Enable User Policy for Terminal Servers CM 1906

We found an issue where our Citrix Admins couldn't install software from software center or application catalog. Found the client was refusing user policy. After some digging we found that user policy is disabled by default in 1906 and no GUI way to flip it until CM 1910.

You can confirm this with the following sql command. You will have to open the resulting xml blob to view.

SELECT SiteControl FROM vSMS_SC_SiteControlXML WHERE SiteCode = 'SiteCode'


To make the change to policy you have to make the update via wbemtest and it will be apply to all setting. This becomes a regular client policy setting in 1910.

Wbemtest
Connect to your site server namespace
Enum Instances = SMS_SCI_ClientComp
Select “Software Distribution”
Open “Props”
View Embedded
Last one in list Open
Verify “Request User Policy On TS”
Open “Value”
Change to “1 (0x1)”
Save object on all dialogs

Verify the change via the same SQL from the beginning.

SELECT SiteControl FROM vSMS_SC_SiteControlXML WHERE SiteCode = 'SiteCode'


Wait on machine policy or trigger a machine policy download on your terminal server

Verify in PolicyAgent.log on client once policy has downloaded. You should see an entry similar to below.

>>> Instance CCM_PolicyAgent_Configuration in machine policy namespace is modified
User policy: machine is multi-user terminal server
User policy: previous enabled 1, previous enabled on TS 0, effective 0; new enabled 1, new enabled on TS 1, new effective 1
>>> User policy is now Enabled

Now you should be able to install software on a terminal services enabled server.

Comments

Post a Comment

Popular posts from this blog

Stuck @ "Waiting for user logon"

This may or may not be something that you would commonly see in your environment. We only see it occasionally but it used to be a pretty common problem. One of my teammates found a technet forum post that addressed this specifically. Pretty interesting read if you are fighting this issue on a particular client. https://social.technet.microsoft.com/Forums/en-US/1569e1e2-91bc-435d-8998-beb817d5b453/waiting-for-user-logon?forum=configmanagergeneral Here is the meat and potatoes of the forum discussion. $CITask = get-wmiobject -query "select * from CCM_CITask where TaskState != ' PendingSoftReboot' AND TaskState != 'PendingHardReboot' AND TaskState != 'InProgress'" -namespace root\ccm\CITasks if ($CITask -ne $NULL) { $CITask | remove-wmiobject -Whatif $CITask | remove-wmiobject } ELSE { "CCM_CITasks is empty. Nothing to do" }
Read more

Intune Hybrid - NDES Cert Issue

As many of you who might be running a SCCM/Intune hybrid scenario for MDM will have learned. There are a few to many certificates in use between NDES, Intune, Wifi Profiles, VPN profiles, and well anything else that may have a cert buried in it. We had an instance were the NDES wasn't handing out the certs for WiFi and VPN profiles. However it was handing out the base communication certificate so phones could sync correctly. This was one of those head scratchers on our park, but if you know where to look it makes sense. Problem is (at least in my opinion) there is a lack of useful documentation and the logging leaves a little to be desired. Therefore, I'm going to give a bit about our journey and hopefully help some of you folks out if you run into something similar. When we were notified of this issue, we started to look at the usual logs, you know CRP.log NDESPlugin.log those types of things. First thing you will notice is that the CRP.log will show the same message ove
Read more

Triggering a software update install via Powershell

Howdy Folks This post is a holiday slice of pie. Today we focus on triggering update(s) that are deployed to a machine. Now for the pie filling. Triggering an update scan on a client: ([wmiclass]'ROOT\ccm:SMS_Client').TriggerSchedule('{00000000-0000-0000-0000-000000000113}') Trigger install of all updates: ([wmiclass]'ROOT\ccm\ClientSDK:CCM_SoftwareUpdatesManager').InstallUpdates() Here is a nice addition if you only want to install specific update(s) you just have to modify the select statement: ([wmiclass]'ROOT\ccm\ClientSDK:CCM_SoftwareUpdatesManager').InstallUpdates([System.Management.ManagementObject[]] (get-wmiobject -query 'SELECT * FROM CCM_SoftwareUpdate' -namespace 'ROOT\ccm\ClientSDK')) If you would like to see if there are updates applying, if true they are running: $CCMUpdate = get-wmiobject -query "SELECT * FROM CCM_SoftwareUpdate" -namespace "ROOT\ccm\ClientSDK" if(@($CCMUpdate | where {
Read more