Citrix Conferencing Manager 4.0 Deployment Script

The script below is very thorough. Please read through it so that you understand exactly what it does, and how it addresses all issues that need to be considered when deploying Conferencing Manager. This script is part of our automated server deployment model.

I strongly believe that if a customer has Citrix Presentation Server Enterprise or Platinum Edition, you must deploy this for them. It's a great tool and is what I consider to be a value add for any Presentation Server deployment.

CMDOW @ /HID
@Echo Off
::------------------------------------------------------------------------------
:: Citrix Conferencing Manager Deployment
:: --------------------------------------
::
:: Revision History:
::
:: v2.0 9th Feb 2007 by Jeremy.Saunders@au1.ibm.com
:: - Cleared revision history.
:: - Added DCOMPERM.exe to automate the change of permissions on DCOM objects
:: as per CTX107171.
::
:: Requires Presentation Server 3.0 or later.
::------------------------------------------------------------------------------
Echo.
Echo ....Installing Conferencing Manager 4.x.....
Echo.

:: The following 6 lines are Environment variables that are available to all
:: scripts throughout our automated build process. Some are deleted when the
:: build completes. So you will need to uncomment and customise these lines if
:: you are deploying Conferencing Manager manually outside the build process, or
:: to an environment that does not contain these variables. If you want to
:: install on the Conference Organiser Service to a server other than a Citrix
:: server, ensure the ROLE environment variable is set to something other
:: than Citrix, or just left blank.
::set BldSWDrive=S:
::set BldDomain=DEMO
::Set BldUser=svr_build
::Set BldPwd=Password1
::Set ROLE=Citrix
::Set CitrixVersion=PS4

:: The following two lines will allow us to deploy the Conference Organizer
:: Service on a non-Citrix server using a UNC path instead of a mapped drive.
If /I NOT "%ROLE%"=="Citrix" set CitrixVersion=PS4
If /I NOT "%ROLE%"=="Citrix" set BldSWDrive=\\fileserver\software$

set CMUsersGroup=Citrix Conferencing Manager Users

:: These properties are used by the Conference Organizer Service
Set Integration=Outlook
::Set Integration=LotusNotes
::Set LotusNotesINIPath=%%HOMEDRIVE%%%%HOMEPATH%%\Notes\Data\Notes.ini
Set PRIMARY_XML_SERVER=ica:80
Set BACKUP_XML_SERVER=ica2:80

:: This property is used by the Conference Room Manager Service
Set CORGANIZER_SERVER=CitrixCMO

Set loglocation=%systemDrive%\bldlogs
if not exist %loglocation% md %loglocation%

:: To install Conferencing Manager on the Presentation Servers you must use
:: an account that is a Citrix Administrator. Typically, the build account
:: (BldUser) will already have these privileges.

:: There are four issues that are documented and addressed within this script.
:: 1. Ensuring that the MetaFrame COM Server service is running when installing
:: Conferencing Manager on the Presentation Servers.
:: 2. Registry permissions as per Citrix support article CTX108342.
:: 3. DCOM permissions as per Citrix support article CTX107171.
:: 4. Give Citrix users the "Allow logon locally" rights to the server running
:: the Conference Organizer Service. This is not documented at all by Citrix.

:: Only one instance of the Conference Organizer Service is allowed per server
:: farm. It can be installed on a standalone server without Presentation Server
:: installed, but it must be installed in the same domain where the Conferencing
:: Manager user interface and Conference Room components are installed.

:: Typically, we install the Conference Organizer Service on a separate server
:: with a DNS host record called CitrixCMO registered that points to that
:: location. The External Conferencing Service (ECS) is a subset of the
:: Conference Organizer Service, and is only used by the Guest Attendee feature.

:: Because you can only have one Conference Room Organizer service per farm, we
:: typically install it on the server that runs the Citrix Licensing Server
:: service, Terminal Server Licensing Service and Data Store (depending on the
:: type of course). This keeps all the Citrix farm components grouped together.

:: As you will see below, if the server Role is not Citrix, then only the
:: Conference Organizer and External Conferencing Services are installed. Whlist
:: on the other hand, if the Role is Citrix, then only the Conference Room
:: Manager is installed. If you really want to install the Conference Organizer
:: service on a Presentation Server, you will need to modify this script to
:: suite your needs.

:: Start the MetaFrame COM Server service...
:: Note: This must be running in order to install Conferencing Manager.
If /I NOT "%ROLE%"=="Citrix" GOTO InstallCM
net start | FIND "MetaFrame COM Server" > nul
IF errorlevel 1 net start "MetaFrame COM Server"

:InstallCM
Set Components=CR,CMCM
If /I NOT "%ROLE%"=="Citrix" Set Components=CO,ECS

Set SetupProperties=/qb
Set SetupProperties=%SetupProperties% /Lv* %loglocation%\CitrixConfMan.Log
Set SetupProperties=%SetupProperties% CMCMCFG_PARS="/CORGANIZER_SERVER:%CORGANIZER_SERVER% /PRIMARY_XML_SERVER:%PRIMARY_XML_SERVER% /BACKUP_XML_SERVER:%BACKUP_XML_SERVER%"
Set SetupProperties=%SetupProperties% ADDLOCAL="%Components%"
Set SetupProperties=%SetupProperties% LOCALUSER=2
Set SetupProperties=%SetupProperties% CITRIXUSERNAME=%BldUser%
Set SetupProperties=%SetupProperties% PASSWORD=%BldPwd%
Set SetupProperties=%SetupProperties% DOMAINNAME=%BldDomain%

msiexec /I "%BldSWDrive%\Citrix%CitrixVersion%\Components\Conferencing Manager\CMCM.msi" %SetupProperties%

:: As per Citrix support article CTX108342, the Conferencing Manager install
:: removes inherited permissions from the HKLM\SOFTWARE\Citrix\ProductCodes
:: registry key and subkeys. This causes problems when installing and
:: uninstalling hotfixes. Therefore we must reset the permissions on this key
:: (including all subkeys) to inherit its permissions from HKLM\Software\Citrix
:: key again. Research found that the best way of achieving this that is fully
:: compatible between all OS's was to use the SetACL utility, which can be
:: downloaded from http://setacl.sourceforge.net. It is copied to the
:: %SystemRoot% folder during the initial part of the server build process. The
:: following command recursively clears all non inherited access permissions and
:: turns on inheritance for all Keys and Values in the ProductCodes key and
:: below.

SetACL -on "hklm\Software\citrix\productcodes" -ot reg -actn setprot -op "dacl:np" -actn clear -clr "dacl" -actn rstchldrn -rst "dacl"

Echo Checking to see if the Conference Organizer Service service is installed.
NET START COrganizer 2>&1|FIND "2185"
IF errorlevel 1 (Set COrganizer=Yes) ELSE (Set COrganizer=No)

Echo Checking to see if the Conference Room Manager service is installed.
NET START CRoomMgr 2>&1|FIND "2185"
IF errorlevel 1 (Set CRoomMgr=Yes) ELSE (Set CRoomMgr=No)

:: IF ERRORLEVEL statements should be read as IF Errorlevel > OR = number.
:: i.e. IF ERRORLEVEL 1 will return TRUE for an errorlevel of 1 or greater.
:: To put that another way, ERRORLEVEL will return 0 on the successful
:: completion of a command. However IF ERRORLEVEL 0 will also return true even
:: if the errorlevel is 196.

If /I "%COrganizer%"=="No" GOTO DCOMPermissions

:: Complete the integration of either Lotus Notes or Outlook messaging.
SET KEY=HKLM\SOFTWARE\Citrix\CMCM
If /I "%Integration%"=="Outlook" (REG ADD "%KEY%" /v OutlookIntegration /d On /f) Else (REG ADD "%KEY%" /v OutlookIntegration /d Off /f)
If /I "%Integration%"=="Outlook" @call "%BldSWDrive%\Citrix%CitrixVersion%\Components\Conferencing Manager\Outlook\InstallAddIn.cmd"
If /I "%Integration%"=="LotusNotes" (REG ADD "%KEY%" /v LotusNotesIntegration /d On /f) && (REG ADD "%KEY%" /v LotusNotesINIPath /t REG_EXPAND_SZ /d "%LotusNotesINIPath%" /f) Else (REG ADD "%KEY%" /v LotusNotesIntegration /d Off /f) && (REG ADD "%KEY%" /v LotusNotesINIPath /d "" /f)

:: Note how I've changed the the LotusNotesINIPath value type to a REG_EXPAND_SZ
:: . This is so that it will expand variables correctly. Whilst Citrix use a
:: REG_SZ, and state that you can place variables within, I don't trust that it
:: will always be 100% reliable.

:DCOMPermissions
:: This section modifies the DCOM permissions on the Machine object, the Citrix
:: Conference Organizer object, and the Citrix Conference Room Manager object as
:: per Knowledge Base Document ID CTX107171.

:: There are two ways to change the DCOM permissions.
:: 1. DCOMperm.exe
:: 2. DCOM Permissions Manager (DCOMPERM.DLL and DCP.EXE)

:: DCOMperm.exe is a Microsoft Platform SDK utility for setting permissions for
:: a COM Server.

:: DCOM Permissions Manager can be found here:
:: http://izzy.org/Scripts/Public/VBScripts/Misc/DCOM/docs/dcomperm.htm
:: Install the DCOM Permissions Manager component on your system by running the
:: DCPINST.EXE file. This will place DCOMPERM.DLL and DCP.EXE in to your
:: %SystemRoot%\SYSTEM32 directory. There are plenty of samples available on the
:: internet on how to use them. The Release Notes can be found here:
:: http://izzy.org/Scripts/Public/VBScripts/Misc/DCOM/docs/relnotes.htm

:: I chose to only use DCOMPerm.exe, as it contained everything I needed.
:: Although untested, I was concerned that the DCOMPERM.DLL and DCP.EXE files
:: contained within the DCOM Permissions Manager package were a bit old and out-
:: dated, whereas DCOMPerm.exe is compatible with XP, 2003 and Vista.

:: The DCOMperm.exe utility is copied to the %SystemRoot% folder during the
:: initial part of the server build process.

Echo This file is a log of the changes made to COM services for Conferencing Manager.>%loglocation%\CM4DCOMPermissions.txt
Echo For further information refer to Knowledge Base Document ID CTX107171. http://support.citrix.com/article/CTX107171.>>%loglocation%\CM4DCOMPermissions.txt

Echo. >>%loglocation%\CM4DCOMPermissions.txt

Echo List existing Launch Permission of the Machine "My Computer" object...>>%loglocation%\CM4DCOMPermissions.txt
dcomperm -ml list>>%loglocation%\CM4DCOMPermissions.txt

Echo. >>%loglocation%\CM4DCOMPermissions.txt

Echo Then set correct permissions for the Machine object...>>%loglocation%\CM4DCOMPermissions.txt
dcomperm -ml set "Authenticated Users" permit level:ll,rl,la,ra>>%loglocation%\CM4DCOMPermissions.txt

If /I "%COrganizer%"=="No" GOTO CRoomMgr
Echo. >>%loglocation%\CM4DCOMPermissions.txt
dcomperm -ml set "NETWORK SERVICE" permit level:ll,rl,la,ra>>%loglocation%\CM4DCOMPermissions.txt

Echo. >>%loglocation%\CM4DCOMPermissions.txt

Echo Note: The Application ID for Citrix Conference Organizer is {22FD2EDE-2B61-48C4-946A-EB1FF9F49BE8}...>>%loglocation%\CM4DCOMPermissions.txt

Echo. >>%loglocation%\CM4DCOMPermissions.txt

Echo List existing Launch Permission of the Citrix Conference Organizer object...>>%loglocation%\CM4DCOMPermissions.txt
dcomperm -al {22FD2EDE-2B61-48C4-946A-EB1FF9F49BE8} list>>%loglocation%\CM4DCOMPermissions.txt

Echo. >>%loglocation%\CM4DCOMPermissions.txt

Echo Then set correct permissions for the Citrix Conference Organizer object...>>%loglocation%\CM4DCOMPermissions.txt
dcomperm -al {22FD2EDE-2B61-48C4-946A-EB1FF9F49BE8} set "Authenticated Users" permit level:ll,rl,la,ra>>%loglocation%\CM4DCOMPermissions.txt
Echo. >>%loglocation%\CM4DCOMPermissions.txt
dcomperm -al {22FD2EDE-2B61-48C4-946A-EB1FF9F49BE8} set "NETWORK SERVICE" permit level:ll,rl,la,ra>>%loglocation%\CM4DCOMPermissions.txt

:CRoomMgr

If /I "%CRoomMgr%"=="No" GOTO LogOnLocally

Echo. >>%loglocation%\CM4DCOMPermissions.txt

Echo Note: The Application ID for Citrix Conference Room Manager is {9D205FDF-7DC9-4953-BB75-BDEB57FBE92A}...>>%loglocation%\CM4DCOMPermissions.txt

Echo. >>%loglocation%\CM4DCOMPermissions.txt

Echo List existing Launch Permission of the Citrix Conference Room Manager object...>>%loglocation%\CM4DCOMPermissions.txt
dcomperm -al {9D205FDF-7DC9-4953-BB75-BDEB57FBE92A} list>>%loglocation%\CM4DCOMPermissions.txt

Echo. >>%loglocation%\CM4DCOMPermissions.txt

Echo Then set correct permissions for the Citrix Conference Organizer object...>>%loglocation%\CM4DCOMPermissions.txt
dcomperm -al {9D205FDF-7DC9-4953-BB75-BDEB57FBE92A} set "Authenticated Users" permit level:ll,rl,la,ra>>%loglocation%\CM4DCOMPermissions.txt

:LogOnLocally
If /I "%COrganizer%"=="No" GOTO Finish

:: I have noticed that Conferencing users require the Allow log on locally
:: rights to the server running the Conference Room Organizer service. This is
:: not documented by Citrix at all. By default users will have logon locally
:: rights to all servers accept for Domain Controllers. Some environments will
:: also remove these rights from Member servers. Adding them back in can be
:: automated using a Resource Kit utility called Ntrights.exe. Refer to the
:: Knowledge Base article titled "How to Set Logon User Rights with the
:: Ntrights.exe Utility" found here: http://support.microsoft.com/kb/279664

:: ntrights -u Users +r SeInteractiveLogonRight

:: This line has been commented out since we typically manage this within a
:: group policy.

:: Rather than give all users the Log on locally rights, it would be better to
:: create a new group called Citrix Conferencing Manager Users, and add the
:: Conferencing Manager users to it. Then apply that group to the Allow log on
:: locally rights.

:: ntrights -u "%BldDomain%\%CMUsersGroup%" +r SeInteractiveLogonRight

:Finish
Exit /B

 


    9th April 2007