I always use NC. For everything. A more reliable and easier to adminster interface. I control what can be done via the NC Access List. I use split tunnelling so it acts like WSAM. JSAM is especially clunky. NC is especially good on MAC and Linux. I think the only use I would have for WSAM is on a WinMobile phone. Most other access uses the Terminal Services Proxy (CTS) which in Windows is AWESOME. Totally transparent to users. Again, I use NC in MAC and LINUX. (Wish the Citrix Resource Profile allowed selecting Network Connect as the delivery mechanism.) -=Dan=- ... View more

ESP has 1.5X the performance of NCP. Use ESP always. -=Dan=- ... View more

All you need is a valid Web Server certificate for SSL. Load this onto the domain controller you are using for LDAP and you are in business. -=Dan=- ... View more

I do this all the time to test domain member and non-domain member computers for various policies. I also test Ubuntu. Haven't tried a Mac in VMWare. Works great. -=Dan=- ... View more

Yes, the whole "server catalog" is very confusing. If you use AD authentication, this isn't necessary, but it is with LDAP. Nested groups can also be a problem. I set Nested Group Level to 3 (three levels deep) and "Search all nested groups" so I don't have to define very nested group in the server catalog (otherwise you have to do this). JTAC suggests limiting Group Level to a max of 5 for performance reasons. Also, using the server catalog for nested groups is much faster (but not as foolproof and simple). -=Dan=- PS: 6.2R1 is buggy. As I've said other places, try this in 6.1 if possible. ... View more

Not sure if .bat will work on MAC, but the script address we use for AD is: \\na.vul.com\NETLOGON\co.bat where the beginning is the domain name in "DNS" format and the end is the login script batch file name. Note: You CANNOT use the ldap attribute <userAttr.scriptPath> to set the loginscript name. This is NOT supported in this field. Another real pain! I check this in the RoleMapping rules using a custom expression instead and have a different Role for each login script (and make something simple unnecessarily complex). -=Dan=- ... View more

This may not help, but I have found enabling Roaming Sessions in Role Session Options made NC work on several AirCard situations where IP addresses seem to change. -=Dan=- ... View more

I was able to do this by using a secondary authentication. The primary authentication is anonymous, and the secondary is LDAP (or whatever). When primary is set to anonymous, it sets a unique id for each user so you can login multiple times. THe problem with this approach is that you can't save bookmarks and the like. A compromise I could live with. The other negative is that the secondary login does not display the "Welcome" text that is normally displayed on the login screen. I had to create a custom secondary login page to display help text there. A pain I wish they would fix. -=Dan=- Vulcan Materials ... View more

I've be testing 6.2r1. This is a very buggy release. I'd suggest testing with 6.1 first. Note that doing an XML dump is broken, so don't depend on this to downgrade. Also note if you do a rollback you loose any configs you made in 6.2 (learned all this the hard way). JTAC said the 6.2r2 (or 3 or whatever) was coming soon, so if you can hold on, your results may improve. -=Dan=- ... View more