Attachment_3_-_DHS_WPaaS_Instructions.pdf

Version 1.1

DHS Headquarters DHS Workplace

Release 1.5 User Guide

December 2013

DHS Headquarters DHS Workplace Release 1.5 User Guide, Version 1.1

Page i

Contents

Contents ...................................................................................................................................... i Introduction

DHS Workplace Virtual Desktop General Prerequisites and Requirements for DHS Workplace Virtual Desktop

Virtual Desktop Access Prerequisites and Requirements Software and Certificate Requirements for Non-GFE Virtual Desktop Access

GFE Logon to DHS Workplace GFE Windows 7/XP PIV/PIN or Username/Password Access Prerequisites and Logon Steps .5

Prerequisites for GFE Windows 7/XP Logon

GFE Windows 7/XP PIV/PIV Logon Steps

GFE Windows 7/XP Username/Password Logon Steps

GFE Windows 8 Tablet Access Prerequisites and Logon Steps Prerequisites for GFE Windows 8 Tablet Logon

GFE Windows 8 Tablet PIV/PIN Logon Steps

GFE Windows 8 Tablet Username/Password Logon Steps

Non-GFE Logon to DHS Workplace

Non-GFE Windows 7/8.1 Access Tasks, Prerequisites, and Logon Steps Non-GFE Internet Explorer Trusted Sites Entry

Install Citrix Receiver on Windows 7/8.1

Prerequisites for non-GFE Windows 7/8.1 Logon

Non-GFE Windows 7/8.1 PIV/PIN Logon Steps

Non-GFE Windows 7/8.1 Username/Password Logon Steps

Non-GFE Mac OS X Access Tasks, Prerequisites, and Logon Steps Prerequisites for Mac OS X Logon

Install Centrify Smart Card Driver (PIV/PIN Logon)

Configure Centrify Smart Card Driver

Install Citrix Receiver on Mac OS

Non-GFE Mac OS X PIV/PIN Logon Steps

Mac OS X Username/Password Logon Steps

Using Your Virtual Desktop

Virtual Desktop Toolbar Initial Outlook Use

Security Policies for Trusted/Untrusted Devices Open Applications

Initial MS Word Use

Saving and Deleting Files

Save Files

Delete Files

Page ii

Email Compressed Folders

Personalize Virtual Desktop Export Internet Explorer Favorites from Physical workstation

Import Internet Explorer Favorites to Virtual Desktop

Printing

Print to a Network Printer

Print to a Local Printer

Change Password

Open Task Manager View Network Drives

Leaving a Virtual Desktop Session Lock Virtual Desktop

Lock Virtual Desktop Using the Toolbar

Lock Virtual Desktop Using the Start Menu

Disconnect from a Virtual Desktop

Disconnect from Virtual Desktop Using the Toolbar

Disconnect from Virtual Desktop Using the Start Menu

Log off from Virtual Desktop Log off from Virtual Desktop Using the Toolbar

Log off Virtual Desktop Using the Start Menu

Virtual Desktop Lock and Session Terminate Policies Appendix A: FAQ

Appendix B: US Treasury Certificate Installation Appendix C: Windows 7/8.1 Smartcard Reader Check

Appendix D: Terms and Abbreviations

Introduction

The DHS Headquarters DHS Workplace Release 1.5 User Guide provides instructions for accessing DHS A-LAN (unclassified) network resources via the new DHS Workplace Virtual Desktop from both government-furnished equipment (GFE) and non-GFE1, using a DHS personal identity verification (PIV) card and personal identification number (PIN) or—for users excluded from the DHS HQ Mandatory PIV Card Usage Policy—using DHS username and password.

This user guide describes procedures and information based on a Windows 7 operating system (OS) virtual desktop. There may be slight variations in appearance or system behavior for Windows XP, Windows 8, or Mac OS virtual desktops.

Note: This guide is not intended to instruct users on Windows OS, Mac OS, application, or mobile device functionality.

DHS Workplace Virtual Desktop

The DHS Workplace Virtual Desktop is a secure desktop that you can access from GFE and non-GFE workstations, as well as GFE and non-GFE mobile devices. You can access it from anywhere because it resides in the DHS cloud.

This new remote access option provides reliable, secure access to systems and data anytime, anywhere, wherever the mission requires it—creating a virtual DHS Workplace.

The term “non-GFE” refers to workstations and devices that are not DHSNET Windows-imaged government-furnished equipment (GFE), such as contractor-furnished equipment (CFE) and personally-furnished equipment

(PFE). DHS personnel are encouraged to use GFE that is DHSNET Windows-imaged and PIV-enabled. Since non- GFE is not controlled by DHS HQ IT Support, DHS personnel logging on to the DHS A-LAN (unclassified) network with non-GFE via these instructions do so at their own risk and cost. For further details and recommendations regarding non-GFE, see http://dhsconnect.dhs.gov/org/comp/mgmt/cio/itso/Pages/workplacevirtualdesktop_home.aspx.

http://dhsconnect.dhs.gov/org/comp/mgmt/cio/itso/Pages/workplacevirtualdesktop_home.aspx

General Prerequisites and Requirements for DHS

Workplace Virtual Desktop

Virtual Desktop Access Prerequisites and Requirements

General prerequisites for DHS Workplace Virtual Desktop use include the following:

Laptop/desktop/Windows 8 tablet with a Web browser

Connectivity to Internet or DHS intranet

Citrix Receiver installed on workstation

DHS personal identification verification (PIV) card and reader Note: DHS HQ users currently excluded from mandatory PIV card usage may log on with their username and password.

Software and Certificate Requirements for Non-GFE Virtual Desktop Access

DHS is Mandatory PIV and Federal Information Processing Systems (FIPS) 140-2 compliant in accordance with Office of Management and Budget (OMB) and Congressional mandates. As a result, only non-GFE devices that have been approved are supported. Approved devices must have an ISO7816-compliant PIV card reader, either built in or plugged in.

Note: In general, Windows 8, 7, and XP devices that are PIV-enabled meet the minimum requirements.2 Android devices and Mac iOS devices, such as iPads and iPhones, are not currently PIV and FIPS 140-2 compliant. Therefore, these devices do not meet the minimum Federal Government standards for use in any Federal agency, except on an exception basis. Devices that do not meet these requirements may be allowed on an IT Security exception basis as approved by Risk Management Division or LAN-A System Owner. Although Workplace may allow these devices, users who are mandatory PIV cannot use Android or iOS devices since these devices do not currently support PIV. Also, for the same reason, these devices cannot dock directly onto LAN-A. Users who receive a written PIV Exclusion are provided username and password access. However, the IT Service Desk cannot support devices that are not FIPS compliant so users may leverage these devices at their own risk with written exception from Risk Management Division.

2 Depending on your non-GFE’s Windows OS, your PIV card reader may require a device driver and separate software to ensure proper functionality.

A Windows 7, or later Windows OS, automatically detects PIV card readers, enabling the drivers and middleware to automatically load.

A Windows XP, or older Windows OS, typically does not automatically detect PIV card readers, requiring the user to download the device driver from their PIV card reader manufacturer’s website and, furthermore, to purchase the ActivClient software, which is available from numerous vendors. Users requiring ActivClient can visit http://www.militarycac.com/activclient.htm, which provides links to ActivClient vendors, including:

BuyCAC Readers, CDW-G, Envoy Data Corporation, and SCB Solutions. Both the ActivClient 6.2 and the later ActivClient 7.01 versions are valid, and http://www.militarycac.com/activclient.htm provides details regarding updates to both versions.

http://www.militarycac.com/activclient.htm

GFE Logon to DHS Workplace

GFE Windows 7/XP PIV/PIN or Username/Password Access Prerequisites and Logon Steps

Instructions for logging on to DHS Workplace from a GFE Windows 7 or Windows XP3 workstation, using PIV/PIN or, if applicable, username/password are provided below.

Prerequisites for GFE Windows 7/XP Logon

GFE laptop/desktop workstation running Windows 7 or Windows XP

Internet access from GFE and connectivity to DHS Workplace

Citrix Receiver installed on workstation

If using PIV/PIN:

o DHS PIV card and PIN o Integrated or attachable PIV card reader

If using username/password, exclusion from HQ Mandatory PIV Card Usage.

GFE Windows 7/XP PIV/PIV Logon Steps

1. Insert your PIV card in the GFE card reader.

2. Open https://connect.dhs.gov in your Internet browser and click I Agree to the right of “Login from Other Device.”

Note: Although you are accessing network resources via GFE, you must select the I Agree button next to “Login from Other Device” in order to connect to the DHS Workplace Cloud Access Portal. If you experience issues accessing the portal via https://connect.dhs.gov, try going to the DHS Workplace Cloud Access Portal directly at https://workplace.dhs.gov.

3 Mandatory migration of all GFE workstations to Windows 7 is currently underway due to Microsoft’s announcement that it will end support for all versions of Windows XP on April 8, 2014.

https://connect.dhs.gov/ https://connect.dhs.gov/ https://workplace.dhs.gov/

3. Click Log on under “PIV card & PIN login.”

4. In the certificate window choose the certificate that proves your identity to a remote computer and click OK.

Note: This is usually the second certificate.

Windows 7 Windows XP

5. In the Windows Security window, type your PIN and click OK.

6. If Citrix Access Gateway Endpoint Analysis (EPA) software is not installed on your workstation, the below window will appear. Contact IT Service Desk at 1- 800-250-7911 or itsupport@hq.dhs.gov to have it installed.

Note: While Citrix Access Gateway EPA is not required to log on to Workplace, it allows your DHSNET-issued GFE workstation to print locally and access features mailto:itsupport@hq.dhs.gov typically not available to non-GFE devices.

7. The Citrix Access Gateway EPA will scan your workstation.

8. Single click the desktop icon.

Note: Do not double click the icon or the system will attempt to open two sessions.

9. In the logon window, complete the following:

a. Enter your PIV card PIN in the “PIN” field.

b. In the “Username hint” field, enter: dhsnet\

c. Click the arrow next to the “Username hint” field or press Enter.

Note: If an error message appears, click OK in the message window. Click

Restart from the power off menu, and then repeat steps #8-9 above to log on.

10. The virtual desktop session will open.

GFE Windows 7/XP Username/Password Logon Steps

1. Open https://connect.dhs.gov in your Internet browser and click I Agree to the right of “Login from Other Device.”

Note: Although you are accessing network resources via GFE, the only way to connect to the DHS Workplace Virtual Desktop is by selecting the I Agree button next to “Login from Other Device.” If you experience issues accessing the portal via https://connect.dhs.gov, try going to the DHS Workplace Cloud Access Portal directly at https://workplace.dhs.gov.

2. Under “Username & Password Login,” enter your username and password, select “HQ” from the “Component” dropdown menu, and click Log on.

3. If Citrix Access Gateway Endpoint Analysis (EPA) software is not installed on your workstation, the below window will appear. Contact IT Service Desk at 1- 800-250-7911 or itsupport@hq.dhs.gov to have it installed.

Note: While Citrix Access Gateway EPA is not required to log on to Workplace, it allows your DHSNET-issued GFE workstation to print locally and access features https://connect.dhs.gov/ https://connect.dhs.gov/

4. The Citrix Access Gateway EPA will scan your workstation.

5. Single click the desktop icon.

Note: Do not double click the icon or the system will attempt to open two sessions.

6. The virtual desktop session will open.

GFE Windows 8 Tablet Access Prerequisites and Logon Steps

Instructions for logging on to DHS Workplace from your GFE Windows 8 tablet, using PIV and PIN or, if applicable, using DHS username and password are provided below.

Prerequisites for GFE Windows 8 Tablet Logon

Prerequisites for DHS Workplace Virtual Desktop logon from a GFE Windows 8 tablet, using PIV/PIN or username/password include the following:

GFE tablet running Windows 8

Internet access from GFE tablet and connectivity to DHS Workplace

Citrix Receiver installed on tablet

If using PIV/PIN:

o DHS PIV card and PIN o Integrated or attachable PIV card reader

GFE Windows 8 Tablet PIV/PIN Logon Steps

1. Insert your PIV card in the GFE card reader.

2. Click or tap to open Internet Explorer.

3. Enter https://connect.dhs.gov into the address bar and click I Agree to the right of “Login from Other Device.”

Note: Although you are accessing network resources via GFE, the only way to connect to the DHS Workplace Virtual Desktop is by selecting the I Agree button next to “Login from Other Device.” If you experience issues accessing the portal

4. Under PIV &PIN Login, click or tap Log on.

5. In the certificate window, choose the certificate that proves your identity to a remote computer and click or tap OK.

6. In the Windows Security window, type your PIN and click or tap OK.

7. If Citrix Access Gateway Endpoint Analysis (EPA) software is not installed on your tablet, the window below will appear. Contact IT Service Desk at 1-800-250- 7911 or itsupport@hq.dhs.gov to have it installed.

Note: While Citrix Access Gateway EPA is not required to log on to Workplace, it allows your DHSNET-issued GFE device to print locally and access features

8. Allow a few seconds for Citrix Access Gateway EPA to scan your tablet.

9. Single click the desktop icon.

sessions.

10. In the logon window, complete the following:

a) Enter your PIV card PIN in the “PIN” field.

b) In the “Username hint” field, enter: dhsnet\

c) Click the arrow next to the “Username hint” field or press Enter.

11. The virtual desktop session will open.

GFE Windows 8 Tablet Username/Password Logon Steps

1. Click or tap to open Internet Explorer.

2. Enter https://connect.dhs.gov into the address bar and click or tap I Agree to the

Note: Although you are accessing network resources via GFE, the only way to connect to the DHS Workplace Virtual Desktop is by selecting the I Agree button next to “Login from Other Device.” If you experience issues accessing the portal

3. Under “Username & Password Login,” enter your username and password,

4. If Citrix Access Gateway Endpoint Analysis (EPA) software is not installed on your tablet, the window below will appear. Contact IT Service Desk at 1-800-250- 7911 or itsupport@hq.dhs.gov to have it installed.

Note: While Citrix Access Gateway EPA is not required to log on to Workplace, it allows your DHSNET-issued GFE device to print locally and access features

5. Allow a few seconds for Citrix Access Gateway EPA to scan your tablet.

6. Single click the desktop icon.

7. The virtual desktop session will open.

Non-GFE Logon to DHS Workplace For non-GFE access to DHS Workplace, additional certificates, software, and URL trusted site entries may be required. The following sections provide instructions for non- GFE access to DHS Workplace.

Note: DHS Workplace is designed to work with a large number of systems, but there may be situations in which one of the many combinations of approved non- GFE hardware/software packages does not support DHS Workplace.

Non-GFE Windows 7/8.1 Access Tasks, Prerequisites, and Logon Steps

Instructions for logging on to DHS Workplace from a non-GFE Windows 7 or Windows

8.1 laptop/desktop workstation, using your DHS PIV card and PIN or, if applicable, your DHS username and password, are provided below.

Logging on to DHS Workplace from a non-GFE Windows 7/8.1 workstation requires the following preparatory tasks:

PIV/PIN4

o Add DHS Workplace entry to Internet Explorer trusted sites.

o For access through VPN to DHS Connect only: install US Treasury certificates.

o Install Citrix Receiver.

Username/Password o Add DHS Workplace entry to Internet Explorer trusted sites.

o Install Citrix Receiver.

4 Depending on your non-GFE’s Windows OS, your PIV card reader may require a device driver and separate software to ensure proper functionality.

A Windows 7, or later Windows OS, automatically detects PIV card readers, enabling the drivers and middleware to automatically load.

A Windows XP, or older Windows OS, typically does not automatically detect PIV card readers, requiring the user to download the device driver from their PIV card reader manufacturer’s website and, furthermore, to purchase the ActivClient software, which is available from numerous vendors. Users requiring ActivClient can visit http://www.militarycac.com/activclient.htm, which provides links to ActivClient vendors, including:

BuyCAC Readers, CDW-G, Envoy Data Corporation, and SCB Solutions. Both the ActivClient 6.2 and the later ActivClient 7.01 versions are valid, and http://www.militarycac.com/activclient.htm provides details regarding updates to both versions.

Non-GFE Internet Explorer Trusted Sites Entry

To log on to DHS Workplace from a non-GFE Windows 7/8 workstation, the following URL must be added to Internet Explorer trusted sites: https://*.dhs.gov.

Follow the steps below to add the URL to Internet Explorer trusted sites on your non-

GFE.

1. Open Internet Explorer.

https://*.dhs.gov/

2. Click the Tools icon in the upper right corner.

3. Select Internet Options from the “Tools” dropdown menu.

4. In the Security tab, click Trusted sites, and click the Sites button.

5. Under “Add this website to the zone,” type: https://*.dhs.gov Click Add and Close.

Install Citrix Receiver on Windows 7/8.1

The first step in accessing the DHS Workplace on non-GFE is ensuring the Citrix Receiver software is installed on your workstation.

Note: These steps are based on a Windows 7 operating system.

1. Open the Start menu and click on All Programs. If Citrix Receiver is installed on your workstation, Citrix Receiver appears in the list of tools and programs.

Note: If Citrix Receiver is installed, skip to Prerequisites for non-GFE Windows

7/8.1 Logon.

2. To install Citrix Receiver on non-GFE, open https://connect.dhs.gov in your Internet browser and click I Agree to the right of “Login from Other Device.”

Note: If you experience issues accessing the portal via https://connect.dhs.gov, try going to the DHS Workplace Cloud Access Portal directly at https://workplace.dhs.gov.

Note: For username/password logon, skip to step 6.

4. In the certificate window, choose the certificate that proves your identity to a

Windows 7 Windows 8.1

5. In the Windows Security window, type your PIN and click OK.

6. If logging on via username and password: under “Username & Password Login,” enter your username and password, select “HQ” from the “Component” dropdown menu, and click Log on.

7. Citrix Access Gateway Endpoint Analysis (EPA) will scan your workstation. If the EPA software is not installed, click Skip Check.

8. If Citrix Receiver is not installed, click the INSTALL button.

Note: If Citrix Receiver is already installed, a logon screen will appear. Skip to the Non-GFE Logon to DHS Workplace section for logon instructions.

9. On the Citrix website, click Download Receiver for Windows.

Note: If your workstation has a different operating system, click View other devices and choose the appropriate version to download.

10. Check the box to agree to the Citrix License terms and click Continue.

11. In the message box at the bottom of the Citrix window, click Run.

12. In the Citrix Receiver Setup window, click Install.

13. When the installation completes, the DHS Workplace logon window appears.

A message below the logon fields states: An appropriate client is available on your computer. You can now log on to DHS Workplace.

Prerequisites for non-GFE Windows 7/8.1 Logon

Prerequisites for DHS Workplace Virtual Desktop logon from a non-GFE Windows 7 or Windows 8.1 laptop/desktop workstation, using your DHS PIV/PIN or username/password include the following:

Non-GFE laptop/desktop workstation running Windows 7 or Windows 8.1

Internet access from non-GFE and connectivity to DHS Workplace

Internet Explorer Trusted sites updated with DHS Workplace entry (See Non- GFE Internet Explorer Trusted Sites Entry.)

Citrix Receiver installed on workstation (See Install Citrix Receiver on Windows 7/8.1.)

US Treasury certificates installed Note: Necessary for VPN access through DHSConnect only

If using PIV/PIN:

o DHS PIV card and PIN o Integrated or attachable PIV card reader

If using Username/Password:

Exclusion from HQ Mandatory PIV Card Usage

Non-GFE Windows 7/8.1 PIV/PIN Logon Steps

1. Insert your PIV card in the GFE card reader

2. Open https://connect.dhs.gov in your Internet browser and click I Agree to the

Note: If you experience issues accessing the portal via https://connect.dhs.gov, try going to the DHS Workplace Cloud Access Portal directly at https://workplace.dhs.gov.

4. In the certificate window, choose the certificate that proves your identity to a

Windows 7 Windows 8.1

5. In the Windows Security window, type your PIV card PIN and click OK.

6. Click Skip Check in the Citrix Access Gateway window.

7. Single click the desktop icon.

8. In the logon window, complete the following:

a. Enter your PIV card PIN in the “PIN” field.

b. In the “Username hint” field, enter: dhsnet\

c. Click the arrow next to the “Username hint” field or press Enter.

Restart from the power off menu, and then repeat steps #6-7 above to log on.

9. The virtual desktop session will open.

Non-GFE Windows 7/8.1 Username/Password Logon Steps

1. Open https://connect.dhs.gov in your Internet browser and click I Agree to the right of “Login from Other Device.”

Note: If you experience issues accessing the portal via https://connect.dhs.gov, try going to the DHS Workplace Cloud Access Portal directly at https://workplace.dhs.gov.

https://connect.dhs.gov/

3. Click Skip Check in the Citrix Access Gateway EPA.

4. Single click the desktop icon.

5. The virtual desktop session will open.

Non-GFE Mac OS X Access Tasks, Prerequisites, and Logon Steps

The following sections provide instructions for accessing DHS Workplace from a non- GFE Mac OS X laptop/desktop workstation. Both PIV/PIN and Username/Password Logons require Citrix Receiver.

Prerequisites for Mac OS X Logon

Prerequisites for DHS Workplace Virtual Desktop logon from a Mac OS X laptop/desktop workstation, using DHS PIV/PIN or username/password include the following:

Mac OS X 10.6.x or higher laptop/desktop workstation

Internet access and connectivity to DHS Workplace

Chrome web browser

Citrix Receiver software (See Install Citrix Receiver on Mac OS)

Administrator access on Mac workstation

If using PIV/PIN:

o DHS PIV card and PIN o Integrated or attachable PIV card reader o Centrify Smart Card driver (See Install Centrify Smart Card Driver.)

If using Username/Password:

o Exclusion from HQ Mandatory PIV Card Usage

Install Centrify Smart Card Driver (PIV/PIN Logon)

1. Open the following URL in the Chrome browser:

http://www.centrify.com/mac/smartcard/free-smart-card-for-federal-military-cac-piv.asp#download http://www.centrify.com/mac/smartcard/free-smart-card-for-federal-military-cac-piv.asp#download http://www.centrify.com/mac/smartcard/free-smart-card-for-federal-military-cac-piv.asp#download

2. Under Downloads, Click Centrify Express for Smart Card.

3. Enter name, email, and organization. Click to accept agreement and click Download Now.

4. Go to Finder > Downloads.

5. Double click the Centrify dmg folder.

6. Double click to open the .pkg folder.

7. Click Continue in the Welcome to the Centrify Express Installer window.

8. In the Software License Agreement window, click Continue.

9. Click Agree to the software license terms.

10. In the “Standard Install …” window, click Install.

11. Type your Mac account password and click Install Software.

12. At the successful installation message, click Close.

Configure Centrify Smart Card Driver

1. Go to Finder > Applications.

2. Search for Keychain Access.

3. Double click the Keychain Access application.

4. Select File > Add Keychain.

5. Click the Keychains dropdown and select Macintosh HD.

6. Navigate to System > Library > Keychains.

7. Select SystemCACertificate.keychain and click Add. This completes the Centrify configuration.

Install Citrix Receiver on Mac OS

The DHS Workplace system checks your workstation for Citrix Receiver software. If Citrix Receiver is not installed, you will be automatically routed to the Citrix website.

Follow the steps below to install Citrix Receiver on a Mac OS workstation.

1. Open https://connect.dhs.gov in the Chrome browser and click I Agree to the

Note: If you experience issues accessing the portal via https://connect.dhs.gov,

2. If logging on with PIV/PIN:

a. Insert your PIV card in the GFE card reader.

b. Under “PIV & PIN Login,” click Log on.

c. In the certificate window, choose the certificate that proves your identity to a remote computer and click OK.

d. In the keychain password window, type your PIV PIN and click OK.

3. If logging on with username/password, under “Username & Password Login,” enter your username and password, select “HQ” from the “Component” dropdown menu, and click Log on.

4. If Citrix Receiver is not installed, click the INSTALL button.

5. On the Citrix website, click View other devices and click Download Receiver for Macintosh.

6. Allow the software to download.

7. Navigate to Finder > Downloads.

Double click CitrixReceiverWeb.dmg.

8. Double click Install Citrix Receiver.

9. Click Continue in the “Welcome to Citrix Receiver Installer” window.

10. Click Continue in the “Software License Agreement” window.

11. Click Agree to license terms.

12. Click Install in the “Standard Install …” window.

13. Enter your Mac name and password, and click Install Software.

14. Click Close in the next window.

15. A “Confirm Installation is complete” will appear. Click Skip to Log on and follow the steps for PIV/PIN or Username/Password DHS Workplace logon.

Non-GFE Mac OS X PIV/PIN Logon Steps

1. Open https://connect.dhs.gov in the Chrome browser and click I Agree to the right of “Login from Other Device.”

Note: If you experience issues accessing the portal via https://connect.dhs.gov,

2. Under “PIV & PIN Login,” click Log on.

3. In the certificate window, choose the certificate that proves your identity to a

4. In the keychain password window, type your PIV PIN and click OK.

5. In the Citrix Access Gateway Window, click Skip Check.

6. Single click the virtual desktop icon.

7. In the log on window, complete the following:

Enter your PIV card PIN in the “PIN” field.

In the “Username hint” field, enter: dhsnet\

Click the arrow next to the “Username hint” field or press Enter.

Restart from the power off menu, and then repeat steps #3-4 above to log on.

8. The virtual desktop session will open.

Mac OS X Username/Password Logon Steps

1. Open https://connect.dhs.gov in the Chrome browser and click I Agree to the right of “Login from Other Device.”

Note: If you experience issues accessing the portal via https://connect.dhs.gov,

3. Single click the desktop icon.

4. The virtual desktop session will open.

Using Your Virtual Desktop This section is based on a Windows 7 virtual desktop accessed from a Windows laptop.

There may be slight differences in appearance or functionality if the virtual desktop is accessed from a Windows 8, Mac OS, or mobile device.

Virtual Desktop Toolbar

Virtual desktop toolbar functions are described below.

1. Click the arrow in the toolbar tab in the upper middle of the window to open the toolbar.

2. The virtual desktop toolbar opens.

a. Click Full-screen to expand the virtual desktop window.

b. Click Home to go to your GFE. After you click Home, your virtual desktop appears as an icon in the GFE system tray. Click the icon to return to your virtual desktop session.

c. Click Ctrl+Alt+Del from the toolbar to lock or logoff your virtual desktop, to open the task manager, or to change your password.

Note: Clicking Ctrl+Alt+Del outside of the toolbar sends the command to your physical laptop/desktop workstation. If you press Ctrl+Alt+Del outside of the toolbar and select Lock or Shutdown, you are locking or shutting down your physical workstation.

d. When in Full-screen mode, click Window to reduce the virtual desktop window and use the virtual desktop in window mode.

e. In Window mode, you can do the following:

Move between your physical workstation and virtual desktop.

Adjust the virtual desktop window by using the cursor at the window corner or sides to move the borders and minimize the desktop by clicking the buttons in the upper right corner of the window.

Initial Outlook Use

There are two tasks that must be completed when opening Outlook on your virtual desktop for the first time: running the startup wizard and clicking OK in the Live Meeting window. Follow the steps below to complete these tasks.

1. The first time you logon to your virtual desktop and open Outlook, a short wizard opens. Click Next in the “MS Outlook 2010 Startup” window.

2. Click Next in the “Account Configuration” window.

3. Click Next in the “Add New Account” window to accept the default selection of Email Account, verify your name and email address.

Note: If your name and email address are not populated, this indicates your email address is not in the EaaS Migrated Users group. Contact the IT Service Desk at 1-800-250-7911 or itsupport@hq.dhs.gov.

4. Click Finish in the “Add New Account” window.

Note: If you do not see check marks for the three items under “Configuring,” this indicates your email address is not in the EaaS Migrated Users group. Contact the IT Service Desk at 1-800-250-7911 or itsupport@hq.dhs.gov.

5. After wizard completes, allow the initial synchronization with Outlook to complete.

This requires several minutes. After this initial synchronization, Outlook will open promptly.

6. When you first open Outlook, click OK on the pop-up window

Security Policies for Trusted/Untrusted Devices

You can access DHS Workplace from a trusted device or an untrusted device (physical laptop/desktop/workstation). However, certain functionality available from a trusted device is not available on when you access DHS Workplace from an untrusted device.

The only trusted devices are GFE, and Citrix Access Gateway EPA software must be installed on your device in order for DHS Workplace to verify that the device is trusted.

The following functionality is available on your virtual desktop only you access it from a trusted device (GFE), verified through Citrix Access Gateway EPA:

Access to USB devices

Copy and paste between the virtual desktop and physical workstation

Printing to local printers

This functionality is not available from your virtual desktop if you access DHS Workplace from an untrusted device, or from a trusted but unverified device, i.e., GFE that does not have Citrix Access Gateway EPA installed.

Contact the IT Service Desk at 1-800-250-7911 or itsupport@hq.dhs.gov to have Citrix Access Gateway EPA installed on GFE.

Open Applications

Open and use applications on the virtual desktop as you would on your physical workstation. Go to the Start menu and click the application or double click the desktop icon for the application you want to open.

Initial MS Word Use

The first time you open MS Word on your virtual desktop, type your initials and click OK in the message window. This is not required again.

DHS Headquarters DHS Workplace Release 1.5 User Guide, Version 1.0

Saving and Deleting Files

Save Files

Save files to a network drive (e.g., the “P” drive for most DHS Headquarters users) or network storage place (e.g., a SharePoint directory), not a local drive.

Save files to any of the following:

your Component-defined drive on the network (e.g., “P” drive)

Any other network drive or network storage space such as SharePoint that you normally have access to

Note: If you leave applications running overnight, work could be lost. All virtual desktop sessions are rebooted once each day. This reboot clears the virtual desktop session memory, so applications that were left running overnight need to be restarted and work in those applications could be lost.

Delete Files

When you delete files on your virtual desktop, the deleted files are not collected in a Recycle Bin where they can be recovered. Deleting files removes the files permanently.

Email Compressed Folders

To email a compressed folder from your virtual desktop, complete the following three actions:

Create and name a compressed folder.

Move files you want to email into the compressed folder.

Attach the folder to an email and send it.

Follow the steps below.

1. Right click on the desktop and select New > Compressed (zipped) Folder.

2. Right click on the folder and select Rename.

Type the new name for the folder.

3. Copy files you want to email into the folder.

4. Attach the compressed folder to an email.

Personalize Virtual Desktop

Personalization on your virtual desktop includes adding Internet Explorer favorites and desktop shortcuts.

Internet Explorer favorites can be transferred from your GFE to your virtual desktop.

This requires two actions:

Export Internet Explorer favorites from your physical workstation

Import Internet Explorer favorites on your virtual desktop

Steps to export and import Internet Explorer favorites are detailed below.

Export Internet Explorer Favorites from Physical workstation

1. On your physical workstation, open Internet Explorer.

2. Go to File and select Import and Export.

Note: If “File” is not listed as a menu option, right click and select “Menu Bar”.

3. Select “Export to a File,” and click Next.

4. Select “Favorites” and click Next.

5. Click Next.

6. Browse to your network drive and click Export.

7. Click Finish.

Import Internet Explorer Favorites to Virtual Desktop

1. Logon to your virtual desktop and open Internet Explorer.

2. Go to File and select Import and Export.

Note: If “File” is not listed as a menu option, right click and select “Menu Bar”.

3. Select “Import from a file,” and click Next.

4. Select “Favorites,” and click Next.

5. Browse to a network drive and click Next.

6. Click Import.

7. Click Finish.

Internet Explorer favorites are now available from Internet Explorer on your virtual desktop.

Printing

Print to a Network Printer

Print from your virtual desktop to a DHS network printer as you would from your physical workstation. If you have network printers that are currently mapped on your physical workstation, this mapping is carried to the virtual desktop.

Print to a Local Printer

If the physical workstation your virtual desktop is running on is a trusted device, you will be able to print to a local printer.

Change Password

1. To change your password, press Click the arrow in the toolbar tab in the upper middle of the window to open the toolbar.

2. In the virtual desktop toolbar, click Ctrl+Alt+Del.

3. Select Change a password, and complete the password fields.

Open Task Manager

1. To open the task manager, press Click the arrow in the toolbar tab in the upper

3. Select Start Task Manager.

View Network Drives

1. Go to the Start menu to view virtual desktop network drives. Local and network drives you normally have access to from your physical machine are mapped to your virtual desktop. In addition to your normal Component-defined drives, DHS Workplace provides a Documents drive and a [First name.Last name} directory for file storage.

2. Go to Start > Computer. Under Network Location, the virtual drives are displayed:

My VDI HomeDir and First name.Last name.

Leaving a Virtual Desktop Session

Options for leaving the virtual desktop session include the following:

Lock

Disconnect Disconnecting from the virtual desktop session is comparable to putting your physical machine in sleep mode. You can disconnect your virtual desktop session, then log back on before the two hour session termination time and your work will be the same as when you disconnected.

Log off Logging off from your virtual desktop is comparable to shutting down your physical machine. This ensures applications are shutdown properly and work is saved.

Note: If you leave applications running overnight, work could be lost. All virtual desktop sessions are rebooted once each day. This clears the session memory, so applications that had been left running need to be restarted and any work in those applications could be lost.

Note: If you press Ctrl+Alt+Del without using the toolbar, the command is directed to your physical machine. If you press Ctrl+Alt+Del on your virtual desktop without using the toolbar, and select Shutdown, your physical machine will shut down.

Lock Virtual Desktop

You can lock a virtual desktop session using the toolbar or the Start menu.

Lock Virtual Desktop Using the Toolbar

1. To lock your virtual desktop, click the arrow in the toolbar tab in the upper middle of the window to open the toolbar.

3. Click “Lock this computer.”

4. Type your password or enter your PIN to log back on.

Lock Virtual Desktop Using the Start Menu

1. Go to the Start menu, click the arrow beside Log off, and select Lock.

2. Type your password or enter your PIN to log back on.

Disconnect from a Virtual Desktop

You can disconnect from a virtual desktop session using the toolbar or the Start menu.

Disconnecting from the virtual desktop session is comparable to putting your physical machine in sleep mode. You can disconnect your virtual desktop session, then log back on before the two hour session termination time and your work will be the same as when you disconnected.

Disconnect from Virtual Desktop Using the Toolbar

1. To disconnect your virtual desktop, click the arrow in the toolbar tab in the upper

2. In the virtual desktop toolbar, click Disconnect.

3. First time use only, click to select Don’t ask me again and click OK.

4. Click the desktop icon to log back on.

Disconnect from Virtual Desktop Using the Start Menu

1. Go to the Start menu, click the arrow beside Log off, and select Disconnect.

2. Click the desktop icon to log back on.

Log off from Virtual Desktop

You can log off from a virtual desktop session using the toolbar or the Start menu.

Logging off from your virtual desktop is comparable to shutting down your physical machine. Log off at the end of the day. This ensures applications are shutdown properly and work is saved.

Log off from Virtual Desktop Using the Toolbar

1. To logoff your virtual desktop using the toolbar, click the arrow in the toolbar tab in the upper middle of the window to open the toolbar.

3. Click Log off.

4. Click Logoff in the Citrix XenDesktop window.

Log off Virtual Desktop Using the Start Menu

1. To Log off your virtual desktop, go to the Start menu and click Log off.

2. Click Logoff in the Citrix XenDesktop window.

Note: Log off to exit the virtual desktop session cleanly and completely when you have finished working.

Virtual Desktop Lock and Session Terminate Policies

A virtual desktop session locks after 15 minutes of inactivity. Log back in to restart the session.

A virtual desktop session is terminated after two hours of inactivity.

DHS Headquarters DHS Workplace Release 1.5 User Guide, Version 1.0

Appendix A: FAQ

1. How do I contact the DHS Workplace help desk?

Contact the IT Service Desk at 1-800-250-7911 or itsupport@hq.dhs.gov.

2. How do I find the desktop of my physical workstation after I open a virtual desktop session?

o Open the virtual desktop toolbar. Click Window to reduce the virtual desktop window. The physical workstation is displayed in the background o Open the virtual desktop toolbar. Click Home to go to your physical workstation.

3. Why is my virtual desktop session locked?

Virtual desktop sessions are locked after 15 minutes of inactivity. Type your password to resume your virtual desktop session.

4. Can I save files from my virtual desktop to my physical workstation?

No, DHS Workplace prohibits saving files from the virtual desktop to your physical workstation.

5. Can I save files on the actual desktop of my virtual desktop?

No, do not save work to the desktop of your virtual desktop. Save work to either

1) your Component-defined network drive, e.g., the “P” drive for most DHS Headquarters users, or 2) Any other network drive or network storage space, such as SharePoint, that you normally have access to.

6. How do I print from my virtual desktop?

DHS network printers mapped to your physical workstation when you log on are mapped to your virtual desktop. DHS HQ allows printing from a trusted device to a local printer. To do so, log on to your virtual desktop from a trusted device and print from your virtual desktop as you would your physical workstation.

7. Why don’t I see my network drives and my local drive on my virtual desktop?

As a first step, check to see if the drives are mapped to your physical workstation. If they are not, reboot your physical machine and check again. If they are mapped on your physical machine after reboot, they should map to your virtual desktop. Restart your virtual desktop. If the drives are not mapped to your virtual desktop, contact the IT Service Desk at 1-800-250-7911 or itsupport@hq.dhs.gov.

8. Why can’t I send or receive email in Outlook on my virtual desktop?

9. How do I know if Citrix Receiver is installed on my laptop?

Open the Start menu and click on All Programs to see if Citrix Receiver is listed.

Check for the icon.

10. Why can’t I log on? I’ve got Citrix Receiver installed on my physical workstation and I know my DHS PIV PIN (or, if applicable, username and password).

If you have the correct PIN (or username and password) but can’t log on, it may be a system-wide issue. Contact the IT Service Desk at 1-800-250-7911 or itsupport@hq.dhs.gov.

11. What happens if I’m working on a file on my virtual desktop and I lose connectivity or my physical workstation crashes?

If the network connection went down, you should be able to recover your virtual desktop session, so try logging back on. As long as you log back on before the two hour session termination time, your work will be as you left it.

12. How do I extend my virtual desktop so I can use two monitors?

a. Click the virtual desktop toolbar and click Window.

b. Press Fn + F8 keys as you would on your physical machine and select Extend.

c. To extend the virtual desktop across two monitors, drag the desktop from your GFE across to the second monitor so that it appears on both the first and second monitor. Click the maximize button (in the upper right corner of the window).

d. To move the virtual desktop to a second monitor and see your GFE desktop on the first monitor, drag the virtual desktop window completely to the second monitor. You may need to resize the virtual desktop window by moving the sides of the window so it fits on the monitor. Click the maximize button (in the upper right corner of the window).

13. Why do I see stuttering shadows of the mouse when I move it?

This indicates latency that should be checked. Contact the IT Service Desk at 1- 800-250-7911 or itsupport@hq.dhs.gov.

14. Why don’t I see an application on my virtual desktop that should be there?

This indicates a group or permission issue that should be checked. Contact the IT Service Desk at 1-800-250-7911 or itsupport@hq.dhs.gov.

Appendix B: US Treasury Certificate Installation

For PIV logon to DHS Workplace from non-GFE running Windows XP, US Treasury certificate installation is required. Instructions for installing the certificates are provided below.

1. To install certificates, go to: https://workplace.dhs.gov/vpn/installdhscerts.zip

2. Click OK.

3. Click Open.

4. Right click DHS_InstallCert file.

https://workplace.dhs.gov/vpn/installdhscerts.zip

5. Click Extract all.

6. Click Extract.

7. Right click the script icon and select Run as administrator.

8. Click Yes to allow changes to computer.

9. Allow the executable to run.

10. After the executable completes, a successful installation message is displayed.

Close the browser windows.

11. Check that the certificates were installed.

Go to Start menu and type certmgr.msc in the search field.

12. In the certmgr window, go to Trusted Root Certification Authority > Certificates.

13. Scroll down to see that US Treasury Root CA is listed. This shows the certificate has been successfully installed.

14. Still in the certmgr window, go to Untrusted Certificates > Certificates.

15. Scroll down to see that US Treasury Root CA is listed. This shows the certificate has been successfully installed.

16. After verifying certificate installation, delete the DHS_InstallCerts_on_W7x86 script from your laptop/desktop.

Appendix C: Windows 7/8.1 Smartcard Reader Check

Laptop/desktop workstations running Windows 7/8 may have the software required to read a PIV card. Follow the steps below to check for this.

1. Insert your PIV card in the reader.

2. Go to the Start menu > Control Panel.

Open Device Manager.

3. Look for Smart card readers.

4. Open Internet Explorer, and go to Internet Options > Content tab > Certificates tab.

If your PIV card certificate is listed, the PIV card is being read properly by Windows.

Appendix D: Terms and Abbreviations

Term or abbreviation Definition

EPA Endpoint Analysis

GFE government-furnished equipment

LAN local area network non-GFE non-government-furnished equipment

OS operating system

PIN personal identification number

PIV personal identity verification system tray The system tray is usually located at the bottom-right corner of the screen and is used to display the clock and the icons of certain programs.

VDI Virtual desktop interface

Virtual Desktop Lock and Session Terminate Policies