WEM AD Group Importer – Creating Filters and Conditions Efficiently
Citrix Workspace Environment Management offers a clean way to associate actions with user groups using filters and conditions. In practice, however, this mechanism is often bypassed because manually creating these associations for each AD group in the WEM console is too time-consuming in larger environments. Instead, additional AD group assignments are attached directly to actions—with the result that the configuration becomes confusing and difficult to maintain.
Citrix does not currently provide a built-in bulk function for this use case. The WEM AD Group Importer, a lightweight Windows utility that automates exactly this step.
How It Works
The tool connects to the WEM database, reads the existing configuration sets, and displays an Active Directory browser. The administrator navigates to the desired OU, selects the groups to be imported, and specifies the target configuration set. For each group, the tool creates a „Active Directory Group Match“ condition and an associated filter, and links the two objects. The filters created in this way are then available in the WEM console and can be assigned actions as usual.
Design Principles
The importer is intentionally kept to a minimum and serves only this one purpose. Key features:
An import always runs in exactly one configuration set. Site binding is enforced in the data access layer; accidental multiple assignments are not possible.
Before each write operation, you can run a dry run that displays the generated SQL or exports it to a file. This makes it easy to see what would actually be written to the database.
Existing objects are detected and automatically skipped during import, ensuring that no duplicates are created.
Each import creates an entry in the WEM change log, marked with the tool of origin—ensuring that changes remain traceable in the audit trail.
Authentication against the WEM database is performed exclusively through Integrated Security; the tool does not store any passwords.
Technical Basis
The importer is implemented as a Windows Forms application based on the .NET Framework 4.8. Since this runtime is preinstalled on every current Windows Server, the EXE file remains compact and requires no additional installation. The tool accesses the WEM database directly. The SQL structures used were derived from the freely available Citrix.WEMSDK by Arjan Mensch and verified against actual WEM databases.
Support Information
Citrix does not officially support direct write access to the WEM database. Before deploying the tool in a production environment, it is recommended that you back up the WEM database and perform a dry run in a test environment. The tool is intended as a resource for administrators who are aware of this limitation and can work around it.
German 
English