But we can easily retrieve the path using a small VB Script:

The scripts accepts the shortcut filename as a parameter so you can simply drag the shortcut to the script and it will show the Target Path and Icon Location:

Bonus Chatter: if you want to prevent an installer from creating Advertised Shortcuts set the DISABLEADVTSHORTCUTS MSI property to 1 (MsiExec /I MyMsi.msi DISABLEADVTSHORTCUTS=1).

On my testmachine it ran nicely but on a customer machine the script failed with the error 2312 “The Citrix online plug-in received a corrupt ICA File. The ICA File has no [ApplicationServer] section“:

I couldn’t find any errors in my script so I fired up Process Monitor and noticed that the Ica Client Object creates a temporary .ica file in the %temp% folder. When it tried to write to this file this fails because access is denied:

I Checked the temporary .ica file and it was empty (0 bytes). Then I used the Stack View option from Process Monitor on the first ACCESS DENIED event:

From the stack we can see that fltMgr.sys is the last to touch the file (stack is from bottom to top). fltMgr is the File System Filter Driver which makes it likely that the Virus Scanner is blocking access. So I checked the Anti Virus log, McAfee VirusScan in my case:

The text is in Dutch, it says: Blocked by the access rule: maximum Anti-Spyware: prevent script execution from the temp folder.

So McAfee considers the .ica a script since it’s created by the process cscript.exe.

Unfortunately the Ica Client Object doesn’t offer a method or property to change the folder where the temporary ica file is created. I decided to have look at Wfica.ocx with Ida Pro and noticed that the GetTempPath and GetTempFilename API’s are used to assemble the filepath.

In the remarks section of the GetTempPath documentation on MSDN states that it looks first to the %TMP% environment variable.

So we can easily workaround this issue by changing the %TMP% variable before we run our script:

But I wanted to deploy the .hta as a single file.

And this can be done using data: followed by a base64 encoded png:

The Base64 encoding can easily be done with PowerShell:

Example:

I used reg.exe to set the key but even though it returned success the key wasn’t altered.

As I suspected the key was written to the Wow6432Node. In the help I couldn’t find any switch to force reg.exe to use the 64-bit view.

On a 64 bit machine this is not a problem since both 32- and 64 bit versions of reg.exe exists. The 32 bit version of reg.exe defaults to the 32 bit view and the 64 bit version defaults to the 64 bit view.

But luckily reg.exe has a switch (that is not listed in the help) to force the View:

• /reg:64 forces reg.exe to use the 64 bit view
• /reg:32 forces reg.exe to use the 32 bit view

Example:

Note: Windows XP, 2003, Vista and Server 2008 require hotfix kb948698.

In the OS Configuration part the IP configuration needs to be applied and I decided to do this with a database.

The database consists of 2 tables; one table with the per host settings and one table with the global settings (such as DNS).

In the Altiris job both tables are read from an embedded VBScript and assigned to the NIC.

Database configuration

I created a database (SQL Server) called IPManagement with 2 tables:

The globalconfig table has a name and a data field:

And contains only the DNS settings:

The hostconfig table has fields for hostname, ip address, netmask and default gateway:

Some sample data:

Altiris Configuration

In Altiris I have added the database as a custom data source, this can be done via Tools | Options | Custom Data Sources:

The Script:

The final step is the VBScript, which use the Custom Token feature to retreive the data from the database:

Note that I had to do a little trick using the Trim statement and a space to get a correct assignment to the variables. Without the space Altiris doesn’t properly recognize the custom token.

The array is necessary beasue the EnableStatic and SetGateways Methods require array parameters even when there’s just a single entry.

However, Microsoft doesn’t tell us there’s an undocumented registry value that allows us to have FUS when joined to a domain!

To enable FUS you need to set the DWORD registry value HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceFriendlyUI.

It can also be set by Group Policy at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.

When the value is set to 1, and LogonType key is also set to 1, it allows you to use a Friendly UI on a computer joined in a domain:

You can even set AllowMultipleTSSessions value to 1, which will allow you to have multiple users logged on!

The only problem is that the “Friendly UI” doesn’t always allow to logon as a domain user. Only when no-one is logged on you can press the Ctrl+Alt+Delete sequence twice to get to the Classis Logon Screen where you can logon with Domain Credentials:

If we disconnect the console session, for example, by using the tsdiscon.exe tool we are also able to go to the Classic Logon Screen.

I’ve created a few files, which you can place, say to the All Users Desktop (CSIDL_COMMON_DESKTOPDIRECTORY) folder (i.e. “C:\Documents and Settings\All Users\Desktop”) to make them available to all users:

There is also a slightly modified version of “Switch User” application, which now adjust the value of AllowMultipleTSSessions, LogonType and ForceFriendlyUI keys programmatically (if required) for the time needed to logon the user and then reverts them back.

It also supports a /Server=ServerName option, which allows you to execute it on another machine.

Please note that you cannot log on domain users in this way!

P.S. “Bugs”

1) If you’ve logged on as a domain user, and are set the logon type to friendly UI, be careful: if you lock your current session, you won’t be able to return to it in a normal way – “Friendly UI” doesn’t support domain logged users and you just won’t be listed in a users list! But, of course, you can log in as a different user, start Task Manager, click on “Users” tab, and connect to your original session manually. You can also use “”Turn Friendly UI Off.bat” file to switch Friendly UI off and be able to lock your workstation normally.

2) If you connect via RDP session, you’ll still get a “Friendly UI”. It won’t be fully functional as it was not designed to be used from RDP session.

3) Explorer doesn’t show you “Switch user” option when you try to logoff the current user, but you can lock workstation by using “Window+L” shortcut or use the batch file above.

He received this error message:

Citrix has a KB Article: “How to Allow More Memory for Session Graphics on Windows Server 2003” that explains exactly how we can solve this.

We need to change the MaxLVBMem registry value and we can use the Excel Sheet from the KB Article to calculate the proper value.

Please don’t set this value too high because a higher value means you will restrict other kernel memory pools.

You also need to deny the SYSTEM account the SetValue permission on the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management key to prevent the Citrix IMA service from overwriting the new value.

So I wrote a small PowerShell script to change the permission and set the value:

With older versions of this client (up to 5.4) you could use the -r (record) installer switch to record the install in a setup.iss file but version 6.1 uses an MSI based installer.

IBM offers the client in a 2 DVD download but you probably only need the first dvd (dvd 1 has both the x86 and x64 installers, dvd 2 has the ia64 installer) which is a whopping 3,5 GB download.

Inside the download (a zip) is an iso file of which you will only need the files in the root and the Image32 or Image64a folder.

Inside the image folder are subfolders names MRI29xx where xx is a language identifier:

The following Identifiers are used:

MRI2912 – Croatian
MRI2922 – Portuguese
MRI2923 – Dutch Netherlands
MRI2924 – English
MRI2925 – Finnish
MRI2926 – Danish
MRI2928 – French
MRI2929 – German
MRI2930 – Japanese
MRI2931 – Spanish
MRI2932 – Italian
MRI2933 – Norwegian
MRI2937 – Swedish
MRI2938 – English Uppercase DBCS
MRI2939 – German Multinational
MRI2940 – French Multinational
MRI2942 – Italian Multinational
MRI2954 – Arabic
MRI2956 – Turkish
MRI2957 – Greek
MRI2961 – Hebrew
MRI2962 – Japanese (5026)
MRI2963 – Belgian Dutch Multinational
MRI2966 – Belgian French Multinational
MRI2975 – Czech
MRI2976 – Hungarian
MRI2978 – Polish
MRI2979 – Russian
MRI2980 – Brazilian Portuguese
MRI2981 – Canadian French Multinational
MRI2984 – English DBCS
MRI2986 – Korean DBCS (KS)
MRI2987 – Traditional Chinese DBCS
MRI2989 – Simplified Chinese DBCS (GB)
MRI2992 – Romanian
MRI2994 – Slovakian
MRI2996 – Portuguese Multinational

So if you need to transfer the installer over a slow connection you only need to transfer the language(s) you require.

To set the language you can use the CWBPRIMARYLANG property to set the language eg CWBPRIMARYLANG=Mri2923 and the /v switch can be used to pass MSI Public properties to the installer.

Note that the installer requires a reboot so you may want to add REBOOT=ReallySupress to prevent this.

I use Master Return Codes for this in Altiris.

This the Altiris Job I use:

IBM References:

• Public Properties
• Defining the level of user interface throughout the installation
• Using command line parameters to change the installation behaviour

Other references:

• SQL Query to get the Full Path of an Altiris Job
• Using Master Return Codes in Altiris

I always try to remove such things as I don’t think it’s necessary for every user to accept it.

So I took the usual approach and used Process Monitor to see where acceptance of this agreement is recorded.

This application creates at file called CMUSER.CFG in the Start Directory of the Application. It’s a binary file of 276 bytes, probably some kind of struct/record written to a file.

I inspected it with an Hex Editor and looked for a byte with the value 1 (the ordinal value of a Boolean) and there were only two.

One of them was followed by three times 00:

This is the most likely suspect because often struct/record members are aligned on 4 byte boundaries or a Boolean type is 4 byte.

I verified this by changing it to 0 and then the EULA is shown again.

I decided to add this to the login script because it’s very little effort to do so (I use a very clever login script). I just need to make a folder with the application’s group name in the groups subfolder and place any script in there.

The logonscript knows that it only has to inspect this folder if the user is a member of this group and knows how to handle different file types (eg a reg file is imported but a vbs or ps1 file is executed).

In my case I created a PowerShell file because I can embed a byte dump of the CMUSER.CFG file in it:

This is an ancient trick, just set the the LocalizedString Value of the following key:

to “%USERNAME% on %COMPUTERNAME%”.

It get’s a little more complicated if you want to set this from a script, because the environment variables are replaced with the actual value BEFORE they are entered in the Registry.

So I always did this with a small VBScript but I figured we should be able to do it with a simple oneliner.

I first tried the Reg command because the help describes that you can use the caret sign (^) and even gives an example:

It actually works if we do this:

But it fails if we try this:

My next try was to do it in PowerShell but if using the “& {<command>}” syntax it fails because of the same reason.

So I came up with the following code:

Basically I use an environment var to set a readable string where the % sign is replaced by the @ sign.

And in the PowerShell statement I use the -replace operator to replace the @ with a % again.

I used [char]0×25 (0×25 is the Hex value of the ASCII code for %) because a single % sign is removed in a bat file.

Basically I use an environment var to set a readable string where the % sign is replaced by the @ sign.

And in the PowerShell statement I use the -replace operator to replace the @ with a % again.

I used [char]0×25 (0×25 is the Hex value of the ASCII code for %) because a single % sign is removed in a bat file.