PVS: An unexpected MAPI error occurred

A lovely error Citrix Provisioning Services (PVS)  "An unexpected MAPI error occurred" error. Fortunately, Jeff found the fix and shared it here.  This is a bug in PVS 5.6.

Solution: In short, when you edit the properties of the PVS vDisk, set the disk status to Standard and select “MAK” on the Licensing TAB and press OK. Now you will not receive the error. Then set it back to KMS and click Ok.

Read More

ExecuteNonQuery Failed for database

This error happened to us today as we were updating our XenDesktop 5.5 environment to 5.6.  I swear the DBAs changed the perms on us but found out the SQL database failed to the mirrored site.  Anyway it was an easy fix and Citrix even had an article...just fail them back. 

Lesson learned:  If you are usign SQL mirroring, make sure the SQL databases are on the primary node PLUS get some scripts in place to auto-fail back.
  
The Detail
Exception:
    System.Reflection.TargetInvocationException Exception has been thrown by the target of an invocation.
       at Citrix.Console.Common.CallbackEventArguments.OperationCompleteSynchronizer.CheckResults()
       at Citrix.Console.Common.CallbackEventArguments.OperationCompleteSynchronizer.WaitForResults()
       at Citrix.Console.DeliveryCenter.UI.DatabaseUpgrade.ApplyUpdateWithCredentials(UserCredentials credentials)
       at Citrix.Console.DeliveryCenter.UI.DatabaseUpgrade.ApplyUpgrade()
       at Citrix.Console.CommonControls.ProgressDisplay.GenericProgressOperation.PerformOperationInternal()
       at Citrix.Console.CommonControls.ProgressDisplay.ProgressWindowOperation.PerformOperation()
       at Citrix.Console.CommonControls.ProgressDisplay.ProgressWindowViewModel.PerformAction(ManualResetEvent operationComplete)
   
   
Inner exception:
    Microsoft.SqlServer.Management.Smo.FailedOperationException ExecuteNonQuery failed for Database 'XenDesktop_Database'.
       at Citrix.Console.InteractionCore.ThreadedScript.d__9.MoveNext()
       at Citrix.Console.InteractionCore.ScriptBase.d__1.MoveNext()
       at Citrix.Console.InteractionCore.Scheduler.ExecuteNext(ScriptExecution execution)
   
    HelpLink.ProdName : Microsoft SQL Server
    HelpLink.BaseHelpUrl : http://go.microsoft.com/fwlink
    HelpLink.LinkId : 20476
    HelpLink.ProdVer : 10.50.1600.1 ((KJ_RTM).100402-1540 )
    HelpLink.EvtSrc : Microsoft.SqlServer.Management.Smo.ExceptionTemplates.FailedOperationExceptionText
    HelpLink.EvtData1 : ExecuteNonQuery
    HelpLink.EvtData2 : Database
   
Inner exception:
    Microsoft.SqlServer.Management.Common.ExecutionFailureException An exception occurred while executing a Transact-SQL statement or batch.
       at Microsoft.SqlServer.Management.Common.ServerConnection.ExecuteNonQuery(String sqlCommand, ExecutionTypes executionType)
       at Microsoft.SqlServer.Management.Common.ServerConnection.ExecuteNonQuery(StringCollection sqlCommands, ExecutionTypes executionType)
       at Microsoft.SqlServer.Management.Smo.ExecutionManager.ExecuteNonQuery(StringCollection queries, ExecutionTypes executionType)
       at Microsoft.SqlServer.Management.Smo.Database.ExecuteNonQuery(StringCollection sqlCommands, ExecutionTypes executionType)
   
   
Inner exception:
    System.Data.SqlClient.SqlException The database "XenDesktop_Database" cannot be opened. It is acting as a mirror database.
       at Microsoft.SqlServer.Management.Common.ConnectionManager.ExecuteTSql(ExecuteTSqlAction action, Object execObject, DataSet fillDataSet, Boolean catchException)
       at Microsoft.SqlServer.Management.Common.ServerConnection.ExecuteNonQuery(String sqlCommand, ExecutionTypes executionType)
   
    HelpLink.ProdName : Microsoft SQL Server
    HelpLink.ProdVer : 10.00.4000
    HelpLink.EvtSrc : MSSQLServer
    HelpLink.EvtID : 954
    HelpLink.BaseHelpUrl : http://go.microsoft.com/fwlink
    HelpLink.LinkId : 20476

Read More

Citrix Logon Best Practices and Troubleshooting

Citrix Optimization Guide: User Logon

This just came out and thought it was timely for some things I'm working on.
Best part was Troubleshooting Tools section on page 12 that covered the Edgesight Session Startup Duration Detail report/breakdown of the logon process.  This report would also be a good validation tool with each vDisk rev, Profile or GPO changes. All the acronyms below correspond to different steps in the login process so you can pin point the area that is slow (i.e. web interface, login script, etc). This is handy paper to keep around in case you need it.


Edgesight Server Startup Details

Read More

Citrix Success Accelerator for XenDesktop

If you haven't seen Citrix's new Success Accelerator for XenDesktop, you should check it out before doing any size deployment (i.e. 10 to 1000s).  I wish we had this 12 months ago when we started our pilot.  It is in a Q&A format and gets you thinking about all the technologies involved and what choices you may need to make. It will walk you through the Design, Implementation and Rollout phases and provide an output of instructions and resources for your project.  Definitely check it out.

Screenshot of the web ui is below.

Read More

Pink screen after Xenith Firmware 1.7 upgrade

I ran into this after upgrading our Wsye Xenith from 1.6 to 1.7 firmware. We were using the AutoSignoff=yes Shutdown=yes commands in our ini and after users devices were powered down then up again were seeing this.  Ironically, it didn't occur on the Xenith Pro's.

To reproduce:

1. Apply firmware 1.6

2. Upgrade to 1.7

3. Shutdown from Wyse Toolbar

4. Power on and the issue occurs

To resolve:

1. While shutdown, pull power supply

2. Start up.

OR add this to your xen.ini or wnos.ini

AutoSignoff=yes Shutdown=yes
ShutDown=turnoff 

This appears to be a known issue with no good documented solution so hopefully this helps.



Read More

DPM 2010 and Juniper SRX Firewall

SharePoint 2010 is all the rage (still) and products are finally maturing enough where you don't need best of breed to get everything done. We recent started rolling Microsoft's Data Protection Manager (DPM) 2010 to do our SharePoint 2010 back ups. DPM 2007 recovery process through a "recovery farm" is a thing of the past with DPM 2010 so the timing was right. So we choose DPM 2010 as our backup/recovery strategy and implemented it fine on the intranet but then....yes we need SharePoint 2010 on the extranet so DPM 2010 followed and so did the firewall....

I followed the ports outlined by Microsoft and cringed a little with the 135 TCP Dynamic reference and the somewhat legal jargen below it. Anyone who has worked with Microsoft and sees DCOM, RPC or the phrase "port range" knows what I mean when I say cringe. I found this article recently by Thomas Shinder and while a little older the diagrams illustrate network traffics behavior for RPC traffic. Since all our servers are Windows Server 2008, the high port range is ONLY the TCP 49152 – 65535. Yes only 16,000 ports which makes my security team cringe as well.

Our environment:
- All Windows Server 2008 or 2008 R2 64bit
- DPM 2010
- SharePoint 2010
- Juniper SRX Firewall

So assuming you have proper communication to your Domain Controller from your windows servers, what are the options:
 
1. Open 135 TCP Dynamic, 3148/3149 TCP, and open the port range if not respected by the firewall as dynamic
 Pros: Easy...just open the ports
 Cons: Lots of ports open

2. Create an IPsec tunnel between DPM and the Protected Servers (see this for more info)
 Pros: Open only a few ports
 Cons: Need to maintain IPsec policy via local or group policy on all DPM and Protected Servers

3. Change the RPC port range
 Pros: Easy to change via registry
 Cons: It affects ALL RPC traffic not just DPM's PLUS need to maintain on all DPM and Protected Servers

4. Open 3148/3149 TCP and leverage MSDPM UUIDs
 Pros: Set it and forget it
 Cons: Hard to find the UUID without looking through traces or googling a lot.

So we when with number #4. We dealt with Active Directory communciation through our Juniper firewalls a few years ago and remembered the UUID model. So I started searching and came across Steve Buchanan write-up and while for ISA, Juniper has the same functionality. Long story short, we implemented a Global UUID Services with the following on our Juniper SRX Firewall:

MSDPM AC:
{C4EBD674-1457-4B79-BE30-B04735AED9D1}
{A3B9D3F4-2477-4F95-B2D1-F75B0FDF2A2F}

DPM RA:{DA6AA17A-D61C-4E9C-8CEA-DB25DEA52A95}
{2DF31D97-33CC-4966-8FF9-F47C90F7D0F3}

MSDPM:
{27F60283-447F-4D5F-AA84-F45D09BD06EF}
{8D8C691A-AFE6-4EA3-A6B2-F3E5EF1BD0CA}

DPM LA:{1B308A4A-FFEC-4C85-957C-53AA1DCC696F}
{9E6C5356-B180-4295-888C-5A99E505420F}

RPC interface UUID for IRemoteSCMActivator
{000001A0-0000-0000-C000-000000000046}

RPC interface UUID for IObjectExporter
{99fcfec4-5260-101b-bbcb-00aa0021347a}

RPC SMB Relay type bind
{6cb71c2c-9812-4540-0300-000000000000}

Microsoft NDR Transfer Syntax Identifier
{8a885d04-1ceb-11c9-9fe8-08002b104860}

The last four I'm thinking are covered under ISA's default 135 TCP Dynamic configuration so they were additional on the SRX.

** Some of the errors you'll see if firewall is blocking traffic to the protected servers (when you are "attaching" an agent).  Just run a trace on the DPM server using Wireshark or Netmon and look for ReSynTransmits over the TCP 49152 – 65535 range.

Install protection agent on SERVERA.lmx.abc.com failed: Error 346: DPM is unable to retrieve the configuration information from SERVERA.abc.com. Recommended action: Ensure that the Windows Management Instrumentation (WMI) service is started. If the firewall is turned on, on SERVERA.abc.com make sure that an exception for WMI is created.

The RPC server is unavailable (0x800706BA)

Good luck..and chances are it is the firewall! 

Read More

XenDesktop ESXi Permissions

Background:

Jarian Gibson has a great post here on all the VMware ESX permissions needed for XenDesktop Desktop Delivery Controller (DDC) to communciate with the VMware ESXi VirtualCenter.  I ran into one issue below, using the Citrix Provisioning Services XenDesktop Wizard and had to add "Virtual Machine > Configuration > Change CPU count which is the attribute "VirtualMachine.Config.CPUCount".


Environment:
Citrix XenDesktop 5 SP1
Citrix Provisioning Services 5.6 SP1
VMware ESXi 4.1 Update 1


Problem:
Error There was an error reported by the wizard
[VDI-NonProd-XXXX] Failed to connect with the requested server. (Permission to perform this operation was denied. (NoPermissionFault)(group-v51VirtualMachine.Config.CPUCount) )

Solution:
I was getting the error above but after adding the Change CPU count option it was fixed.  Detailed permissions are outlined below.

ESXi 4.x Perms
At the Datastore node -   Allocate space -  Browse Data Store - Low level file operations
On the Global Node -  Manage custom attributes - Set custom attributes
On the Network node - Assign network
On the Resource node - Assign virtual machine to resource pool
On the Task node - Create Task
On the Virtual Machine > Configuration node - Add existing disk - Add new disk - Change resource - Remove disk
On the Virtual Machine > Interaction node - Power On - Power Off - Power Suspend - Power Reset
On the Virtual machine > Inventory node - Create from existing - Create new - Register - Remove
On the Virtual machine > Provisioning node - Allow disk access - Allow virtual machine download - Allow virtual machine files upload - Clone template -  Clone virtual machine - Deploy template
On the Virtual machine > State node - Revert to snapshot

Read More