Product documentation
Workspace Environment Management
Service Current Release 2402 2311 2308 2305 2303 2212 2209 2206 2203
View PDF

Group Policy Settings

September 5, 2023
Contributed by: 
S

Important:

WEM currently supports adding and editing only Group Policy settings associated with the HKEY_LOCAL_MACHINE and the HKEY_CURRENT_USER registry hives.

In previous releases, you could migrate only Group Policy Preferences (GPP) into Workspace Environment Management (WEM). For more information, see the description of the Migrate wizard in Ribbon. You can now also import Group Policy settings (registry-based settings) into WEM.

After importing the settings, you can have an itemized view of the settings associated with each GPO before you decide which GPO to assign. You can assign the GPO to different AD groups, just like you assign other actions. If you assign GPOs to an individual user directly, the settings do not take effect. A group can contain users and machines. Machine-level settings take effect if the related machine belongs to the group. User-level settings take effect if the current user belongs to the group.

Tip:

For machine-level settings to take effect immediately, restart the Citrix WEM Agent Host Service. For user-level settings to take effect immediately, users must log off and log back on.

Group Policy settings

Note:

For WEM agents to process Group Policy settings properly, verify that Citrix WEM User Logon Service is enabled on them.

Enable Group Policy Settings Processing. Controls whether to enable WEM to process Group Policy settings. By default, this option is disabled. When disabled:

  • You cannot configure Group Policy settings.
  • WEM does not process Group Policy settings even if they are already assigned to users or user groups.

Group Policy object list

Displays a list of your existing GPOs. Use Find to filter the list by name or description.

  • Refresh. Refreshes the GPO list.
  • Import. Opens the Import Group Policy Settings wizard, which lets you import Group Policy settings into WEM.
  • Edit. Lets you edit an existing GPO.
  • Delete. Deletes the GPO you select.

Import Group Policy settings

Before importing Group Policy settings, back up your Group Policy settings on your domain controller:

  1. Open the Group Policy Management Console.

  2. In the Group Policy Management window, right-click the GPO you want to back up and then select Back Up.

  3. In the Back Up Group Policy Object window, specify the location where you want to save the backup. Optionally, you can give the backup a description.

  4. Click Back Up to start the backup and then click OK.

  5. Navigate to the backup folder and then compress it into a zip file.

    Note:

    WEM also supports importing zip files that contain multiple GPO backup folders.

To import your Group Policy settings, complete the following steps:

  1. Use Upload, available in the menu on the WEM service Manage tab, to upload the zip file of your GPOs to the default folder in Citrix Cloud.

  2. Navigate to the Administration Console > Actions > Group Policy Settings tab, select Enable Group Policy Settings Processing, and then click Import to open the import wizard.

  3. On the File to Import page of the import wizard, click Browse and then select the applicable file from the list. You can also type the name of the file and then click Find to locate it.

    • Overwrites GPOs you imported previously. Controls whether to overwrite existing GPOs.

  4. Click Start Import to start the import process.

  5. After the import completes, click Finish. Imported GPOs appear on the Group Policy Settings tab.

Import Group Policy settings from registry files

You can convert registry values that you export using the Windows Registry Editor into GPOs for management and assignment. If you are familiar with the Import registry files option available with Registry Entries, this feature:

Before you start, be aware of the following:

  • When importing settings from a zip file, the file can contain one or more registry files. Make sure that the size of the unzipped file is not greater than 30 M.
  • Each .reg file will be converted into a GPO. You can treat each converted GPO as a set of registry settings.
  • The name of each converted GPO is generated based on the name of the corresponding .reg file. Example: If the name of the .reg file is test1.reg, the name of the converted GPO is test1.
  • Descriptions of converted GPOs are empty. Their state defaults to enabled (check mark icon).

To import your Group Policy settings, complete the following steps:

  1. In the administration console, go to Actions > Group Policy Settings, select Enable Group Policy Settings Processing, click the down arrow next to Import, and select Import Registry File.

  2. In the wizard that appears, browse to the zip backup of your registry files.

    • Overwrite existing GPOs. Controls whether to overwrite existing GPOs when conflicts occur.

  3. Click Start Import.

  4. After the import completes, click Finish. GPOs converted from the registry files appear in Group Policy Settings.

Edit Group Policy settings

Double-click a GPO from the list for an itemized view of its settings and to edit the settings if needed.

To clone a GPO, right-click the GPO and select Copy from the menu. The clone is automatically created after you click Copy. The clone inherits the name of the original and has a suffix “-Copy.” You can use Edit to change the name.

The Edit Group Policy Object window appears after you click Edit.

Name. The name of the GPO as it appears in the GPO list.

Description. Lets you specify additional information about the GPO, which appears in the GPO list.

Registry Operations. Displays registry operations that the GPO contains.

Warning:

Editing, adding, and deleting registry-based settings incorrectly can prevent the settings from taking effect in the user environment.

  • Add. Lets you add a registry key.
  • Edit. Lets you edit a registry key.
  • Delete. Lets you delete a registry key.

To add a registry key, click Add on the right-hand side. The following settings become available:

  • Order. Lets you specify the order of deployment for the registry key.

  • Action. Lets you specify the type of action for the registry key.
    • Set value. Lets you set a value for the registry key.
    • Delete value. Lets you delete a value for the registry key.
    • Create key. Lets you create the key as specified by the combination of the root key and the subpath.
    • Delete key. Lets you delete a key under the registry key.
    • Delete all values. Lets you delete all values under the registry key.

  • Root Key. Supported values: HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.

  • Subpath. The full path of the registry key without the root key. For example, if HKEY_LOCAL_MACHINE\Software\Microsoft\Windows is the full path of the registry key, Software\Microsoft\Windows is the subpath.

  • Value. Lets you specify a name for the registry value. The highlighted item in the following diagram as a whole is a registry value.

    Registry value in the registry editor

  • Type. Lets you specify the data type for the value.
    • REG_SZ. This type is a standard string used to represent human readable text values.
    • REG_EXPAND_SZ. This type is an expandable data string that contains a variable to be replaced when called by an application. For example, for the following value, the string “%SystemRoot%” will be replaced by the actual location of the folder in an operating system.
    • REG_BINARY. Binary data in any form.
    • REG_DWORD. A 32-bit number. This type is commonly used for Boolean values. For example, “0” means disabled and “1” means enabled.
    • REG_DWORD_LITTLE_ENDIAN. A 32-bit number in little-endian format.
    • REG_QWORD. A 64-bit number.
    • REG_QWORD_LITTLE_ENDIAN. A 64-bit number in little-endian format.
    • REG_MULTI_SZ. This type is a multi-string used to represent values that contain lists or multiple values. Each entry is separated by a null character.
  • Data. Lets you type data corresponding to the registry value. For different data types, you might need to type different data in different formats.

Your changes might take some time to take effect. Keep the following in mind:

  • Changes associated with the HKEY_LOCAL_MACHINE registry hive take effect when Citrix WEM Agent Host Service starts or the specified SQL Settings Refresh Delay times out.
  • Changes associated with the HKEY_CURRENT_USER registry hive take effect when users log on.

Contextualize Group Policy settings

You can make Group Policy settings conditional by using a filter to contextualize their assignments. A filter comprises a rule and multiple conditions. The WEM agent applies the assigned Group Policy settings only when all conditions in the rule are met in the user environment at runtime. Otherwise, the agent skips those settings when enforcing filters.

A general workflow to make Group Policy settings conditional is as follows:

  1. In the administration console, navigate to Filters > Conditions and define your conditions. See Conditions.

    Important:

    For a complete list of filter conditions available, see Filter conditions. Group Policy settings comprise user and machine settings. Some filter conditions apply only to user settings. If you apply those filter conditions to machine settings, the WEM agent ignores the filter conditions and applies the machine settings. For a complete list of filter conditions that do not apply to machine settings, see Filter conditions not applicable to machine settings.

  2. Navigate to Filters > Rules and define your filter rule. You can include the conditions you defined in Step 1 into that rule. See Rules.

  3. Navigate to Actions > Group Policy Settings and configure your Group Policy settings.

  4. Navigate to Administration Console > Assignments > Action Assignment and complete the following:

    1. Double-click the user or user group to which you want to assign the settings.

    2. Select the application and click the right arrow (>) to assign them.

    3. In the Assign Filter window, select the rule you defined in Step 2 and then click OK. The settings move from the Available pane to the Assigned pane.

    4. In the Assigned pane, configure priority for the settings. Type an integer to specify a priority. The greater the value, the higher the priority. Settings with higher priority are processed later, ensuring that they are in effect when there is a conflict or dependency.

Filter conditions not applicable to machine settings

Filter name Applicable to machine settings
ClientName Match No
Client IP Address Match No
Registry Value Match If you configure a registry value starting with HKCU, the Registry Value Match filter does not work if applied to machine settings.
User Country Match No
User UI Language Match No
User SBC Resource Type No
Active Directory Path Match No
Active Directory Attribute Match No
No ClientName Match No
No Client IP Address Match No
No Registry Value Match No
No User Country Match No
No User UI Language Match No
No Active Directory Path Match No
No Active Directory Attribute Match No
Client Remote OS Match No
No Client Remote OS Match No
Active Directory Group Match No
No Active Directory Group Match No
Published Resource Name No
Group Policy Settings
September 5, 2023
Contributed by: 
S
September 5, 2023
Contributed by: 
S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.