Security & Encryption:
DO
- Disable FileVault unless required by policy. If FileVault is enabled and the machine powers down, MacStadium Data Center Technicians (DCT) must manually intervene to decrypt the drive.
- If encryption is required, coordinate with MacStadium to implement secure restart scripts that automate reboots and recovery.
- Use Apple Business Manager (ABM) for automated enrollment and enforcement of enterprise security baselines.
DON’T
- Rely solely on the Secure Enclave for recovery. Remote unlock may not be feasible without hands-on access.
- Allow unmanaged users to enable FileVault without central IT approval.
Networking & Connectivity:
DO
- Configure firewall rules and VPNs to allow Citrix traffic. Ensure required ports (TCP/UDP 1494, 2598, 443, and HDX adaptive ports) are open.
- Whitelist trusted Citrix and MacStadium service endpoints.
- Disable packet inspection or SSL interception on Citrix HDX sessions where possible to improve performance.
- Provide users with backup access methods (e.g., VNC or MacStadium-provided remote tools) in case the Citrix VDI session becomes inaccessible.
DON’T
- Route sessions through unnecessary network hops or proxy chains. Each jump increases latency and lowers session quality.
- Overlook bandwidth planning:
- Coding / general productivity: ~2–3 Mbps per user
- Graphic design: ~5–10 Mbps per user
- Video editing / high-performance: ~15–25 Mbps per user
User Experience Tuning:
DO
- Disable desktop animations and transparency effects on macOS to improve responsiveness over HDX.
- Configure Citrix Workspace client per Citrix guidelines (Citrix Docs).
- Disable lock screen timers to prevent session loss if a user is disconnected.
- Optimize power settings by disabling Wi-Fi power saving and ensuring stable NIC performance.
DON’T
- Leave defaults enabled that cause session interruptions (screen savers, hot corners, or lock timers).
- Forget to test client tuning across different OS versions and hardware configurations.
Management & Policy:
DO
- Define MDM policies clearly:
- Must be enabled : Automated enrollment, system integrity protection, screen sharing off, disable end-user restart/shutdown buttons.
- Should be enabled : Password complexity, firewall on, Gatekeeper enabled, software update enforcement.
- Cannot be enabled : User lockout policies that require local hands-on recovery.
DON’T
- Allow end users to bypass MDM profiles or disable supervision.
- Apply policies that conflict with Citrix session stability (e.g., auto-sleep or aggressive idle timeouts).
Backup & Recovery:
DO
- Maintain secondary connection paths such as VNC or MacStadium secure console for administrative recovery.
- Ensure power management policies keep machines in a “always on” or “wake on network access” state.
- Enable backups using the macOS Time Machine utility on a schedule that meets your needs and corporate policies.
DON’T
- Rely solely on user-initiated restarts or shutdowns—disable those options at the MDM level.
- Forget to back up user data; Citrix and MacStadium sessions are not substitutes for enterprise backup solutions.
Automated Enrollment & Scalability:
DO
- Use Apple Business Manager (ABM) + MDM for zero-touch enrollment of macOS instances.
- Automate provisioning of new Citrix VDA-enabled macOS workloads through Orka or bare-metal orchestration (see MacStadium Docs).
DON’T
- Attempt to manually configure large numbers of machines without ABM integration—this is error-prone and hard to scale.
Quick Reference:
- Apple Security Guide: Apple Platform Security
- Citrix Workspace App for Mac: Citrix Docs
- MacStadium Documentation: MacStadium Docs