Special considerations on Terminal Server / Citrix / VDI

KB Home   |   Special considerations on Terminal Server / Citrix / VDI

Main.SpecialConsiderationsOnTerminalServer History

Hide minor edits - Show changes to output

June 03, 2019, at 01:37 AM by peterf - Minor change to language for clarity around rate limit API config key availability
Changed line 111 from:
If you're using PaperCut version 15.0 there's a built-in check that looks for multiple failed logins from a client on the same IP address (looks like suspicious activity). You may then see a message on the client (and in the App.Log tab) saying:
to:
As of PaperCut MF and PaperCut NG version 15.0, there's a built-in check that looks for multiple failed logins from a client on the same IP address (looks like suspicious activity). You may then see a message on the client (and in the App.Log tab) saying:
August 05, 2015, at 11:34 PM by Kyle - Changed "CITRIX" to case correct "Citrix"
Changed line 1 from:
(:title Special considerations on Terminal Server/CITRIX/VDI:)
to:
(:title Special considerations on Terminal Server / Citrix / VDI:)
June 11, 2015, at 07:13 PM by TimG - Added info about security rate limit warning
Added lines 108-117:
[[#suspiciousactivity]]
!!Suspicious User Client Activity

If you're using PaperCut version 15.0 there's a built-in check that looks for multiple failed logins from a client on the same IP address (looks like suspicious activity). You may then see a message on the client (and in the App.Log tab) saying:

->"Server has detected suspicious user client activity from IP "x.x.x.x" and temporarily denied requests from this address"

This will show up a lot more on Terminal server environments because you may have a number of user clients running on a single IP address. To avoid that issue, go into @@Options -> Config Editor@@, and search for @@client.api.security.rate-limit.enabled@@ and set this to N, then update the key.

May 15, 2015, at 12:50 PM by TimG - Updated keywords
Changed line 111 from:
[-Keywords: terminalserver, thin client, Virtual Desktop Infrastructure (VDI), terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services, incorrect user, NAT, wrong user -]
to:
[-Keywords: terminalserver, thin client, Citrix, Virtual Desktop Infrastructure (VDI), terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services, incorrect user, NAT, wrong user -]
Deleted lines 31-32:
The solution is to change the system configuration as follows.
Changed lines 37-38 from:
If none of these scenarios apply in your environment it should be safe to apply the username-only matching. Otherwise please contact support to discuss your setup, and we’ll see if we can help out further!
to:
The solution is to change the system configuration as follows.
Added line 48:
Changed lines 51-53 from:
!!!Other things to keep in mind:

to:
!!!Other considerations to keep in mind:

Deleted line 4:
[[<<]]
Deleted line 6:
April 22, 2015, at 09:27 PM by TimG - Added in two different terminal server scenarios for config settings
Changed lines 5-21 from:
Sites planning on using advanced PaperCut features such as the account selection popup, may need to make a minor system configuration change.  This is particularly true for sites running versions prior to version 8.  Version 8+ uses more advanced logic and in most cases will work "out of the box" in all environments.

By default, PaperCut uses the client's IP address to help match print jobs to the client (the client software running on the user's screen).  Under a terminal server, this assumption is often not valid as multiple users can be logged in under the one IP address at any one time.  The symptom is that the account selection popup or other popup messages may appear on multiple terminals at once.  The solution is to change the system configuration as follows:

->'''1)''' Log into the administration interface as the [@admin@] user.

->'''2)''' Navigate to [@Options@] and select the [@Config Editor (Advanced)@] Action from the left set of ''Action'' links.

->'''3)''' Use the ''Quick find:'' to locate the key:

-->[@client.allow-match-on-machine-or-ip-only@]

->'''4)''' Change the value to [@N@] (no) and press the ''Update'' button.

If you require further assistance, please don't hesitate to [[https://www.papercut.com/contact/ | contact support]] via our email support queue.


to:
[[<<]]
!!!PaperCut Client Considerations:


Sites planning on using advanced PaperCut features such as the account selection popup, may need to make a minor system configuration change. This is particularly true for sites running versions prior to version 8. Version 8+ uses more advanced logic and in most cases will work “out of the box” in all environments.

By default, PaperCut uses the client’s IP address to help match print jobs to the client (the client software running on the user’s screen). Under a terminal server, this assumption is often not valid as multiple users can be logged in under the one IP address at any one time. The symptom is that the account selection popup or other popup messages may appear on multiple terminals at once.

!!Running the PaperCut client and applications (e.g. MS Word) on the Terminal Server:

This scenario is suitable if the user is launching the PaperCut client from the Terminal server, and the user is running the application that they’re printing from (e.g. MS Word) on the terminal server. Both the PaperCut client and the application are running on the same IP address.

The solution is to change the system configuration as follows:

#Log into the administration interface as the admin user.
#Navigate to Options and select the Config Editor (Advanced) Action from the left set of Actionlinks.
#Use the Quick find: to locate the key: @@client.allow-match-on-machine-or-ip-only@@
#Change the value to N (no) and press the Update button.

The above change will mean that PaperCut will not match on machine only or IP only.  But it will match on the combination of IP address and username (together).

That setting change will work for terminal server environments where the user is running the PaperCut client and the application they are printing from, on the same terminal server.

!!Running the PaperCut client locally, and applications (e.g. MS Word) on the Terminal Server:

This scenario is suitable if the user is launching the PaperCut client from the local workstation, and the user is running the application that they’re printing from (e.g. MS Word) on the terminal server. The PaperCut client and the application are not running on the same IP address.

This is because the combination of the username/IP address from the client will not match the combination of the username/IP address from the application that they’re printing from.

The solution is to change the system configuration as follows.

''''HOWEVER'''': using the client on a network where you can't uniquely identify the machine via IP is limited:
*No popup authentication
*No possibility of running multiple clients for the one user
*Cannot handle lab situations where many machines are using same username

If none of these scenarios apply in your environment it should be safe to apply the username-only matching. Otherwise please contact support to discuss your setup, and we’ll see if we can help out further!

#Log into the administration interface as the admin user.
#Navigate to Options and select the Config Editor (Advanced) Action from the left set of Actionlinks.
#Use the Quick find: to locate the key: @@client.allow-match-on-machine-or-ip-only@@
#Change the value to N (no) and press the Update button.
#Use the Quick find: to locate the key: @@client.allow-match-on-user-only@@
#Change the value to Y (yes) and press the Update button.

The above change will mean that PaperCut will not match on machine only, or IP address only, but in addition it will be able to match the job with a user client based on username alone. The username in this case becomes the only piece of unique information to match on.

[[<<]]
!!!Other things to keep in mind:


September 25, 2014, at 05:30 AM by 203.222.91.204 -
Changed lines 52-53 from:
In late 2011, two customers of PaperCut Software running Windows 2008 R2 with Citrix/Terminal Services noticed that some print jobs had the incorrect owner assigned by the operating system.  If you are encountering this issue follow the steps below to remedy the issue.
to:
In late 2011, two customers of PaperCut Software running Windows 2008 with Citrix/Terminal Services noticed that some print jobs had the incorrect owner assigned by the operating system.  If you are encountering this issue follow the steps below to remedy the issue.
Changed lines 3-4 from:
PaperCut works well on Microsoft Terminal Server (2000, 2003, 2008+) and CITRIX servers and a number of organizations are successfully using it to manage their printing and quotas.  As a general rule, we recommend deploying PaperCut server software on a separate server (e.g. a print server) other than the terminal server itself.  The reason for this is that Terminal Server / CITRIX systems can be very resource hungry and leave little resources left for PaperCut's use.  This is however not too much of an issue with good high-spec hardware.
to:
PaperCut works well on Microsoft Terminal Server (2000, 2003, 2008+, 2008 R2, and 2012) and CITRIX servers and a number of organizations are successfully using it to manage their printing and quotas.  As a general rule, we recommend deploying PaperCut server software on a separate server (e.g. a print server) other than the terminal server itself.  The reason for this is that Terminal Server / CITRIX systems can be very resource hungry and leave little resources left for PaperCut's use.  This is however not too much of an issue with good high-spec hardware.
Changed lines 7-8 from:
By default, PaperCut uses the client's IP address to help match print jobs to the client (the client software running on the user's screen).  Under a terminal server, this assumption is often not valid as a multiple users can be logged in under the one IP address at any one time.  The symptom is that the account selection popup or other popup messages may appear on multiple terminals at once.  The solution is to change the system configuration as follows:
to:
By default, PaperCut uses the client's IP address to help match print jobs to the client (the client software running on the user's screen).  Under a terminal server, this assumption is often not valid as multiple users can be logged in under the one IP address at any one time.  The symptom is that the account selection popup or other popup messages may appear on multiple terminals at once.  The solution is to change the system configuration as follows:
April 03, 2013, at 10:30 AM by Nick K - Small typo
Changed line 66 from:
Rigkt-click `EnabledProtocols.
to:
Right-click `EnabledProtocols.
Changed lines 7-8 from:
By default, PaperCut uses the client's IP address to help match print jobs to the client (the client software running on the user's screen).  Under a terminal server, this assumption is often not valid as a multiple users can be logged in under the one IP address at any one time.  The symptom is that the account selection popup, or other popup messages may appear on multiple terminals at once.  The solution is to change the system configuration as follows:
to:
By default, PaperCut uses the client's IP address to help match print jobs to the client (the client software running on the user's screen).  Under a terminal server, this assumption is often not valid as a multiple users can be logged in under the one IP address at any one time.  The symptom is that the account selection popup or other popup messages may appear on multiple terminals at once.  The solution is to change the system configuration as follows:
Changed line 80 from:
[-Keywords: terminalserver, thin client, Virtual Desktop Infrastructure (VDI), terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services, incorrect user, wrong user -]
to:
[-Keywords: terminalserver, thin client, Virtual Desktop Infrastructure (VDI), terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services, incorrect user, NAT, wrong user -]
Changed lines 71-72 from:
->'''4)''' Install Hotfix [[http://support.microsoft.com/kb/2493115|KB2493115]] (May need to be requested from Microsoft as it is not currently mentioned on their support site). Please carefully review the hotfix documentation before installing.
to:
->'''4)''' Install Hotfix [[http://support.microsoft.com/kb/958741|KB958741]] (May need to be requested from Microsoft as it is not currently mentioned on their support site). Please carefully review the hotfix documentation before installing.
Changed line 59 from:
Key: [@HKLM\SYSTEM\`CurrentControlSet\Control\Print@]
to:
Key: [@HKLM\SYSTEM\CurrentControlSet\Control\Print@]
Changed line 80 from:
[-Keywords: terminalserver, thin client, Virtual Desktop Infrastructure (VDI), terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services -]
to:
[-Keywords: terminalserver, thin client, Virtual Desktop Infrastructure (VDI), terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services, incorrect user, wrong user -]
Changed lines 49-50 from:
!! Incorrect owner of print job [[#owner]]
to:
[[#owner]]
!!Incorrect owner of print job
Changed lines 49-50 from:
[[#Incorrect owner of print job]]
!! Incorrect owner of print job
to:
!! Incorrect owner of print job [[#owner]]
Added line 49:
[[#Incorrect owner of print job]]
Changed line 79 from:
[-Keywords: terminalserver, thin client, Virtual Desktop Infrastructure (VDI), terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services -]
to:
[-Keywords: terminalserver, thin client, Virtual Desktop Infrastructure (VDI), terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services -]
February 13, 2012, at 01:51 AM by 119.15.100.32 -
Added lines 73-74:
As a footnote, there is [[http://social.technet.microsoft.com/Forums/en-US/winserverprint/thread/71b2c4ec-94b1-4302-8f07-349696e9f4d1|this discussion]] on Microsoft's Technet site about a possibly similar issue.
Added lines 71-72:
'''Please note''' that this is general advice. We recommend contacting Microsoft specifically to confirm that your situation will be fixed by the above changes.
Changed lines 50-51 from:
In late 2011, two customers of PaperCut Software running Citrix/Terminal Services noticed that some print jobs had the incorrect owner assigned by the operating system. Shown below are the steps that were used to remedy the issue.
to:
In late 2011, two customers of PaperCut Software running Windows 2008 R2 with Citrix/Terminal Services noticed that some print jobs had the incorrect owner assigned by the operating system.  If you are encountering this issue follow the steps below to remedy the issue.
December 19, 2011, at 12:18 PM by RossM - particularly
Changed lines 5-6 from:
Sites planning on using advanced PaperCut features such as the account selection popup, may need to make a minor system configuration change.  This is particually true for sites running versions prior to version 8.  Version 8+ uses more advanced logic and in most cases will work "out of the box" in all environments.
to:
Sites planning on using advanced PaperCut features such as the account selection popup, may need to make a minor system configuration change.  This is particularly true for sites running versions prior to version 8.  Version 8+ uses more advanced logic and in most cases will work "out of the box" in all environments.
Added line 21:
Added lines 49-70:
!! Incorrect owner of print job
In late 2011, two customers of PaperCut Software running Citrix/Terminal Services noticed that some print jobs had the incorrect owner assigned by the operating system. Shown below are the steps that were used to remedy the issue.

Please note that these are general instructions and may not apply directly to your situation. Please contact PaperCut Support for more information.

->'''1)''' The customer initially upgraded to Windows 2008 `SP1 and applied this fix, this may not be applicable for you, review the hotfix documentation (see below).

->'''2)''' Make the following changes in the registry for Print server and Terminal Server.
Key: [@HKLM\SYSTEM\`CurrentControlSet\Control\Print@]
REG Value: "`DisableRpcTcp" REG_DWORD 1

->'''3)''' On the Terminal Server also make the following changes to the registry.
[@HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\@]
Right-click Printers, point to New, and then click DWORD.
Type `EnabledProtocols.
Rigkt-click `EnabledProtocols.
In the Value data box, type 6.
Close Registry Editor.
Restart the Spooler.

->'''4)''' Install Hotfix [[http://support.microsoft.com/kb/2493115|KB2493115]] (May need to be requested from Microsoft as it is not currently mentioned on their support site). Please carefully review the hotfix documentation before installing.

June 03, 2011, at 01:41 AM by 202.129.124.120 -
Changed lines 44-45 from:
Users have reported that when the [[http://technet.microsoft.com/en-us/library/cc753853(WS.10).aspx | Terminal Services Easy Print driver]] is used that there are inconsistent page analysis results. This is because the print job is no longer rendered in the original printer language (PCL, PostScript etc).
to:
Users have reported that when the [[http://technet.microsoft.com/en-us/library/cc753853%28WS.10%29.aspx | Terminal Services Easy Print driver]] is used that there are inconsistent page analysis results. This is because the print job is no longer rendered in the original printer language (PCL, PostScript etc).
June 02, 2011, at 04:18 AM by 202.129.124.120 -
Added lines 43-47:
!! Terminal Services Easy Print driver
Users have reported that when the [[http://technet.microsoft.com/en-us/library/cc753853(WS.10).aspx | Terminal Services Easy Print driver]] is used that there are inconsistent page analysis results. This is because the print job is no longer rendered in the original printer language (PCL, PostScript etc).

In order to allow PaperCut access to the original print language, we suggest that this feature is not used.

Changed line 46 from:
[-Keywords: terminalserver, Virtual Desktop Infrastructure (VDI), terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services -]
to:
[-Keywords: terminalserver, thin client, Virtual Desktop Infrastructure (VDI), terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services -]
Changed lines 1-2 from:
(:title Special considerations on Terminal Server/CITRIX:)
to:
(:title Special considerations on Terminal Server/CITRIX/VDI:)
Changed line 46 from:
[-Keywords: terminalserver, terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services -]
to:
[-Keywords: terminalserver, Virtual Desktop Infrastructure (VDI), terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services -]
Changed line 46 from:
[-Keywords: terminalserver, terminal, remote desktop, ts, [=MetaFrame=], Presentation Server -]
to:
[-Keywords: terminalserver, terminal, remote desktop, ts, [=MetaFrame=], Presentation Server, terminal services -]
August 30, 2010, at 01:58 AM by 202.129.124.120 -
Added lines 37-42:
!!Unauthenticated Terminals

In some scenarios administrators may not want users to have to log on at the terminal. For this case, terminals can be configured to auto-logon to the server with a pre-set username that is configured once for each terminal.

In order to allow PaperCut print authentication please make sure that each terminal logs on to the terminal server with a different username so that PaperCut can determine the origin of the print job. Also make sure that these usernames are marked "unauthenticated" in PaperCut and that the PaperCut client is running in each terminal session so that users can supply their printing credentials when sending off a print job.

Added lines 22-23:
In some circumstances, if the client is not minimized in the Citrix session it may stay active when the published application is closed.
Deleted lines 25-26:
If the client is not minimized in the Citrix session it may stay active when the published application is closed
Changed lines 22-26 from:
The PaperCut local-cache client should be run with the --minimized option. Login scripts should set this option.

If the client does is not minimized in
the Citrix session it may stay active when the published application is closed

to:
The PaperCut User client, [@pc-client-local-cache.exe@] should be run with the --minimized option. Login scripts should set this option.

If
the client is not minimized in the Citrix session it may stay active when the published application is closed
June 30, 2010, at 04:58 AM by Peter Williams - typo
Changed lines 22-23 from:
The local-cache client should be run with the --minimized option. Login scripts should set this option.
to:
The PaperCut local-cache client should be run with the --minimized option. Login scripts should set this option.
June 30, 2010, at 04:57 AM by Peter Williams - Run miminized
Added lines 21-26:
!!Run Minimized
The local-cache client should be run with the --minimized option. Login scripts should set this option.

If the client does is not minimized in the Citrix session it may stay active when the published application is closed

Comments

Share your findings and experience with other PaperCut users. Feel free to add comments and suggestions about this Knowledge Base article. Please don't use this for support requests.

Article last modified on June 03, 2019, at 01:37 AM
Printable View   |   Article History   |   Edit Article