Citrix WEM – Locked out of Management Console?

During a cleanup task in my lab environment I deleted an OU in Active Directory which contained a security group that has been assigned to the “Full Access” permission in Citrix Environment Management. When I tried connecting to the WEM infrastructure server I received the following error message:

“You are not registered as a Workspace Environment Management Administrator. Therefore, you are not allowed to access the service. Please contact your Workspace Environment Management Administrator to gain access.”

To get back access to the WEM console, we could easily restore the deleted security group with the help of Active Directory recycle bin (if it is enabled) OR we could have a look at the tables of the SQL database and figure out a different way to get back access to console.

With the following SQL query we can see which users and groups are listed for the administrative access to the WEM console.

SELECT TOP (1000) [IdAdmin]
,[Name] ,[State] ,[Type] ,[Permissions] ,[RevisionId]
FROM [WEM].[dbo].[VUEMAdministrators]

2019-06-30 12_23_26-mRemoteNG - confCons.xml - XDC-01

The group with the SID “S-1-5-21-2144917800-3565007536-2997083959-500” is the one which got deleted. Note: Even if the user or group is still available in Active Directory you will always see the SID and never the common name.

Explanation of the available attributes:

State
1: Enabled
0: Disabled

Type
1: User-Account
2: Security-Group

Permissions
https://pastebin.com/RSvS1eQu

Solution

First of all we are going to create a new security group “WEM_FullAccess” and determine the SID of it —> Get-ADGroup -Identity “WEM_FullAccess”

2019-06-30 13_11_00-mRemoteNG - confCons.xml - DC-01

Now we can edit the table “dbo.VUEMAdministrators” and swap the orphaned SID with the one we just created. Close the opened table otherwise the change will not apply.

2019-07-01 06_40_57-Window

 

2019-07-01 06_59_09-Window

At this point we should be able to login to the WEM console again.

2019-07-01 06_46_21-Window.png

We are having back access to the Workspace Environemnt Management Console. I hope this is helping some people who have been as stupid as me 🙂

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Blog at WordPress.com.

Up ↑

%d bloggers like this: