Folder redirection has been around since Windows 2000 and has undergone significant changes since then. The core function is the same: take a local directory path and point it somewhere else, without the user knowing or caring that it isn’t local. The advantages of this are that your users can store their important documents “on the network” without having to map drives or instructing them to save in a certain location. You can selectively redirect documents and app data but exclude photos, music, etc if you choose. In this example, I am interested in redirecting My Documents for all users to a secure, redundant, and high performance NetApp Filer. Technologies involved are Windows 7 Enterprise, Server 2008 R2 DFS, and NetApp CIFS shares running on a FAS2020.

First thing, create your CIFS shares on the filer. The way NetApp NAS with the CIFS protocol works is that the filer actually becomes a member of your domain. You can even apply certain GPO settings to it! The stated domain type is incorrect as I’m running in 2008 R2 native mode, but this doesn’t affect anything functionally from what I can tell.

Your CIFS shares are then managed just like a regular Windows server. You can even connect to the filer via the computer management MMC.

Each share you create exists inside a volume and has an associated qtree. All the other NetApp goodies still apply: deduplication, snapshots, auto volume grow, and opportunistic locking. The rest of the options look very much like a regular Windows file server.

I have created a single hidden share called Users$ that sits in a 300GB volume. All of my user’s My Documents will live here. Following best practices, I have granted authenticated users full control to the share as I will control granular access permissions with NTFS. We’re ready to prepare the DFS namespace.

Now in my redirection GPO I could simply point all users to redirect to \\<filername>\users$\<username> but one of the values DFS provides is a consistent domain-based namespace: \\domain\<dfsRoot>\<redirection_root>\<username>. Everything that will exist as a file share in my environment will be accessible via a DFS namespace, much cleaner this way and much easier to change targets should I need to enact my DR plan which I would do via folder targets to my DR filer. I first create a new domain-based namespace in Server 2008 mode called Users (add a $ to the end to make it hidden):

This is simply the DFS root which lives in the local file system space on my namespace server (domain controller). To be able to point to my filer I need to create another folder inside of this DFS root, that can then be targeted to a matching folder on my NAS. So I will create a new folder called “root” on both NAS: \\cufas2\users$\ and DFS: \\domain.com\Users\. First create the new root folder on NAS then add a folder to DFS with a target that will point to the root folder on the filer. Additional targets can be configured and controlled for redundancy, replication, and DR.

Before we configure the GPO let’s set permissions on the Root folder. This is a critical step and is what will ultimately make or break this configuration. Since this is the root folder for the entire share, remove permission inheritance and set the following permissions:

• CREATOR OWNER - Full Control (Apply onto: Subfolders and Files Only)
• System - Full Control (Apply onto: This Folder, Subfolders and Files)
• Domain Admins - Full Control (Apply onto: This Folder, Subfolders and Files)
• Authenticated Users - Create Folder/Append Data (Apply onto: This Folder Only)
• Authenticated Users - List Folder/Read Data (Apply onto: This Folder Only)
• Authenticated Users - Read Attributes (Apply onto: This Folder Only)
• Authenticated Users - Traverse Folder/Execute File (Apply onto: This Folder Only)

This will allow all users to programmatically create their directory folders beneath the root folder as well as be granted full control to them without the ability to see anyone else’s folders. Domain Admins will have full control to all folders. Now we’re ready to set up our folder redirection GPO.

Folder redirection is a user configuration setting so the GPO that contains these settings must be linked to an OU that houses user accounts, or linked high enough in the AD tree so that user-housing OUs will inherit. Redirection can be set in basic or advanced mode, basic redirecting everyone to the same location. Advanced enables the opportunity to redirect users differently based on security group. In either case you can redirect to the user’s home directory, create a folder for each user under the specified root, redirect to a specific location or to the user’s local %userprofile% path. I will be using the “create a folder” option under the advanced mode and the path is the DFS root created earlier: \\domain.com\users$\root. For now the policy will apply to one group, domain users, but I will have future flexibility should I need to have additional groups redirected differently. The effect of this policy is that each user, once successfully redirected, will automatically have a new folder under the root directory named after their username, with the documents folder beneath it. Any other folders I choose to redirect will also live under this %username% directory.

Additionally, you can grant the user exclusive access to their folder which keeps out even domain admins and creates problems for backups. Since we’ve set very specific permissions on the root we don’t need to worry about this anyway. The other pertinent option is to move the contents of the source to the destination which I have had problems with in my environment. I’ll be leaving both of these unchecked.

Now when a user logs into any machine in the enterprise they will see the exact same documents folder which lives safe and sound on an enterprise storage array. Should the primary array fail, DFS will repoint their redirected documents to a DR filer in another datacenter.

Something else to consider for your laptop users is offline files in conjunction with folder redirection. I have this enabled by default for all laptops and expressly disable them for desktops. This is a good compromise so that laptop users will enjoy the benefits of redirection while in the office but will also be able to access and work on these documents while away. The next time they connect to the corporate network any changes they made to an offline file will sync back up with their redirected folders on the NAS.

The XenApp (XA) brand was a name change that continues the Citrix Presentation Server (CPS) product line. CPS 4.5 for Server 2003 ended and XenApp 5 for Server 2008 x86 began. Citrix has recently released XA 6 which is 64-bit and designed to run on Server 2008 R2. Citrix Essentials, the scaled down SMB product, was renamed to Citrix Fundamentals (XAF). XAF is akin to XA 5 functionally for all intensive purposes. XenApp 5 and 6 come in Advanced, Enterprise, and Platinum flavors, each unlocking different features.

XAF is targeted for small to medium enterprises that need only a maximum of 75 named users. That is the main drawback, concurrent licensing is not available on this platform. The idea is simplicity and XAF achieves that goal handily while providing a full XA experience. When installing XAF you are presented with 2 installation types: application or DMZ (secure gateway). The intended design is for the Secure Gateway to sit in a firewalled DMZ (single-hop) and point to the application server sitting on the LAN inside.

Installing the application server piece is incredibly simple with the installer taking care of everything including all prerequisites. Make sure to enable Remote Desktop Services prior to install with all licensing requirements taken care of.

Once the “Set Up Server” wizard launches, you have a choice to configure a stand-alone server or a server group. Advanced mode can be enabled now or later which unlocks user profile management, load balancing, and server failover. The advanced features rely heavily upon Active Directory and currently only Server 2008 R1 functional-level domains are supported. The OU structure will be created in 2008 R2 domains but the advanced mode initialization will ultimately fail. Citrix is aware of the issue and says that we should see some kind of fix in 2-3 weeks.

Once setup completes, launch the Quick Start tool and add your license file. I am using evaluation licenses provided by Citrix for this trial.

The Quick Start tool walks you through the steps to get your sever up and running, including publishing apps, linking up with the Secure Gateway (if you choose), publishing printers, and delegating administrative access. Application installations work just like any other terminal server install, start up “install app in TS-mode” and install. Then the application can be published, assigned to user groups/ servers, associated with file types, and appearance controlled. You can open the familiar Citrix Access Management console at any time to complete any of these tasks.

Performance optimizations can be set at the farm or server levels and include Session Reliability, CPU/Memory Optimization, etc.

The Web Interface is fully customizable providing options for authentication methods , secure access, and internal/external web site appearance.

The External Access server portion (Secure Gateway) is even simpler. Again all requisite components are taken care of by setup.

Once setup completes the Quick Start tools launches displaying the External Access options.

Configuring the gateway consists of specifying the FQDN it will respond to on the internet and the address of the internal Citrix application server. You can generate a temporary SSL certificate but you’ll have to install the cert and add the issuer as a trusted publisher before your applications will be usable. I opted to use a free comodo cert instead. The last step is opening TCP/1080 through your firewall from your DMZ server to your internal application server. That’s it.

The Secure Gateway has its own Web Interface which can be customized in appearance as well. Additionally you can choose which plugins to publish and whether or not the native plugin should be preferred. All of the other Web Interface options are available here as well.

The default login form is clean and simple. Domain names can be required to login using a UPN or domain\username formats. Assuming the domain name that resolves to your Secure Gateway does not have the same name as your internal domain, this can add some easy additional security.

Once authenticated, if you don’t have the Citrix client you will be directed to a screen where you can download and install it before you continue. Once installed you will be presented with your published applications. Access to your enterprise is now a click away.

Performance is very good and there are no issues running the entire solution in a virtual environment. Application Isolation as it was known in CPS is gone in XenApp, replaced by Application Streaming. This feature is only available in the Enterprise and Platinum versions. After my environment was set up, anytime I closed an app I also saw the Server 2008 logoff screen. While not a huge deal this disturbs the seamless Citrix user experience. To get around this I added a logoff script to the user portion of my terminal server baseline GPO. Create a .bat file and put the following in it, no more logoff screens:

tsdiscon %sessionname%

Licensing is roughly $100 per concurrent user for XAF, plus the TS CAL, plus any applicable application licensing. Definitely not a cheap solution, especially since Server 2008 includes Remote Apps by default. Like most out-of-the-box Microsoft solutions what they give you is adequate but if you want all the bells and whistles you have to go third-party. I plan to completely replace my legacy Cisco VPN solution with Citrix as well as provide an environment to run applications with Windows7 compatibility problems. Home user PCs and whatever nightmares they harbor will stay in their homes. Citrix provides a secure, reliable, and rich user experience that will ultimately reduce support calls and make application maintenance easier.

As with any terminal server environment, the challenges will come with publishing apps and ensuring that users have access to all the proper resources. I ran into another issue publishing Office 2003 SP3 to satisfy a companion legacy reporting application. Not having any application isolation options to publish Office 2003 along side 2007, I decided to publish Office 2003 with the 2007 compatibility pack. Office itself worked fine but to get the compatibility pack converters to work I had to use some trickery. wordconv.exe as well as the excel and ppt converters had to be added to the DEP exception list. I also had to enable compatibility mode for all users on the core executables themselves (winword.exe, etc). With these changes in place I was able to open and edit 2007 file formats without issue. All told I’m very pleased with XAF and if they fix the advanced mode compatibility issues with 2008 R2 domains I’ll be ecstatic. If anything pushes me towards XA Enterprise though, it will be application streaming.