Secondary logon and Citrix

Citrix can be used very creatively. For example, if you work in a multi forest/domain environment, IT staff would need to hop on to domain tools with different domain crendential. Secondary logon will be use so you won't need a secondary PC. Runas is the command that come with Windows product, which I knew it before. However, Citrix access gateway seem provide a better, easy-adopted, scalable interface to provide secondary logon as well as application/tool delivery. Once you login with your 2nd crendential, the available tools in that domain context are just there for you to click. I believe this is a great use of Citrix seamless integration technology.

More than that, you can customize the tools that you want helpdesk to use and restrict the permission as less as you want. Here you see, you can use this to delegate many things.

To sum it up, the Citrix model can be:
Financial/Business applications --> Citrix ---> non-IT users
admin tools --->Citrix ---> IT user with delegate control
Multiple domain ----> Citrix ---> user

Add one more layer increase the flexibility and give more granular control over the application

Delegate non-domain admin group to workstation

My recent work allow me to watch how Helpdesk works on the workstation deployment. It is a large enviornment, so helpdesk group don't have domain admin right, but they still need full admin right to user workstations, so there is a need to add domain\helpdesk group into each workstation, not the servers.


Here is their ways because they use disk cloning to complete OS/APP installation.


1. join in the domine, and add domain \helpdesk group into this local admin group of this workstation
2. remove this workstation from the domain; a unknown user account will show in local admin group, do NOT delete this one
3. clone this workstation
4. join the new workstation into domain, and this unknown user account will become domain\helpdesk group.


I know I can use restricted group in group policy computer setting to delegate a non-domain admin group to workstations, but the process is tricky and easy to make very serious problem, such as removing domain admin group from each workstations.


The group name must be "Administrators" and the Memebers has to include


Administrator - the local administrator
- Domain Admins
- Remote Administrator

This GPO policy is all-to-all change, not a incremental change, so you have to include every member in the group.

Here is another tutorial on restricted group

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

use group policy to assign a special group , such as helpdesk, to assume local-admin right for all workstation in a OU, whilke keep domain admins and original administrator in the same control level.

It need to create a GPO and apply to this OU. The modification of this GPO is to go to computer setting\windows setting\security setting\restricted group, and create an in group called "administrators" and include "administrator, < >\domain admins, < >\helpdesk " . The trick is to udderstand the name specified above is used like leg for leg, hand for hand. No more, no less. It carve out the exact setting. If you miss out the domain admins group, you won't find it later. I have a lesson for this when I work for Yak in 2006. This is very tricky, very easy to make mistake.


http://www.windowsecurity.com/articles/Using-Restricted-Groups.html