App-V 编辑

Using App-V with XenApp and XenDesktop

Microsoft Application Virtualization (App-V) lets you deploy, update, and support applications as services. Users access applications without installing them on their own devices. App-V and Microsoft User State Virtualization (USV) provide access to applications and data, regardless of location and connection to the internet.

The following table lists supported versions.

The App-V client does not support offline access to applications. App-V integration support includes using SMB shares for applications. The HTTP protocol is not supported.

If you’re not familiar with App-V, see the Microsoft documentation. Here’s a recap of the App-V components mentioned in this article:

• Management server. Provides a centralized console to manage App-V infrastructure and delivers virtual applications to both the App-V Desktop Client and a Remote Desktop Services Client. The App-V management server authenticates, requests, and provides the security, metering, monitoring, and data gathering required by the administrator. The server uses Active Directory and supporting tools to manage users and applications.
• Publishing server. Provides App-V clients with applications for specific users, and hosts the virtual application package for streaming. It fetches the packages from the management server.
• Client. Retrieves virtual applications, publishes the applications on the client, and automatically sets up and manages virtual environments at runtime on Windows devices. You install the App-V client on the VDA, where it stores user-specific virtual application settings such as registry and file changes in each user’s profile.

Applications are available seamlessly without any pre-configuration or changes to operating system settings. You can launch App-V applications from Server OS and Desktop OS Delivery Groups:

• Through Citrix Receiver
• From the Start menu
• Through the App-V client and Citrix Receiver
• Simultaneously by multiple users on multiple devices
• Through Citrix StoreFront

Modified App-V application properties are implemented when the application is started. For example, for applications with a modified display name or customized icon, the modification appears when users start the application.

Management methods

You can use App-V packages created with the App-V sequencer and then located on either App-V servers or network shares.

• App-V servers: Using applications from packages on App-V servers requires ongoing communication between Studio and the App-V servers for discovery, configuration, and downloading to the VDAs. This incurs hardware, infrastructure, and administration overhead. Studio and the App-V servers must remain synchronized, particularly for user permissions.

  This is called the dual admin management method because App-V package and application access requires both Studio and the App-V server consoles. This method works best in closely coupled App-V and Citrix deployments.

• Network share: Packages placed on a network share removes Studio’s dependence on the App-V server and database infrastructure, thereby lowering overhead. (You still need to install the Microsoft App-V client on each VDA.)

  This is called the single admin management method because App-V package and application use requires only the Studio console. You browse to the network share and add one or more App-V packages from that location to the Site-level Application Library.

  Application Library is a Citrix term for a caching repository that stores information about App-V packages. The Application Library also stores information about other Citrix application delivery technologies.

You can use one or both management methods simultaneously. In other words, when you add applications to Delivery Groups, the applications can come from App-V packages located on App-V servers and/or on a network share.

When you select Configuration > App-V Publishing in the Studio navigation pane, the display shows App-V package names and sources. The source column indicates whether the packages are located on the App-V server or cached in the Application Library. When you select a package, the details pane lists the applications in the package.

Load balancing App-V servers

Load balancing management and publishing servers using DNS Round-Robin is supported if you are using the dual admin management method. Load balancing the management server behind Netscaler, F5 (or similar) Virtual IP is not supported because of the way Studio needs to communicate with the Management Server via remote PowerShell. For more information, see this Citrix blog article.

Isolation groups

When you use the App-V single admin method, creating isolation groups allow you to specify interdependent groups of applications that must run in the sandbox. This feature is similar, but not identical to, App-V connection groups. Instead of the mandatory and optional package terminology used by the App-V management server, Citrix uses automatic and explicit for package deployment options.

• When a user launches an App-V application (the primary application), the isolation groups are searched for other application packages that are marked for automatic inclusion. Those packages are downloaded and included in the isolation group automatically. You do not need to add them to the Delivery Group that contains the primary application.
• An application package in the isolation group that is marked for explicit inclusion is downloaded only if you have explicitly added that application to the same Delivery Group that contains the primary application.

This allows you to create isolation groups containing a mix of automatically included applications that are available globally to all users. Plus, the group can contain a set of plug-ins and other applications (that might have specific licensing constraints), which you can limit to a certain set of users (identified through Delivery Groups) without having to create more isolation groups.

For example, application “app-a” requires JRE 1.7 to run. You can create an isolation group containing app-a (with an explicit deployment type) and JRE 1.7 (with an automatic deployment type). Then, add those App-V packages to one or more Delivery Groups. When a user launches app-a, JRE 1.7 is automatically deployed with it.

You can add an application to more than one App-V isolation group. However, when a user launches that application, the first isolation group to which that application was added is always used. You cannot order or prioritize other isolation groups containing that application.

Setup

The following table summarizes the sequence of setup tasks for using App-V in XenApp and XenDesktop.

Deploy Microsoft App-V

For App-V deployment instructions, see https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/?redirectedfrom=MSDN.

Optionally, change App-V publishing server settings. Citrix recommends using the SDK cmdlets on the Controller. See the SDK documentation for details.

• To view publishing server settings, enter Get-CtxAppvServerSetting -AppVPublishingServer <pubServer>.
• To ensure that App-V applications launch properly, enter Set-CtxAppvServerSetting –UserRefreshonLogon 0.

If you previously used GPO policy settings to manage publishing server settings, the GPO settings override any App-V integration settings, including cmdlet settings. This can result in App-V application launch failure. Citrix recommends that you remove all GPO policy settings and then use the SDK to configure those settings.

Packaging and placement

For either management method, create application packages using the App-V sequencer. See the Microsoft documentation for details.

• For single admin management, make the packages available on a UNC or SMB shared network location. Ensure that the Studio administrator who adds applications to Delivery Groups has at least read access to that location.
• For dual admin management, publish the packages on the App-V management server from a UNC path. (Publishing from HTTP URLs is not supported.)

Regardless of whether packages are on the App-V server or on a network share, ensure the packages have appropriate security permissions to allow the Studio administrator to access them. Network shares must be shared with “Authenticated users” to ensure that both the VDA and Studio have read access by default.

Configure App-V server addresses in Studio

Important:

Citrix recommends using the PowerShell cmdlets on the Controller to specify App-V server addresses if those servers use nondefault property values. See the SDK documentation for details. If you change App-V server addresses in Studio, some server connection properties you specify might be reset to default values. These properties are used on the VDAs to connect to App-V publishing servers. If this happens, reconfigure the nondefault values for any reset properties on the servers.>

This procedure is valid only for the dual admin management method.

Specify App-V management and publishing server addresses for the dual admin management method either during or after Site creation. You can do this during or after creating the Site.

During Site creation:

• On the App-V page of the wizard, enter the URL of the Microsoft App-V management server, and the URL and port number of the App-V publishing server. Test the connection before continuing with the wizard. If the test fails, see the Troubleshoot section below.

After Site creation:

1. Select Configuration > App-V Publishing in the Studio navigation pane.
2. If you have not previously specified App-V server addresses, select Add Microsoft Server in the Actions pane.
3. To change App-V server addresses, select Edit Microsoft Server in the Actions pane.
4. Enter the URL of the Microsoft App-V management server, and the URL and port number of the App-V publishing server.
5. Test the connection to those servers before closing the dialog box. If the test fails, see the Troubleshoot section below.

Later, if you want to remove all links to the App-V management and publishing servers and stop Studio from discovering App-V packages from those servers, select Remove Microsoft Server in the Actions pane. This action is allowed only if no applications in packages on those servers are currently published in any Delivery Groups. If they are, you must remove those applications from the Delivery Groups before you can remove the App-V servers.

Install software on VDA machines

Machines containing VDAs must have two sets of software installed to support App-V: one from Microsoft and the other from Citrix.

Microsoft App-V client

This software retrieves virtual applications, publishes the applications on the client, and automatically sets up and manages virtual environments at runtime on Windows devices. The App-V client stores user-specific virtual application settings, such as registry and file changes in each user’s profile.

The App-V client is available from Microsoft. Install a client on each machine containing a VDA, or on the master image that is used in a machine catalog to create VMs. Note:: Windows 10 (1607 or greater) and Windows Server 2016 already include the App-V client. On those OSs only, enable the App-V client by running the PowerShell Enable-AppV cmdlet (no parameters). The Get-AppVStatus cmdlet retrieves the current enablement status.

Tip: After you install the App-V client, with Administrator permissions, run the PowerShell Get-AppvClientConfiguration cmdlet, and ensure that EnablePackageScripts is set to 1. If it is not set to 1, run Set-AppvClientConfiguration -EnablePackageScripts $true.

Citrix App-V components

The Citrix App-V component software is installed and enabled by default when you install a VDA.

You can control this default action during VDA installation. In the graphical interface, clear the Citrix Personalization for App-V - VDA check box on the Additional Components page. In the command line interface, include the /exclude “Citrix Personalization for App-V - VDA” option.

If you expressly disable installation of the Citrix App-V components during VDA installation, but later want to use App-V applications: In the Windows machine’s Programs and Features list, right-click the Citrix Virtual Delivery Agent entry and then select Change. A wizard launches. In the wizard, enable the option that installs and enables App-V publishing components.

Add or remove App-V packages in the Application Library

These procedures are valid only for the single admin management method.

You must have at least read access to the network share containing the App-V packages.

Add an App-V package to the Application Library

1. Select Configuration > App-V Publishing in the Studio navigation pane.
2. Select Add Packages in the Actions pane.
3. Browse to the share containing the App-V packages and select one or more packages.
4. Click Add.

Remove an App-V package from the Application Library

Removing an App-V package from the Application Library removes it from the Studio App-V Publishing node display. However, it does not remove its applications from Delivery Groups, and those applications can still be launched. The package remains in its physical network location. (This effect differs from removing an App-V application from a Delivery Group.)

1. Select Configuration > App-V Publishing in the Studio navigation pane.
2. Select one or more packages to be removed.
3. Select Remove Package in the Actions pane.

Add, edit, or remove App-V isolation groups

Add an App-V isolation group

1. Select App-V Publishing in the Studio navigation pane.
2. Select Add Isolation Group in the Actions pane.
3. In the Add Isolation Group Settings dialog box, type a name and description for the isolation group.
4. From the Available Packages list, select the applications you want to add to the isolation group, and then click the right arrow. The selected applications should now appear in the Packages in Isolation Group list. In the Deployment drop-down next to each application, select either Explicit or Automatic. You can also use the up and down arrows to change the order of applications in the list.
5. When you are done, click OK.

Edit an App-V isolation group

1. Select App-V Publishing from the Studio navigation pane.
2. Select the Isolation Groups tab in the middle pane and then select the isolation group you want to edit.
3. Select Edit Isolation Group in the Actions pane.
4. In the Edit Isolation Group Settings dialog box, change the isolation group name or description, add or remove applications, change their deployment type, or change the application order.
5. When you are done, click OK.

Remove an App-V isolation group

Removing an isolation group does not remove the application packages. It removes only the grouping.

1. Select App-V Publishing from the Studio navigation pane.
2. Select the Isolation Groups tab in the middle pane and then select the isolation group you want to remove.
3. Select Remove Isolation Group from the Actions pane.
4. Confirm the removal.

Add App-V applications to Delivery Groups

The following procedure focuses on how to add App-V applications to Delivery Groups. For complete details about creating a Delivery Group, see Create Delivery Groups.

Step 1: Choose whether you want to create a new Delivery Group or add App-V applications to an existing Delivery Group:

To create a Delivery Group containing App-V applications:

1. Select Delivery Groups in the Studio navigation pane.
2. Select Create Delivery Group in the Actions pane.
3. On successive pages of the wizard, specify a machine catalog and users.

To add App-V applications to existing Delivery Groups:

1. Select Applications in the Studio navigation pane.
2. Select Add Applications in the Actions pane.
3. Select one or more Delivery Groups where the App-V applications will be added.

Step 2: On the Applications page of the wizard, click the Add drop-down to display application sources. Select App-V.

Step 3: On the Add App-V Applications page, choose the App-V source: the App-V server or the Application Library. The resulting display includes the application names plus their package names and package versions. Select the check boxes next to the applications you want to add. Then click OK.

Step 4: Complete the wizard.

Good to know:

• If you change an App-V application’s properties when adding them to a Delivery Group, the changes are made when the application is started. For example, if you modify an application’s display name or icon when adding it to the group, the change appears when a user starts the application.
• If you later edit a Delivery Group containing App-V applications, there is no change in App-V application performance if you change the group’s delivery type from desktops and applications to applications only.
• When you remove a previously published (single admin) App-V package from a Delivery Group, Citrix App-V client components attempt to clean up, unpublish, and remove any packages that are no longer in use by the single admin management method.
• If you are using a hybrid deployment—with packages delivered by the single admin management method and an App-V publishing server, managed either by dual admin or by another mechanism (such as Group policy)—it is not possible to determine which (now potentially redundant) packages came from which source. In this case, cleanup is not attempted.
• If you are not using a publishing server, but have packages on the VDA managed by another mechanism (such as SCCM, custom scripting, or a third party App-V management solution), the clean-up routines may remove packages which are still required. In this scenario, add a dummy App-V Management server registration to the VDA to prevent clean up being attempted.

Troubleshoot

Issues that can occur only when using the dual admin method are marked (DUAL).

(DUAL) There is a PowerShell connection error when you select Configuration > App-V Publishing in the Studio navigation pane.

• Is the Studio administrator also an App-V server administrator? The Studio administrator must belong to the “administrators” group on the App-V management server so that they can communicate with it.

(DUAL) The Test connection operation returns an error when you specify App-V server addresses in Studio.

• Is the App-V server powered on? Either send a Ping command or check the IIS Manager; each App-V server should be in a Started and Running state.
• Is PowerShell remoting enabled on the App-V server? If not, see https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ff700227(v=msdn.10)?redirectedfrom=MSDN.
• Is the Studio administrator also an App-V server administrator? The Studio administrator must belong to the “administrators” group on the App-V management server so that they can communicate with it.
• Is file sharing enabled on the App-V server? Enter \\<App-V server FQDN> in Windows Explorer or with the Run command.
• Does the App-V server have the same file sharing permissions as the App-V administrator? On the App-V server, add an entry for\\<App-V Server FQDN> in Stored User Names and Passwords, specifying the credentials of the user who has administrator privileges on the App-V server. For guidance, see https://support.microsoft.com/kb/306541.

• Is the App-V server in Active Directory?

  If the Studio machine and the App-V server are in different Active Directory domains that do not have a trust relationship, from the PowerShell console on the Studio machine, run winrm s winrm/Config/client ‘@(TrustedHosts=”<App-V server FQDN>”)’.

  If TrustedHosts is managed by GPO, the following error message will display: “The config setting TrustedHosts cannot be changed because use is controlled by policies. The policy would need to be set to Not Configured to change the config setting.” In this case, add an entry for the App-V server name to the TrustedHosts policy in GPO (Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Client).

(DUAL) Discovery fails when adding an App-V application to a Delivery Group.

• Is the Studio administrator also an App-V management server administrator? The Studio administrator must belong to the “administrators” group on the App-V management server so that they can communicate with it.
• Is the App-V management server running? Either send a Ping command or check the IIS Manager; each App-V server should be in a Started and Running state.
• Is PowerShell remoting enabled on both App-V servers? If not, see https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ff700227(v=msdn.10)?redirectedfrom=MSDN.
• Do packages have the appropriate security permissions for the Studio administrator to access?

App-V applications do not launch.

• (DUAL) Is the publishing server running?
• (DUAL) Do the App-V packages have appropriate security permissions so that users can access them?
• (DUAL) On the VDA, ensure that Temp is pointing to the correct location, and that there is enough space available in the Temp directory.
• (DUAL) On the App-V publishing server, run Get-AppvPublishingServer \* to display the list of publishing servers.
• (DUAL) On the App-V publishing server, ensure that UserRefreshonLogon is set to False.
• (DUAL) On the App-V publishing server, as an administrator, run Set-AppvPublishingServer and set UserRefreshonLogon to False.
• Is a supported version of the App-V client installed on the VDA? Does the VDA have the “enable package scripts” setting enabled?
• On the machine containing the App-V client and VDA, from the Registry editor (regedit), go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\AppV. Ensure that the AppVServers key has the following value format: AppVManagementServer+metadata;PublishingServer (for example: http://xmas-demo-appv.blrstrm.com+0+0+0+1+1+1+0+1;http://xmas-demo-appv.blrstrm.com:8082).
• On the machine or master image containing the App-V client and VDA, check that the PowerShell ExecutionPolicy is set to RemoteSigned. The App-V client provided by Microsoft is not signed, and this ExecutionPolicy allows PowerShell to run unsigned local scripts and cmdlets. Use one of the following two methods to set the ExecutionPolicy: (1) As an administrator, enter the cmdlet: Set-ExecutionPolicy RemoteSigned, or (2) From Group Policy settings, go to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell> Turn on Script Execution.

If these steps do not resolve the issues, enable and examine the logs.

Logs

App-V configuration-related logs are located at C:\CtxAppvLogs. The application launch logs are located at: %LOCALAPPDATA%\Citrix\CtxAppvLogs. LOCALAPPDATA resolves to the local folder for the logged-on user. Check the local folder of the user for whom the application launch failed.

To enable Studio and VDA logs used for App-V, you must have administrator privileges. You will also need a text editor such as Notepad.

To enable Studio logs:

1. Create the folder C:\CtxAppvLogs.
2. Go to C:\Program Files\Citrix\StudioAppVIntegration\SnapIn\Citrix.Appv.Admin.V1. Open CtxAppvCommon.dll.config in a text editor and uncomment the line: <add key =”LogFileName” value=”C:\CtxAppvLogs\log.txt”/>
3. Restart the Broker service to start logging.

To enable VDA logs:

1. Create the folder C:\CtxAppvLogs.
2. Go to C:\Program Files\Citrix\ Virtual Desktop Agent. Open CtxAppvCommon.dll.config in a text editor and uncomment the following line: <add key =”LogFileName” value=”C:\CtxAppvLogs\log.txt”/>
3. Uncomment the line and set the value field to 1: <add key =”EnableLauncherLogs” value=”1”/>
4. Restart the machine to start logging.