Introduction:
A while back I needed to automate the deployment of Citrix StoreFront 3.x for a customer I was working for at the time. However it wasn’t perfect. It only did the installation of the software and didn’t do anything with stores, server groups and certificates. Since time was scarce these items were put on hold. However, I put them on my own ToDo-list with the goal to automate an (almost) complete deployment of StoreFront with Ivanti Automation and share it with anyone who would like to use it.

I will give a small walkthrough of the automation steps and why I made certain decisions and of course instructions on how to import and use them.
You can find the download link for the Ivanti Automation building blocks here and also at the bottom of this blog post.

These modules have been tested on Windows Server 2012 R2 and 2016 (with User Experience enabled) and up to StoreFront version 1912.

Instructions:

Import the Ivanti Automation building block and change the following (global) variables in your Automation deployment:

Installation Account
Credentials for the account that will be used for software installation
Installation Account username
Username for the account that will be used for software installation
Software Source
Your software share, for which the installation account should have the appropriate rights

(And yes, there are two variables for the Installation Account. One for the complete credentials and one for just the username.)

After that, schedule the first module for the agent on the first StoreFront server to be and it will ask you for all the required information (Base URL, XenDesktop site name, XenDesktop Delivery Controllers and the StoreFront store name).
Schedule the second module for the agent on the second StoreFront server and it will ask you for the hostname or IP address of the first StoreFront server.
Of course, your software share should contain the Citrix StoreFront 3.x software which you can download from Citrix.com. Just extract the ISO to a folder on your software source and you should be fine. The module will ask for an exact location when scheduling.

The configuration of the stores and server group is done through PowerShell. I will add the configuration scripts below for the people who don’t want to use Ivanti Automation for deployment (if they exist ;-)).

I could have used more pre-defined Ivanti Automation tasks, but my goal was to make the scripts usable without Ivanti Automation for as much as possible.

Modules overview:

There are two modules in the building block:
StoreFront 3.x – Part 1 – First server – Install software & Configuration
StoreFront 3.x – Part 2 – Additional server – Install software & Join server group

Use the ‘Part 1’-module for deployment of the first server and the ‘Part 2‘ module for any additional servers (don’t run the additional servers all at once).

Modules walkthrough:

StoreFront 3.x – Part 1 – First server – Install software & Configuration

Add RES installation account to local administrators
For when you haven’t done this through GPO for example.
Add required Windows Features – Windows Server 2012 R2
With conditions for the Operating System
Add required Windows Features – Windows Server 2016
With conditions for the Operating System
Install StoreFront
Copy StoreFront shortcut to desktop
Personal thing. I prefer to have the specific management consoles for which the server is used to be visible for every administrator that logs on.
Reboot Computer
Add machine to StoreFront team
Not really necessary but handy for when you also use RES ONE Automation as a management tool.
Create StoreFront store
PowerShell script that creates the store, creates and binds a self-signed certificate and creates a redirect from the wwwroot to the created store.
Disable check publisher’s certificate revocation
Console responsiveness improvement.

StoreFront 3.x – Part 2 – Additional server – Install software & Join server group

Add RES installation account to local administrators
Add required Windows Features – Windows Server 2012 R2
Add required Windows Features – Windows Server 2016
Install StoreFront
Copy StoreFront shortcut to desktop
Reboot Computer
Add machine to StoreFront team
Join existing StoreFront server group
Add machine to StoreFront team

Known issues:

– When configuring StoreFront for the first time it needs to create an initial store. However with this store the available options are limited. So in my PowerShell script, an initial store will be created, the definitive store will be created and after that the initial store will be deleted (not really an issue, but still worth mentioning).

Footnote:

That’s it again for now. Try the modules if you like and let me know if you have any problems. I will also look into the automated deployment of Director, Licensing and Provisioning Services. So stay tuned. 😉

DISCLAIMER: This is just my take on the automation of StoreFront 3.x with Ivanti Automation. So if you have any suggestions on how to improve these modules: I would be very happy to hear it. As for the scripts below: I’m in no way an expert PowerShell scripter, so it might not always be the most efficient code, but it gets the job done. Also, feel free to use it/alter it/publish it as your own.

Edit March 1st 2018:
This module has been tested with StoreFront 3.14 and Ivanti Automation 10.2.100.0 and works accordingly.

Edit July 23rd 2018:
Revised the scripts and tested with StoreFront 3.15 and Ivanti Automation 2018.1.

Edit August 2nd 2018:
It seems that during the joining process the StoreFront servers use a randomly selected port. This is not a problem for the Windows Firewall (if active) since the exceptions are created for the application and not a specific port. However, if both StoreFront servers are in seperate networks with a firewall between them you can set a specific port. Check Citrix article CTX101810 for more information. But I have NOT tested this myself.
Big thanks to Mark for pointing this out.

Edit March 10th 2020:
Revised the scripts and tested with StoreFront 1912. Added the suggestion for adding the certificate to the Trusted Root Certification Authorities store (thanks to Michell Grauwmans). The download at the top of this post has been updated with the most recent building blocks.

PowerShell scripts:
Create StoreFront store

# SCRIPT INFO -------------------
# Script that creates a store in Citrix StoreFront 3.x
# Run on designated StoreFront server
# By Chris Jeucken
# -------------------------------

# PREREQUISITES -----------------
# Import required PowerShell modules
    . "C:\Program Files\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"
    Start-Sleep -Seconds 10
# -------------------------------

# VARIABLES ---------------------
# User defined variables
    $SFBaseURL = "$[SFBaseURL]"								  
    $XDDeliveryController1 = "$[XDDeliveryController1]"
    $XDDeliveryController2 = "$[XDDeliveryController2]"
    $StoreFriendlyName = "$[SFStoreName]"
    $XDFarmName = "$[XDSiteName]"
# Pre-defined variables
    $SiteID = 1
    $AuthenticationVirtualPath = "/Citrix/Authentication"
    $StoreFriendlyNameWithoutSpaces = $StoreFriendlyName -replace '\s',''
    $StoreFriendlyNameWithoutSpacesWeb = $StoreFriendlyNameWithoutSpaces + "Web"
    $StoreVirtualPath = "/Citrix/" + $StoreFriendlyName -replace '\s',''
    $StoreVirtualPathWeb = $StoreVirtualPath + "Web"
    $StoreURL = $SFBaseURL + "/Citrix/" + $StoreFriendlyNameWithoutSpaces
    $FarmType = "XenDesktop"
    $Port = "80"
    $TransportType = "HTTP"
    $ServicePort = "80"
    $SslRelayPort = "443"
    $RedirectFile = "SFRedirect.html"
    $RedirectPath = "C:\inetpub\wwwroot\"
    $RedirectPage = $RedirectPath + $Redirectfile
# -------------------------------

# SCRIPT ------------------------
# Create initial store (will be deleted after creation of the definitive store)
    Set-DSInitialConfiguration -HostBaseUrl $SFBaseURL `
        -FarmName $XDFarmName `
        -Port 80 `
        -Transporttype HTTP `
        -SslRelayPort 443 `
        -Servers @("tempddc.domain.lan") `
        -LoadBalance $false `
        -FarmType "XenDesktop" `
        -StoreVirtualPath /Citrix/TEMP `
        -WebReceiverVirtualPath /Citrix/TEMPWeb
# -------------------------------
    
# Create StoreFront store with one defined XenDesktop Delivery Controller
    if ($XDDeliveryController2 -eq "") {
        $AuthSummary = Get-DSAuthenticationServicesSummary -SiteID $SiteID
        Install-DSStoreServiceAndConfigure -SiteID $SiteID `
            -FriendlyName $StoreFriendlyName `
            -VirtualPath $StoreVirtualPath `
            -AuthSummary $AuthSummary `
            -FarmName $XDFarmName `
            -FarmType $FarmType `
            -Servers @($XDDeliveryController1) `
            -TransportType $TransportType `
            -ServicePort $ServicePort `
            -SslRelayPort $SslRelayPort

        Install-DSWebReceiver -FriendlyName $StoreFriendlyName `
            -SiteID 1 `
            -StoreURL $StoreURL `
            -useHttps $false `
            -VirtualPath $StoreVirtualPathWeb
    }
# -------------------------------

# Create StoreFront store with two defined XenDesktop Delivery Controllers
    if ($XDDeliveryController2 -ne "") {
        $AuthSummary = Get-DSAuthenticationServicesSummary -SiteID $SiteID
        Install-DSStoreServiceAndConfigure -SiteID $SiteID `
            -FriendlyName $StoreFriendlyName `
            -VirtualPath $StoreVirtualPath `
            -AuthSummary $AuthSummary `
            -FarmName $XDFarmName `
            -FarmType $FarmType `
            -Servers @($XDDeliveryController1,$XDDeliveryController2) `
            -TransportType $TransportType `
            -ServicePort $ServicePort `
            -SslRelayPort $SslRelayPort

        Install-DSWebReceiver -FriendlyName $StoreFriendlyName `
            -SiteID 1 `
            -StoreURL $StoreURL `
            -useHttps $false `
            -VirtualPath $StoreVirtualPathWeb
    }
# -------------------------------

# Create self signed certificate and bind it to site
    if ($SFBaseURL -like "*https*") {
# Remove https from URL 
        $SFBaseURLShort = ($SFBaseURL -replace "https://","")
# Create self signed certificate
        $Certificate = New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname $SFBaseURLShort
# Add certificate to Trusted Root Certification Authorities
        $CertificateRootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store -ArgumentList Root, LocalMachine
        $CertificateRootStore.Open("MaxAllowed")
        $CertificateRootStore.Add($Certificate)
        $CertificateRootStore.Close()
# Get certificate thumbprint
        $Thumbprint = $Certificate.Thumbprint
# Create new IIS binding
        New-WebBinding -Name "Default Web Site" -IP "*" -Port 443 -Protocol https -Verbose
# Add certiticate to IIS binding
        Start-Sleep -Seconds 5
        $Binding = Get-WebBinding -IPAddress "*" -Port 443 -Protocol https
        $Binding.AddSslCertificate($Thumbprint, "my")
    }
# -------------------------------

# Create redirect to StoreFront site
    Add-Content -Path $RedirectPage -Value ""
    Add-WebConfiguration "system.webserver/defaultdocument/files" -atIndex 0 -Value $RedirectFile
# -------------------------------

# Remove initial store ----------
    Remove-DSStore2 -SiteID 1 -VirtualPath "/Citrix/TEMP"
# -------------------------------

Join existing StoreFront server group

# SCRIPT INFO -------------------
# Script that queries a existing StoreFront server for it's passcode and adds the additional StoreFront server to the server group
# Run on a new additional StoreFront server.
# By Chris Jeucken
# -------------------------------

# PREREQUISITES -----------------
# Import StoreFront PowerShell modules
    . "C:\Program Files\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"
    Start-Sleep -Seconds 10
# Set Execution Policy Bypass
	Set-ExecutionPolicy -ExecutionPolicy Bypass -Force
# Set Stop on error
	$ErrorActionPreference = "Stop"
# Disable open file security warnings
	$env:SEE_MASK_NOZONECHECKS = 1
# -------------------------------

# VARIABLES ---------------------
# User defined variables
	$SFExistingServer = "$[SFExistingServer]"
# Pre-defined variables
# Locations
	$RemoteConfigFolder = "_CONFIG"
	$RemoteConfigPath = "\\$SFExistingServer\c$"
	$RemoteRedirectPath = "\inetpub\wwwroot\"
	$LocalConfigFolder = "_CONFIG"
	$LocalConfigPath = "C:"
	$LocalRedirectPath = "C:\inetpub\wwwroot\"
# Files and scripts
	$RedirectFile = "SFRedirect.html"
	$RemoteRedirectPage = $RemoteConfigPath + $RemoteRedirectPath + $Redirectfile
	$RemotePasscodeScript = "$RemoteConfigPath\$RemoteConfigFolder\SFPasscodeScript.ps1"
	$LocalPasscodeScript = "$LocalConfigPath\$LocalConfigFolder\SFPasscodeScript.ps1"
# -------------------------------

# SCRIPT ------------------------
# Create PowerShell Session object
	$PSSession = New-PSSession -ComputerName $SFExistingServer
# Check if folders and/or files already exist
	if ((Test-Path $RemoteConfigPath\$RemoteConfigFolder) -eq 0 ) {
		mkdir $RemoteConfigPath\$RemoteConfigFolder
	}
	if ((Test-Path $RemotePasscodeScript) -ne 0) {
		Remove-Item $RemotePasscodeScript
		}
	if ((Test-Path $RemoteConfigPath\$RemoteConfigFolder\Passcode.txt) -ne 0) {
		Remove-Item $RemoteConfigPath\$RemoteConfigFolder\Passcode.txt
	}
# Create script on existing StoreFront server
	Add-Content -Path $RemotePasscodeScript -Value ". ""C:\Program Files\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"""
	Add-Content -Path $RemotePasscodeScript -Value "Start-DSClusterJoinService"
	Add-Content -Path $RemotePasscodeScript -Value "`$Passcode = (Get-DSClusterJoinServicePasscode).Response.Passcode"
	Add-Content -Path $RemotePasscodeScript -Value "`$Passcode > $LocalConfigPath\$LocalConfigFolder\Passcode.txt"
# Run script on existing StoreFront server
	schtasks /Create /F /TN SFPasscodeScript /S $SFExistingServer /RU "SYSTEM" /TR "powershell.exe -File $LocalPasscodeScript" /SC once /ST 23:30
	schtasks /Run /TN SFPasscodeScript /S $SFExistingServer
	While ((schtasks /Query /TN SFPasscodeScript /S $SFExistingServer /fo List)[5] -notlike "*Ready") {
		Write-Verbose -Message "Waiting on scheduled task..."
	}
	Start-Sleep -Seconds 5
	$SFPasscode = Get-Content -Path "$RemoteConfigPath\$RemoteConfigFolder\Passcode.txt"
	schtasks /Delete /TN SFPasscodeScript /S $SFExistingServer /F
	Remove-Item $RemoteConfigPath\$RemoteConfigFolder\Passcode.txt
	Remove-Item $RemotePasscodeScript
# Join new server to StoreFront group and wait a while for completion
	Start-DSClusterJoinService
	Start-DSClusterMemberJoin -authorizerHostName $SFExistingServer -authorizerPasscode $SFPasscode
	Start-Sleep -s 300
	Invoke-Command -Session $PSSession -Scriptblock {
		. "C:\Program Files\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"
		Stop-DSClusterJoinService
	}
	Start-Sleep -seconds 30
	Stop-DSClusterJoinService
# -------------------------------

# Propagate changes from existing StoreFront server
	$PSSession = New-PSSession -computerName $SFExistingServer
	Invoke-Command -Session $PSSession -Scriptblock {
		Add-PSSnapin Citrix*
		Start-DSConfigurationReplicationClusterUpdate -confirm:$FALSE
	}
# -------------------------------

# Create self signed certificate and bind it to site
	$SFBaseUrlFull = Get-DSHostBaseUrl
	$SFBaseUrl = $SFBaseURLFull.hostBaseUrl
    if ($SFBaseURL -like "*https*") {
# Change URL to correct format
        $SFBaseURLShort = ($SFBaseURL -replace "https://","")
		$SFBaseURLShort = ($SFBaseURLShort -replace "/""")
# Create self signed certificate
        $Certificate = New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname $SFBaseURLShort
# Add certificate to Trusted Root Certification Authorities
        $CertificateRootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store -ArgumentList Root, LocalMachine
        $CertificateRootStore.Open("MaxAllowed")
        $CertificateRootStore.Add($Certificate)
        $CertificateRootStore.Close()
# Get certificate thumbprint
        $Thumbprint = $Certificate.Thumbprint
# Create new IIS binding
        New-WebBinding -Name "Default Web Site" -IP "*" -Port 443 -Protocol https
# Add certiticate to IIS binding
		$Binding = Get-WebBinding -IPAddress "*" -Port 443 -Protocol https
		$Binding.AddSslCertificate($Thumbprint, "my")
    }
# -------------------------------

# Create redirect to StoreFront site
	Copy-Item -Path $RemoteRedirectPage -Destination $LocalRedirectPath
	Add-WebConfiguration "system.webserver/defaultdocument/files" -atIndex 0 -Value $RedirectFile
# -------------------------------

Building blocks: