Redirect USB Flash Drives with hardware encryption

[Markus Fumasoli1709152661]

Hi all

 

According the support article https://support.citrix.com/article/CTX123015 Virtuals Apps 1808 should support generic USB redirection for USB Flash Drives with hardware encryption. 

I tried this with an Ironkey from imation. This usb device has an encrypted Partition and cdrom drive with an helper app on it. When I redirect this device to the Virtual Apps Session on a Windows Server 2016, only the encrypted partition is visible in the explorer.

OS is Windows Server 2016 and the september patches from MIcrosoft are installed. Client OS is Windows 10 with Workspace App 1809

 

Did somebody manage to redirect an encrypted usb flashdrive?

 

Thanks

Markus

[Guang Liu]

This feature requires Windows update KB4074590. Have you installed this update or replaced update?

[Markus Fumasoli1709152661]

2 hours ago, Guang Liu said:

This feature requires Windows update KB4074590. Have you installed this update or replaced update?

@Guang Liu

Yes, the cumulative update from september 2018 is installed.

Do I have to set custom USB redirection rules for this device?

[Guang Liu]

You'd better add redirection rules for the specific device

[Markus Fumasoli1709152661]

2 hours ago, Guang Liu said:

You'd better add redirection rules for the specific device

It does also not work with device redirection rules

[Markus Fumasoli1709152661]

@Guang Liu

When I open the Device Manager in the user session, I see the CDRom drive in the list. Here I connected an external USB CDROM and the Encrypted USB Device. Both CDRoms are visible, but no drive letter was assigned?! The drive letter I:\ is the vmware cdrom.

 

 

How can I assign a drive letter to this drives?

 

Regards

Markus

 

 

UPDATE: When I gave the user admin rights on the server, the drive mapping works fine. This is a clean server from ISO with no GPO

[Guang Liu]

Hi mfumaso44,

 A similar issue was under investigation by the escalation team, I will keep you posted. 

 

Could you please help to confirm whether this issue occurs with administrator account

[Mark Howell1709152087]

Hi Markus,

 

I'm the PM for devices here at Citrix and I was able to reproduce the issue in house. I'll speak to the engineer that wrote the code for this feature tomorrow morning and will show him the issue. 

I'll keep you posted through this discussion board, or you can e-mail me directly at mark.howell@citrix.com

 

Thank you,

Mark.

[Markus Fumasoli1709152661]

On 9/29/2018 at 6:11 AM, Guang Liu said:

Hi mfumaso44,

 A similar issue was under investigation by the escalation team, I will keep you posted. 

 

Could you please help to confirm whether this issue occurs with administrator account

This issue not occures with an administrator accoutn

[Jan-Paul Plaisier]

I know this is an old post but I have similar issues with the implementation of IronKey encrypted USB disks in Citrix Virtual Apps 2003. Is this issue ever fixed?

[Danping Wang]

hi all, this is a how to fix FYI. try to contact software or driver vendor then add FILE_FLAG_SESSION_AWARE flag to CreateFile API. 

please also make sure the above microsoft update already installed. 

such issue should be also exist on microsoft REMOTEUSB Redirection solution 

 

below information also FYI. 

https://support.microsoft.com/en-nz/help/3125295/remotefx-usb-redirected-scanner-doesn-t-start-on-windows-server-2012-o

https://techcommunity.microsoft.com/t5/ask-the-performance-team/sessions-desktops-and-windows-stations/ba-p/372473

 

Although RemoteFX USB Redirection for Windows 7 SP1 was implemented for client SKUs with a single session, RemoteFX USB Redirection for Windows Server 2012 R2 supports redirection from multiple clients and provides session isolation for redirected devices. Therefore, users will see only USB devices that belong to them. When USB device redirection is enabled in RDS or MultiPoint, USB devices are assigned to the particular session into which they've been redirected. Only user-mode code that's running in that same session can access these devices.

The default behavior of the I/O Manager is to deny access when a service that's running in session 0 tries to open one of these devices unless the service does this by passing the c. The theory here is that when developers updated their services to use this flag to open devices, they also added new functionality to make sure that their services restricted access to those devices to any other apps from other sessions that might also be using the service (for example, if the service is a COM server).

Session 0 is the base session where services run and is typically also the console session.  In Windows Vista this has been changed to exclusively run services, and the console session is typically Session 1.