CDRom Scripting Fun

Here's a nifty bit of shop talk. Although no one really uses them, the Windows Media Player API exposes the CDRom controls. The following code snippit uses vbscript to eject the cdrom. It's only a few lines, so you could easily put it in .. oh I dunno.. a login script or something. Just imagine the little snaps of cdroms ejecting all over the office at 9am. Now that is some capital whimsy, folks.


Set objMPlay = CreateObject("WMPlayer.OCX.7" )
Set colCDROM = objMPlay.cdromCollection
if colCDROM.Count >= 1 then
For i = 0 to colCDROM.Count - 1
colCDROM.Item(i).Eject
Next
End If


If you would like to learn more about scripting with Media Player, then you are a dork and I pity you. All that aside, the SDK is available here.



-CG

Edgesight for Loadtesting Semi-Free!

Here's some news. Load testing on Citrix is still a pain in the ass.

Citrix is attempting to round out that chasm of product functionality with a new product called "Edgesight for Load Testing". Actually to say that it's a new product is a fat lie. Like many other products (Edgesight included) Citrix just bought up a company and slapped their logo on their product. So in addition to the name being completely lame, it's also incorrect. This product is in no way related to Edgesight. No doubt future integration is planned, but for now it has about as much to do with Edgesight as notepad does.

According to the press release found here:
"Citrix EdgeSight for Loading Testing 2.5 will be available on June 25, 2007, and suggested retail pricing starts at $7,500. Citrix EdgeSight for NetScaler is available as part of the Citrix NetScaler 8.0 Platinum Edition."

In other words, this shit ain't cheap.

Unless of course you found some way to get a license for some kind of discount.

Recently I took a class on Edgesight 4.5, specifically CTX-1800AI. It's a moderately interesting course, but the cool part is that you get a demo license for Edgesight for Load Testing. So what? Well.. the "demo" license you get is good for 2 years! 2 friggin years! What the hell were these guys thinking?

So why pay 7500 for a product when you can get the same product for around 1200 and some change? Just take the course and conduct a very extensive demo of the product. I think most people would agree that two years is adequate to make a determination as to whether or not you actually want to go forward and pay the full licensing cost.

-CG

Edgesight Licensing Hole

Edgesight is a cool product. There's no doubt about it. But why pay for it if you don't have to?

A little history is probably in order..

Edgesight was actually developed by another company called Reflectant. Citrix bought Reflectant as a means to round out their suite of products. Let's face it, Resource Manager is about as useful as loose bowels. Oh sure, it was probably grand back in the days, but it's a dinosaur by modern standards. Hence the need for Citrix to find something to monitor their stuff.

A little known fact is that shortly after acquiring Reflectant, Citrix promptly told most of the other competing vendors (EG Innovations, etc) to go fuck themselves. Citrix is no longer including these vendors in the development process of the Metaframe product suite. Downright bastardly if you ask me, but many of us have seen the big red dot toss its weight around before for no other apparent reason than just to be catty. They refunded their iForum exhibition fees and did a tremendous job in showing their ass.

So anyways, after Citrix purchased reflectant they were in a rush to re-brand the product and get it out there. As is often the case, certain compromises were made with the product conversion for the sake of some deadline. Long story short is that the licensing in 4.0 and 4.2 is not perfect.

It's so imperfect in fact that it is not enforced by the product. Edgesight is licensed by concurrent connection in the same fashion that MPS is. What is supposed to happen is that the product gathers data on the number of users that you are licensed for and then stops once it hits the ceiling. With version 4.0 and 4.2 this doesn't happen. You could be licensed for 10 users and collect data on 10,000. Pretty sweet.

This little bug is fixed in 4.5, which may explain why Citrix is pushing folks so hard to upgrade even though the improvements are somewhat minor in the newer version.

Sometimes the latest and greatest turns out not to be.

-CG

Free TS CALs Forever!

I've given you a way to get around the Citrix licensing. It's only fair that I illustrate how to give the finger to Microsoft as well.

You'll note from my last entry, that I'm a little pissed at old Billy Gates. So I got to thinking.. As a Citrix engineer, how can I screw Microsoft? Of course the answer is licensing - the same way MS screws us. It's kinda poetic when you think about it.

There's potentially two ways to do this. Both of them are illegal, so you're on your own if you get caught.

User Mode licensing - TS User licensing with Win2003 is something that most Citrix Engineers don't mess with much. The idea is that you set up user level licensing and then you pay for each user who would be accessing a terminal server in your environment. In reality, it works much differently.

You see user level TS licensing is a new feature with Win2k3 server. Unfortunately, it's half baked. If you log on to a terminal server that's running in user licensing mode, it checks to see if there is a TS Licensing server on the network. That's it. If it finds a license server you're in. Money in the bank. So you can have a TS License server set up with only 1 CAL installed, and thousands of users would still be able to connect as long as your Terminal Servers are using user licensing. Nice huh?

Now if you opt to stay with device cals (the older win2k model that most of us are probably familiar with) the solution is a bit more extensive, but is still within reach.

The device CAL is stored on each workstation in the following registry location
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSLicensing\Store\

If the device tries to connect and doesn't have an entry there, a CAL is issued.. or if no CALs are available - a *temporary* CAL is issued. The temporary CALs expire in 120 days, which is plenty of time to get your users working. The problem of course is that after 120 days they get an error if there are no legitimate device CALs available.

So the way to get around that is to have a TS Licensing server that has a few device CALs installed, but all of them being in use. In this scenario, workstations that connect without a CAL are issued a temporary one. If the temporary CAL is deleted before it expires, it will get another temporary CAL, and so on.

It's the "and so on.." part that we're most concerned with. If you keep deleting the temporary CAL at login, they get a new one the next time they connect. This can be done over and over.

So a simple line or two in the login script to delete the license store (the registry key above) when users logon is enough to keep your entire enterprise running on temporary CALs.

Now go get busy,
-CG

Make Your Own Citrix CALs!

It's all about design.

The licensing model has been vastly improved since the days of XP. It's easier and more secure to manage your Citrix licenses. In fact, there used to be a cool utility called TFLKey.exe that would puke up Citrix licenses all day long, including licenses for unlimited servers and connections. You could even activate your existing cals with it.

Of course, using such a utility violates the license agreement (which I guess you wouldn't really need if you had the tool) and may get you thrown in Jail - which is bad because being Bubba's bitch is never fun.

But if it's an architectural design flaw that is a security hole - and you happen to build your environment in such a way that exposes it.. is it still illegal? You're not exploiting or in violation of licensing - and all your servers are working normally. Or are you just leveraging an aspect of the product's design in an unconventional way? Hmm.

Consider the following:

Let's say your environment consists of:
-10 MPS4 servers
-1 Citrix License Server with 100 CALs installed
-1000 users

In this scenario, we're going to potentially consume 100 Citrix CALs, but we're going to get our 1000 concurrent users up and running.

How the hell do we do that? We're simply going to leverage the 30 day Citrix Licensing grace period. You see, each of those 10 MPS servers keeps its own running tally of how many CALs are available. So with the license server up and running you have a max concurrency of 100 users.

Here's where it gets fun.

Kick off all your users and wait a few minutes. At some point, each server will recognize that there are 100 CALs available.

Shut down your license server.

Now you have entered the 30 day grace period where each server thinks that there are 100 licenses available. And since there's no license server to update as users logon and logoff, each server now has the capability to issue 100 cals.

As long as that license server stays offline (for up to 30 days), you can host all of those 1000 users using only 100 CALs.

Obviously the way around this is to bring it back up every 29 days when no users are online for a little while. Once you verify in the event logs on each server that the grace period has been reset you can take it down again, and drive on for another 29 days.

You've just saved your company 315,000 dollars (assuming 350 bucks per CAL).

Is this legal? I honestly don't know.. I think it might be a gray area that could be argued either way. Chances are that Citrix can pay for better lawyers than you or I, so I don't suggest doing something like this.

Is it ethical? No, but all that aside, from a technical perspective it is a pretty cool hack.

-CG

Edgesight ADM

Yes, it's been a while since the last post. Sorry. Have you looked outside lately? The sun is out. I have a life. That means the give-a-shit quotent regarding things in the office takes a sharp decline. Since I pilfer work hours to update this blog, citrixguy.net falls within the scope of that phenominon.

Anyways, I came up with a basic ADM Template that I thought might be useful for some of you wokies that play with Edgesight. It allows you to set some fundamental settings that make managing your deployment a little less painful. Like most of these things, it's not as pretty as it could be (see also: give-a-shit quotent above), but it gets the job done and gives you something to play with.

There's five parameters I'm setting with this:
- the edgesight app server name
- the app server path
- the app server port
- The Department Name
- The Company Name

If you don't know how to make this work as a GPO, take your hands off the keyboard immediately and go fling yourself in front of the nearest bus. I hate to be the one to break it to you, but you are a pus-filled boil on the ass of the IT industry.

All you not so dumb people, please enjoy with my compliments.

-CG

--------------------------------------------------

CLASS MACHINE

CATEGORY "Edgesight Server Configuration"

POLICY "Server Port"

#if VERSION >= 3 EXPLAIN "This policy defines the port on which the Edgesight web server is running. The default is 80" #endif

KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00\NetAccess\"

PART "Server Port" EDITTEXT VALUENAME "ServerPort" DEFAULT "80" #if VERSION >= 2 EXPANDABLETEXT #endif END PART

END POLICY ; Server Port

POLICY "Server Path"

KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00\NetAccess\"

PART "ServerPath" EDITTEXT KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00\NetAccess\" VALUENAME "ServerPath" END PART

END POLICY ; Server Path

POLICY "ServerName"

#if VERSION >= 3 EXPLAIN "This defines the name of the Edgesight server. The default is EATABAGOFDICKS" #endif

KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00\NetAccess"

PART "ServerName" EDITTEXT VALUENAME "ServerName" DEFAULT "ENTER YOUR STUPID SERVER NAME HERE" END PART

END POLICY ; ServerName

POLICY "Department"

#if VERSION >= 3 EXPLAIN "This defines the Department name which usually corresponds to the partinular Farm." #endif

KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\"

PART "Department" EDITTEXT VALUENAME "Department" DEFAULT "ENTER YOUR DEPARTMENT" END PART

END POLICY ; Department

POLICY "Company"

KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\"

PART "Company" EDITTEXT KEYNAME "SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\" VALUENAME "Company" DEFAULT "ENTER YOUR COMPANY NAME" #if VERSION >= 2 EXPANDABLETEXT #endif END PART

END POLICY ; Company

END CATEGORY ; Edgesight Server Configuration

[STRINGS]