Reference

To set up Citrix XenApp streaming applications to work with certain elements of Application Control , you need to specify certain exclusions, as follows:

  1. Navigate to Citrix Streaming Profiler for Windows.
  2. Open the Application Profile.
  3. Highlight the relevant Target and select the Edit menu.
  4. Select Target Properties . The Target Properties screen displays.
  5. Select Rules . The Rules work area displays.
  6. Click Add in the Rules work area. The New Rule Select Action and Objects dialog displays.
  7. In the Action section leave the default setting as Ignore .
  8. In the Object section select Named Objects and click Next . The New Rule Select Objects dialog displays.
  9. Select Some Named Objects and click Add . The Choose Named Object dialog displays.
  10. Add \??\pipe\Appsense* and click OK . This displays in Named Objects on the New Rule Select Objects dialog.
  11. Click Next to display the New Rule Name Rule dialog.
  12. Enter a name for the rule or accept the default and click Finish .
  13. Click OK . The Target Properties screen displays and the Ignore all named objects rule is listed in the work area.
  14. Save the Profile.

Repeat for each Application Profile as required.

Web Services Configuration

Prerequisites

The system requirements for Application Manager Web Services are:

For further information on required utilities and components, see the User Workspace Manager Install and Configure Guide.

Web Services Port Configuration

The Application Manager Web Service provides two communication routes:

Communication with the Application Manager Web Service is via HTTP or optionally Secure HTTP (HTTPS), defaulting to the standard TCP ports 80 for HTTP and 443 for HTTPS. It is recommended that you use the default values, as these ports are already well known by firewall products and should provide the most trouble-free installation.

However, should you find you have port conflict with other software, follow the steps to configure the Application Manager Web Service to use ports that are free.

Configure Application Manager Web Services to use SSL

This process describes how to configure the Application Manager Web Services to use secure sockets for communication.

  1. Click Start >Run and enter MMC. The Microsoft Management Console displays.
  2. Click File >Add/Remove Snap-in. The Add or Remove Snap-ins dialog displays.
  3. Select Certificates and click Add.
  4. From the Certificates snap-in dialog, select Computer account and click Next.
  5. Click Finish and then OK. The snap-in is added to the MMC.
  6. From the navigation tree, select Certificates (Local Computer) >Personal.
  7. Right-click Personal and select All Tasks >Import. The Certificate Import Wizard displays.
  8. Click Next.
  9. Click Browse and change select All Files in the Open dialog.
  10. Navigate to, and select, the required PFX file and click Open.
  11. Click Next.
  12. Enter the password for the private key and click Next.
  13. Select Automatically select the certificate store based on the type of certificate option and click Next.
  14. Click Next then OK to complete the import and close the wizard.
  15. Refresh the MMC. The certificate displays in the Personal > Certificates store.
  16. Right-click on the machine certificate and select Open.
  17. Select the Details tab.
  18. Select Thumbprint to display the value in the text box below.
  19. Copy the value and paste it into a text editor, such as Notepad.
  20. Remove any spaces from the value. This will be used for the certhash value in the commands entered in step 26.
  21. Click OK to close the certificate.
  22. Close MMC without saving.
  23. Stop Application Manager Web Services.
  24. From an elevated Notepad, open the following file: %ProgramFiles(x86)%\AppSense\ApplicationManager\AnalysisService\AnalysisServiceCore.dll.config
  25. In the file, change http://localhost:80/ondemand to https://localhost:443/ondemand and save.
  26. From an elevated CMD on the server, run the following commands, replacing the certhash values with your thumbprint value from step 20:
  27. Start Application Manager Web Services.
  28. From a browser, text the connection to the web service using https: https:// lb-svr2012-r2-5/ondemand
  29. Authenticate with a valid user.

Configuring TCP port numbers used for Communication

For the two communication routes you can independently configure the ports used for HTTP and HTTPS, meaning up to four different port numbers could be configured.

However, for simplicity it is recommended that if you are changing port configuration that you make the same changes to both communication routes. If you are choosing to change the port used for HTTP, then make the change for HTTP on both routes and similarly if changing the Secure HTTP port.

Any firewalls on the machines participating in communication must allow connections over the configured ports.

Quick Setup

Use the following procedure to configure your ports.

  1. Open an administrator level Command Prompt and type: netsh http show urlacl A list of the reserved URLs displays.
  2. Verify that the following entries exist:

Reserved URL: https://+:443/AmAnalysisService/

User: NT AUTHORITY\LOCAL SERVICE

Reserved URL : https://+:443/AmAnalysisQueryDataService/

User: NT AUTHORITY\LOCAL SERVICE

Reserved URL : https://+:443/OnDemand/

User: NT AUTHORITY\LOCAL SERVICE

  1. Using a text editor, open the AMAnalysisServiceCore.dll.config located in: C:\Program Files(x86)\AppSense\ApplicationManager\AnalysisService\AMAnalysisServiceCore.dll.config
  2. In the text document search for the following statement:
  3. Replace the statement with following:
  4. Save and close the text document.
  5. Using Internet Explorer, navigate to https://localhost:443/OnDemand.

The text editor must be elevated to save the document.

Configuring the Windows HTTP Subsystem

The Application Manager Web Service uses the Port Sharing feature of Windows HTTP (HTTP.SYS), allowing it to co-exist with other applications making use of the same mechanism. At a basic level this is achieved by an application registering a portion of a URL, including a port number, for which it will be responsible for servicing requests.

The Application Manager Web Service runs under the account of Local Service, so you need to grant access to the port for that account. You can do this using the httpcfg.exe or netsh.exe tool, depending on the OS Version on which you have installed the Application Manager Web Services:

Running Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows 7, Windows 8, and Windows 8.1

Use the Netsh.exe tool to configure and display the status of various network communications server roles and components.

Do the following:

Open an administrator level Command Prompt and type: netsh http add urlacl sddl=D:(A;;GX;;;LS) url=

is the URL containing the port you wish to grant access to.

Configuring the Application Manager Web Services for Agent Configuration

Use the netsh.exe or httcfg.exe tool with the following URLs and commands to configure each of the ports. The examples shown here use the netsh.exe tool but the same command parameters are used with httcfg.exe:

HTTP Port

The in this example, is to represent the port number you have chosen for standard HTTP communication.

For example, to use port 81 enter the command:

netsh http add urlacl sddl=D:(A;;GX;;;LS) url= http://+:81/AmAnalysisService/

Secure HTTP (HTTPS) Port

The in this example, is to represent the port number you have chosen for Secure HTTP communication.

For example, to use port 444 enter the command:

netsh http add urlacl sddl=D:(A;;GX;;;LS) url= https://+:444/AmAnalysisService/

Configuring the Application Manager Web Services for Console Communication

Use the netsh.exe or httcfg.exe tool with the following URLs and commands for each of the ports. The examples shown here use the netsh.exe tool but the same command parameters are used with httcfg.exe:

HTTP Port

Enter http://+:/ AmAnalysisQueryDataService/

The in this example, is to represent the port number you have chosen for standard HTTP communication.

For example, to use Port 81 enter the command:

netsh http add urlacl sddl=D:(A;;GX;;;LS) url= http://+:81/AmAnalysisQueryDataService/

Secure HTTP (HTTPS) Port

Enter https://+:/ AmAnalysisQueryDataService/

The in this example, is to represent the port number you have chosen for Secure HTTP communication

For example, to use Port 444 enter the command:

netsh http add urlacl sddl=D:(A;;GX;;;LS) url= https://+:444/AmAnalysisQueryDataService/

Editing the Application Manager Web Services Configuration

Editing the Application Manager Web Service configuration requires manual editing of its XML configuration file - AMAnalysisServiceCore.dll.config - located in the directory where the Application Manager Web Services are installed.

Default Installation Directories:

Caution: Before starting it is highly recommended that you take a backup copy of this file because an incorrect configuration can prevent the Application Manager Web Services from starting.

In the process below, is the port number you have chosen for standard HTTP communication.

  1. Using the Windows Services Administrative tool, stop the Application Manager Web Service.
  2. Open the AMAnalysisServiceCore.dll.config file in a text editor such as Notepad and navigate to the XML tag.
  3. If required, do the following:
  4. To change the HTTP Port, navigate to the following the XML tag:
  5. Select the webHttpNonSecureBinding attribute and replace the address value using the following format: address 6"> To change the Secure HTTP Port, navigate to the following XML tag:
  6. Select the webHttpSecureBinding attribute and replace the address value using the following format: address 8"> To change the HTTP Port, navigate to the following the XML tag:
  7. Select the wsHttpNonSecureBinding attribute and replace the address value using the following format: address 10"> To change the Secure HTTP Port, navigate to the following XML tag:
  8. Select the wsHttpSecureBinding attribute and replace the address value using the following format: address 12"> Save and close the AMAnalysisServiceCore.dll.config file. The text editor must be elevated to save the document.
  9. Using a text editor, open the AMAnalysisServiceCore.dll.config located in: C:\Program Files(x86)\AppSense\ApplicationManager\AnalysisService\AMAnalysisServiceCore.dll.config
  10. In the text document search for the following statement:
  11. Replace the statement with the following:
  12. Save and close the text document.
  13. Using the Windows Services Administrative tool, start the Application Manager Web Service. If there are any problems starting the Service, refer to the Windows Event Log under AppSense for error data.

Wildcards and Regular Expressions

Application Control uses regular expressions when you select the Use regular expressions option when adding filenames, folder paths, command line arguments and metadata strings. Regular expressions are not supported for Groups and User Name Rules.

When using regular expressions, you need to check the expression fully before committing it. If the criteria are incorrectly entered, both complete and partial matches are returned.

"alice" matches because her name starts with a letter between a and f

"john" does not match because his name starts with a letter greater than f

"Alice" does not match because her name does not start with a lowercase letter

"UserWithFourNumbers1234" does not match because the user name has four numbers in it

wordpad.exe does not match because it is not in the list

The information below shows examples of how regular expression and wildcards can be used in Application Control .

Example Description
^chkdsk((?!/[f|x]).)*$ Used to allow users to run the check disk utility and view the result, but prevent fixing any errors on the disk using a /f (fix) parameter.

Distributed File Systems

A distributed file system or network file system allows access to files from multiple hosts sharing via a computer network. This makes it possible for multiple users on multiple machines to share files and storage resource. Using DFS, System administrators can make it easy for users to access and manage files that are physically distributed across a network.

There are two ways of implementing DFS on a server:

For examples of that can be part of both a domain and standalone scenario, see Choosing the DFS Namespace Type.

For Application Network Access Control (ANAC) rules using a network share and files or folders that refer to items on a DFS share, you must specify the target server, rather than the namespace server in the UNC path. Application Control Agent substitutes the namespace server path with the target server path, so the namespace server path never gets passed through the rules engine.

App-V5.0 Support

App-V 5.0 allows applications to be streamed in real-time to any client from a virtual application server. With a streaming-based implementation, the App-V client needs to be installed on the client machines. Application packages are presented on the App-V server and then streamed to the endpoint cache. At the first application package launch request, the package is streamed to the endpoint. For any subsequent application launch requests made on that specific endpoint the application package will be run from the local App-V client cache.

By default, App-V 5.0 applications are inherently trusted, which means they will not fail the Trusted Ownership check. The Application Control Agent caches any published App-V 5.0 applications at session startup. If any application is published mid-session it will not pass Application Managers Trusted Ownership check until that user logs off and logs on again.

Related topics

This page refers to an older version of the product. View the current version of the online Help.