Citrix released XenApp 5.0 a few weeks ago, so I thought I would go through the processes required to profile and stream Office 2007 to a desktop. Citrix Presentation Server 4.5 Enterprise and Platinum introduced the ability to package and stream applications to the server or client desktop.
In theory this was a good direction for Citrix. However, in reality the first attempt was a little rough. It worked ok but needed some fixing. With Citrix XenApp 5.0 the streaming profiler and client have been updated and it looks like some of the general bugs and issues customers have had with the technology have been fixed.
I can confirm that some of the bugs and issues I had have been fixed now. One application that would not work now works properly.
Also worth a note is that XenDesktop is a virtual desktop infrastructure product from Citrix that includes XenServer for desktops and XenApp for streamed applications.
I have been using and testing streamed application in Citrix for a year now and for the most part liked the technology. I will now run through the steps required to profile and stream applications in Citrix.
To profile applications all you need is a virtual server with a clean guest machine that matches the type of device you want to stream to. For instance, if you want to stream to a xp workstation you will need a virtual xp workstation that matches as close as possible.
Some applications can not be profiled. Like similar products you cannot stream applications that need to install kernel mode or device drivers. I have read that you can profile an application and then install the service on the client machine, but I would do a lot of testing before doing this in a production environment.
Install XenApp streaming profiler.
- Install the XenApp streaming profiler 1.2. You can find this on the components disk of XenApp 5. You can usually download a trial copy of XenApp from Citrix
- You will also neet to install Dot Net Framework 2
- Copy any software you will want to work with frequently to a folder on the virtual machine
- If you are using a virtual machine to do the profiling on take a snapshot now
I won’t go through every aspect of the Office 2007 preparation. Citrix has produced a very good guide for streaming Office 2007. See this document for how to rollup updates in Office 2007.
Profile Office 2007
- copy the Office 2007 source files to the profiling machine if you haven’t already
- customize your Office installation using setup.exe /admin
- download and extract any service packs and patches to the Updates subfolder of the Office 2007 installation. To make sure your customized msp is running first rename it to aaa_<name>.msp
- open the Citrix XenApp streaming profiler
- click New Profile
- give it a meaningful name
- Select which ever security model you want. I usually use relaxed for testing
- Select your destination system types, languages and service pack levels. Use the lowest common denominator
- Select Advanced Install
- Run install program – browse to and select the setup.exe from the Office installation directory
- Click launch Installer. The office installation will now run through as per your instructions in the MSP file
- Click next and select perform additional installations
- Select files and folders
- Browse to c:\windows\system32 and copy control.exe to c:\windows\system32. This will allow you to use the Mail Profile control panel
- At this point you can install more applications if you like or need to. Just remember the larger the profile the longer it will take to launch.
- You can edit the registry as required to make any customizations needed.
- Click Finish Installations once you’re done
- If required you can run the applications and change any settings you like
- Add a new application in the Select Applications screen. Browse and select control.exe. Set the run and working directories and enter MLCFG32.cpl in the command line parameter
- Click through and finish the profile. The profile will now be built, the time it takes will depend on the size of the profile
- Select the fileshare where you wish to save the profile. It needs to be a UNC path
Isolation rules
Streamed applications isolate the application data from the normal drive files and as a result if you try and save something from a profiled application to a system drive or the drive where the application is installed it will be saved within the application profile. You can get around this two ways.
The first way is to manually edit a file found within the streamed profile once it has been downloaded to the client machine. The file to modify is SandboxData.xml. This is the actual rule sets as they apply. This method is very manual and prone to causing you issues if done wrong.
The second and easiest method is to modify the isolation rules within the application profiler. If you right click on the profiled application you will see a number of options. The one we are concerned with is Rules.
The rule we want to modify is the Default file ignore-rule. We need to do this because the profiled application will essentially isolate all folders on the same drive the application was installed that are not specified to be ignored. What this means is that if you save a file from Outlook into a folder e.g. c:\myfiles it will appear normal. But if you browse the file system you will not be able to find it. This is because the file is actually located within the user part of the streamed application. I simply add environmental variables for additional drive letters e.g. %datadrive% to the rule as well as specific folders that reside on the system drive. Have a play and see the behaviour first hand.
Now the applicaton has been profiled and is ready to be published.
To publish streamed applications you will need a Citrix XenApp 5.0 server with the relevant licenses and a Program Neighbourhood Agent site configured on the web interface server. Part 2 of this article will step through the installation of the Web Interface server and publishing applications to clients.
October 20th, 2008
Very good and informative. I have a question though:
If I stream applications, how do I go about licensing them?
Presumably with Citrix and also ThinApp, you control which users you stream the apps to, but Microsoft license all their products on a per device basis, with CAL licenses…
So to stream MSOffice or Project to a select group of users, I need to purchase device licenses for every device in my site? even though Project is only used by a small proportion of my user base?
Thanks.
October 20th, 2008
Thanks for reading.
When using Citrix XenApp you still need to license Microsoft applications as per normal, that is one for each device.
In Citrix, applications are allocated to users or groups, this includes streaming applications. A further option to allocate users an offline ability also exists.
So no, it is not a solution to licensing. The streamed application can be run on a Citrix Server or on the client. I have heard from vendors like Appsense that using their Application Manager has been accepted by Microsoft for license management.
I guess it is still really an area that needs addressing by Microsoft .
Hope it answers your question.
Colin
October 27th, 2008
Ahhh, thank you Colin.
I dont actually stream applications to my users, but I took a look at the Appsense website following your suggestion nonetheless.
Found a page dedicated to license management : http://www.appsense.com/solutions/licensemanagement.aspx
thinking more about this, when applications are licensed by the device, not the user, where do Microsoft stand on using their own Group Policies and Software Restriction policies to control app access and adhere to the device based license model? I ask as the policies apply to the user, or group of users, and so all devices are still able to run the said applications by the authorised users?!
Hmm, i agree with you Colin, yes, this really does need to be addressed by Microsoft!
Thanks
October 28th, 2008
No problems.
I think when it comes to licensing, factors like software management and deployment are/have not been considered. It seems that Microsoft Licensing is determined by which model makes them more money.
Terminal Service licensing is a good example of this, first you had to buy licenses for each device/user, then a device license was included with Windows XP Professional license. Now they are really moving back towards device based licensing. I have been told that using user based terminal service licensing does not actually check the number of licenses in use.
Just recently I was told a story about Microsoft Licensing. When asked how to license a new VDI installation the response was “We think you need to do it this way…”
So I think when it comes to licensing, as long as you have taken care to stay compliant on paper, and can back up your story with management processes and policies you should be alright in most circumstances.
Microsoft Licensing is always changing, all we can to is try to keep up.
Colin
November 2nd, 2008
[...] you have profiled Office 2007 in part 1 , you need to publish the applications through the Citrix XenApp Access Management Console. But [...]
November 12th, 2008
Hello.
My name is Gareth Kitson, I am a Product Marketing Manager at AppSense.
A few interesting points have been raised here regarding Microsoft application licensing in a streamed or virtual environment, this is a topic I am having conversations about on a daily basis.
Yes, like you state Colin, many Microsoft applications, including Microsoft Office™, Project™ and Visio™, are licensed on a per-device basis. This means a desktop application license is required for each and every device that is able to potentially access the application or server where the application is installed.
As you have both mentioned, licensing applications in virtual environments is a tricky subject, a subject that is often misunderstood. So lets take just two minutes to cover some of the most common misunderstandings as to Microsoft Application/Device licensing in SBC estates.
One misconception is that by ‘publishing’ or ’streaming’ applications to a limited “user” group, that group is compliant with the Microsoft license agreement – in other words, Microsoft licenses their applications per user.
‘Publishing’ or ’streaming’ applications to a limited “user” group is not a valid approach to license restriction, since users within the group can potentially access the application from any device that can connect to the Windows® Terminal Server hosting the application binaries, or, any device the virtualization server can see or stream to. This means desktop application licenses may need to be purchased for devices where the user of that device does not actually use the application.
Furthermore, Microsoft technologies such as Group Policies and Software Restriction Policies cannot be used as a means of enforcing licensing control, as these methods apply to “users”, or groups of “users”. For Microsoft applications which are licensed on a per device basis application access must be controlled at the “device” level.
Colin, you kindly referred to AppSense Application Manager, thank you. To elaborate on this, AppSense Application Manager (is to my knowledge) the only officially, Microsoft endorsed and recognized means of controlling application access on a per device basis in SBC/Terminal Server, Virtual Desktop or streamed application environment with regards to license enforcement.
AppSense Application Manager operates with a kernel level filter driver within the Windows operating system. This filter intercepts all file execution requests prior to an application actually launching, to determine if the request is to be authorized or prohibited. Any unauthorized requests are blocked and the user receives a message, configurable by the administrator, stating that execution has been denied. A flexible and granular rule set enables the Administrator to restrict access to applications by a range of variables, but specific to device based licensing, AppSense can restrict access based on device name or IP address. This enables AppSense Application Manager to effectively control, manage and in most cases, reduce the required number of Microsoft licenses.
AppSense Application Manager also provides detailed insight into user activity and application usage through reporting and auditing functionality. By reporting on application usage at a user and device level, AppSense Application Manager helps organizations verify compliance with Microsoft desktop application license models and provide estimates of license volume typically required across the user base.
To learn more about Microsoft Licensing and how AppSense Application Manager can be used not only to ensure compliance, but also reduce the amount of licenses required, please visit http://www.appsense.com/solutions/licensemanagement.aspx for more information.
Furthermore, a copy of the official Microsoft endorsed whitepaper on Licensing in a Windows Terminal Server environment with AppSense Application Manager can be found at http://www.appsense.com/Files/Documents/Windows%20Terminal%20Server%20Software%20Licensing%20Control%20(US).pdf
If anyone requires further information, please do not hesitate to ask.
Many thanks
Gareth Kitson
AppSense
November 13th, 2008
Gareth
Thanks for your response. It certainly must have taken you some time. Thanks also for providing more detail about the licensing situation. I am aware of the general licensing requirements. I wasn’t sure about Application Manager’s official endorsement from Microsoft.
I do use Appsense in my Environment, but not for License Management, rather performance and control of applications. It is very good for this.
Even though everyone knows the requirements of licensing, especially in SBC environments, so many do not want to take pro-active steps to manage their responsibilities.
Once again thank you for your response and contributing to this discussion.
December 10th, 2008
[...] application streaming options back in 5 options for application streaming. So far I have shown you Citrix Application Streaming and VMWare ThinApp. In this blog I am looking at Altiris Software Virtualization Solution (SVS) [...]
February 23rd, 2009
[...] XenApp5 requires a Citrix XenApp farm to be created, you will also need a profile machine or machines. See Stream Microsoft Office 2007 with XenApp 5. [...]
August 10th, 2009
Just to add to this. Per user application writes are only captured on c:\ and not on other drives such as H:\ (if redirected within my documents for example).
Also anything within the users profile is generally excluded but if you are clearing the profile on logout then you have to be careful that you dont delete the per user applications writes too.
August 16th, 2009
James
Thanks for commenting. I am sure it will be helpful for other people as well. Are you publishing the streamed apps to the XenApp server or to the local desktop?
Was this issue causing you some issue?
Colin
November 2nd, 2009
I have a question,
i now have a working profile of office 2007, how can i add another language interface in to that profile?
should i open it in profiler and then update the profile and save as different profile?
November 2nd, 2009
Avi
Thanks for asking a question.
I guess you are talking about adding the Microsoft Office language packs etc. Yes, in general I would do as you have suggested and open the existing profile and make the changes and save it as a different profile. This will allow you to roll back if there are any issues.
You will need to test this, but I suspect that you would also need to ensure that the operating system also has the same language interfaces installed to complement the Microsoft Office language interfaces.
Colin
November 9th, 2009
Colin, just wondering if you could share your knowledge – I am wondering what the best method is for updating Office 2007 (or updating any streamed/profiles application for that matter) when new MS updates are released? Do I need to reprofile with the updates added into the update folder or is there an easier way? I’ve tried opening the existing profile and using the modify/update option to perform an advanced install and using the ‘Install IE plugins, Web Applications, online updates’ option and then running Microsoft Update, however MS Update never seems to find any updates for Office. Can you please teach this old dog new tricks?
November 10th, 2009
Geoff
I am not necessarily an expert and like to work things out by testing. I would approach it this way:
I hope this makes sense. In general I would not update very often. But there is nothing stopping you from keeping an updated version of source installation.
You could also modify the package profile by running the downloaded update as well.
So I guess the important aspect is just getting a list of the require updates and downloading them manually.
Colin