Something I found after installing Citrix Secure Gateway (CSG) 3.1 on a server running Web Interface (WI) 5.0.1. It removed permissions from the “%ProgramFiles%\\Citrix\\Web Interface\\5.0.1\\Clients” folder and instructed it to inherrit from its parent.<\/p>\n
Therefore, only the Administrators local group had full control.<\/p>\n
This was causing problems for client updates and downloads via the CSG server.<\/p>\n
An error in the Application Event Log was…<\/p>\n
Event Type: Error
\nEvent Source: Citrix Web Interface
\nEvent Category: None
\nEvent ID: 0
\nDate: 19\/12\/2008
\nTime: 8:33:45 AM
\nUser: N\/A
\nComputer: NOT-TELLING-01
\nDescription:
\nSite path: c:\\inetpub\\wwwroot\\Citrix\\XenApp.<\/p>\n
Due to an error, the file watcher could not be created at the path C:\\Program Files\\Citrix\\Web Interface\\5.0.1\\Clients. [Log ID: e22724f9]<\/p>\n
This could be correlated to a Security Log event that was suggesting that the Network Service account could not traverse the filesystem.<\/p>\n
So after comparing it to a standard Web Interface 5.0.1 deployment without CSG 3.1 installed, I found that this folder had been given explicit permissions for the local Administrators, Authenticated Users and NETWORK SERVICE security principles.<\/p>\n
So I guess I just needed to add them back in with the appropriate access.<\/p>\n
Here is the XCACLS.vbs script I ran…<\/p>\n
cscript.exe “%SystemRoot%\\xcacls.vbs” “%ProgramFiles%\\Citrix\\Web Interface\\5.0.1\\Clients” \/P ADMINISTRATORS:F “NETWORK SERVICE”:X “Authenticated Users”:X<\/p>\n
I’m still not 100% sure what caused this in the first place, and haven’t had a chance to prove it, but I’m dubious about the CSG 3.1 deployment, so just thought I’d post this article for anyone else that may run into the same problem.<\/p>\n
FYI, I use the Network Service account as the CSG services account as per the following deployment script…<\/p>\n
\r\n@Echo Off\r\nEcho Citrix XenApp Deployment\r\nEcho ------------------------\r\nEcho. \r\nEcho Revision History: \r\nEcho.\r\nEcho v2.0 04\/12\/08 Jeremy@jhouseconsulting.com\r\nEcho Updated for Secure Gateway 3.1\r\nEcho.\r\nEcho ....Installing Secure Gateway 3.1.....\r\nEcho.\r\nEcho.\r\n\r\nSet CSGVersion=3.1\r\nSet WIVersion=5.0.1\r\n\r\nSet loglocation=%systemDrive%\\bldlogs\r\nif not exist %loglocation% md %loglocation%\r\n\r\n:: Installing CSG\r\nSet SetupProperties=\/qb\r\nSet SetupProperties=%SetupProperties% CTX_INSTALL_TYPE=GATEWAY\r\nSet SetupProperties=%SetupProperties% CTX_SERVICE_ACCOUNT=\"Network Service\"\r\nSet SetupProperties=%SetupProperties% \/Lv* %loglocation%\\CSG_GWY%CSGVersion%.log\r\nSet SetupProperties=%SetupProperties% REBOOT=ReallySuppress\r\n\r\nstart \"Installing\" \/wait msiexec \/i \"%~dp0%CSGVersion%\\CSG_GWY.MSI\" %SetupProperties%\r\n\r\n:: Fixing up Web Interface Client Deployment Issues...\r\ncscript.exe \"%SystemRoot%\\xcacls.vbs\" \"%ProgramFiles%\\Citrix\\Web Interface\\%WIVersion%\\Clients\" \/P ADMINISTRATORS:F \"NETWORK SERVICE\":X \"Authenticated Users\":X\r\n\r\nExit \/b 0\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"Something I found after installing Citrix Secure Gateway (CSG) 3.1 on a server running Web Interface (WI) 5.0.1. It removed permissions from the “%ProgramFiles%\\Citrix\\Web Interface\\5.0.1\\Clients” folder and instructed it to inherrit from its parent. Therefore, only the Administrators local group had full control. This was causing problems for client updates and downloads via the CSG … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[122],"tags":[120,424,118,124,119,123,121],"class_list":["post-253","post","type-post","status-publish","format-standard","hentry","category-citrix-secure-gateway","tag-authenticated-users","tag-citrix-secure-gateway","tag-csg-31","tag-file-watcher-could-not-be-created","tag-network-service","tag-web-interface","tag-wi-501"],"aioseo_notices":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/253","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/comments?post=253"}],"version-history":[{"count":3,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/253\/revisions"}],"predecessor-version":[{"id":256,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/253\/revisions\/256"}],"wp:attachment":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/media?parent=253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/categories?post=253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/tags?post=253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}