Note:
You can manage your Citrix Virtual Apps and Desktops deployment using two management consoles: Web Studio (web-based) and Citrix Studio (Windows-based). This article covers only Web Studio. For information about Citrix Studio, see the equivalent article in Citrix Virtual Apps and Desktops 7 2212 or earlier.
Before creating a policy, decide which group of users or devices it might affect. You might want to create a policy that is based on user job function, connection type, user device, or geographic location. You can also use the same criteria that you use for Windows Active Directory group policies.
If you already created a policy that applies to a group, consider editing that policy instead of creating another policy. After editing the policy, configure the appropriate settings. Avoid creating a policy solely to enable a specific setting or to exclude the policy from applying to certain users.
When you create a policy, you can base it on settings in a policy template and customize settings as needed. You can also create it without using a template and add all the settings you need.
In Web Studio, new policies created are set to Disabled unless the Enable policy check box is explicitly checked.
During policy creation and when configuring the settings, the system provides an option to view the settings type. You can view the following settings type:
To view the settings while configuring the settings:
Policy settings can be enabled, disabled, or not configured. By default, policy settings aren’t configured, which means they aren’t added to a policy. Settings are applied only when they’re added to a policy.
The policy settings are enhanced to provide clarity between dependent policies. This feature ensures that the parent policy is configured first for the child policy settings to take effect when configured.
To configure the policy settings:
Note:
- The child policies cannot be selected until the parent policy is configured.
- If the parent policy is unchecked, a pop-up message instructs that the child policies associated will also get unchecked or unselected.
The following table provides the list of parent policies along with the corresponding dependent or child policies.
Parent policy Dependent Child policies Overall session bandwidth limit Audio redirection bandwidth limit percent Clipboard redirection bandwidth limit percent COM port redirection bandwidth limit percent File redirection bandwidth limit percent HDX MediaStream Multimedia Acceleration bandwidth limit percent LPT port redirection bandwidth limit percent Printer redirection bandwidth limit percent Client USB device redirection bandwidth limit percent TWAIN device redirection bandwidth limit percent Allow bidirectional content redirectionSome policy settings can be in one of the following states:
In addition, some settings control the effectiveness of dependent settings. For example, Client drive redirection controls whether users are allowed to access the drives on their devices. Both this setting and the Client network drives setting must be added to the policy to allow users to access their network drives. If the Client drive redirection setting is disabled, users can’t access their network drives, even if the Client network drives setting is enabled.
In general, policy setting changes that impact machines go into effect either when the virtual desktop restarts or when a user logs on. Policy setting changes that impact users go into effect the next time users log on. If you’re using Active Directory, policy settings are updated when Active Directory reevaluates policies at 90-minute intervals. And the policy settings are applied either when the virtual desktop restarts or when a user logs on.
For some policy settings, you can enter or select a value when you add the setting to a policy. You can limit the configuration of the setting by selecting Use default value. This selection disables the configuration of the setting and allows only the setting’s default value to be used when the policy is applied. This selection is regardless of the value that was entered before selecting Use default value.
If the secure default setting is enabled, during VDA installation, the priority of the policy settings is affected as follows:
To see the secure default setting for a policy:
In the Select Settings table, when you hover over the settings that have Allowed ? as their current value, the Secure default value: Prohibited is shown.
As best practices:
When creating a policy, you assign it to certain users and machine objects. That policy is applied to connections according to specific criteria or rules. In general, you can add as many assignments as you want to a policy, based on a combination of criteria.
If you do not specify any assignments, or specify assignments but disable them, the policy is applied to all connections.
Note:
Policy assignments are also known as policy filters. For additional information, see the following topics:
The following table lists the available assignments:
Assignment name Applies a policy based on Access Control Access control conditions through which a client is connecting. Connection type - Whether to apply the policy to connections made with or without NetScaler Gateway. NetScaler Gateway farm name - Name of the NetScaler Gateway virtual server. Access condition - Name of the end point analysis policy or session policy to use. NetScaler SD-WAN Whether a user session is launched through NetScaler SD-WAN. Note: You can add only one NetScaler SD-WAN assignment to a policy. Client IP Address IP address from which a client is connecting, which varies based on how the client connects to the session:When a user logs on, all policies that match the assignments for the connection are identified. Those policies are sorted into priority order and multiple instances of any setting are compared. Each setting is applied according to the priority ranking of the policy. Any policy setting that is disabled takes precedence over a lower-ranked setting that is enabled. Policy settings that are not configured are ignored.
Important:
When configuring both Active Directory and Citrix policies using the Group Policy Management Console, assignments and settings might not be applied as expected. For more information, see CTX127461
To set the Client IP policy filter to always use the client’s private IP address, configure the following registry setting on the session host:
- Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Ica\GroupPolicy- Value type:
DWORD- Value name:
UseClientDeviceIpForPolicyFilter- Value data:
1
A policy named “Unfiltered” is provided by default.
An assignment’s mode determines if the policy is applied only to connections that match all the assignment criteria. If the mode is set to Allow (the default), the policy is applied only to connections that match the assignment criteria. If the mode is set to Deny, the policy is applied if the connection does not match the assignment criteria. The following examples illustrate how assignment modes affect Citrix policies when multiple assignments are present.
Example: Assignments of like type with differing modes - In policies with two assignments of the same type, one set to Allow and one set to Deny, the assignment set to Deny takes precedence, provided the connection satisfies both assignments. For example:
Policy 1 includes the following assignments:
Because the mode for Assignment B is set to Deny, the policy isn’t applied when the Sales manager logs on to the Site, even though the user is a member of the Sales group.
Example: Assignments of differing type with like modes - In policies with two or more assignments of differing types, set to Allow, the connection must satisfy at least one assignment of each type for the policy to be applied. For example:
Policy 2 includes the following assignments:
When the Sales manager logs on to the Site from the office, the policy is applied because the connection satisfies both assignments.
Policy 3 includes the following assignments:
When the Sales manager logs on to the Site from the office, the policy isn’t applied because the connection does not satisfy Assignment F.
Sign in to Web Studio and select Policies in the left pane.
Select the Templates tab and select a template.
Select Create Policy from Template in the action bar.
By default, the new policy uses all the default settings in the template. In this case, the Template default settings (recommended) is selected. If you want to change settings, select the Modify default settings and add more, and then add or remove settings.
Specify how to apply the policy by selecting one of the following:
Enter a name for the policy. Consider naming the policy according to who or what it affects, for example Accounting Department or Remote Users. Optionally, add a description.
The policy is disabled by default; you can enable it. Enabling the policy allows it to be applied immediately to users logging on. Disabling prevents the policy from being applied. If you must prioritize the policy or add settings later, consider disabling the policy until you are ready to apply it.
Sign in to Web Studio and select Policies in the left pane.
Select the Policies tab.
Select Create Policy in the action bar.
Add and configure policy settings.
Specify how to apply the policy by choosing one of the following:
Enter a name for the policy or accept the default. Consider naming the policy according to who or what it affects, for example Accounting Department or Remote Users. Optionally, add a description.
The policy is enabled by default; you can disable it. Enabling the policy allows it to be applied immediately to users logging on. Disabling prevents the policy from being applied. If you must prioritize the policy or add settings later, consider disabling the policy until you are ready to apply it.
From the Group Policy Editor, expand Computer Configuration or User Configuration. Expand the Policies node and then select Citrix Policies. Choose the appropriate action:
Task Instruction Create a policy On the Policies tab, click New. Edit an existing policy On the Policies tab, select the policy and then click Edit. Change the priority of an existing policy On the Policies tab, select the policy and then click either Higher or Lower. View summary information about a policy On the Policies tab, select the policy and then click the Summary tab. View and amend policy settings On the Policies tab, select the policy and then click the Settings tab. View and amend policy filters On the Policies tab, select the policy and then click the Filters tab. When you add more than one filter to a policy, all the filter conditions must be met for the policy to be applied. Enable or disable a policy On the Policies tab, select the policy and then select either Actions > Enable or Actions > Disable. Create a policy from an existing template On the Templates tab, select the template and then click New Policy.The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.
DIESER DIENST KANN ÜBERSETZUNGEN ENTHALTEN, DIE VON GOOGLE BEREITGESTELLT WERDEN. GOOGLE LEHNT JEDE AUSDRÜCKLICHE ODER STILLSCHWEIGENDE GEWÄHRLEISTUNG IN BEZUG AUF DIE ÜBERSETZUNGEN AB, EINSCHLIESSLICH JEGLICHER GEWÄHRLEISTUNG DER GENAUIGKEIT, ZUVERLÄSSIGKEIT UND JEGLICHER STILLSCHWEIGENDEN GEWÄHRLEISTUNG DER MARKTGÄNGIGKEIT, DER EIGNUNG FÜR EINEN BESTIMMTEN ZWECK UND DER NICHTVERLETZUNG VON RECHTEN DRITTER.
CE SERVICE PEUT CONTENIR DES TRADUCTIONS FOURNIES PAR GOOGLE. GOOGLE EXCLUT TOUTE GARANTIE RELATIVE AUX TRADUCTIONS, EXPRESSE OU IMPLICITE, Y COMPRIS TOUTE GARANTIE D'EXACTITUDE, DE FIABILITÉ ET TOUTE GARANTIE IMPLICITE DE QUALITÉ MARCHANDE, D'ADÉQUATION À UN USAGE PARTICULIER ET D'ABSENCE DE CONTREFAÇON.
ESTE SERVICIO PUEDE CONTENER TRADUCCIONES CON TECNOLOGÍA DE GOOGLE. GOOGLE RENUNCIA A TODAS LAS GARANTÍAS RELACIONADAS CON LAS TRADUCCIONES, TANTO IMPLÍCITAS COMO EXPLÍCITAS, INCLUIDAS LAS GARANTÍAS DE EXACTITUD, FIABILIDAD Y OTRAS GARANTÍAS IMPLÍCITAS DE COMERCIABILIDAD, IDONEIDAD PARA UN FIN EN PARTICULAR Y AUSENCIA DE INFRACCIÓN DE DERECHOS.
本服务可能包含由 Google 提供技术支持的翻译。Google 对这些翻译内容不做任何明示或暗示的保证，包括对准确性、可靠性的任何保证以及对适销性、特定用途的适用性和非侵权性的任何暗示保证。
このサービスには、Google が提供する翻訳が含まれている可能性があります。Google は翻訳について、明示的か黙示的かを問わず、精度と信頼性に関するあらゆる保証、および商品性、特定目的への適合性、第三者の権利を侵害しないことに関するあらゆる黙示的保証を含め、一切保証しません。
ESTE SERVIÇO PODE CONTER TRADUÇÕES FORNECIDAS PELO GOOGLE. O GOOGLE SE EXIME DE TODAS AS GARANTIAS RELACIONADAS COM AS TRADUÇÕES, EXPRESSAS OU IMPLÍCITAS, INCLUINDO QUALQUER GARANTIA DE PRECISÃO, CONFIABILIDADE E QUALQUER GARANTIA IMPLÍCITA DE COMERCIALIZAÇÃO, ADEQUAÇÃO A UM PROPÓSITO ESPECÍFICO E NÃO INFRAÇÃO.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.3