Solved

Citrix Printer Issue

Posted on 2014-10-10
22
671 Views
Last Modified: 2014-11-11
Hi Experts,

This is a very very weird anomaly which has been going on for the past few weeks.

We have Citrix Xenapp 6 (Windows Server 2008) in our environment and our users sessions printers are mapped via multiple user Citrix Policies which works based on the users IP address. For example User A logs onto a Thin client on subnet 192.168.105.xx and they receive the HP Printer by default. Whats been happening lately is user A would log on to subnet 192.168.105.xx and they would receive the session printers for a user who logs onto subnet 192.168.10.xx and not 192.168.105.xx and sometimes they would receive Onenote as their default printer rather than the printer being deployed by the Citrix policy on 192.168.105.xx

Similarly we have deployed a special printer via the Citrix printer policy to work based on a security group but people not even in the security group seem to be getting the printer mapped for some reason?

Bear in mind users don't have privileges to map printers by themselves as this is locked down.

This issue has only been happening for the past few weeks.
0
Comment
Question by:Rizzle
  • 10
  • 8
  • 4
22 Comments
 
LVL 23

Expert Comment

by:Coralon
Comment Utility
Having OneNote as the default printer says that the printer connections are either not happening, or are not happening fast enough.  (I've had this happen plenty to me).

For the user with the printer from the wrong subnet, I'd check the policy and make sure your filters are correct.

Now.. are you patched up on your XA6?   I'd also run a group policy modeling in the Citrix console and check what it *thinks* is supposed to be happening.  You might also need to look at moving your policy settings to a GPO.

Coralon
0
 
LVL 13

Author Comment

by:Rizzle
Comment Utility
Hi Coralon,

Thanks for the reply I appreciate it!,

We've checked the policies and they're fine. This is whats happening (Confusing as it may sound) user on subnet 192.168.104.x would get the printer from subnet 192.168.30.x and vice versa.

Yes we're patched up. I don't think this can be achieved via a GPO due to the amount of printers we have in our environment aswell as subnets, (Each subnet has a different printer queue assigned to it)
0
 
LVL 23

Assisted Solution

by:Coralon
Coralon earned 167 total points
Comment Utility
The GPO can have Citrix components in them, and that is what I'm referring to.

Now, I had done a full XD rollout, and we had a lot of problems getting the printer policies to work properly.  I ended up creating scripts that read the client IP out of the registry of the session, and mapped the printers using that.   It was using ScriptLogic/Desktop Authority, but it can be done in Kix.  I've not had that problem with XA though..

I'm wondering if you have stale information in their profiles.. When you get one wrong, check the session information on the server, when you have an incorrect printer mapping.  I don't remember the exact key.. but it is something like HKLM\Software\Citrix\ICA\Session\<session#>  You'll find the value that shows the ip address of the session.  I believe the value also shows up in HKCU\Volatile Environment.  That's also the key you'll use if you need to go the scripted route.  

Coralon
0
 
LVL 15

Assisted Solution

by:joharder
joharder earned 333 total points
Comment Utility
XenApp 6.0 and session printer policies experienced a number of issues due to the data store structure.  If you have a lot of session printer policies, they just don't get processed fast enough.  In other words, session printers are great conceptually, but if you have quite a few of them (I'd say more than about 5 or 6), it's not unusual for them to not work correctly.

Fortunately, this issue appears to have been addressed in XA6.5, but that doesn't help your current situation.

On a few random users that are logged into a XA server, check the user profile in regedit.  Under HKUsers, pull up a few user profiles that don't end with _Classes.  Find the user by looking at Volatile Environment.  Then look under Printers and the child folders, Connections, DevModePerUser and DevModes2.  Are these the right printers for the respective user?
0
 
LVL 13

Author Comment

by:Rizzle
Comment Utility
Hi both,

Thank you for your replies.

I believe we have about 13 Session Printer Policies in place. This issue started a few weeks ago and we thought it might have been a GPO we released into the environment that would have caused it but this was never proved.

I will check this next time round. We've tried resetting the users profile (RDS and Redirected) and that didn't clear the issue. In our environment we use RDS Profiles in AD for the users TS profile and then we Redirect their Desktop, App Data and My Documents elsewhere. We also had a script made called Cleanupmyprinters which clears the users currently mapped printers they log off and back on and i believe the issue re-occurs.

Would you guys like a copy of the script and also our Citrix Session Policies for review?
0
 
LVL 15

Expert Comment

by:joharder
Comment Utility
What are the results of checking these registry entries?  We must first know the downstream impact and can then work it backwards to resolve the issue.
0
 
LVL 23

Expert Comment

by:Coralon
Comment Utility
Jo is definitely the expert here.  But, scripting is going to be the way to go.

Coralon
0
 
LVL 13

Author Comment

by:Rizzle
Comment Utility
No problem guys give me til Monday when i'm back in the office to check what you have said above.
0
 
LVL 15

Expert Comment

by:joharder
Comment Utility
If the wrong entries are indeed in the user profile in the registry and the Citrix Session Printers policy isn't working, then it may be necessary to inject specific entries into the user profile via GPP.  I don't like to do that because the entries then become tattoo'd there and then you need to force a deletion if anything changes, but that may be your only option.  

Keep us posted as to your findings on Monday, and I'll walk you through that process if necessary.
0
 
LVL 13

Author Comment

by:Rizzle
Comment Utility
We have 40 session printers setup within Citrix currently, some are filtered by IP or via User.

I will wait for a problem user and I will check whatyou stated above Jo.
0
 
LVL 15

Expert Comment

by:joharder
Comment Utility
40 Session Printers is a large number of items for XA6.0.  I would not be surprised if the issue is that the policies are not able to apply in full and some are timing out.
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 13

Author Comment

by:Rizzle
Comment Utility
Hmmmm :(

I will post the results once I've checked a problem users registry.
0
 
LVL 13

Author Comment

by:Rizzle
Comment Utility
Hi Jo,

We have a problem user and I've checked the entries in the registry and its taking a local printer mapping from a machine the users logs onto sometimes, local printer mapping is initiated in our environment if a user is in a specific security group which then allows the policy to be applied to that user based on that. I've now removed a problem user from the group and will see if that resolves her issue. We have quite a few people with this issue so i will check their reg's and post back but I've posted a screenshot of the registry for the current user i'm working with, i've marked which should be the printer based on the Citrix Session User Policy (Based on IP)

Citrix Printer issue
0
 
LVL 15

Expert Comment

by:joharder
Comment Utility
If the issue is that one or more printer entries have been tattoo'd into the user profile, you can just delete those printer entries manually.  Alternatively, you can do so via GPP, but that's often more trouble than it's worth when only a few users are involved.
0
 
LVL 13

Author Comment

by:Rizzle
Comment Utility
No worries Jo, I will wait for the results of the above user and then check another problem users registry, sometimes what happens is a user will login and get no printers at all!
0
 
LVL 13

Author Comment

by:Rizzle
Comment Utility
Hi Jo,

We had another problem user today,

The user has her local network printer setup on her iGel and then we have a group in Citrix which allows the past through of locally mapped printers, I then checked her registry and deleted the rogue printers she received, she logged off and back on and then she received over 10 printers from nowhere. She seems to be getting printers from our other Citrix Session User Policies but those printers policies are done based on IP addresses and this user isn't in the range to receive those policies???
0
 
LVL 15

Expert Comment

by:joharder
Comment Utility
Does this user have admin rights or is she an ordinary user?  The former will cause the user to have all printers available that are mapped on that server.

Also, if the user had sessions open on two different servers, deleting the printers in the roaming user profile won't get saved.  The last session that logged off wins, so that may also be the cause of your issue.

It sounds like the majority of the original question has been addressed, and now you know how to check the registry for printers that are mapped as they appear within the user profile.
0
 
LVL 13

Author Comment

by:Rizzle
Comment Utility
Hi Jo,

The issue stated in my initial question still occurs to multiple users.
0
 
LVL 15

Accepted Solution

by:
joharder earned 333 total points
Comment Utility
It seems that because you have so many session printer policies, it's just not working right.  Time to pull out the big guns and set this up via Group Policy Preferences.

First, you'll want to establish groups  based on the assignment.  I'd suggest just a couple of groups at first to start testing.  It may be easiest to create the groups based on the individual printers that will be assigned, e.g, 4FloorHP4250.  Your call.

Create a new GPO and then user-based Group Policy Preference Registry (User-->Preferences-->Windows-->Registry).  When you're on the Key Path selection, press F3.  It will bring up a list of variables you can use.  Select LoginUserSID.  Your string should look exactly like this: %LoginUserSID%\Printers\Connections\,,IPAddress,PrinterName.  You'll create one of each of these with the value names Provider (REG_SZ; win32spl.dll), server (REG_SZ; \\IPaddress), and LocalConnection (REG_DWORD; 1).  Save it, and you will see that a GuidPrinter name gets inserted by default.

Then, go to the Common tab, and select Item Level targeting, and designate the group name.

As a reference, look at the entries in the user profile for any user that has a Citrix Session Printer mapped.  You'll see that these four entries appear in there.  All you're doing is forcing these entries into the registry based on group membership so that the Citrix Session Printers policy isn't required.
0
 
LVL 23

Expert Comment

by:Coralon
Comment Utility
The only problem Jo is if the users are going to different workstations.  With those groups, they'd be tied to specific printers, regardless of physical location.

*If* the users don't move around much, then this is a workable solution.  (And definitely a fascinating one that I'll keep in my tool bag :-))

With XA, you can use clientname to map printers, which will give you station specific printers.  

With XD, it's a fair amount tougher.. If you're interested let me know, and I'll be glad to help lay it out.


Coralon
0
 
LVL 15

Expert Comment

by:joharder
Comment Utility
Coralon, you raise a good point with regard to the physical location of the users.  In my case, the users were stationary, so this worked perfectly.  

I should add that if you need to revise the printers, you'll need to modify the policy such that it's set to Delete in order to remove the printers from the user profile.

The Citrix Session Printers policy certainly provides more versatility, but if it's not working, using a GPP may be a good option.
0
 
LVL 13

Author Comment

by:Rizzle
Comment Utility
Hi both,

Thank you for your contribution on this, we have decided internally not to spend anymore time on our old Xenapp 6 environment as we're in the process of provisioning a new XenApp/XenDesktop 7.6 environment which is due to go live in coming weeks.

No doubt I will need you both when I have questions on that! :)
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Suggested Solutions

David Varnum recently wrote up his impressions of PRTG, based on a presentation by my colleague Christian at Tech Field Day at VMworld in Barcelona. Thanks David, for your detailed and honest evaluation!
HOW TO: Connect to the VMware vSphere Hypervisor 6.5 (ESXi 6.5) using the vSphere (HTML5 Web) Host Client 6.5, and perform a simple configuration task of adding a new VMFS 6 datastore.
Teach the user how to join ESXi hosts to Active Directory domains Open vSphere Client: Join ESXi host to AD domain: Verify ESXi computer account in AD: Configure permissions for domain user in ESXi: Test domain user login to ESXi host:
This video shows you how easy it is to boot from ISO images for virtual machines with the ISO images stored on a local datastore on the ESXi host.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now