Citrix CC-VAD-CC cheat sheet

A Site is the top-level container for all configuration; it contains one or more Delivery Controllers (typically 2+ for HA), machine catalogs, delivery groups, and policies.

Delivery Controller is the central management component that communicates with the hypervisor, brokers user connections, and stores configuration in the Site database.

Site database (SQL Server) holds configuration; each Controller caches data locally. Use SQL high availability (Always On) for resilience.

Citrix Cloud vs on-premises: Citrix Cloud hosts the control plane; on-premises requires you to manage Controllers, databases, and StoreFront.

StoreFront authenticates users and enumerates resources; it can be deployed on-premises or use Citrix Workspace (cloud).

VDA (Virtual Delivery Agent) registers with a Controller; registration requires a healthy VDA and network connectivity to the Controller.

Machine catalogs define the source of virtual machines (MCS, PVS, or existing); delivery groups map users to machines and assign access.

Scaling: use multiple Controllers, separate SQL, and ensure StoreFront is highly available (server group + load balancing).

Design considerations: user geography, hypervisor choice, storage, network latency, and profile management strategy.

Install Delivery Controller on Windows Server; prerequisites include .NET Framework, SQL Server (local or remote), and IIS for Director/StoreFront if co-located.

Controller installation requires a Site database; create a new Site or join an existing one. The first Controller creates the Site.

StoreFront installation requires IIS; configure authentication (Windows, forms-based, SAML) and add stores to enumerate resources.

Director is installed with the Controller; it provides monitoring and troubleshooting. Requires a database and can be integrated with Citrix Cloud.

VDA installation: choose machine type (Server OS for multi-session, Desktop OS for single-session) and register with a Controller.

VDA registration: ensure the VDA can resolve the Controller FQDN and that firewall ports (80, 443, 2598, 8008) are open.

Use Citrix Studio (included with Controller) to manage catalogs, delivery groups, and policies.

Silent installation via command line: use /quiet and /noreboot for automated deployments.

Post-installation: configure licensing (Citrix license server), enable Remote PC access if needed, and test with Citrix Workspace app.

Machine catalog: collection of physical or virtual machines; types: Server OS, Desktop OS, Remote PC Access, or Citrix Provisioning.

MCS (Machine Creation Services) provisions VMs from a master image; supports full clones and fast clones (copy-on-write).

PVS (Provisioning Services) streams a shared vDisk to target devices; requires a PVS server and a vDisk store.

Delivery group: assigns users to machines from a catalog; defines which applications/desktops are available and access permissions.

Power management: configure peak/off-peak hours to start/stop machines based on demand; requires hypervisor connection.

Machine catalog update: for MCS, update the master image and roll out; for PVS, update the vDisk and reboot targets.

Delivery group types: Desktops (full desktop) or Applications (published apps); can include both.

Use tags to restrict which machines are used for specific delivery groups or policies.

Test catalog creation: ensure the hypervisor connection is configured and credentials have sufficient permissions.

StoreFront store: defines authentication, servers (Controllers), and resources; users access via Citrix Workspace app or web.

Authentication methods: Windows Integrated, Forms-based (username/password), SAML (for federation), and Citrix Gateway (NetScaler).

StoreFront server group: multiple StoreFront servers for HA; configure using the StoreFront console or PowerShell.

Citrix Workspace app: client software that connects to StoreFront or Citrix Cloud; supports Windows, macOS, Linux, mobile, and HTML5.

Workspace configuration: set default store URL, enable auto-update, and configure account settings (email discovery).

Beacon points: used for network location detection; configure internal and external beacons for optimal routing.

StoreFront scaling: use load balancing (NetScaler) and ensure server certificates are valid.

Troubleshooting: check StoreFront logs (%ProgramFiles%\Citrix\Receiver StoreFront\Logs), IIS logs, and authentication provider settings.

Citrix Workspace (cloud) vs StoreFront: cloud uses Citrix Cloud connectors; on-premises uses StoreFront servers.

Citrix policies: control session settings (e.g., clipboard, drives, printing), filtering by users, machines, or groups.

Policy priorities: policies are evaluated in order; higher priority (lower number) wins. Use the Policy Modeling Wizard to test.

Citrix Profile Management (Profile Management): handles user profiles; configure via GPO or Citrix Studio; settings include profile path, exclusions, and streaming.

Profile Management features: active write-back, profile streaming, and folder redirection to improve logon times.

Folder redirection: redirect user folders (Documents, Desktop) to network share; configure via GPO or Profile Management.

Citrix Workspace Environment Management (WEM): optimizes user environment, manages profiles, and applies policies.

Policy templates: import ADMX/ADML files for Citrix policies; use the Citrix Group Policy Management snap-in.

Troubleshooting policies: use Resultant Set of Policy (RSoP) and Citrix policies are logged in event logs.

Best practices: avoid conflicting policies, use filters (e.g., client IP, user group) for granular control.

PVS: streams a vDisk image to target devices over the network; uses a PVS server, vDisk store, and a write cache (RAM or disk).

PVS vDisk modes: Private (persistent), Standard (shared, read-only), and Difference (writes cached).

MCS: provisions VMs from a master image; uses hypervisor APIs to create VMs; supports full clones (dedicated) and fast clones (shared).

MCS machine catalog types: Random (non-persistent) or Static (persistent); Random uses a difference disk.

PVS vs MCS: PVS is better for large-scale, image streaming, and physical machines; MCS is simpler and hypervisor-integrated.

PVS write cache: configure to RAM or disk; insufficient cache can cause performance issues or crashes.

MCS update process: update the master image, then update the catalog; for fast clones, use the rollback feature if needed.

PVS vDisk update: use the vDisk Update Management feature to automate updates via a maintenance VM.

Troubleshooting: check PVS server logs, stream service status, and network bandwidth for PVS; for MCS, check hypervisor permissions and storage.

Citrix Director: monitors sessions, machine utilization, and failures; provides help desk tools (shadowing, session reset).

Director alerts: configure alerts for failures, high load, and registration issues; integrate with email/SMTP.

Citrix Analytics: cloud service for security and performance analytics; requires data collection from on-prem or cloud.

Troubleshooting tools: Citrix Diagnostic Facility (CDF) tracing, Event Viewer, and Performance Monitor.

Common issues: VDA registration failures (check Controller connectivity, firewall, time sync), session launch failures (check policies, licenses).

Logs: Controller logs in %ProgramData%\Citrix\Broker; StoreFront logs; VDA logs in %ProgramData%\Citrix\VirtualDesktop.

Supportability: use Citrix Scout to collect logs and diagnostics; run Scout from Controller or VDA.

Performance: monitor CPU, memory, disk I/O on VDAs; use Director to identify bottlenecks.

Licensing: ensure license server is reachable and has sufficient licenses; check grace period.

Authentication: StoreFront supports Windows, forms-based, SAML, and Citrix Gateway; use multi-factor authentication (MFA) for external access.

Citrix Gateway (NetScaler): provides secure remote access; configure ICA proxy, authentication policies, and session policies.

Access control: use delivery group permissions (Allow/Deny) and tags to restrict access to machines and applications.

SmartAccess: filter policies based on access conditions (e.g., user location, device type) using Citrix Gateway.

TLS/SSL: secure communications with certificates; enable HTTPS on StoreFront and Gateway.

Security best practices: least privilege for admin roles, regular patching, and auditing via Director or Citrix Analytics.

Citrix Cloud security: uses Citrix-managed identity provider or integrate with Azure AD; configure SSO.

Session security: enable session watermarking, disable clipboard/drive redirection for sensitive users via policies.

Troubleshooting authentication: check StoreFront authentication service logs and Gateway authentication policies.