This article describes how to configure a registry-based scan expression to look for domain membership.

When the user types the NetScaler Gateway web address, the NetScaler Gateway checks to see if there are any client-based security policies in place. This is called a preauthentication policy. If this type of policy is configured on the NetScaler Gateway, it checks for the specified condition on the user device. These are generally security checks that verify that the user device has the necessary security-related operating system updates, antivirus protection, and perhaps a properly configured firewall.

If the user device fails the security check, the NetScaler Gateway blocks the user from logging on. A user unable to log on needs to download the necessary updates, packages or keys and install them on the user device.

Instructions

To perform a registry-based scan expression to look for domain membership you can use either of the following registry keys:

• Parameters Registy Key
• Winlogon Registry Key
• Single Policy to Look for Both Keys

Parameters Registry Key

This registry key is located at - My Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

The EPA expression to use on the NetScaler Gateway is:
CLIENT.REG('HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters_Domain').VALUE== example.net

Configure from NetScaler CLI

Run the following command from NetScaler CLI:
add aaa preauthenticationpolicy EPA_expression_domain_membership q/CLIENT.REG('HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters_Domain').VALUE == example.net/ Test

Configure from NetScaler GUI

1. From the configuration utility, in the navigation pane, click Access Gateway.
2. In the details pane, under Policy Manager, click Change group settings and user permissions.
3. In the Access Gateway Policy Manager, under Available Policies / Resources, click Pre-Authentication Policies.
4. Under Related Tasks, click Create new preauthentication policy and complete the fields as shown in the following screen shot:

Winlogon Registry Key

This registry key is located at - My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

The EPA expression to use on the NetScaler Gateway is:
CLIENT.REG('HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon_DefaultDomainName').VALUE == CITRIX
Important! Notice the space between Windows\\ NT

Configure from NetScaler CLI

Configure from NetScaler GUI

1. From the configuration utility, in the navigation pane, click Access Gateway.
2. In the details pane, under Policy Manager, click Change group settings and user permissions.
3. In the Access Gateway Policy Manager, under Available Policies / Resources, click Pre-Authentication Policies.
4. Under Related Tasks, click Create new preauthentication policy and complete the fields as shown in the following screen shot:

Single Policy to Look for Both Keys

Alternatively, you can use both expressions to create a single preauthentication policy and look for both registry keys.

The EPA expression to use on the NetScaler Gateway is:
CLIENT.REG('HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters_Domain').VALUE == example.net || CLIENT.REG('HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon_DefaultDomainName').VALUE == CITRIX
Important! Notice the space between Windows\\ NT

Configure from NetScaler CLI

Configure from NetScaler GUI

1. From the configuration utility, in the navigation pane, click Access Gateway.
2. In the details pane, under Policy Manager, click Change group settings and user permissions.
3. In the Access Gateway Policy Manager, under Available Policies / Resources, click Pre-Authentication Policies.
4. Under Related Tasks, click Create new preauthentication policy and complete the fields as shown in the following screen shot: