ScrewDrivers Client Printers and Scanners Missing in Citrix VDA 2109+

Owned by Andrew Parlette, created
Last updated: Apr 05, 2022 by Brian Rinebarger
2 min read

 Problem

Newer versions of the Citrix VDA (starting with version 2109 or 7.31) have a policy that defaults to only allow third party virtual channels from the allowed list. As a result, Tricerat ScrewDrivers client printers and scanners will not be created in remote sessions. Disabling the policy or specifically allowing the ScrewDrivers virtual channel will re-enable functionality. This policy was made available first in version 2006, and defaults to enabled in 2109.

Note: This only applies to client printers and scanners with the ScrewDrivers Endpoint Client. Print Server printers, Direct IP printers, and other printing methods are not affected by this Citrix change.

Reference: Virtual channel security | Citrix Virtual Apps and Desktops 7 2109

 Solution

There are two methods to enable ScrewDrivers virtual channels in Citrix Virtual Apps and Desktops. The first is to disable the policy. The second is to add the specific virtual channels to the allow list.

Since this policy is enabled by default, if the policy is not set, it’s considered enabled. You have to add a policy and set it to disabled to disable the policy and allow all virtual channels.

Disable “Virtual channel allow list” policy

This is the only option that easily supports ScrewDrivers Scanning

  1. Open Citrix Studio and navigate to the Policies branch

  2. Create or modify an existing policy

  3. Search for “virtual channel” and select “Virtual Channel Allow List” policy.

  4. Set the policy to disabled.

  5. Hit Next and assign the policy to the desired user and machine objects, or select “All objects in the site” to apply the policy universally.

  6. Name the policy and click “Enable Policy”, then Finish.

Add specific virtual channels to the allow list policy

  1. Open Citrix Studio and navigate to the policies branch.

  2. Create or modify an existing policy.

  3. Search for “virtual channel” and select “Virtual channel allow list policy”.

  4. Set the policy to enabled.

  5. Add the following lines to the allow list.
    SCREW04,C:\Program Files\Tricerat\ScrewDrivers\Common\ScrewDrivers Notification Service.exe
    SCREWD4,C:\Windows\System32\spoolsv.exe
    If using scanning, also add these lines:
    VSCAN01,C:\Program Files\Tricerat\ScrewDrivers\Common\ScrewDrivers Notification Service.exe
    VSCAN01,C:\Program Files\TWAIN Working Group\Twack_32.exe
    VSCAN01,C:\Program Files\TWAIN Working Group\Twack_64.exe
    VSCAN01,<The path to your scanning application.exe>

  6. Apply the policy to the desired location and apply.