The Microsoft Office 2010 Deployment Kit for App-V enables Office 2010 client products to be sequenced and deployed with Microsoft Application Virtualization (App-V).

The Microsoft Office 2010 Deployment Kit for App-V is required for sequencing and deploying Office 2010 client products with Microsoft Application Virtualization (App-V). This kit includes the components required for Office license activation.

This product must be installed on the App-V sequencing station prior to monitoring the Office 2010 client installation.

This product must also be installed on the client machines to which virtualized Office 2010 client packages will be deployed. It can be configured to enable certain system components to interact with virtualized Office 2010, including:

• Fast search in virtualized Outlook 2010 using Windows Desktop Search
• Ability for virtualized Office 2010 applications to open, edit, and save Office files hosted with Windows SharePoint
• Search indexing support for Office file types
• URL protocol redirection to virtualized Outlook 2010
• Print to virtualized OneNote 2010
• Mail control panel applet for virtualized Outlook 2010

For all the details and to download the deployment kit see this link.

Additional Information:

The Office 2010 App-V RTM Recipe is available as a KB article here: http://support.microsoft.com/kb/983462

The Office 2010 App-v Deployment kit is available from the Microsoft Download center at http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=479f12f2-5678-493e-bce1-682b3ece5431

Curious on how to build a Windows 7, Office 2010 and App-V Proof of Concept?  Check out the guidance here: http://technet.microsoft.com/en-us/windows/ff603537.aspx

J.C. Hornbeck | System Center Knowledge Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/05/06/the-microsoft-office-2010-deployment-kit-for-app-v-is-now-available.aspx

Our very own Steve Bucci recently posted this great video that shows you how to collect the logs and information from your App-V environment. With almost any App-V support call we will ask you for this information but knowing where to find these logs will prove invaluable when troubleshooting any issue you might run into.

We also have some additional information on the App-V log files here:

Troubleshooting App-V with log files

KB931803 - Log options for SoftGrid Client 4.x

KB930871 - How to interpret the messages in the SoftGrid Virtual Application Server log

J.C. Hornbeck | System Center Knowledge Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/05/04/how-to-collect-the-log-files-for-microsoft-app-v.aspx

Just a quick heads-up that the Application Virtualization Sequencing SuperFlow has been released. So what’s a SuperFlow? Think flowchart, but cooler and better. The SuperFlow series “is an interactive content model that provides a structured and interactive interface for viewing documentation.” The App-V SuperFlow that we just released visually maps out the sequencing process, and each section provides the relevant documentation, as well as instructions, for that part of the sequencing process. I have an example screenshot below:

The Resources tab has shortcuts to the App-V TechCenter, Documentation, Forums, and this blog. For more details and to download the App-V Sequencing SuperFlow visit the download center here.

Steve Bucci | Senior Support Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/04/29/the-application-virtualization-sequencing-superflow-has-been-released.aspx

We recently uncovered this issue and while we're going to be publishing a Knowledge Base article on it very soon I thought it might be helpful to mention it here as well.

Issue:

Uninstallation of the Microsoft Application Virtualization 4.6 desktop client may fail with no specific error message given.  If you collect a verbose MSI log you may see the following:

SoftGrid Action: IsRuntimePackagePolicyCfgValid Details: NET_DOTIMEOUTMINUTES(#0) is invalid

Also note that you can see this same issue when trying to upgrade a previous version of the App-V client to version 4.6.

Cause:

This is a known issue with the App-V client versions 4.5 and later.

Resolution:

To resolve this issue you will need to modify the registry entry for the Disconnected Operation Timeout in the registry.

1. For x86 clients, open Regedit and navigate to the following location:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Softgrid\4.5\Client\Network\

For 64-bit clients, open Regedit and navigate to the following location:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\SoftGrid\4.5\Client\Network

2. Change the DOTimeoutMinutes value to the default which is 129600 (Decimal) or 1fa40 (Hex).

3. Reboot the client.

Once rebooted, you should now be able to successfully uninstall the App-V client.

Steve Thomas | Senior Support Escalation Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/04/22/resolution-you-may-be-unable-to-uninstall-the-app-v-4-6-desktop-client.aspx

On Windows 7 and Windows Server 2008 R2, there is a great troubleshooting tool called the Problem Steps Recorder (PSR). The PSR allows screenshots and details of actions to be automatically recorded and saved in a .MHT file that is automatically zipped. A user can send this file to Microsoft Support to provide an accurate account of steps to reproduce and issue. There is a short video on TechNet that gives a demonstration of the Problem steps recorder.

We can appropriate this tool and turn it into a Sequencing Steps Recorder to document “recipes” for sequencing applications. Other App-V blog articles have demonstrated how to use video to document sequencing. The Problem Steps Recorder just provides another alternative, especially for those users that like to read from a printout.

The PSR can be easily be found on Windows 7 or Server 2008 just by clicking on the Windows Logo and typing “steps” ,“record”, or “PSR.exe” in the search bar.

In order to use the PSR correctly on your Sequencer, it is important to follow these steps:

1. Connect to your Sequencing Virtual Machine.

2. Click on the Windows Logo (Start button) and type “steps”.

3. Click on “Record steps to reproduce a problem.”

4. Click on the down arrow by the Help icon and choose “Run as Administrator” if it is not grayed out. Some windows may not capture if this is not selected.

5. From the same menu, click on SETTINGS.

6. Change the NUMBER OF RECENT SCREEN CAPTURES TO STORE to the maximum value of 100.

a. If you have more than 100 actions, which is possible, screenshot #1 would be removed in order to capture screenshot #101. The text detail for Step #1 would still remain.

7. Click on START RECORD

a. Recording doesn’t have to start until before “Begin Monitoring” is selected. You may wish to document the procedure start to finish , especially if there are other pre-requisites that need to be installed prior to sequencing.

b. If you Begin Monitoring before launching the PSR, you will pick up the PSR in your sequence and possibly prevent your application from working as expected.

8. Install pre-requisites or launch the Sequencer

9. Complete the sequencing process.

10. Click on STOP RECORD and save the zip file.

When the .ZIP file is extracted, the .MHT file can be double-clicked and viewed inside Internet Explorer. Scroll through the steps, or choose to watch them as a slide show. Each step provides text details of the action taken and clearly defines in the screenshot where the action should be taking place.

The “Additional Details” section at the end of the .MHT file provides a text only version of all the steps taken as well as specific version information. This information can be especially helpful in a Technical Support situation. Here are the details from the same step as above:

Problem Step 17: User left click on "Begin Monitoring (push button)" in "Sequencing Wizard: Step 3 of 7"

Program: Microsoft Application Virtualization Sequencer, 4.5.2.17140, Microsoft Corporation, SFTSEQUENCER.EXE, SFTSEQUENCER.EXE

UI Elements: Begin Monitoring, Begin &Monitoring, Button, Sequencing Wizard: Step 3 of 7, #32770, Sequencing Wizard: Step 3 of 7, #32770

The Problem Steps Recorder does have a few limitations, but the ability to capture easy to follow, easy to distribute, and explicit documentation makes it a very valuable tool. The limitations include: 100 screenshot maximum, inability to capture detail inside a VM when PSR is run outside the VM, it captures your mistakes as well.

Steve Bucci – Senior App-V Support Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/04/12/document-sequencing-on-windows-7-with-the-problem-sequencing-steps-recorder.aspx

Below is a clarification of our support statement regarding applications virtualized with a 3rd party sequencer used in conjunction with Microsoft Application Virtualization (App-V):

Microsoft Application Virtualization allows for the usage of applications sequenced by 3rd party sequencing products in App-V environments and Microsoft will provide support for App-V environments that contain these application packages related to all App-V client and server operational issues with the following exceptions:

•   Microsoft's App-V Support team will ask you to contact the 3rd party application vendor for support relating to issues with the actual sequencing process of an application with the 3rd party product.

•   Microsoft's App-V Support team will not support issues relating to how an application behaves inside the virtualized environment when sequenced using a 3rd party product. Microsoft App-V Support team refers to this issue as a virtualization or an "application not functioning as expected" issue. When these specific issues arise, we will require either cross-collaborative engagement with the sequencing vendor or that the virtualization issue be reproduced with the actual App-V sequencer.  This may require that the customer re-sequence the application using the Microsoft App-V sequencer. It is important to understand that this would be viewed as a troubleshooting step and not necessarily a solution, however further engagement with the 3rd-party sequencing vendor would be needed for collaborative purposes and to further troubleshoot the issue.

For more information on support for 3rd party applications virtualized with Microsoft App-V see the following Knowledge Base article:

 KB940729 - Description of the support policy for Microsoft programs that are running in a Microsoft SoftGrid Application Virtualization environment

Hope this helps!

Steve Thomas | Senior Support Escalation Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/04/08/support-for-applications-virtualized-with-a-3rd-party-sequencer-in-a-microsoft-application-virtualization-app-v-environment.aspx

We are aware that many of our App-V/SoftGrid users that are in the process of migration will follow our advice and upgrade the clients first before upgrading the management servers, and we're also aware that scheduling and testing with multi-server environments will require extended periods of time where 4.5 or 4.6 clients will be used in conjunction with 4.1 servers.

You may, however, encounter some problems during these migrations if you are using App-V Clients and App-V/SoftGrid servers in an environment where the network infrastructure employs firewalls, routers, VPN concentrators, or any network device using security software that employs RTSP stateful inspection.

These problems occur when trying to authenticate over RTSP during desktop configuration refresh as well as when streaming an application over RTSP.

Examples of some of these issues include:

1.) “Network Operation did not Complete in Time” errors:

You may see these errors on SoftGrid 4.2 and 4.1 as well as App-V 4.5 when communicating to a 4.1 server.

An example of this kind of error is when on a server refresh or during an RTSP stream you receive the following error:

A network operation did not complete in time. Check your network connection, and then try again. If the problem persists, report the following error code to your System Administrator.

Error code: xxxxxx-xxxxxx0A-10000005

2.) “The Server will not Allow a Connection Without Valid NTLM Credentials” errors:

You may get this with local domain accounts as well as if using another trusted domain account.

An example of this kind of error is when on a server refresh or during an RTSP stream you receive the following error:

The server will not allow a connection without valid NTLM credentials Please report the following error code to your System Administrator.

Error code: xxxxxx-xxxxxx 0A-00002002

3.) “The publishing Server returned invalid data in response to the Client's request.”

The publishing Server returned invalid data in response to the Client's request. Report the following error code to your System Administrator.

Error Code 45242F4-24E00B04-00000910"

You will also see potential problems with RTSP exclusive to the use of FQDNs (Fully Qualified Domain Names) with using 4.5 and later clients with pre 4.5 servers (SoftGrid Virtual Application Servers.)

Errors may go back and forth between the above examples as well.

Causes

This ties into the relegation of authentication down levels to achieve legacy compatibility. We have seen that this inspection can modify the authentication information post SSPI negotiation and that this can possibly be interpreted as a false positive for an RTSP exploit. In other words, the RTSP authentication the server receives is not what the client sent (e.g. it's truncated).

Resolutions and Workarounds

1.) Complete the server upgrade to App-V version 4.5 or later: App-V 4.5 clients and servers negotiate Kerberos/SSPI and do not exhibit the issue when working with the ASA Software. This requires a DB upgrade.

2.) Disable RTSP inspection on the network device: This would only need to be in place until the server-side upgrade to App-V 4.5 is complete.

3.) Leverage a separate protocol (RTSPS/HTTP/HTTPS:) This would require reconfiguration on both client and server side.

4.) Leverage different virtual application delivery methods: Use of SCCM R2 integration or stand-alone deployment removes desired features only offered through the server solution (e.e. licensing control, active upgrade, etc).

The quickest workaround is #2: Disabling RTSP inspection. Depending on the type of network device being used this will vary as to the approach and may violate your corporate security policy.

The majority of issues relating to this coming into the App-V support team are from our users working with the various devices employing the Cisco adaptive security appliance (ASA) software or the various firewall internetworking operating systems (PIX, etc.)

In one recent example, the final resolution was to remove the RTSP inspection from the default inspection map within the global_policy map.  This was done as follows:

ASA# conf t
ASA(config)# policy-map global_policy
ASA(config-pmap)# class inspection_default
ASA(config-pmap)# no inspect rtsp

The above example was on a device using Cisco Adaptive Security Appliance Software Version 8.2(1) and Device Manager Version 6.2(1)

More Information

In the mid 1990’s, the standards for a new streaming protocol that we now know as the Real Time Streaming Protocol (RTSP), were submitted to the IETF. It was originally designed as a media delivery protocol to transmit real-time, streaming media to client media software such as RealPlayer, QuickTime, and others.  Since the media leverages XML and other forms of metadata, it can also be leveraged for exploitations and for potential man in the middle attacks. Most RTSP inspection software operates by examining the session setups and authentication to apply normal stateful inspection to stop any malicious behavior.

Steve Thomas | Senior Support Escalation Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/03/24/network-devices-that-use-rtsp-inspection-may-cause-problems-in-specific-app-v-scenarios.aspx

As you can see in the Whitepaper for the App-V Integration in SCCM, it’s not possible to configure SCCM 2007 for user based targeting on Terminal Servers (RDS).

As a workaround to this, some customers have written logon scripts or used third party apps like Citrix or AppSense that run multiple SFTMIME instances at user logon to publish the application.  While this appears to work at first, from time to time some applications may eventually fail because the OverrideURL value under the Packages key in the Registry that is used by Configuration Manager 2007 will be deleted. From that point on no user on that Terminal Server will be to use the app anymore.  Instead, the following error will be logged:

The specified command line is incorrect.
The specified package does not exist. Report the following error code to your System Administrator.
Error code: 4514197-18303E04-00001804

What is that reason?

As soon a user logs on and starts SFTMIME.EXE PUBLISH PACKAGE via a logon script or from a third party application, we try to publish the app and read a specific global Registry Key on the Terminal Server. If a second user logs on at the same time and gets the same package then both of the SFTMIME.EXE processes call the SFTLIST service so now you have two threads trying to access the same registry key at the same time.  What happens is that one of the threads will get a result of INVALID, and if the key is missing or INVALID then it will be deleted.

This behavior has been known since Windows NT 4.0:  http://support.microsoft.com/kb/176906

Why didn’t we notice this earlier?

Frankly we didn't notice this earlier because the method above is not a tested and supported way of publishing an application using App-V.  Only after a few folks implemented the workaround above and ran into a problem did we become aware of it.

With that said, a fix for this is scheduled to be in the next Hotfix rollup release for App-V Service Pack 1. Does that guarantee it will be?  Absolutely not, since we won't know what's in the final package until it goes out the door but so far that's the plan.

Kind regards,

Sebastian Gernert | App-V Support Escalation Engineer

Read more at: http://blogs.technet.com/appv/archive/2010/03/23/app-v-configuration-manager-2007-and-user-based-targeting-of-applications.aspx

As you can see in the Whitepaper for the App-V Integration in SCCM, it’s not possible to configure SCCM 2007 for user based targeting on Terminal Servers (RDS).

As a workaround to this, some customers have written logon scripts or used third party apps like Citrix or AppSense that run multiple SFTMIME instances at user logon to publish the application.  While this appears to work at first, from time to time some applications may eventually fail because the OverrideURL value under the Packages key in the Registry that is used by Configuration Manager 2007 will be deleted. From that point on no user on that Terminal Server will be to use the app anymore.  Instead, the following error will be logged:

The specified command line is incorrect.
The specified package does not exist. Report the following error code to your System Administrator.
Error code: 4514197-18303E04-00001804

What is that reason?

As soon a user logs on and starts SFTMIME.EXE PUBLISH PACKAGE via a logon script or from a third party application, we try to publish the app and read a specific global Registry Key on the Terminal Server. If a second user logs on at the same time and gets the same package then both of the SFTMIME.EXE processes call the SFTLIST service so now you have two threads trying to access the same registry key at the same time.  What happens is that one of the threads will get a result of INVALID, and if the key is missing or INVALID then it will be deleted.

This behavior has been known since Windows NT 4.0:  http://support.microsoft.com/kb/176906

Why didn’t we notice this earlier?

Frankly we didn't notice this earlier because the method above is not a tested and supported way of publishing an application using App-V.  Only after a few folks implemented the workaround above and ran into a problem did we become aware of it.

With that said, a fix for this is scheduled to be in the next Hotfix rollup release for App-V Service Pack 1. Does that guarantee it will be?  Absolutely not, since we won't know what's in the final package until it goes out the door but so far that's the plan.

Kind regards,

Sebastian Gernert | App-V Support Escalation Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/03/23/app-v-configuration-manager-2007-and-user-based-targeting-of-applications.aspx

Consider the following scenario:

• You enable streaming for virtual application packages on a Microsoft System Center Configuration Manager 2007 R2-based computer.
• You are granted the following permissions for the Package class:
  • Read
  • Distribute
  • Delegate
  • Create
  • Manage Folders
• You open the System Center Configuration Manager console.
• You try to create a virtual application package at the following location:

  Computer Management\Software Distribution\Packages

User <user> does not have sufficient rights

ErrorCode = 1112017920

If you're using Configuration Manager with your Microsoft Application Virtualization (App-V) packages then you can download the hotfix for this from our new Knowledge Base article below:

KB978755 - Error message when you try to create a virtual application package in System Center Configuration Manager 2007 R2: "User does not have sufficient rights"

J.C. Hornbeck | System Center Knowledge Engineer

Read more at: http://blogs.technet.com/appv/archive/2010/03/10/new-hotfix-error-message-when-you-try-to-create-a-virtual-application-package-in-configmgr-2007-r2-user-does-not-have-sufficient-rights.aspx

Consider the following scenario:

• You enable streaming for virtual application packages on a Microsoft System Center Configuration Manager 2007 R2-based computer.
• You are granted the following permissions for the Package class:
  • Read
  • Distribute
  • Delegate
  • Create
  • Manage Folders
• You open the System Center Configuration Manager console.
• You try to create a virtual application package at the following location:

  Computer Management\Software Distribution\Packages

User <user> does not have sufficient rights

ErrorCode = 1112017920

If you're using Configuration Manager with your Microsoft Application Virtualization (App-V) packages then you can download the hotfix for this from our new Knowledge Base article below:

KB978755 - Error message when you try to create a virtual application package in System Center Configuration Manager 2007 R2: "User does not have sufficient rights"

J.C. Hornbeck | System Center Knowledge Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/03/10/new-hotfix-error-message-when-you-try-to-create-a-virtual-application-package-in-configmgr-2007-r2-user-does-not-have-sufficient-rights.aspx

The following are some of the common problems customers may run into when using RTSPS. These are based on specific errors and their likely causes. Please bear in mind that some of these errors may occur under other contexts so understand that the context here is strictly related to RTSP.

Common RTSPS Problem #1:

Users receive the following error on publishing refresh or when trying to stream an application via RTSP:

"The specified Application Virtualization Server has shut down the connection. Try again in a few minutes. If the problem persists, report the following error code to your System Administrator."

"Error Code: xxxxxx-xxxxxx0A-10000009"

This error can occur when one or more of the following conditions are true:

1.) Network Service Account (the account used to authenticate the App-V Server Service does not have access to path to the machine keys:

Location for Windows 2008/R2:

%ALLUSERSPROFILE%\Microsoft\Crypto\RSA\MachineKeys

Location for Windows Server 2003:

%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys

2.) The Certificate Store lacks the necessary permissions for the NETWORK SERVICE account. When this occurs there will also be an accompanying event in the Application Event Log:

Source: Application Virtualization
Event ID: 44955
Description: Certificate could not be loaded. Error code (-2146893043) Make sure the Network Service account has proper access to the certificate and its corresponding private key file.

When this occurs in Windows Server 2003 as the underlying operating system, you will need to modify the actual certificate store permissions using the WinHttpCertCfg command.

Additional information on using the WinHttpCertCfg.exe tools is available at the link below:

http://msdn.microsoft.com/en-us/library/aa384088(VS.85).aspx

The syntax you will need to use is:

winhttpcertcfg -g -c LOCAL_MACHINE\My -s Name_of_cert -a NetworkService

You can then verify that the security context was properly added by listing the permissions on the certificate using this syntax:

winhttpcertcfg -l -c LOCAL_MACHINE\My -s Name_of_cert

Windows Server 2008 makes the process of changing the ACLs on the private key much easier.  The certificates MMC Snap-in can be used to manage private key permissions. To do so, follow these steps:

1. Create an MMC with the Certificates snap-in that targets the Local Machine certificate store.

2. Expand the MMC down to the certificate you need as shown in the image below and select Manage Private Keys.

3. Use the Security tab to add the Network Service account with Read access.  These instructions are also available in the Security Operations Guide at the following link:

http://technet.microsoft.com/en-us/appvirtualization/cc843994.aspx

http://download.microsoft.com/download/f/7/8/f784a197-73be-48ff-83da-4102c05a6d44/AppV_Secuirty_Operations_Guide.docx

Common RTSPS Problem #2:

Users receive the following error on publishing refresh or when trying to stream an application via RTSP:

"No connection could be made because the target machine actively refused it."

"Error code xxxxxx-xxxxxx2A-0000274D"

This error can happen during publishing/refresh or during streaming. It usually occurs when one or more of the following conditions are true:

• Potential issue with firewall on the server running the App-V Management server or streaming server. Either create and inbound rule that allows RTSPS Port 322 or an inbound rule that allows for the application/service sghwdsptr.exe (for the dispatcher) and sghwsvr.exe (for the core.)
• Listener Port Configuration for server is configured incorrectly or the port is specified incorrectly in the OSD file.

Assuming your configuration is the default in 4.5 and later for RTSPS, watch for the following common URL errors:

a. <CODEBASE HREF="RTSP://APPVSRV:554/off2010RC1_mnt/off2010RC1_mnt.sft"

- Wrong Protocol

b. <CODEBASE HREF="RTSPS://APPVSRV:332/off2010RC1_mnt/off2010RC1_mnt.sft"

- Wrong Port (RTSPS default port changed with 4.5)

c. <CODEBASE HREF="RTSPS://APPVSRV:554/off2010RC1_mnt/off2010RC1_mnt.sft"

- Wrong Port (forgot to change port after changing protocol)

Common RTSPS Problem #3:

Users receive the following error on publishing refresh or when trying to stream an application via RTSP:

"The certificate chain was issued by an authority that is not trusted."
"Error code: xxxxxx-xxxxxx2A-80090325"

This error occurs when the cert being used on the App-V server either is not issued by a trusted authority, or if it is self-signed certificate, it has not been imported into the trusted root folder of the server's certificate store.

Viewing the certificate from within the Certificates MMC-Snap-in (for local computer) will show the certificate with a red X denoting that it is not trusted.

Self-signed certificates can be trusted by installing the certificate in the Trusted Root Certification Authorities Store. If you are using an online CA, you will need to collect certain data and verify the certificate before doing further PKI troubleshooting.

Load the Certificates MMC snap-in focused on the local computer. This requires Administrator credentials.

1.) Click Start, then Run, type mmc.exe, and press Enter.

2.) Click the File Menu and select Add/Remove Snap-in.

3.) Click the Add button. Select Certificates from the list of snap-ins, and click Add.

4.) Select Computer Account, and click Next.

5.) Select Local Computer, and click Finish.

6.) Click Close, and then click Ok.

7.) Expand Certificates (Local Computer).

8.) Expand the Personal folder, and select Certificates.

9.) Export the certificate. In the list of certificates, select the one you want to export.

10.) Right-click and select All Tasks and then Export…

11.) This will start the Certificate Export Wizard. Click Next.

12.) Select No, do not export the private key. Click Next.

13.) Select DER encoded binary X.509 (.cer) and click Next.

14.) Enter the location and file name for the file, and click Next. I usually use appvcert.cer

15.) Click Finish. Click Ok.

After you are finished exporting the .CER file, you can then run the following command against it to verify the certificate:

certutil -urlfetch -verify appvcert.cer >appvcert.txt

As you can see, I have redirected the output to this command to a file. To quickly search for status errors, use the findstr command to list the error status for each certificate in the chain.

Common items you may want to search for include:

• 0x800b0109
• 0x80092013
• 0x80072ee7
• UNTRUSTED
• failed
• terminated
• Expired

To determine if the certificate is published in Active Directory run the following command:

certutil -store "ldap:///CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=ForestRootDomain?cACertificate?one?objectClass=certificationAuthority" SerialNumber

The serial number can be found by double-clicking the exported *.CER file and clicking on the "Details" tab.

Common RTSPS Problem #4:

Users receive the following error on publishing refresh or when trying to stream an application via RTSP:

"The target principal name is incorrect."
"Error code: xxxxxx-xxxxxx2A-80090322"

This is usually caused by the path to the server in the OSD mismatching the name specified for the certificate. It can also occur if the name specified for the publishing server via (RTSPS) does not match the name of the same machine specified in the OSD.  For example: Name specified for the certificate is the FQDN but the OSD only references the NETBIOS name.

Common RTSPS Problem #5: Poor Streaming Performance

This was first addressed in Hotfix Package 5 for Microsoft Application Virtualization 4.5 Cumulative Update 1: August 2009 http://support.microsoft.com/?kbid=973873. It has also been included in Service Pack one for App-V 4.5.

Common RTSPS Problem #6

When using RTSPS and a 3rd party Certificate Authority some clients may receive the following error message during a refresh after a user login:

The revocation function was unable to check revocation because the revocation server was offline.
Error code: 450260-24C02F2A-80092013

Please see this blog post for the resolution:

http://blogs.technet.com/appv/archive/2008/09/18/softgrid-app-v-client-receives-an-xxxxxx-xxxxxx2a-80092013-error-during-refresh.aspx

General Tips on using self-signed certificates:

The use of certificates is much more streamlined for App-V version 4.5 and above. When constructing a certificate for use with RTSPS, you can leverage a web server template and share the certificate with an IIS service (especially if you are securing web management service access.)

If bypassing Internal CA's or 3rd-party certificates, you can make use of self-signed certificates. If your App-V Server is residing on a Windows 2003 Server, you can use the SelfSSL tool from the IIS Resource Kit Utility. SelfSSL (SelfSSL.exe) can help you generate and install a self-signed SSL certificate.

Information about the IIS Resource Kit can be found here:  http://support.microsoft.com/kb/840671

The IIS 6.0 Resource Kit can be found here:  http://www.microsoft.com/downloads/details.aspx?FamilyID=56fc92ee-a71a-4c73-b628-ade629c89499

Here are some syntax hints as well:

selfssl.exe /N:CN=app-v-ms /K:1024 /V:7 /S:1 /P:443

- Creates, Installs, and Binds the Certificate.

selfssl.exe /T

- Adds the certificate into the Trusted Root Store

You can then verify the certificate using the Certificates MMC Snap-in or CERTUTIL.EXE

Ensure the certificate you generate is for Server Authentication (or both Server and Client Auth.) Pay close attention to Name and Friendly Names

Windows Server 2008 has a built-in feature inside of the IIS Manager for creating self-signed certificates.

1.) Open IIS Manager and navigate to the server node (identified by your server name.)

2.) In Features view, double-click Server Certificates.

3.) In the Actions pane, click Create Self-Signed Certificate.

4.) On the Create Self-Signed Certificate page, type a friendly name for the certificate in the Specify a friendly name for the certificate box, and then click OK.

Hope this helps,

Steve Thomas | Senior Support Escalation Engineer

Read more at: http://blogs.technet.com/appv/archive/2010/03/09/troubleshooting-common-rtsps-issues-with-app-v.aspx

The following are some of the common problems customers may run into when using RTSPS. These are based on specific errors and their likely causes. Please bear in mind that some of these errors may occur under other contexts so understand that the context here is strictly related to RTSP.

Common RTSPS Problem #1:

Users receive the following error on publishing refresh or when trying to stream an application via RTSP:

"The specified Application Virtualization Server has shut down the connection. Try again in a few minutes. If the problem persists, report the following error code to your System Administrator."

"Error Code: xxxxxx-xxxxxx0A-10000009"

This error can occur when one or more of the following conditions are true:

1.) Network Service Account (the account used to authenticate the App-V Server Service does not have access to path to the machine keys:

Location for Windows 2008/R2:

%ALLUSERSPROFILE%\Microsoft\Crypto\RSA\MachineKeys

Location for Windows Server 2003:

%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys

2.) The Certificate Store lacks the necessary permissions for the NETWORK SERVICE account. When this occurs there will also be an accompanying event in the Application Event Log:

Source: Application Virtualization
Event ID: 44955
Description: Certificate could not be loaded. Error code (-2146893043) Make sure the Network Service account has proper access to the certificate and its corresponding private key file.

When this occurs in Windows Server 2003 as the underlying operating system, you will need to modify the actual certificate store permissions using the WinHttpCertCfg command.

Additional information on using the WinHttpCertCfg.exe tools is available at the link below:

http://msdn.microsoft.com/en-us/library/aa384088(VS.85).aspx

The syntax you will need to use is:

winhttpcertcfg -g -c LOCAL_MACHINE\My -s Name_of_cert -a NetworkService

You can then verify that the security context was properly added by listing the permissions on the certificate using this syntax:

winhttpcertcfg -l -c LOCAL_MACHINE\My -s Name_of_cert

Windows Server 2008 makes the process of changing the ACLs on the private key much easier.  The certificates MMC Snap-in can be used to manage private key permissions. To do so, follow these steps:

1. Create an MMC with the Certificates snap-in that targets the Local Machine certificate store.

2. Expand the MMC down to the certificate you need as shown in the image below and select Manage Private Keys.

3. Use the Security tab to add the Network Service account with Read access.  These instructions are also available in the Security Operations Guide at the following link:

http://technet.microsoft.com/en-us/appvirtualization/cc843994.aspx

http://download.microsoft.com/download/f/7/8/f784a197-73be-48ff-83da-4102c05a6d44/AppV_Secuirty_Operations_Guide.docx

Common RTSPS Problem #2:

Users receive the following error on publishing refresh or when trying to stream an application via RTSP:

"No connection could be made because the target machine actively refused it."

"Error code xxxxxx-xxxxxx2A-0000274D"

This error can happen during publishing/refresh or during streaming. It usually occurs when one or more of the following conditions are true:

• Potential issue with firewall on the server running the App-V Management server or streaming server. Either create and inbound rule that allows RTSPS Port 322 or an inbound rule that allows for the application/service sghwdsptr.exe (for the dispatcher) and sghwsvr.exe (for the core.)
• Listener Port Configuration for server is configured incorrectly or the port is specified incorrectly in the OSD file.

Assuming your configuration is the default in 4.5 and later for RTSPS, watch for the following common URL errors:

a. <CODEBASE HREF="RTSP://APPVSRV:554/off2010RC1_mnt/off2010RC1_mnt.sft"

- Wrong Protocol

b. <CODEBASE HREF="RTSPS://APPVSRV:332/off2010RC1_mnt/off2010RC1_mnt.sft"

- Wrong Port (RTSPS default port changed with 4.5)

c. <CODEBASE HREF="RTSPS://APPVSRV:554/off2010RC1_mnt/off2010RC1_mnt.sft"

- Wrong Port (forgot to change port after changing protocol)

Common RTSPS Problem #3:

Users receive the following error on publishing refresh or when trying to stream an application via RTSP:

"The certificate chain was issued by an authority that is not trusted."
"Error code: xxxxxx-xxxxxx2A-80090325"

This error occurs when the cert being used on the App-V server either is not issued by a trusted authority, or if it is self-signed certificate, it has not been imported into the trusted root folder of the server's certificate store.

Viewing the certificate from within the Certificates MMC-Snap-in (for local computer) will show the certificate with a red X denoting that it is not trusted.

Self-signed certificates can be trusted by installing the certificate in the Trusted Root Certification Authorities Store. If you are using an online CA, you will need to collect certain data and verify the certificate before doing further PKI troubleshooting.

Load the Certificates MMC snap-in focused on the local computer. This requires Administrator credentials.

1.) Click Start, then Run, type mmc.exe, and press Enter.

2.) Click the File Menu and select Add/Remove Snap-in.

3.) Click the Add button. Select Certificates from the list of snap-ins, and click Add.

4.) Select Computer Account, and click Next.

5.) Select Local Computer, and click Finish.

6.) Click Close, and then click Ok.

7.) Expand Certificates (Local Computer).

8.) Expand the Personal folder, and select Certificates.

9.) Export the certificate. In the list of certificates, select the one you want to export.

10.) Right-click and select All Tasks and then Export…

11.) This will start the Certificate Export Wizard. Click Next.

12.) Select No, do not export the private key. Click Next.

13.) Select DER encoded binary X.509 (.cer) and click Next.

14.) Enter the location and file name for the file, and click Next. I usually use appvcert.cer

15.) Click Finish. Click Ok.

After you are finished exporting the .CER file, you can then run the following command against it to verify the certificate:

certutil -urlfetch -verify appvcert.cer >appvcert.txt

As you can see, I have redirected the output to this command to a file. To quickly search for status errors, use the findstr command to list the error status for each certificate in the chain.

Common items you may want to search for include:

• 0x800b0109
• 0x80092013
• 0x80072ee7
• UNTRUSTED
• failed
• terminated
• Expired

To determine if the certificate is published in Active Directory run the following command:

certutil -store "ldap:///CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=ForestRootDomain?cACertificate?one?objectClass=certificationAuthority" SerialNumber

The serial number can be found by double-clicking the exported *.CER file and clicking on the "Details" tab.

Common RTSPS Problem #4:

Users receive the following error on publishing refresh or when trying to stream an application via RTSP:

"The target principal name is incorrect."
"Error code: xxxxxx-xxxxxx2A-80090322"

This is usually caused by the path to the server in the OSD mismatching the name specified for the certificate. It can also occur if the name specified for the publishing server via (RTSPS) does not match the name of the same machine specified in the OSD.  For example: Name specified for the certificate is the FQDN but the OSD only references the NETBIOS name.

Common RTSPS Problem #5: Poor Streaming Performance

This was first addressed in Hotfix Package 5 for Microsoft Application Virtualization 4.5 Cumulative Update 1: August 2009 http://support.microsoft.com/?kbid=973873. It has also been included in Service Pack one for App-V 4.5.

Common RTSPS Problem #6

When using RTSPS and a 3rd party Certificate Authority some clients may receive the following error message during a refresh after a user login:

The revocation function was unable to check revocation because the revocation server was offline.
Error code: 450260-24C02F2A-80092013

Please see this blog post for the resolution:

http://blogs.technet.com/appv/archive/2008/09/18/softgrid-app-v-client-receives-an-xxxxxx-xxxxxx2a-80092013-error-during-refresh.aspx

General Tips on using self-signed certificates:

The use of certificates is much more streamlined for App-V version 4.5 and above. When constructing a certificate for use with RTSPS, you can leverage a web server template and share the certificate with an IIS service (especially if you are securing web management service access.)

If bypassing Internal CA's or 3rd-party certificates, you can make use of self-signed certificates. If your App-V Server is residing on a Windows 2003 Server, you can use the SelfSSL tool from the IIS Resource Kit Utility. SelfSSL (SelfSSL.exe) can help you generate and install a self-signed SSL certificate.

Information about the IIS Resource Kit can be found here:  http://support.microsoft.com/kb/840671

The IIS 6.0 Resource Kit can be found here:  http://www.microsoft.com/downloads/details.aspx?FamilyID=56fc92ee-a71a-4c73-b628-ade629c89499

Here are some syntax hints as well:

selfssl.exe /N:CN=app-v-ms /K:1024 /V:7 /S:1 /P:443

- Creates, Installs, and Binds the Certificate.

selfssl.exe /T

- Adds the certificate into the Trusted Root Store

You can then verify the certificate using the Certificates MMC Snap-in or CERTUTIL.EXE

Ensure the certificate you generate is for Server Authentication (or both Server and Client Auth.) Pay close attention to Name and Friendly Names

Windows Server 2008 has a built-in feature inside of the IIS Manager for creating self-signed certificates.

1.) Open IIS Manager and navigate to the server node (identified by your server name.)

2.) In Features view, double-click Server Certificates.

3.) In the Actions pane, click Create Self-Signed Certificate.

4.) On the Create Self-Signed Certificate page, type a friendly name for the certificate in the Specify a friendly name for the certificate box, and then click OK.

Hope this helps,

Steve Thomas | Senior Support Escalation Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/03/09/troubleshooting-common-rtsps-issues-with-app-v.aspx

We recently noted some of the changes to support for ConfigMgr 2007 over on our support team blog but I wanted to also mention one big App-V 4.6 related change here:

Microsoft Application Virtualization 4.6 is now supported on ConfigMgr 2007 R2 with ConfigMgr 2007 SP2

System Center Configuration Manager 2007 R2 with System Center Configuration Manager 2007 SP2 now supports Microsoft Application Virtualization 4.6 Desktop Client and Client for Remote Desktop Services. This client release enables support for Windows 7 and Windows Server 2008 R2 and support for 64-bit operating systems. 

No software updates are required.

If you're curious about what happens if you're not running Service Pack 2 and you upgrade the App-V client to v4.6, the following error is logged in the VirtualApp.log file when trying to register an App-V package with Configuration Manager:

The installed AppVirtMgmt version [4.6] cannot be used with this version of SCCM

It was also reported that you may also get this error in the execmgr.log file:

CVirtualAppExecution::ExecuteProgram - The virtual application package was not registered because the SoftGrid client is not installed

Enjoy!

J.C. Hornbeck | System Center Knowledge Engineer

Read more at: http://blogs.technet.com/appv/archive/2010/03/08/an-update-regarding-app-v-4-6-support-in-system-center-configuration-manager-2007.aspx

We recently noted some of the changes to support for ConfigMgr 2007 over on our support team blog but I wanted to also mention one big App-V 4.6 related change here:

Microsoft Application Virtualization 4.6 is now supported on ConfigMgr 2007 R2 with ConfigMgr 2007 SP2

System Center Configuration Manager 2007 R2 with System Center Configuration Manager 2007 SP2 now supports Microsoft Application Virtualization 4.6 Desktop Client and Client for Remote Desktop Services. This client release enables support for Windows 7 and Windows Server 2008 R2 and support for 64-bit operating systems. 

No software updates are required.

If you're curious about what happens if you're not running Service Pack 2 and you upgrade the App-V client to v4.6, the following error is logged in the VirtualApp.log file when trying to register an App-V package with Configuration Manager:

The installed AppVirtMgmt version [4.6] cannot be used with this version of SCCM

It was also reported that you may also get this error in the execmgr.log file:

CVirtualAppExecution::ExecuteProgram - The virtual application package was not registered because the SoftGrid client is not installed

Enjoy!

J.C. Hornbeck | System Center Knowledge Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/03/08/an-update-regarding-app-v-4-6-support-in-system-center-configuration-manager-2007.aspx

Just a quick heads up that we recently published our prescriptive guidance (aka recipe) for sequencing the Microsoft Office 2010 beta using Microsoft Application Virtualization 4.6.   Please note that:

This article describes one method that you can use to successfully sequence the Beta version of the 2010 Microsoft Office system for use with Microsoft Application Virtualization (App-V) 4.6. The method that is described in this article is not the only method that is available. You may have to change the information in the article as appropriate for your particular environment. 

This process should work on the final version of Office 2010 but of course until it's released we can't make any guarantees.  We'll update the article with any changes (if needed) once it ships.

KB980861 - Prescriptive guidance for sequencing the Beta version of the 2010 Office system in Microsoft App-V

Enjoy!

J.C. Hornbeck | System Center Knowledge Engineer

Read more at: http://blogs.technet.com/appv/archive/2010/03/03/new-kb-prescriptive-guidance-for-sequencing-the-beta-version-of-the-2010-office-system-in-microsoft-app-v.aspx

Just a quick heads up that we recently published our prescriptive guidance (aka recipe) for sequencing the Microsoft Office 2010 beta using Microsoft Application Virtualization 4.6.   Please note that:

This article describes one method that you can use to successfully sequence the Beta version of the 2010 Microsoft Office system for use with Microsoft Application Virtualization (App-V) 4.6. The method that is described in this article is not the only method that is available. You may have to change the information in the article as appropriate for your particular environment. 

This process should work on the final version of Office 2010 but of course until it's released we can't make any guarantees.  We'll update the article with any changes (if needed) once it ships.

KB980861 - Prescriptive guidance for sequencing the Beta version of the 2010 Office system in Microsoft App-V

Enjoy!

J.C. Hornbeck | System Center Knowledge Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/03/03/new-kb-prescriptive-guidance-for-sequencing-the-beta-version-of-the-2010-office-system-in-microsoft-app-v.aspx

Here's an issue we see every once in a while and since I didn't see the details published anywhere I thought I'd go ahead and do that here.

Consider the following scenario:

1.  You install the App-v 4.x server and set the packageroot (content directory) to an alternate location (not the default).
2.  You delete the included Default Application, package and content from the disk.
3.  You upgrade the server to a newer version of App-V.

After completing the steps above, when clients attempt to stream a virtualized application they receive one of the following errors:

A network error occurred error :  XXXXXXXX-XXXXXXXX-20000194

or

A network error occurred error :  XXXXXXXX-XXXXXXXX-10000003

Cause:

This is caused by an invalid value for SOFTGRID_CONTENT_DIR in the registry.

Resolution:

To resolve this issue, complete the following steps:

1.  Start RegEdit

2.  Navigate to the following key:

HKLM\Software\Microsoft\Softgrid\4.5\Server

3. Set the SOFTGRID_CONTENT_DIR value to the proper content directory location.

4.  Restart the server.

More Information:

During the server upgrade, the installer first searches for the defaultapp.sft file location. After getting the defaultapp.sft file path, the installer then gets the content directory path from the SOFTGRID_CONTENT_DIR registry key. If the defaultapp.sft file path is not the same as SOFTGRID_CONTENT_DIR registry entry, the installer overrides the value of SOFTGRID_CONTENT_DIR. If there is no defaultapp.sft file (i.e. it has been deleted), the installer overrides the value of SOFTGRID_CONTENT_DIR anyway with the default installation content directory (PROGRAM_FILES\Microsoft System Center App Virt Management Server\App Virt Management Server\Content).

This is an issue we're aware of and it should be fixed in the next version of the server, but if you run into this in the mean time this is how you can fix it.

J.C. Hornbeck | System Center Knowledge Engineer

Read more at: http://blogs.technet.com/appv/archive/2010/03/02/after-upgrading-a-microsoft-app-v-server-client-machines-may-receive-00000194-errors-when-trying-to-launch-applications.aspx

Here's an issue we see every once in a while and since I didn't see the details published anywhere I thought I'd go ahead and do that here.

Consider the following scenario:

1.  You install the App-v 4.x server and set the packageroot (content directory) to an alternate location (not the default).
2.  You delete the included Default Application, package and content from the disk.
3.  You upgrade the server to a newer version of App-V.

After completing the steps above, when clients attempt to stream a virtualized application they receive one of the following errors:

A network error occurred error :  XXXXXXXX-XXXXXXXX-20000194

or

A network error occurred error :  XXXXXXXX-XXXXXXXX-10000003

Cause:

This is caused by an invalid value for SOFTGRID_CONTENT_DIR in the registry.

Resolution:

To resolve this issue, complete the following steps:

1.  Start RegEdit

2.  Navigate to the following key:

HKLM\Software\Microsoft\Softgrid\4.5\Server

3. Set the SOFTGRID_CONTENT_DIR value to the proper content directory location.

4.  Restart the server.

More Information:

During the server upgrade, the installer first searches for the defaultapp.sft file location. After getting the defaultapp.sft file path, the installer then gets the content directory path from the SOFTGRID_CONTENT_DIR registry key. If the defaultapp.sft file path is not the same as SOFTGRID_CONTENT_DIR registry entry, the installer overrides the value of SOFTGRID_CONTENT_DIR. If there is no defaultapp.sft file (i.e. it has been deleted), the installer overrides the value of SOFTGRID_CONTENT_DIR anyway with the default installation content directory (PROGRAM_FILES\Microsoft System Center App Virt Management Server\App Virt Management Server\Content).

This is an issue we're aware of and it should be fixed in the next version of the server, but if you run into this in the mean time this is how you can fix it.

J.C. Hornbeck | System Center Knowledge Engineer

Read more at: http://blogs.technet.com/b/appv/archive/2010/03/02/after-upgrading-a-microsoft-app-v-server-client-machines-may-receive-00000194-errors-when-trying-to-launch-applications.aspx

Well, it was long overdue in coming but we’re pleased to announce that the home for the App-V Team blog has now changed.  Out is the old http://blogs.technet.com/SoftGrid URL we used to use and in is the new http://blogs.technet.com/AppV URL we've begun using this week.  What, you didn't notice?  That's thanks to our wonderful blog admins who simply put a redirect on the old site, mirroring the content and sending all traffic to the new site instead.

So what does this mean to you?  Really not much, but if you have any RSS or ATOM subscriptions you might want to update them to point to the new feed URL instead.  All existing subscriptions should continue to work but we can't guarantee how long the old SoftGrid site will remain live and we'd hate for you to miss out on an important announcement because your subscription wasn't updating.  If you have any old shortcuts or bookmarks you're hanging onto, you might want to update those as well.

Aside from this it should look like the same blog you've become familiar with since we launched it way back in 2007.  As always, thanks for reading and if you have any suggestions or feedback don't hesitate to send us a note.

The App-V Team

Read more at: http://blogs.technet.com/appv/archive/2010/02/26/the-softgrid-blog-has-a-new-location.aspx