How Group Policy Impacts Logon Performance #4: Citrix Policies
This article is based on my Citrix Synergy 2015 session and is the fourth in a mini-series on Group Policy performance. All measurements by uberAgent on Windows Server 2012 R2 with Citrix XenApp 7.6 in a steady state. Please start reading with the first article.
Farm vs. Active Directory
Citrix policies, i.e. policies applying to the VDAs, can be stored in these two locations:
- Farm (database)
- Active Directory and Sysvol (Group Policy)
Both types of policies can be used together. Their settings are joined on the client by the VDA.
Precedence
Settings configured in Group Policy have precedence over farm settings. Settings are applied in the following order (highest priority last):
- Local
- Farm
- Site
- Domain
- OU
Policy Refresh
Farm Policy
New or changed settings are distributed to VDAs:
- When the VDA registers with a DDC
- When a user logs on
These events trigger a BrokerAgent CONFIGURATION SET event. BrokerAgent.exe writes changed farm policies to %ProgramData%\Citrix\PvsAgent\LocallyPersistedData\BrokerAgentInfo\<GUID>.gpf. BrokerAgent.exe then triggers a policy evaluation via CitrixCseClient.dll. This causes CitrixCseEngine.exe to process policy (see below).
Group Policy
Group Policy is updated following the regular Group Policy cycle with an additional refresh at session reconnection added by Citrix:
- Computer startup
- User logon
- Background refresh
- When triggered by gpupdate
- Session reconnection
Citrix Group Policy Client-Side Extension (CSE)
In order to hook into Group Policy operations Citrix adds the client-side extension CitrixCseClient.dll. The Citrix CSE is configured in such a way that it is called every time Group Policy is applied. Its main task is to notify the Citrix Group Policy Engine service (see below).
In addition to that the CSE checks the following undocumented registry values in HKLM\SOFTWARE\Citrix\GroupPolicy:
- CseIgnoreCitrixComputerPolicyTrigger
- CseIgnoreCitrixUserPolicyTrigger
- CseIgnoreWindowsComputerPolicyTrigger
- CseIgnoreWindowsUserPolicyTrigger
- CseIgnoreWindowsBackgroundComputerPolicyTrigger
- CseIgnoreWindowsBackgroundUserPolicyTrigger
If you want to change how/when Citrix Policy is applied, those values look like a good place to start.
Citrix Group Policy Engine Service
All the important work is done by the Citrix Group Policy Engine Service (CitrixCseEngine.exe). It is notified by the local Citrix CSE (CitrixCseClient.dll) whenever a policy refresh needs to happen. It then combines Group Policy settings with farm settings, applies them and creates RSoP data. Resulting policy settings are written to the registry:
- Computer: HKLM\SOFTWARE\Policies\Citrix
- User: HKLM\SOFTWARE\Policies\Citrix\<SessionID>\User
In addition to generating the resulting policy values the Citrix Group Policy Engine Service creates several cache and helper files: actual policy settings are stored as GPF files in %ProgramData%\CitrixCseCache. Rollback and RSoP information is written to Rollback.gpf and Rsop.gpf respectively in %ProgramData%\Citrix\GroupPolicy.
