Local Client Drive frustration

[denacho]

I'm running 2 Win2K3 PS4 and 1 Win2K3 WI servers. I had them set up and working perfectly at one point so users logging into the WI would not see the server drives when the try to open or save a doc (let's say in Notepad for example). Here's some of the settings that I had:
Citrix Policy (Client Devices|Resources|Drives)
Connection - Enabled - Connect at Logon
Mappings - Enabled - uncheck all but Remote
Local Windows Policies - nothing here; all Not Enabled
Domain Policies - nothing here; all Not Enabled
ICA Connection Properties - default from Citrix install
Registry entry (HKLM\SW\Ms\Windows\CurrVer\policies\Ex) nodrives=fff2c

I had experimented with the registry entry one day until I got a combination that hid the server drives but gave them their local drives and it worked fine, until....

Nothing has changed on the server, in my Citrix config, or in Group Policy, but now, all of a sudden, I can't see my local workstation drives when accessing File Open or Save. I can see the server drives. I checked the registry entry and found it was no longer there, so I put it back in. But now I can see the server floppy and cdrom. I restricted those through Group Policy; they still show up but are unaccessible. I'd love to get back to how I had it working before where they don't see the server drives at all and see only their local. Any advice? Oh, and I've searched and read much on tek-tips as well as Brian Madden, but nothing is working.

 

[krazykatz]

are you using loopback policy on the citrix server???

 

[denacho]

yes, i do have that enabled. although, as i understand that, it allows for User Config settings within my Citrix OU could be applied? however, i don't have any User Config settings set. and when this worked before, i didn't have Loopback enabled. i just enabled it this time to see if it would change anything, but it hasn't.

 

[krazykatz]

and you did modify the local policy on that server via mmc local computer. yes?

 

[denacho]

i had both the Local and the OU GP set to Enable on the Loopback policy. after doing some more reading about GP (i've never had to set any of that myself before so i'm new), i set the local stuff back to Defaults (i.e. Not Configured) because i understood it that Local is the lowest priority and wouldn't matter compared to what i have in the OU GP.

on top of that, i compared my test server to my production server. the test server is working as it should. i compared Citrix Policies, local GP, ICA Connection settings, and the registry entry. everything is the same at this point, but when launching Notepad from WI against production, i can only see the C and D of the server, but nothing on the client PC. i'm baffled!

 

[krazykatz]

I was just wondering what was is the resultant policy. Can you use the The Microsoft Group Policy Management Console ad find out what is the effect the reg. setting you are making your production environment??? I know this setting is in the ica connection settings, policy setting in citrix, and the gpo's, just play with the front end setting and remove the reg stuff untill the drives will map and then ad on the hide drive settings... good luck

 

[denacho]

at this point i have tried about every crazy setting i can think possible.

I have turned off (=Not Configured) any Local GP settings on the server. I had Domain GP's set that (1) applied to the TS/Citrix server and (2) applied to all users except Domain Admins on that server. In the 2nd GP, I used the highly mentioned HideCalc to hide the server drives. It worked and was as easy to use as has been mentioned in this group. However, the only drive that shows up is a mapping to the local drive - by that I mean, when I go to File|Open, I'm prompted that a drive is trying to map H: to Docs and Settings\etc. I say Yes and I can get to my profile folder on my local drive - but I want them to get to the root of C: on their workstations. Aside from that, nothing from the client is showing up.

I've tried all types of combinations of ICA Connection settings, Policy settings, and Domain GP settings. Turning things off and on in every combo I can think of. The best I can get is the above mentioned result - no server drives but only one local connection.

So I guess I'm halfway there since I didn't want them seeing the server drives, but it doesn't help if they won't be able to see other local drives or directories. And lastly, what confuses this more, is I'm getting completely different results on my Test server even if I config them exactly the same! As Charlie Brown said: UGGHHHH!!!!

 

[krazykatz]

I was just wondering for you can test a session with something simple like a net use command to see if the a drive will map.(opening the door to to logon scripts) if you don't want to rebuild the server and don't have the reg backed up, you can get "dangerously" creative and see if the test server reg key can be using on your production server. I might try this as a last ditch effort, with the idea that a rebuild would follow if this failed.