Assignment published applications users can be a very simple task, but if not handled well, it can end up creating more problems. I saw the posting customers individual user accounts to published applications in the Citrix management console and it can become very problematic because there is a danger of inconsistency assignment. Usually, we use Active Directory groups to manage assignments. In the Microsoft world, there are 3 types of groups AD - domain local group, global and universal. I am often asked by customers what is the best practice in the management of applications assignment, and I refer to the best practices of Microsoft (scroll to the last section of the page).
As recommended by Microsoft, use domain local group to manage access to resources, ie published applications. Then use global groups to manage users in a particular area, then grant user access to published applications by global groups from a member of the local group. Finally, there is a universal group that can consolidate global groups from different areas, but so far I have not come for customers who still use universal groups.
To give a specific scenario XenApp for example, say that there are two different areas, area A and area B, and XenApp servers are in the area A. to assign, say users of human resources the two domains published applications, create global groups "G_HR" for each affected areas and HR users worldwide respective field group. In the field of XenApp servers (domain), create a local group for each application and make the "DomainA G_HR" and member "DomainB G_HR" of these local groups if they need to use the applications.
Even if there is only one domain, I recommend using this approach. If there is a need to migrate your users or XA servers to a different area in the future, it can help make the transition smoother.
0 Komentar