Log into a server / client without the EdgeSight plugin installed, and browse to the edgesight website. Once logged in, you will receive the usual prompt to install the software:

Install the software and ensure it works, then fire up a command prompt and browse down to “c:windowsdownloaded program files”. Once in this folder, a DIR will reveal the ActiveX plugin “csmdbprov.dll”.

Now simply copy this file out to shared storage:

Once done, now its scripting time!

Below are two examples in batch (.bat , .cmd) or PowerShell (.ps1) for achieving this:

(please amend h:csmdbprov.dll to the path you use)

Batch:

[sourcecode language=”text”]
copy h:csmdbprov.dll "c:windowsdownloaded program files"
regsvr32 /s "c:windowsdownloaded program files"
[/sourcecode]

Powershell:

[sourcecode language=”powershell”]
if (test-path h:csmdbprov.dll){
copy-item H:csmdbprov.dll ‘C:WindowsDownloaded Program Files’ -Force
start-process regsvr32 -ArgumentList "/s ""C:WindowsDownloaded Program Filescsmdbprov.dll""" -wait
}
[/sourcecode]

It can be extremely useful when retiring new hardware, or doing inventory as below:

Using your preferential database browsing tool, browse over to the edgesight database and view the contents of the DBO.Box_asset as below, this table will give you a view of the types of hardware on which you can create your reports:

Take a note of the Hardware types above and lets jump over to edgesight and start creating the groups.

Logged into the EdgeSight console, go to the configure tab, Device management, Groups:

Click the new group button:

On the new group tab, configure the relevant names and the options you require, below is an example:

Once happy with the options, click create group.

On the Member Type selection, choose Queries.

On the query page, select new query:

Name the query as you wish then paste the following in below (replacing %query% with the hardware type you have identified above).

Note: a % is the equivalent of a * in sql language.

select i.instid
from instance  as i inner join machine as m on i.machid = m.machid
inner join box_asset as b on b.boxaid = m.boxaid
WHERE b.model LIKE '%query%'

Once finished, click the test query button to ensure you have the results you desire in the window as above.

Assuming you are happy with your result, Click save query, Add query then next, then finally Finish.

Once complete, browse to Device Management, devices and in the dropdown you’ll see the newly created groups on which you can run reports.

Edgesight doesn’t seem to have any API’s or command line interfaces to hook into. For this reason my scripts are based on connecting to the Edgesight database and retrieving the information with SQL statements. This presented a really fun challenge for me as I’m an SQL novice. I learned quite a bit in a short period of time by writing this powershell module.

With the following module you can run scheduled tasks to connect to your edgesight database and add / amend your user groups with ease.

First, some caveats, warnings and limitations of Edgesight you should be aware of:

• My SQL statements have been tested fully internally and work flawlessly, that being said Always backup your database before you attempt to use these modules.
• Each Edgesight group has a unique GUID assigned when it is created, for this reason you must manually create the Edgesight groups before attempting to import users.
• Each user has a unique identifier in Edgesight called a PRID, if Edgesight has not seen a user before, the PRID will not exist. As such, you cannot import a user who has not logged into the environment before.

The Module:



I have sealed the necessary commands for this job into a self contained module you can import on runtime.

The module needs to be edited by hand before you first use it. This is to specify the credentials you wish to use to connect to the Edgesight database.  I have included options for trusted connections and SQL account logins. For more information on this read the Configuring the module section below.



Module Components:

This module has the following commands embedded to be used as part of your maintenance scripts:

Get-ESGroups

• Retrieves the name and ID of each Edgesight user group

Get-ESGroupMembers

• Retrieves all members PRID’s of a specified user group.

Add-ESGoupMember

• Ensures the user isnt already in the group.
• Adds a specified user to a specified group.

Remove-ESGroupMember

• Remove a user via their prid from a specified user group.

Clear-ESGroupMembers

• Removes all members from the specified group.
• Reports the amount of users removed.

Get-ESUserPrid

• Looks up a user by name (samaccount name / login name) and returns their Prid.
• Warns if the user doesn’t exist.

Get-ESUserName

• Looks up a user by Prid and returns their login name.
• Warns if the user doesn’t exist.

Dowloading the module:



You can download the Edgesight Module from my box.net account here. Remember to continue down this blog post to see how to use the modules for your best chance of success.



Configuring the module:



Once you have downloaded the module, you need to edit it by hand before you first use it. This is to specify the credentials you wish to use to connect to the Edgesight database.

Configuring the SQL Server and database name:

• Change the $SQLServer variable (labeled 1: below) to the sql database server or instance name you wish to connect to.
• Change the $SQLDatabase variable (labeled 2: below) to the sql database name you wish to connect to.:



Below is an example of how this should look:

Configuring the SQL login details:



I have included options for trusted connections and SQL account logins. Here’s a brief description of the two options available to you when configuring your authentication for this module:

• A trusted connection is a connection using your logged in details.
• A non trusted connection requires a SQL user account and password with modify rights to the edgesight database.

Using a Trusted connection:

• Configure the $SQLTrustedConnection variable as $true
• You can then ignore or remove the $SQLUsername and $SQLpassword variables.

An example of how this should appear is below:

Using an untrusted connection:

• Configure the $SqlTrustedConnection variable ( labelled below as 1:) as $false
• Configure the $SqlUserName variable as the SQL username labelled below as 2:) with the afforementioned access rights.
• Configure the $SQLPassword variable as the SQL user’s password (labelled below as 3:)

Note: remember to wrap the username and password in quotes.

An example of how this should appear is below:

Once you’ve configured the Module to suit your environment, simply save it.



Importing the Module:



Once you’ve modified to module to suit yourselves, its time to import the module and see if you’ve configured it correctly.

I suggest you change  your executionpolicy to unrestricted with the following command first to remove any overzealous security warnings:

set-executionpolicy unrestricted

Now, open a powershell window and run the following command: (where c: is the location of the module)



import-module C:Citrix.Edgesight.Cmdlets.psm1

The module will either error out telling you that the details are incorrect as below:

Or confirm a database connection has been established:

If the module imported correctly, try one of my powershell functions to see if you can retrieve information.

For example, try:

get-esgroups

Adding and removing users from groups:



Once we have the module imported, now we can get to the important task of modifying the memberships of edgesight  groups. Lets do this manually once so we understand the process for active directory imports later.

1: To retrieve an Edgesight user Group’s group ID, run the following command:

get-esgroups

For this article, we’ll assume we want to add users to “All Access Gateway Users”, so the groupid is 11.

2: To clear the group, we can use the following command:

Clear-ESgroupmembers -GroupID 11

The command should return the amount of deleted users



3: Because we need the Edgesight user’s PRID to add the member to the group, we can achieve that by running the following command: (where “user” is the users name is the login name)

Get-ESUserPrid username

I’ve omitted the username for privacy reasons.



4: Once we have the PRID we can now add the user to the group:

add-esgroupmember -GroupID 11 -Prid 26

If this returns no error, this has completed successfully



5: To confirm this user is now in the correct group, try:

get-esgroupmembers -GroupID 11

You should see you user added as above.



You can also check this in Edgesight by reviewing the group details:

I’ve omitted the username for privacy reasons.



So now that we know a single user import works, lets try an active directory import.



Importing from Active Directory:

you will need the following items for this task:

• a Powershell module or snapin for listing members of groups. *
• The active directory name group.
• The GroupID you wish to add the users to.

The basic concept behind this task, is to clear the current group then repopulate it with users from AD. Above I’ve walked you through one user, so now you understand the concept and can modify the script to import in bulk safe in the knowledge you know what is happening.

Now that you understand the process, its just a matter of using a powershell snapin or module to list active directory users and import them one by one.

Below you will find two examples using the quest and microsoft tools. These are fairly basic examples as each persons needs are different, the module is robust and flexible enough for you to script your own solution using these modules and I’ll happily help if you have a specific requirement not covered by these basic examples.

*In reference to the powershell module, they are numerous and available online, for the sake of completeness I’ve included the Quest tools & the Microsoft ActiveDirectory module below for reference.



Quest Active Directory Snapin:

Below you will find an example on how to use the Quest active directory snapin for powershell to retrieve users from the group “Active directory user group” and populate the Edgesight user group 20 with these members.

For convenience, you can download this here:

[sourcecode language=”PowerShell”]
import-module "C:citrix.edgesight.cmdlets.psm1"
add-pssnapin Quest.ActiveRoles.ADManagement
$group="Active Directory User Group"
$esgroupid=20

#clear the group before import
clear-esgroupmembers -groupid $esgroupid

#get users from group, then import them into edgesight
foreach ($user in Get-QADGroupMember $group -type user -indirect -sizelimit 0){
$prid = get-ESUserPrid $user.logonname
if ($prid -NE $null){
Add-ESGroupMember -groupid $ESgroupid -prid $prid
}
}#end For
[/sourcecode]

Microsoft ActiveDirectory Powershell module:

Below you will find an example on how to use the Microsoft ActiveDirectory module for powershell to retrieve users from the group “Active directory user group” and populate the Edgesight user group 20 with these members.

For convenience, you can download this here:

[sourcecode language=”PowerShell”]
import-module "C:citrix.edgesight.cmdlets.psm1"
import-module activedirectory
$group="Active Directory User Group"
$esgroupid=20

#clear the group before import
clear-esgroupmembers -groupid $esgroupid

#get users from group, then import them into edgesight
foreach ($user in Get-ADGroupMember $group -recursive){
$prid = get-ESUserPrid $user.samaccountname
if ($prid -NE $null){
Add-ESGroupMember -groupid $ESgroupid -prid $prid
}
}#end For
[/sourcecode]

Keeping your groups up to date:

Once you are happy that you have gotten the code to work for your environment, you can simply run these scripts as scheduled tasks and the groups will be cleared and repopulated when the scheduled task runs.

It’s that simple.

Getting further help with these modules:



Once the module is imported, you can retrieve help on any of these commands by running “get-help (command)”, where command is the command you wish to retrieve help from.

I’m also quite happy to support and expand this module is necessary as I really enjoyed this project. Drop me a comment or email: andrew (at) andrewmorgan (dot) ie and I’ll see if I can help you with this.

With the request in hand, I went back to the drawing board and attempted to Re-Engineer this task with limited success. In the end the quickest solution I found was to simply modify the “Session Details for a User Group” report to include the query I covered in my previous copy.

This wasn’t without peril, many of the labels will cease to work when you re-upload your report, so there was quite a bit of manual intervention to make the report pretty again.

I do intend to follow up with a powershell script to help populate Edgesight user groups from active directory. Check back later or follow me on twitter for updates.

I’ve shared this report file below for anyone to use and below you will find the steps to take in order to complete this task.

Note: Ensure you have configured your Access Gateway Web Interfaces to differenciate access gateways connections, I covered this before here:

1: Download the file here from box.net and place it somewhere you can easily access from your browser:

2: Open your browser and login to your edgesight instance:

3: Once logged in, choose the Configure tab:

4: From the left hand menu, Choose Custom Reports:

5: Choose Upload a Report:

6: Browse to your file, then fill in the details as below, Click Upload:

7: Confirm your new report has been uploaded, then click the report to do a test run:

Select your Desired values, then click Go:

the output show appear as below (account details have been omitted):

First, we need to uniquely identify users as they come through the access gateway. To do this we change the web interface site to tag workstation names differently for access gateway connections.

Log into your web interface and Identify the site used for your access gateway.

• For Web Interface 4.5 and 4.6
  • edit the session.aspxf file located in the C:inetpubwwwrootCitrix<site name>app_datasiteserverscripts folder.
• For Web Interface 5.0
  • edit the SessionUtils.java file located in the C:inetpubwwwrootCitrix<site name>app_codePagesJavacomcitrixwipageutils folder.
• In either case, change the following line

From: deviceInfo.setClientName(clientName);
To: deviceInfo.setClientName(clientName.Replace("WI_","AG_"));

Note: The length of the client name must remain the same. For example, WEB0 cannot be substituted for WI_

Now that your users will be uniquely identified with their client name starting with AG_, time to move to edgesight and write your custom user group:

Open the Edgesight client, and browse to user configuration:

Select user groups from the left hand menu

Select new user group

Name the user group something relevant e.g. Access gateway users, and press “Create user group”.

Select Queries and choose next

again, give the query a relevant name, and enter the following in the query:

Select sessid from vw_es_usergroup_ica_users where client_name like "ag_%"

Save the query, then click back, then next again.

Choose the new query you have created from the list, then choose Add query below.

Now select Finish.

Now we wait until the next data upload occurs. This is configured in your agent properties…

Once the data upload has occured, move to the Browse tab in edgesight

Find the report near the bottom called “user login details for a user group”

Select the user group you specified from the user group dropdown, then choose Group by Date, then by user then by all.

you should now get a meaningful report on access gateway connections: