Service

The ActionMonitor parameter is a list of actions that tells the internal actions that may be monitored. The monitoring automatically restarts processes that are stopped for any reason.

The only supported monitoring is of the user service, which is the one configured above.

The ActionMonitor always started the requested action automatically. ActionStart is used to start in the same manner as the monitoring but without the monitoring. This is used to start the user service from the setup program to allow to switch from administrator privilege to normal user privilege.

These parameters contain a list of colon-separated names that should run for each respective service (system and user):

The ActiveSystem and ActiveUser tell that they should be started on this computer. But this computer can need to connect somewhere else, so the ActiveClient tells when this computer should connect. The default value for ActiveClient is the combination of ActiveSystem and ActiveUser.

The order of names in the list is ignored since each component is started in the required order.

The ChannelMemoryCount parameter is used when communicating with the virtual channel/driver. The number of available memory buffers is limited. Thus, this parameter should correspond to the value suggested in the documentation of the virtual channel/driver from Microsoft/Citrix.

The ChannelName parameter is used when communicating with the virtual channel/driver. The name is used to identify the Net iD Client’s channel and must be the same on both the Terminal Server system and the connecting computer.

The ChannelOptions parameter is used when communicating with the virtual channel/driver. The value is a bitmask with the following options:

See the documentation of virtual channel/driver from Microsoft/Citrix for meaning and usage. Search in the respective developer forum for more information.

The CheckLocation parameter is used to validate the calling application. Only trusted locations are allowed when location check is active.

All service calls are blocked if the location is considered untrusted. That is, single sign-on not available.

The CommunicationDelay parameter is used by the developer to simulate communication delay and should never be used. The format is <protocol>:<delay> … <protocol><delay>. The delay value is a DWORD. The lower WORD tells the number of milliseconds that the process sleeps before starting a data transmit. The upper WORD tells the number of milliseconds that the process sleeps before processing the data.

The parameter CommunicationMaxConnect specifies the number of connection attempts to make when sending data on initial connection. This parameter is only implemented for the WTS protocol, but may be implemented for other protocols in the future if it proves necessary.

The parameter CommunicationMaxReconnect specifies the number of reconnection attempts to make when sending data and the connection has been terminated. This parameter is only implemented for the WTS protocol, but may be implemented for other protocols in the future if it proves necessary.

The CommunicationSecure parameter is used to send additional options for setting up SSL/TLS protocol:

The CommunicationTransmitHeader parameter tells the number of bytes needed for the protocol header. This value should never be updated but is included to handle possible future changes in protocols. The format is <protocol>:<size> … <protocol><size>.

The CommunicationTransmitSize parameter tells the maximum number of bytes that can be transmitted for each protocol. The value must be between 1 kB and 128 MB, but is specified in bytes. Default value is 128 kB. The format is <protocol>:<size> … <protocol><size>.

The Debug parameter enables the recording of more information to the trace. This information includes the actual data sent in the communication channel. Thus, it can be sensitive, and therefore a development license is required to enable this parameter.

The EndSessionAbort parameter checks event viewer for name/level/event id+qualifier to detect aborted shutdown.

The listening service is running in a non-connected mode when used with the virtual channel or driver. Thus, the service may not discover that the connecting part is closed if disconnected without a proper close message. These parameters include an idle checking mechanism to detect when a connecting part is gone.

The communication must run without interference from other processes. Because some of the communication protocols are non-connected, it is necessary that only one part is communicating at the same time. The lock mode tells how the service locks the communication from other parties:

The total amount of simultaneous connections is limited. Thus, it must be controlled what is allowed for each connection.

The MaxTransmitFail parameter resets the communication channel when the data transmission fails. The default value is 0, no resetting.

The maximum data transmit buffer tells the maximum number of bytes that can be sent in the communication channel.

The MaxTransmitTime parameter is the maximum number of milliseconds that a transmit can take. But this is not entirely true. The initial connect may only take milliseconds, and some actions will get milliseconds. Usually, operations that result in smart card updates. Smart card key generation gets more time, so this parameter should be considered to be the maximum time for a normal operation.

The MutexTimeout parameter adds a timeout to the communication lock. Normally this is never needed. But it can be useful while diagnosing some failures. The value tells the number of milliseconds.

The ProtectAlgorithm parameter is the algorithm used when adding encryption to the communication channel. Default is no protection at all.

The remote communication using virtual channel/driver relies on the established protection used in each channel. Thus, no encryption is needed.

The shared memory protocol is only used at the local computer. Thus, no encryption is needed.

The network protocol, when used with localhost, does not require protection since the communication never leaves the computer. The network protocol, when used remotely, requires protection. Using network protocol remotely is not recommended at this time because there is a potential man-in-the-middle attack.

Skip is also possible to completely turn off encryption.

The virtual channel/driver communication requires a single communication channel. A proxy synchronizes all communication.

The RunAsProcess parameter allows the system service to run as a process instead of service.

Communicating with shared memory requires a special naming convention. See Windows documentation for more information.

The UseWorkerThread is used to enable simultaneous calls from other processes. Default enabled for compatible version, disabled for none compatible version. Also possible to extend initial time to wait for function enabled, but not recommended. HWORD bitmask where 03EB is time in milliseconds.

The WaitRunning parameter tells the number of milliseconds a process must wait for the system/user service to run when not responding.