The purpose of this Article is to summarize and illustrate the different ways an Administrator can use to take a XenApp Server Offline for Maintenance purposes.

A XenApp could need to be Isolated from production, either for Maintenance purposes (System or XenApp Updates, for example) or because the Server is unstable and should be removed from available servers.

To Isolate a Server, XenApp Admins can use different methods :

Disable Logons on the Specified Server(s)

This action, that can be done through the Access Management Console (AMC) or through the "change logon /disable" command line will prevent any new Remote Session (either RDP or ICA) to open on the selecter server(s).

Since Windows 2003 (and Presentation Server 3.0 for Windows 2003), this setting is reboot persistent and will still be applied after a server reboot.

The Major Downside of this method is that it'll prevent any remote connection, even Admins RDP connections so the Server won't be manageable which could be a real constraint if the Servers are hosted in an external DataCenter because Hardware Remote Admin tools like ILO for example are not really a must.

Moreover, this setting must be managed on a per server basis then it could really be an headache to select all servers, apply them the setting and then remember to turn on Logon again.

In this case, when managing lots of servers, MFCOM Scripts or Third Party Tools like XenApp Servers Logon Manager are required to efficiently manage this setting.

Windows 2008 introduces a more flexible feature called the Drain Mode.

When Drain Mode is activated, Only Admins and Users that have an existing session on the server can connect.

For more informations about this mode, please Read the Related Article.

Isolate the Specified Server(s) from the XenApp Load Management Subsystem

This method, based on Scripting, relies on a new API available since XenApp 4.5 called CPSCOM (for example, the AMC relies on this API) .

Through this API, it's possible to remove a server from the XenApp Load Management Table.

A PowerShell Script using this functionnality is available  On the Citrix Developper Network.

Be Careful when using such a method because the Official support of using CPSCOM APIs is still unclear.

The main Advantage of using such a method is to disable ICA sessions (and thus to prevent XenApp Published Applications users to connect to the specified server) but to let Administrators connect via RDP.

However, it requires scripting skills as when a server is removed from Load Management Table, You'll then need to run the Enablelb.exe command line to insert it again.

A reboot will also insert the Server back in the Load Management Subsystem.

Also there is no way except scripting to check if a server is correctly back in the Load Management Table or is still out (If the server is not rebooting).

Be really careful if You decide to use this Method.

-----------------------------------------------

$server = $Args[0]

$servicestatus = (Get-WmiObject -computer $server Win32_Service -Filter "name='IMAservice'").state

if ($servicestatus -eq "Running")
{
$newLM = New-Object -comobject CPSCOMInterop.CPSLoadManager.1

#remove server from LB

$returnvalue = $newLM.SetServerLMState($server,0)

}
else
{
write-host "$server's IMA service is not running, it can be moved off LB table"
}
 

-----------------------------------------------

If You prefer VBS Scripting, then You may want to get the VBS Adaptation of this script from Joe Shonk

Use a Maintenance / Offline Load Evaluator

That's My Favorite Method.

The First Article dealing with this subject is This Article from Scott Chiara on BrianMadden's Website.

This method relies on creating a specific Load Evaluator and then Applying it on the XenApp Server(s) You want to Isolate.

Why Specific ? A XenApp Load Evaluator consist of Rules that are used to calculate the effective Load of the Server.

The trick is to create a Load Evaluator based on Only one rule, based on the Scheduling Object.

Basically, this rule was designed to allow connections only on specific day(s) or during specific(s) hour range(s).

It is however possible to create such a rule without any selected auhorized time frame, then always denying connections.

Applying such a Load Evaluator to a XenApp Server will then make it considered by the Load Management Subsystem as always Full implying that no connection will be directed to that Server. 

This method is fully supported and it also has the advantage of affecting only ICA published Resources connection so Admins will still be able to connect through RDP sessions.

Moreover, it's easy via the "XenApp Advanced Configuration" Console (or Presentation Server Console) to see Load Evaluators Attachments.

The only Downside is that since XenApp 4.5 it's not as easy to attach a Load Evaluator on several servers.

In this case, Scripts or Third Party Tools like XenApp Load Evaluator Manager allows to Attach Quickly a Load evaluator to a XenApp Server.