Securing the ICA File Enhancements within Citrix Workspace App

 I recently worked with a client requesting extra features be set up within the Citrix Workspace app. The environment had a good security team and asked the following below.

1. Remove all ICA files being stored after launch use.
2. Make the ICA file stored in memory so that if the ICA files were not removed, there was no location it would be downloaded to. The mindset around this is: “To reduce the attack surface, ICA files from Citrix Workspace app for Windows will now be stored in memory.”

Let’s dive into each setting and go over how I approached this.

Delete the ICA file after being used:

1. You will notice the typical setup in most environments I have seen.
   • The user opens a URL, navigates to the area where their company Citrix hosting site is, inputs username/password/MFA, clicks the Citrix resource, an ICA file is downloaded, and then opens.
   • Depending on the browser, in most cases, it’s going to be Chrome/Chromium Edge/Firefox.
   • Afterwards, you will notice the session ICA files in downloads (in most cases).
2. To address this, the first setting is to Enable “ICA File Settings” and then check the box to “RemoveICAFile.” I explained to the customer that inside the ICA file, there is an STA (Secure Ticket Authority) and the lifetime of this is 100 seconds. Therefore, it will not be good. But as we all know, it will contain some environmental data. With that in mind, it was a reasonable request. I also explained that the STA ticket could only be used once, although they still wanted this feature set. “Okay, we can do that,” I said.
   • FAQ: Citrix Secure Gateway/ NetScaler Gateway Secure Ticket Authority
3. Below is the screenshot of the GPO that will be needed, as the client was all Windows-based clients.

4. For example, if the GPO above is not enabled, you will notice ICA files in the downloads from my last session.

5. The default for Citrix Workspace App is when I launch a Citrix Session. You will see it download to my downloads folder and start connecting to the Desktop once you close the resource. The ICA file persists. But if I set the GPO, as I explained above, you will see this behavior.
6. I log into my URL, open my Citrix resource, and download an ICA file.

7. I am now logged into the Desktop, and the current ICA file is still in the downloads while I am in my session.

8. Once the ICA session has ended, the ICA file is deleted per the GPO. As you can see, you don’t see it anymore. It deleted the ICA file, which was the desired configuration I was after.

9. Once the GPO applies, you will see it here on the local Client if you want to check if the keys are enforced and get peace of mind, which the security team wanted to see as well.
   • Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\ICA File
   • REG_SZ = RemoveICAFile
   • Value = True

Addressing the ICA File in Memory

1. I needed to do some reading on this, as I recall it being announced. I read the blogs to get a better understanding of the flow: Enhanced ICA file security on Citrix Workspace app for Windows | Citrix Blogs

2. I also remember a podcast on this with some great information from Andy and Bill at XenTegra. (These podcasts provide excellent value by investing in the technology not only from an informative aspect but also a technical aspect for folks like myself. E83 – The Citrix Session: Enhanced ICA file security on Citrix Workspace app for Windows – XenTegra – Citrix, Microsoft, EUC, & Cloud Solutions and Services

What I Discovered After Some Quick Education

1. This applies to Workspace App (Native application) and Workspace for Web.
2. After reading the documentation on this, natively it was only supported by the Workspace app. Then in time, Citrix released it for the Workspace Web side.
3. On Citrix StoreFront, you will see inside the Web.config file an entry like this.
4. On the Citrix StoreFront server, inetpub location is where you will see the Web.config file. C:\inetpub\wwwroot\Citrix\labWeb
   • https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/configure.html#improved-ica-file-security
   • <protocolHandler enabled=”true” platforms=”(Macintosh|Windows NT|Linux|CrOS).*((Firefox/((5[2-9]|[6789][0-9])|\d\d\d))|(Chrome/((4[2-9]|[56789][0-9])|\d\d\d)))|Macintosh.*Version/(1[2-9]|[2-9][0-9]).*Safari/”
     skipDoubleHopCheckWhenDisabled=”false” />
   • This protocolHandler should be enabled by default on 2203.1000 as well.
5. I also went and enabled “Secure ICA File Session launch.” This will block the ICA files from being opened by browsers that can’t use the ICA in memory. I have no ICA file downloaded either, because I set this Citrix Workspace GPO.
6. It’s no longer required to add the registry EnableIcaFileInMemory and set the value to “True.”

7. To check this after the Citrix Workspace GPO is applied:
   • Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix
   • REG_DWORD = BlockDirectICAFileLaunches
   • Value = 1
8. At first, I couldn’t get this to work in Edge.
9. I am trying it with Edge.

10. Next, I am trying it with Chrome. As you can see, it did what it was supposed to.

11. For the most part, Chrome and Edge have the same code, and I was not sure why it wasn’t working in Edge.
12. I went back to the docs, and this jumped out at me: “When you sign in to the store through the browser, click Detect Workspace App. If the prompt doesn’t appear, clear the browser cookies and try again.”
13. This part is what detects the workspace for the web when, from what I gather, it is what detects to apply the “protocolHandler enabled=”true” If it does not do this the first time, it will not be able to open the ICA file if you have the GPO set to “Secure ICA File Session launch.”
14. I cleared all my cookies from Edge and got the “Detect Workspace App” to prompt me.

15. As you can see, it opened my Citrix Desktop now from Edge.

16. If the user gets this error:

17. You will have to ask them to clear the cookies to allow it to work. It may happen more than it should as well. Also, this was from my lab and testing.
18. If the users are using only the Native Citrix Workspace app without going to the URL, this should not be a problem. It works every time as well.
19. What about BYOD devices? Citrix has a solution for those as well: Global App Configuration Service (cloud.com)

20. Recent enhancement: Manage Citrix Workspace app for your users with just one click | Citrix Blogs
21. At this time, it is in Tech Preview, but it will be a game changer, in my humble opinion. Customize Citrix Workspace app settings [Technical Preview]

With these settings in place, I could achieve the desired configuration. I hope everyone had a wonderful holiday in 2022 and a safe and happy new year!

Citrix Workspace App device access behavior

Some documentation isn’t updated as fast as some would like. Citrix has a couple of sites that outline how to configure default device access behavior in Workspace for Windows. But as with any documentation, things change around technology, user needs, and security.

I recently faced a challenge: Users wanted this prompt to go away, and only WebCams needed to be blocked.

Now, I understand the user can click the option and say “don’t remind me again.” But our job in these roles is to make things transparent for our end users and clients to promote a good Citrix environment. I understand this sounds small, but in a high-security environment, it should be something that any Citrix person thinks about in the back of their mind. In my humble opinion, without proper configuration, it will give any product a sour taste to a user or client. Citrix Products (or really any products) take some heat from users at times. Citrix offers many configurations in its line of products. It’s up to you as a System Admin or Consultant to do what you can to deliver a good experience.

1. Navigate to the Citrix Article and download the ADMX files:
   • https://support.citrix.com/article/CTX133565
2. Log in with your Citrix account and download

The files will look like this:

3. Drop these files in your \\domain.local\SYSVOL\lab.local\Policies\PolicyDefinitions
4. Open up the Group Policy Management console and expand Citrix components. You will see the following:

5. In my case, I disabled the 64bit settings, but you don’t need to unless you are using it.
6. I proceeded with disabling the Settings in the “Client selective Trust x64.” The following screenshot shows the settings I disabled.

7. In this situation, I defined the settings in “Citrix Client Selective Trust x86).”
8. Enable the “Create Client Selective Trust Keys”

9. For this specific setup, I was working on something for a client. They wanted things blocked, and the popups stopped.
10. I went through these locations and selected:
    • Enable
    • 0: No access
      • specifying 0 for no access for all categories
      • File Security
      • MicrophoneAndWebcamSecurityPermission
      • PdaSecurityPermission
      • ScannerAndDigitalCameraSecurityPermission)
    • Also, do this in all zones:
      • oidInternetRegionIcaAuthorizationDecision,
      • oidIntranetRegionIcaAuthorizationDecision,
      • oidRestrictedSitesRegionIcaAuthorizationDecision,
      • oidTrustedSitesRegionIcaAuthorizationDecision

11. The last setting you will need, if not already completed, is to add the URLS into the Trusted Zone.
12. Computer configuration-> Administrative templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Enable “Site to Zone Assignment list” and add your company URL and put a number 2 in it.

Example:

13. You can check the key as well by browsing here:
    1. Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

14. Now with those settings in place above, when a user opens a Citrix Desktop, you will notice that the Desktop viewer preferences are now set for the user.

15. The settings will stop it from asking you. As you can see, they are set to “Do not connect me” The users can also change them if needed.

16. At this point, the popups are gone. But the user still has control to change them if needed. If you wanted to prevent users from changing them for security purposes, you need to edit the registry location(on the client devices):
    • Here:
      Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\ICA Client\Client Selective Trust\oidPredefinedSecurityPolicySettings\InstantiatedSecurityPolicyEditable
    • Registry REG_SZ key is (Default)
    • Value is True by default. True means the users can change the settings.

17. False means they cannot change them.

18. You don’t need the user to log out. It will update once the client gets the updated reg key location. But for safety measures, I would. You can also wait until the next business day or when new sessions start. It’s your option, ideally.
19. You can toggle them on or off in GPO with a computer login script on the client’s or any option you may use in your enterprise environment.
    • Set-ItemProperty -Path “HKLM:\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\ICA Client\Client Selective Trust\oidPredefinedSecurityPolicySettings\InstantiatedSecurityPolicyEditable” -Name ‘(Default)’ -Value False
    • Set-ItemProperty -Path “HKLM:\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\ICA Client\Client Selective Trust\oidPredefinedSecurityPolicySettings\InstantiatedSecurityPolicyEditable” -Name ‘(Default)’ -Value True
20. I am opening my desktop and will trigger something that will want to use my Webcams/Mic and Local drives.
21. It’s now greyed out as well.

22. No file security pop up.

23. Drive is not allowed to be accessed.

24. Let’s do a test with Zoom to see if it will trigger the Default Device Access behavior. No popup. In this case, the Zoom VDI plugin picked up the HDX Optimized channels and natively allowed the Mic.

25. No USB options, as it’s using the HDX optimized channel.

26. To take it a step further, you can implement a Citrix Studio Policy to restrict some of this. Blocking the client’s drives will never allow them to show up in the session.

27. I had a request to Allow Mics only while blocking webcams. I must admit, this one was a challenging task.
28. So I went back to the “Citrix Client selective trustx86” section and updated these keys:

31. I logged into my VDA.
32. Mic came in with no Device Behavior popup.
33. The camera came in with no device popup.
34. 1 out of 2 things is working. We know the CAM/MIC would come through. But I wanted to ensure no popup. Now I must figure out how to block the Web Cams for all.

33. So I went into Citrix studio and found a Multimedia Conference Policy. I set it to Prohibited.

34. Results are…. No video.

35. Let’s undo the Policy to ensure it will work again. This helps me confirm as well that what I did is working after all.
36. After setting it to allow, the camera came back.

37. I achieved the desired configuration by:
    • Setting the Client device keys to full access. Its’ Number 2:FullAccess in the GPO
    • Disabling unusable configuration
    • Disabling Multimedia Conference Policy, which seemed to do the trick here for the cameras

Hopefully, this will help someone, and as always, if you know something better. Please share 

After all, Sharing is caring in my books.

References used

• How to Prevent Users from Changing Client Device Access Settings for 12.x Plug-in and later versions of Receiver for Windows Using Client Selective Trust (citrix.com)

• How to Configure Default Device Access Behavior of Workspace app for Windows (citrix.com)