ThinKiosk is busy.


Wireless Networks:



Beta support for Wireless Networks has been added via the control panel

This functionality will only currently work with:

• Windows 7
• Windows Embedded Standard 7.
• Windows Thin PC

Note: this setting is disabled by default, but can be enabled via the group policy or offline config too.


Language Selection:


Probably the most requested feature so far, I’ve finally added a drop down for Language selection as below:



This drop down will allow the users to change the language on the fly. This option can be disabled via group policy or the offline config tool.



New items in the admin menu





The admin menu now contains some very useful commands for administrators when troubleshooting end points:

• Task Manager.
• Internet Explorer Control panel.
• Restart /Exit ThinKiosk.
• Remote Desktop connection.
• Offline Configuration Tool.



Desktop launching dialog:

When using Web interface log off on session launch, ThinKiosk performed the task so quickly that the user was often left a little confused as to what has happened and why they have been kicked out before the session finally launched. ThinKiosk will now provide feedback when a new session launches or when workspace control is busy reconnecting and has a 2 seconds hold down timer before it kicks the user off the web interface.

End of session options:

Previously when a remote session ended, you had an option to log the local user off. This was particularly useful if you were using Citrix Pass through authentication. A recurring request was to add the ability to restart, or shutdown the pc. This is now included in the offline config tool and group policy.

Classic Colours:

A number of fussy individual’s didn’t appreciate my lightsteelblue colour scheme change, for you guys (you know who you are) you can now disable the colour change on startup via group policy or offline config tool if grey is your thing.

Process Launcher:

A new feature in ThinKiosk 3.0 is the process launcher. Instead of loading ThinKiosk as a browser session, the process launcher simply launches the process you specify, and only displays the ThinKiosk menu bar at the top for user convenience.



This process launcher, will launch the process you configure, watch the process and relaunch it if the user accidentally closes the window!

Process launcher also has all the user empowering options available, along with power management. This functionality is all free as aposed to paid for solutions delivering half this functionality!
As below, you can use the Process launcher for Microsoft Remote desktop connections:

Or VMware view!:





Or basically any process you would like to use. This functionality is quite new, so if find issues with it, I want to know about it!

Offline Config Tool improvements:



Restructure:


The offline config tool has been reordered to provide a better structure to settings.





Policy awareness:



The offline config tool will now detect values specified in group policy or in user key’s it cannot control and warn you that these values exist.

The apply button has been removed from the offline config tool, it wasn’t needed or working exactly as I wanted it to.

Bug fixes / enhancements:

ThinKiosk Layout changes:


Resizing ThinKiosk has been moved to a more native location as below:





The clock and language selection are now enabled by default:





Advanced functionality:



ThinKiosk can no longer be run as a standalone executable, the shared.dll must be available too, Don’t say I didn’t warn you.

Changing zones in internet explorer while ThinKiosk is running used to result in a crash (e.g moving a domain from the internet zone to trusted sites). This crash is now handled and you will receive a warning icon to restart ThinKiosk at your next convenience. Please note, circumventing this crash will disable Auto log off and log off redirection until ThinKiosk is restarted.

When navigating to a url with an untrusted SSL certificate, by default an embedded browser will not allow you to continue without prompting for scripting errors. These scripting errors in turn stopped Citrix Web Interface from working in multi farm environments. Support has been added to allow scripting errors only when an untrusted ssl cert is requested.

ThinKiosk will now amend the feature controls neccessary for embedded browsers on a per user basis. This will allow for better native support for ActiveX and Mime types. This will cause a quick restart as soon as ThinKiosk launches if a change is neccessary. This will also handle the upgrade to Internet Explorer 10 seamlessly. This process can be disabled via the offline config tool / group policy.

All shared code between ThinKiosk and the Offline config tool has been moved to a shared library! it wasn’t fun, it wasn’t easy but it will make things alot easier for me in future when making changes.

And it’s still free!


ThinKiosk development has taken quite some time and it takes time to support you via email. If you use ThinKiosk in your environment or appreciate the savings its made for you, please consider making a donation to help me keep this project alive… I would really appreciate it as it will allow me to invest in better development tools to make the product look and feel even better!

Download:

The download links for ThinKiosk are available above, or here:

In this customers environment, they are using XenApp 6.5 on Server 2008 R2 for published desktops, this environment is a hosted desktop environment for a number of countries in Europe.

Infrequently an issue could be observed where the users timezones would shift out by one or two hours within the Lotus Notes application. This would case SameTime conversations and Calendar times to display out by the aforementioned value above.

When this issue occurred, it happened to all users on the server. A restart of the server did not fix the issue.

Interestingly, a “TZUtil /g” was reporting the client was in the correct time zone:

If you ran “TZUtil /s GMT Standard Time“, then closed and opened Lotus Notes… The problem was resolved for that user, in that session until they logged off.

It’s worth pointing out, that this issue was only seen in Lotus Notes, not in any other application, java or otherwise.

When comparing the TimeZone settings from a problematic server to a working server, I found the following difference:

These keys are stored under:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTimeZoneInformation

And the working server looked as follows:

Now that is weird! So we copied the correct keys from the server to server and the issue was resolved. On all servers once users closed and opened Lotus Notes again.

But what caused this?

With a work around in place, I began to dig deeper into what caused the timezone to change on the servers despite the fact that no users have the ability to do so.

Analysing the logins to the servers, I spotted an administrator account logging into each of the servers as the day went by. This user didn’t log into the correctly working servers so this was the first clue.

Now if you’ve used Lotus Notes combined with XenApp and timezones before, you’ll know its a complete nightmare, interestingly the administrator in question (me, shamefully), was logging onto a XenApp session with a linux timezone to replicate an issue.

More embarrassingly, I then decided to Remote Desktop inside of the XenApp session to the affected servers, and with my admin account being who it was… inadvertently changed the timezone for the servers it seems.

That doesn’t sound right? You rdp’d from a client in a different time zone and it changed the server timezone?

I agree, but I have since been able to replicate this in a test environment. As with Server 2008 Microsoft now handle the timezone redirection themselves as part of group policy and administrative accounts will change the timezone of the server intermittently.

Now most customers probably wouldn’t even notice this, unless they are using lotus notes, as all other applications behaved correctly.

How do you work around this issue?

Ensure that the Group Policy you use to configure timezone redirection is configured to “not apply” to any local administrator on the XenApp server that may log in.