Deploying VDAs in a Multi-Forest Environment

I was recently brought onto a project to consolidate two aging Citrix farms into a single 7.15 farm.

The project consisted of multiple images across multiple domains with the endgame being all the images be in the same infrastructure under a single Citrix 7.15 Environment with the only exception being the images had to be a member of their original domain.

The images were reverse engineered and ported over to a shiny new ESX Cluster, which made life easier as the abundance of compute and storage was a joy to play with.

Part of the standard image creation process was to point the VDAs to the new DDCs. For the Citrix guys who have done manual VDA installs it’s always nice and comforting to see that green tick to indicate the connection has been established and a valid DDC has responded. Awesome!....or so you would think….

One of the things that make my job awesome is coming up against tricky problems that have no explanation as to why something is broken…then trying to fix it……this blog ( I hope ) will provide a quick resolution for whoever reads it to solve the issue.

What is the issue I am writing about though…? Keep reading to find out…

VDAs in Domain1 communicate to Desktop Delivery Controllers in Domain1…….VDAs in Domain2 could not communicate to Desktop Delivery Controllers in Domain1.  

Standard procedure, check Network Firewall & Settings, check Windows Firewall and settings etc… 9 out of 10 times this all checks out OK…but must be done.

So research time….I realised that I had a few more items to configure before this very simple piece of comms between server/client to be possible.

First was to establish the permissions on the OU for the Citrix Admin to create machines.

Select the OU that will house your Computer accounts:

  • Right Click and select Delegate Control
  • Add the Security group which has Citrix site access (Citrix admin account)
  • Create a custom task to delegate
  • Select the below settings:

  • Select permissions on the next screen to be Read & Write

So that’s it…..but wait there’s still more to do…

For this type of setup to work the existing VDAs must be granted authentication access to the Delivery Controllers – this has to be done via active directory.

For simplicity reasons nest all the VDA computer accounts into a single group (this will make setting the appropriate permissions easier).

Right click onto the OU where the Citrix DDCs reside and select -> Properties -> Security. Here we are going to add the VDIs security group and assign R/W abilities.

An example of the config here:

Now that Active Directory is configured – lets go back to the Citrix VDA configuration - starting with the Desktop Delivery Controller….

Login to your Citrix Desktop Delivery Controllers and open the registry editor…

Navigate to HKEY_LOCAL_MACHINE\Software\Citrix\DesktopServer\

If the key doesn’t exist, please add a REG_DWORD called SupportMultipleForest and assign it the value 1.

Next phase is to move back onto your master image and open up the registry. You will then need to add the following items to the following keys:

  • 32-Bit VDA: HKEY_LOCAL_MACHINE\Software\Citrix\VirtualDesktopAgent\ListOfSIDs

Add the SIDs of the Delivery Controllers

  • 64-Bit VDA: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Citrix\VirtualDesktopAgent\ListOfSIDs

Technically this is all you need to do….but here is the bit the vendor tech articles leave out:

One more STEP!

So after trying various means to figure out what was missing…the BrokerAgent Config file needs a little modification before allowing the multi-site registration cycle to be complete.

Always prudent to take a backup……..just in case!

Open the file in a Notepad and set the following field to “true”:

Join the Insentra Community with the Insentragram Newsletter

Hungry for more?

[Modern Workplace]


By [Penny Theodoulou]

I’m sure I speak for many when I say we all love to hate them. In fact, I think I can hear the groans from here!

[Modern Workplace]

Identity and Authentication - The Boss of All Bosses

By [Hambik Matvosian]

Hi folks! Pure Awesomeness back again! Yes, I know it’s been a stupid amount of time since my last blog post but I’m back…back again to pump as much knowledge and wisdom into your cerebrums as one individual with the title of Pure Awesomeness can!

[Modern Workplace]

Project Management and Change Management – How Insentra ensures projects run smoothly

By [Marni Noble]

I am going to say something that will really blow your mind… are you ready? It seems in business today that change is the only constant in this crazy fast-paced world of variables.