XenApp 6 server in wrong worker groups


A XenApp 6 server may ignore a work group after the renaming the worker group


This is caused because the server fails to update the registry key with the worker groups it belongs to.


To verify the list of worker groups a server belongs to check the registry key HKLM\SOFTWARE\Wow6432Node\Citrix\IMA\WorkerGroups It contains a list with all the worker groups that the server is member of.


To ensure that the server recognizes the new worker group name; remove the server from the worker group, check the registry used in troubleshooting and wait for the worker group to be removed from the list, note that at this time the old name will be showing in the registry; if the worker group isn’t removed from the registry you can remove it manually.

Once the worker group isn’t present in the registry, add the server back to the worker group list. Wait for a few seconds and check the same registry key again; the correct worker group should be displayed now.

Shadow permissions on XenApp6

On XenApp 6 non-admin users cannot shadow user sessions although permissions were given to the user at the farm level. This happens because the user doesn’t have Remote Control rights on the ICA listner on the server.

Changing permissions

Start the ICA Listner configuration from Start\Citrix\Administration Tools; note that the application takes a couple of seconds to start.

Once the ICA listener configuration has started, select the desired listener, ICA-TCP by default, and press Security.

From the permissions window for the selected listener press Advanced.

Once the Advanced Security Settings for ICA-TCP is open you will need to, add the security group and give it Remote control rights as follows. Press Add… to open the Select user, Computer, Service Account, or group window.

Type the name of the group, HELPDESK press Check Names to verify and then press OK.

Now from the Permission Entry for ICA-TCP window, verify that you’re setting the permissions to the right group, by checking the name and tick the Allow box for Remote Control and press OK.

Note: DO NOT tick any other boxes.

Once the Advanced Security Settings for ICA-TCP is active, verify that the HELPDESK group is in the list with Allow and Remote Control. Press Apply and OK.

Press OK to close any other window that was still open.

The changes take immediate effect on new connections and there is no requirement to restart services or reboot the server.