The installation and configuration of all Citrix products can be automated. This article covers the Citrix Provisioning Server unattended installation with PowerShell and SCCM. Also included is the unattended creation and configuration of the Provisioning Server farm and the local host.

Change Log 31.08.2017: updated to Provisioning Server 7.15 (this article was originally written for Provisioning Server 7.13). 28.11.2017: updated complete script for Provisioning Server configuration. Improved reading the local IP address (lines 631 to 658). 06.12.2017: updated to Provisioning Server 7.16 (no major changes).

Table of Contents Introduction Part 1: Install Windows Roles and Features Complete script for installing Roles and Features Part 2: Install Citrix Provisioning Server Step 1: Install the Provisioning Server console Step 2: Install Provisioning Server Step 3: Install the Provisioning Server snap-in Complete script for installing Citrix Provisioning Server Part 3: Create and configure the Provisioning Server farm and the local host Step 1: Configure the firewall (using GPO, NetSh or PoSH) Option 1: Create the firewall rules using Group Policy Option 2: Create the firewall rules using NetSh Option 3: Create the firewall rules using PowerShell Step 2: Create or join farm (using the ConfigWizard) Step 3: Configure the farm and the local host (using PowerShell) Create administrators (farm, site and collection) Enable auditing, offline database support and configure the license server Enable the Customer Experience Improvements Program (CEIP) Enable verbose mode in the bootstrap configuration Configure streaming ports, threads per port, event log and set max password age Create a new store and add the local host to the store Disable BIOS Boot Menu Fix error: No servers available for disk When Booting from vDisk Complete script for configuring Provisioning Server and the local host Conclusion

Introduction

Before continuing with this article please be aware of the following:

• In this article, Provisioning Server or Provisioning Services is sometimes abbreviated to PVS.
• The version of Citrix Provisioning Server in this article is 7.16, but all installations work from Provisioning Server 7.13 and upward.
• The software can be downloaded here:
  https://www.citrix.com/downloads/xenapp-and-xendesktop/edition-software/enterprise-716.html
• The installation and configuration scripts are designed for the following operating systems:
  • Microsoft Windows Server 2008 R2 SP1
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows Server 2016
• The installation and configuration scripts have been tested on the following operating systems:
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows Server 2016
• The assumption is that you execute the example script in this article on a server which has been pre-installed with one of the aforementioned operating systems including all latest hotfixes and .Net Framework 4.6.x.

This article consists of three parts:

• Part 1 focuses on the installation of the Windows Roles and Features;
• Part 2 deals with the installation of the Citrix Provisioning Server;
• Part 3 describes the configuration of the Provisioning Server farm and the local host.

Part 1: Install Windows Roles and Features (optional)

Before we install the Citrix Provisioning Server software, I recommend to install some commonly used roles and features. These components are optional, except for .Net Framework 3.5.1 on Windows Server 2008 R2 SP1, which is a prerequisite for Citrix Provisioning Server 7.16.

In this example we will install the following features:

• .Net Framework 3.5.1 (for W2K8R2 only)
• .Net Framework 4.5.x (for W2K12 and W2K16 only)
• Desktop experience (for W2K8R2 and W2K12 only)
• Group Policy Management Console
• Remote Server Administration Tools (AD DS Snap-Ins)
• Remote Desktop Licensing Tools
• Telnet Client
• Windows Process Activation Service

You can remove or add any role or feature you need. Please be aware though that not all features can be installed at the same time. Some features need a reboot. After that, other features can be installed.

In PowerShell, roles and features are installed using the Add-WindowsFeature (Windows Server 2008 R2) or Install-WindowsFeature command (Windows Server 2012 and higher). For example:

Windows Server 2008 (R2):

Windows Server 2012 (R2):

Windows Server 2016:

The names of the individual roles and features differ between the various operating systems:

• .Net Framework:
  • Windows Server 2008 R2 only offers version 3.5.1 (Add-WindowsFeature command NET-Framework-Core).
  • Windows Server 2012 (R2) offers both the versions 3.5.1 and 4.5.x (Install-WindowsFeature command NET-Framework-Core and NET-Framework-45-Core), but I only install the 4.5.x version.
  • Windows Server 2016 only offers version 4.5.x (Install-WindowsFeature command NET-Framework-45-Core).
• Desktop-Experience:
  This feature no longer exists as a separate item in Windows Server 2016. Let me clarify; when you use the full version of Windows Server 2016 (not the core/nano version), desktop experience is included out-of-the-box.
• Remote Desktop Licensing Tools:
  In Windows Server 2008 (R2), the abbreviation of this feature is called RSAT-RDS-Licensing. In Windows Server 2012 and higher, this feature is called RDS-Licensing-UI.

To establish the version of the running operating system, I use the following PowerShell command:

Complete script for installing Roles and Features

In case you use my installation template, this is what the complete script, including logging, looks like:

Execute the script as follows:
powershell.exe -file %Directory%\Install_Citrix_PVS_Roles.ps1

In case you get a security warning, execute the script as follows:
powershell.exe -executionpolicy bypass -file %Directory%\Install_Citrix_PVS_Roles.ps1

Log files are created in the directory C:\Logs\Citrix_Provisioning_Server_Roles, but you can change this to any directory you want (see lines 91 and 92).

Note: The installation of the roles and features may require a reboot. The reboot is NOT part of the example script. You can either add it to the script yourself, or if you use a deployment tool such as Microsoft SCCM, you can add a reboot task in the task sequence.

If you want to go one step further and create an SCCM package as well, please follow the step-by-step explanation in the article Deep dive creating SCCM packages for Citrix.

Part 2: Install Citrix Provisioning Server

The second part of this article focuses on the installation of the Citrix Provisioning Server. Three components need to be installed: the Citrix Provisioning Server console, the Citrix Provisioning Server component and the Provisioning Server PowerShell snap-in. So how do you start?

• Create an installation directory on the local computer or on a file share (UNC path). For example: C:\Temp\Citrix\ProvisioningServer.
• Create a subdirectory called Files.
• Download and extract the Provisioning Server 7.16 ISO file to the folder Files in the installation directory. The contents of the directory Files should now look like this:
  
• The folders Console and Server contain the main source files (for the Provisioning Server console and Provisioning Server itself).
• Copy the complete PowerShell script at the end of this part to a new PS1 file (e.g. Install_CitrixProvisioningServer.ps1) and add this file to the root of your installation directory (not in the subdirectory Files).
• Execute the PowerShell script: powershell.exe -file C:\Temp\Citrix\ProvisioningServer\Install_CitrixProvisioningServer.ps1

The following paragraphs describe each of the three installation steps individually:

1. Install the Provisioning Server console
2. Install Provisioning Server
3. Install the Provisioning Server snap-in

The complete PowerShell script at the end of this part includes all of these steps! When you use this script, you do not need to execute any of the individual steps described below.

Step 1: Install the Provisioning Server console

The first item to install is the Provisioning Server console.

The basic command line to install the Provisioning Server console is as follows:

The complete PowerShell script at the end of this part includes the installation of the Provisioning Server console including detailed logging and error handling.

Step 2: Install Provisioning Server

The second item to install is Provisioning Server itself.

The basic installation command line to install the Provisioning Server itself is as follows:

The complete PowerShell script at the end of this part includes the installation of Provisioning Server including detailed logging and error handling.

Step 3: Install the Provisioning Server snap-in

For some unknown reason, the Provisioning Server snap-in is not installed during installation. The DLL is there, but it is not registered. To manually install the snap-in, execute the following command:

Please change the log directory to your preference.

After the snap-in has been installed, you are able to load the snap-in in a PowerShell command window or in a PowerShell script:

The snap-in for Provisioning Server 7.16 offers a total of 178 cmdlets (the same as for Provisioning Server 7.13 to 7.15). To see which ones are available, you can use the following command:

How can you count the total number of snap-ins? Like this:

In part 3 of this article I use some of the available cmdlets to configure the Provisioning Server farm and the local host.

For more documentation concerning the Provisioning Server snap-in, please see the official Citrix PowerShell with Objects Programmer’s Guide:
https://docs.citrix.com/content/dam/docs/en-us/provisioning-services/7-13/downloads/PvsSnapInCommands.pdf. I did not find a newer version of this document, but its contents also applies to Provisioning Server 7.14 to 7.16.

The complete PowerShell script at the end of this part includes the installation of the Provisioning Server snap-in.

Complete script for installing Citrix Provisioning Server

In case you use my installation template, this is what the complete script, including logging and error handling, looks like:

Execute the script as follows, for example:
powershell.exe -file C:\Temp\Citrix\ProvisioningServer\Install_CitrixProvisioningServer.ps1

In case you get a security warning, set the execution policy to allow the script to run:
powershell.exe -executionpolicy bypass -file C:\Temp\Citrix\ProvisioningServer\Install_CitrixProvisioningServer.ps1

Log files are created in the directory C:\Logs\Citrix_Provisioning_Server_(installation), but you can change this to any directory you want (see lines 187 and 188).

Part 3: Create and configure the Provisioning Server farm and the local host

The third part of this article focuses on the creation and configuration of the Citrix Provisioning Server farm as well as the local host.

If you have created the installation directory as described in part 2, you can continue as follows:

• Make sure that your Citrix License Server is up-and-running (the latest version). The actual product licenses do not need to be installed yet. Please read the article Citrix License Server unattended installation with PowerShell and SCCM for more information on how to install and configure your Citrix License Server using PowerShell.
• Provisioning Server requires only one database. In order to create this database, you need a Windows (Active Directory) account with the appropriate SQL permissions (securityadmin or sysadmin). The script below assumes that the currently logged on administrator has sufficient permissions.
• In case you want to run the services Citrix PVS SOAP Server and the Citrix PVS Stream Service using an Active Directory account (instead of the default Local Service account), make sure you have created one. You will need this later.
• Copy the complete PowerShell script at the end of this part to a new PS1 file (e.g. Configure_CitrixProvisioningServer.ps1) and add this file to the root of your installation directory (not in the subdirectory Files).
• Execute the PowerShell script:
  powershell.exe -file C:\Temp\Citrix\ProvisioningServer\Configure_CitrixProvisioningServer.ps1

The following paragraphs describe each step in the configuration of Provisioning Server individually. The complete PowerShell script at the end of this part includes all of these steps. When you use this script, you do not need to execute any of the individual steps described below!

Step 1: Configure the firewall (using GPO, NetSh or PoSH)

During installation, Citrix Provisioning Server unfortunately does not offer the possibility to automatically configure the local firewall (as is the case with the installation of a XenDesktop Delivery Controller for example). However, this is only a nuisance, but certainly not a problem.

The Citrix article Communication Ports Used by Citrix Technologies lists all communication ports used by Provisioning Server (and all other Citrix technologies). In summary, the following UDP and TCP ports are used (in ascending order):

• UDP: 67,69,2071,6910-6930,6969,4011,6890-6909
• TCP: 389,1433,54321-54323

There are three ways how to configure the local firewall:

1. Using a Microsoft Group Policy object
2. Using the NetSh command
3. Using the PowerShell cmdlet Get-NetFirewallRule

Note: I recommend using the same rule configurations for both inbound and outbound traffic. Most ports do not require a two-way communication, but it makes life easier and from a security point of view it does little harm (although strictly speaking you should open ports only when absolutely required).

Option 1: Create the firewall rules using Group Policy

When using a Microsoft Group Policy object, follow these steps:

• Create a new or use an existing Group Policy object;
• Open the policy (edit) and go to Computer Configuration Policies Windows Settings Security Settings Windows Firewall with Advanced Security Windows Firewall with Advanced Security – LDAP://[…] Inbound/Outbound  Rules;
• Add the following four rules:
  1. A new Inbound Rule:
     • As a rule type use Port;
     • On the second tab select TCP and enter the ports 389,1433,54321-54323 as the specific local ports;
     • Click three times Next;
     • On the final page of the wizard enter a name for the rule, for example Citrix PVS (Inbound,TCP).
  2. The second Inbound Rule:
     • As a rule type use Port;
     • On the second tab select UDP and enter the ports 67,69,2071,6910-6930,6969,4011,6890-6909 as the specific local ports;
     • Click three times Next;
     • On the final page of the wizard enter a name for the rule, for example Citrix PVS (Inbound,UDP).
  3. A new Outbound Rule:
     • As a rule type use Port;
     • On the second tab select TCP and enter the ports 389,1433,54321-54323 as the specific local ports;
     • Click three times Next;
     • On the final page of the wizard enter a name for the rule, for example Citrix PVS (Outbound,TCP).
  4. The second Outbound Rule:
     • As a rule type use Port;
     • On the second tab select UDP and enter the ports 67,69,2071,6910-6930,6969,4011,6890-6909 as the specific local ports;
     • Click three times Next;
     • On the final page of the wizard enter a name for the rule, for example Citrix PVS (Outbound,UDP).

Option 2: Create the firewall rules using NetSh

The NetSh command has to be used on Windows Server 2008 (R2). If you are using Windows Server 2012 and above, go to the following section to configure the firewall rules using PowerShell.

To configure the firewall rules using the NetSh command, please open a command window (as administrator) and execute the following four command lines:

The complete PowerShell script at the end of this part includes a function to configure the above firewall rules including detailed logging and error handling.
The function checks the version of the operating system. In case of Windows Server 2008 (R2), the function will use the NetSh command to configure the local firewall. If the operating system is Windows Server 2012 or higher, PowerShell is used (see option 3 right below).

Option 3: Create the firewall rules using PowerShell

From Windows Server 2012 and above, the native Microsoft PowerShell cmdlet New-NetFirewallRule can be used to configure the local firewall.

Note: the name and display name are two different things. The name of the firewall rule has to be unique, the display name does not. In my examples, I keep the name and display name the same.

To configure the firewall rules using PowerShell, please open a PowerShell command window (as administrator) and execute the following four command lines:

The complete PowerShell script at the end of this part includes a function to configure the above firewall rules including detailed logging and error handling.
The function checks the version of the operating system. In case of Windows Server 2008 (R2), the function will use the NetSh command to configure the local firewall. If the operating system is Windows Server 2012 or higher, PowerShell is used.

Step 2: Create or join farm (using the ConfigWizard)

A Provisioning Server farm can only be created using the ConfigWizard.exe (Running the configuration wizard silently) and an accompanying configuration file (*.ans). The same goes for joining an existing farm. It is not possible to create or join a farm using the Provisioning Server PowerShell snap-in.

Note: Creating or joining a farm requires dbcreator and securityadmin permissions on the SQL server.

Here are some facts concerning the ConfigWizard.exe:

• The default location is C:\Program Files\Citrix\Provisioning Services;
• The ConfigWizard.exe requires an answer file (with the extension *.ans) in order to create or join a farm;
• The ANS-file can be created in any editor (such as Notepad) and has to be saved in unicode format;
• The account executing the ConfigWizard.exe needs to have dbcreator and securityadmin rights on the SQL database;
• The command to execute the ConfigWizard.exe to either create or join a farm is: “%programfiles%\Citrix\Provisioning Services\ConfigWizard.exe” /a:C:\ConfigWizard.ans /o:C:\ConfigWizard.log. The parameters used in the ANS file determine whether you create a new or join to an existing farm;
• Besides the log file you create with the /o parameter, the ConfigWizard.exe also generates a second log file: C:\ProgramData\Citrix\Provisioning Services\ConfigWizard.txt. This log file is very detailed.
• The command “%ProgramFiles%\Citrix\Provisioning Services\ConfigWizard.exe” /C generates the output file C:\ProgramData\Citrix\Provisioning Services\ConfigWizard.out. This file contains all possible parameters of the ConfigWizard.exe. The output file can be opened in any editor (such as Notepad).
• The command “%ProgramFiles%\Citrix\Provisioning Services\ConfigWizard.exe” /S allows you to run the ConfigWizard.exe interactively. The /S parameter writes (records) all settings from the ConfigWizard to an ANS file (called ConfigWizard.ans). This ANS file can than later be used (after changing some parameters) on other Provisioning Servers. The ANS file is created in the following directory: C:\ProgramData\Citrix\Provisioning Services.
• The ConfigWizard.exe always ends with exit code 0. The only way to determine any error is by checking the log file. During testing, I have encountered the following ConfigWizard error types:
  • Invalid Database Name: You must enter a database name:
    Make sure to save the ANS file in unicode format (!) and make sure to enter a valid database name (DatabaseNew=MyDataBase).
  • Invalid Database Server: You must enter a database server:
    Make sure to enter a valid database server name (DatabaseServer=MySQLServer.my.domain).
  • Invalid Default Path: Default Path not found:
    The directory of the PVS store does not exist. Check the parameter DefaultPath (only used when creating a new farm). The directory entered in this parameter has to be created before you execute the ConfigWizard.exe.
  • Fatal Error: You need to enter at least one server:
    Add the LS1 parameter, for example LS1=192.168.0.1,0.0.0.0,0.0.0.0,6910.
    Make sure to enter the correct local IPv4 address and the first streaming port (= 6910 by default).
  • Invalid Site: You must enter a site:
    Enter a valid site name. When creating a new farm the parameter is SiteNew=MySite. When joining an existing farm the parameter is ExistingSite=MySite.
  • Invalid Server: A network-related or instance-specific error occurred while establishing a connection to SQL Server […]:
    • Make sure to enter a valid SQL server name (DatabaseServer=MySQLServer.my.domain).
    • Make sure that you can connect to the SQL port (1433 by default). Use telnet to test the connection: telnet %hostname% 1433
    • Connect to the SQL server. Check if a listener is active on port 1433. Use the netstat command to check this: netstat -an | find /i “listening”
      If port 1433 is not listed anywhere, the SQL listener is not active. Make sure that the main SQL service SQL Server (MSSQLSERVER) is running.

I am sure that more error types exist, but these are the ones I encountered.

The minimum set of parameters required for the ANS file for creating a farm are the following:

• FarmConfiguration=1
• BootstrapFile=C:\ProgramData\Citrix\Provisioning Services\Tftpboot\ARDBP32.BIN
• DatabaseServer=MySQLServer.my.domain
• DatabaseNew=MyDataBaseName
• FarmNew=MyFarmName
• SiteNew=MySiteName
• CollectionNew=MyDefaultCollection
• Store=MyDefaultStore
• DefaultPath=C:\PVSStore
• LicenseServer=MyLicenseServer.my.domain
• LicenseServerPort=27000
• LS1=192.168.0.1,0.0.0.0,0.0.0.0,6910
• StreamNetworkAdapterIP=192.168.0.1
• UserName=My.domain\MyAccount
• UserPass=MyPassword

Modify the values in bold to your requirements.

Handling passwords in the ANS file There are two parameters that can be used to store the password in the ANS file: UserPass and UserName2. UserPass stores the password in plain text. This is not a problem if you make sure that the password is dynamically written to the ANS file and secondly, that the ANS file is deleted from the local server after creating or joining the farm. The complete PowerShell script at the end of this part dynamically creates the ANS file and deletes it afterwards. In the script, the password has to be entered as a variable in plain text. For production environments, I suggest to dynamically write the password to the ANS file by using one of the methods described in the article Encrypting passwords in a PowerShell script. UserName2 stores an “encrypted” version of the password. This “encryption” is a ConfigWizard specific solution. As mentioned in the beginning of this section, the command “%ProgramFiles%\Citrix\Provisioning Services\ConfigWizard.exe” /S writes (records) all settings from the ConfigWizard to an ANS file. To generate this “encrypted” password, you have to manually go through the wizard, but only once. Start the ConfigWizard with the /S parameter. After going through all the steps, open the dynamically created ANS file in the directory C:\ProgramData\Citrix\Provisioning Services. In this file you will find the parameter UserName2 with a strange looking value, for example: UserName2=kmighmkmkhopiemojqojfhdoggqspngsgfns. This is the “encrypted” version of your password. You can copy this line to the PowerShell script and use it. So instead of using the parameter UserPass to set the password, you use the parameter UserName2. If you follow this method, please change the parameter UserPass in lines 693 and 734 to UserName2 in the complete PowerShell script. I write “encrypted” in quotation marks, because the password is not really encrypted. I am sure that it is relatively simply to decrypt it back to a plain text password. But for most organization I believe this level of password security should be sufficient, especially if you have correctly configured NTFS permissions in place.

The minimum set of parameters required for the ANS file for joining a farm are the following:

• FarmConfiguration=2
• DatabaseServer=MySQLServer.my.domain
• FarmExisting=MyFarmName
• ExistingSite=MySiteName
• ExistingStore=MyDefaultStore
• LS1=192.168.0.1,0.0.0.0,0.0.0.0,6910
• StreamNetworkAdapterIP=192.168.0.1
• UserName=My.domain\MyAccount
• UserPass=MyPassword

Modify the values in bold to your requirements.

The following optional parameters are available as well:

• IPServiceType
  • 0 = Microsoft DHCP
  • 2 = Provisioning Services BOOTP service
  • 3 = BOOTP or DHCP service.
  • Leave out this parameter if non of the above options apply
• PXE Service Type
  • 0 =Microsoft DHCP
  • 1 = Provisioning Services PXE
  • Leave out this parameter if non of the above options apply (for example if you want to use a boot disk or boot partition (BDM).
• FailoverDatabaseServer=x (x is the name of the failover server)
• FailoverDatabaseInstance=x (x is the name of the failover instance)
• ADGroup=x (x is is the Active Directory group.). I did not get this to work though. Probably was my mistake, but I do not know what it was supposed to do.
• Group=x (x is is the Windows group)
• Network=1 (Network is used for the ‘Network service account’ choice). If you do not want to use an Active Directory account for the Citrix PVS SOAP Server service and the Citrix PVS Stream Service, set Network to 1. In this case, you can leave out the parameters UserName and UserPass/UserName2.
• PasswordManagementInterval=x (x is the number of days between password resets). The default is 7 days. You can change this value at a later time using PowerShell.
• ManagementNetworkAdapterIP=x (x is Management IP address. Uses the first available IP address if this parameter is not found in the ANS file)
• ManagementFirstPort=n (n is first port number. 6905 if not found)
• ManagementLastPort=n (n is the last port number. 6909 if not found)
• AdvancedVerbose=x (x is 1 when verbose mode is turned on)
• AdvancedInterruptSafeMode=x (x is 1 when interrupt safe mode is turned on)
• AdvancedMemorySupport=x (x is 1 when advanced memory support is turned on)
• AdvancedRebootFromHD=x (x is 1 when reboot from hard drive on fail)
• AdvancedRecoverSeconds=x (x is the number of seconds to reboot to hard drive after fail)
• AdvancedLoginPolling=x (x is the number of milliseconds for login polling timeout)
• AdvancedLoginGeneral=x (x is the number of milliseconds for login general timeout)
• SslPort=n (n is SSL Port number). Use this parameter is you plan to stream Linux workers using Provisioning Server.
• SSLCert=t (t is Certificate thumbprint). Use this parameter is you plan to stream Linux workers using Provisioning Server.
• CIS User Account
• CisUserName=x (x is a user account name)
• CisPassword=x (x is the password (encrypted) for the user account)
• NoStartServices=1 (Do not start services if exists)

Please note that some settings can be configured by both the ConfigWizard and the Provisioning Server PowerShell cmdlets.

How does the ConfigWizard know which database to use when joining a server to an existing farm? When using the ConfigWizard to join an existing farm, no parameter exists to add the database name. You have to add the name of the database server and the name of the SQL instance (in case your SQL server is configured with multiple instances), but not the name of the database. Even if you enter an incorrect and non-existing farm name, the local server gets joined to an existing farm nonetheless. So how does the ConfigWizard know which database contains the Provisioning Server farm? Well, according to the log file C:\ProgramData\Citrix\Provisioning Services\ConfigWizard.txt, it turns out that the ConfigWizard simply checks ALL available databases on the SQL server (instance): Each available database is checked (if the user running the ConfigWizard has access to it). If the user has sysadmins rights, all databases are checked. An SQL query checks for the availability of a Provisioning Server farm name (in some cases even ignoring the one entered in the parameter FarmExisting). When the ConfigWizard finds a valid farm name in the database, it simply joins the local server to this database (even if the name specified in the parameter FarmExisting is different). In my opinion, this is quite an invasive method for discovering the name of the database and for joining a server to a farm. Also, when no Provisioning Server farm exists with the name entered in the parameter FarmExisting, I would like to see an error in the error log and not an auto-join into the wrong farm!

The complete PowerShell script at the end of this part includes the ConfigWizard. The script creates a new farm or, if the script detects that the farm already exists, joins the local server to the existing farm.
Two ANS-files are dynamically created in the temp directory of the user running the script. One ANS file contains the parameters for creating the farm. The second one contains the parameters for joining an existing farm. After the ConfigWizard is finished, these files are automatically deleted.

Step 3: Configure the farm and the local host (using PowerShell)

Note: Configuring the farm requires db_owner permissions on the Provisioning Server SQL database.

In part 2 we installed the Provisioning Server snap-in. In this section, we will use some of the 178 available cmdlets to further configure the farm and the local host. Some configuration has already been done by the ConfigWizard in the previous section. Some configurations can be done both in the ConfigWizard ANS-file and with PowerShell.

Please take note that the following paragraphs describe each step in the configuration of Provisioning Server individually. The complete PowerShell script at the end of this part includes all of these steps. Therefore, when you use this script, you do not need to execute any of the individual steps described below!

All farm and host configurations run in parallel with Carl Stalhood’s configurations described in the following article: Provisioning Services – Console Config.

Create administrators (farm, site and collection)

In Provisioning Server, you first have to create an authorization group before you can assign access rights to this group. Access rights can be set on three levels: farm, site and collection.

The command to create an authorization group is:

Note: Please note that the standard notation for Active Directory security groups (MyDomain\MyGroup) does not work for creating PVS authorization groups. The correct group notation is LDAP-like. You have to specify the whole path of the Active Directory group, starting with the domain name, followed by the OU s and lastly the group name: MyDomain/MyOu/MyOu/MyGroup. For example: Home.local/Groups/CTXGroups/CTXPVSFarmAdmins

The command to create a farm administrator is:

When the cmdlet Grant-PvsAuthGroup is not followed by the parameters -SiteName or -CollectionName, the group is given farm authorization.

To create a site administrator execute the following command:

A collection administrator is created as follows:

In order to assign collection access rights, both the site name and the collection name are required.

The complete PowerShell script at the end of this part includes a function which creates all three administrator types. Detailed logging and error handling are included.

Enable auditing, offline database support and configure the license server

The cmdlet Set-PvsFarm allows an administrator to configure multiple farm settings.
For example, use the following command to enable auditing, enable offline database support and to configure the license server and license server port:

The complete PowerShell script at the end of this part includes these settings with logging and error handling.

For more options, please use the cmdlet help function:

Enable the Customer Experience Improvements Program (CEIP)

The cmdlet Set-PvsFarm does NOT include the settings for Customer Experience Improvements Program (CEIP) as one may expect. There is a separate cmdlet for this called Set-PvsCeipData.

Use the following command to enable CEIP:

Use the following command to disable CEIP:

The complete PowerShell script at the end of this part includes enabling CEIP with logging and error handling.

For more options, please use the cmdlet help function:

Enable verbose mode in the bootstrap configuration

The cmdlet Set-PvsServerBootstrap allows the administrator to modify the bootstrap configuration.

Use the following command to enable verbose mode:

In case you use a different bootstrap file (instead of the default ARDBP32.BIN) you have to enter the correct name in the previous command.
To check all available bootstrap files on the local Provisioning Server host, enter the following command:

The complete PowerShell script at the end of this part includes enabling verbose mode with logging and error handling.

For more options, please use the cmdlet help function:

Configure streaming ports, threads per port, event log and set max password age

Reference: https://www.citrix.com/blogs/2023/08/22/the-new-citrix-provisioning-guidelines/

The cmdlet Set-PvsServer allows an administrator to configure a number of settings on the local Provisioning Server host. For example, use the following command to modify the streaming ports (6910 to 6968), the threads per port (equal to the number of vCPUs / virtual cores), the maximum password age (10 days) and to enable the logging of events in the Windows event log:

The complete PowerShell script at the end of this part includes these settings with logging and error handling. The script automatically calculates the number of threads per port based on the number of available vCPUs or virtual cores (including hyper-threading). Change the maximum password age to your requirements. The default is 7.

For more options, please use the cmdlet help function:

Create a new store and add the local host to the store

The basic command to create a Provisioning Server store is:

The above two examples create a new local and remote farm-wide Provisioning Server store. If you want to create a Provisioning Server store for a particular site, you need to add the parameter “-SiteName “MySite”:

To add the local server to the store use the following command:

The complete PowerShell script at the end of this part includes the creation of a farm-wide network (UNC) store. The local server is added to this store as well. Detailed logging and error handling are included.

Note: Please note that the cmdlet New-PvsStore allows the Provisioning Server store to be created even if the network share or local directory do not exist at that time. This in contrast to the ConfigWizard, which requires the directory to be created beforehand.

For more options, please use the cmdlet help function:

Disable BIOS Boot Menu

Reference: https://www.carlstalhood.com/provisioning-services-server-install/#bootmenu

Prevent being presented a boot menu when booting any version except Production.

• Path: HKLM\Software\Citrix\ProvisioningServices\StreamProcess
• Value name: SkipBootMenu
• Value: 1

This change requires a restart of the Citrix PVS Stream Service, but I recommend to simply restart the server after the many changes that have been made.

The complete PowerShell script at the end of this part includes the creation of this registry value. Detailed logging and error handling are included.

Fix error: No servers available for disk When Booting from vDisk

Reference: https://support.citrix.com/article/CTX200233

Prevent the following error: when configuring a vDisk for private mode, any device booting from that vDisk gets the “No servers available for disk” error.

• Path: HKLM\Software\Citrix\ProvisioningServices\StreamProcess
• Value name: SkipRIMSForPrivate
• Value: 1

This change requires a restart of the Citrix PVS Stream Service, but I recommend to simply restart the server after the many changes that have been made.

The complete PowerShell script at the end of this part includes the creation of this registry value. Detailed logging and error handling are included.

Complete script for configuring Provisioning Server and the local host

In case you use my installation template, this is what the complete script, including logging and error handling, looks like.

Please make sure to customize the variables from line 524 to line 546 to your requirements!

Execute the script as follows, for example:
powershell.exe -file C:\Temp\Citrix\ProvisioningServer\Configure_CitrixProvisioningServer.ps1

In case you get a security warning, set the execution policy to allow the script to run:
powershell.exe -executionpolicy bypass -file C:\Temp\Citrix\ProvisioningServer\Configure_CitrixProvisioningServer.ps1

Log files are created in the directory C:\Logs\Citrix_Provisioning_Server_(configure), but you can change this to any directory you want (see lines 501 and 502).

Conclusion

This concludes this article on the Citrix Provisioning Server unattended installation. You can customize the scripts in this article in any way you see fit.

I strongly recommend to read Carl Stalhood’s very detailed installation procedure for Provisioning Server 7.16: https://www.carlstalhood.com/provisioning-services-server-install/.

If you want to go one step further and create an SCCM package, please follow the step-by-step explanation in the article Deep dive creating SCCM packages for Citrix.

If you have any questions or recommendations please leave a comment below. Happy scripting!