Policies and User Profile Management
Two policy systems
Citrix policies (Studio > Policies, or AD GPO using the Citrix ADMX templates) define HDX behaviour: adaptive transport, session reliability, clipboard, drive redirection, printing, graphics mode. Windows policies define the OS and, importantly, Profile Management settings. When a Citrix policy and a Windows policy configure the same setting, the Citrix policy wins-so a GPO "fix" may appear to do nothing.
Each Citrix policy has a priority (1 is highest) and filters. Filters of different types combine with AND; multiple values within one type combine with OR. Unfiltered policies apply to everything-use them as the baseline, then add filtered overrides at higher priority.
Filter types worth memorizing: Access Control (Gateway/SmartAccess), Delivery Group, Delivery Group Type, Client IP, Client Name, User, Machine, Tag.
Profiles
Citrix Profile Management captures user settings into a user store. Key options: profile container (VHDX mounted at logon, best for Outlook OST and similar data), active write back, streamed profiles, folder redirection and exclusion lists. WEM can add CPU/RAM optimization and container management. Keep the user store on SMB with DFS-N, grant users access only to their own folder, and exclude containers from antivirus real-time scanning on both the file server and the VDA.
Worked example. Contractors on unmanaged devices must not copy files out. Policy A, priority 1, filtered on Access Control = Gateway: clipboard redirection disabled, client drive redirection disabled. Policy B, priority 2, unfiltered: clipboard both directions and drives enabled. Internal users match only B; external users match both, so A's settings win on priority. The restriction lives in the filtered policy while the permissive baseline stays simple.
Traps
- Assuming lower priority number means lower precedence; 1 is highest and 0 is not valid.
- Using a Client IP filter for roaming laptops and wondering why behaviour changes at home.
- Editing the unfiltered baseline policy for a single department.
- Deploying profile containers without importing the Profile Management ADMX templates, so nothing is actually configured.