Part 1
run regedit.exe
right click on HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum
Permissions...
Select Everyone
Check Full Control

Part 2
rem Hide ejectable devices so that a user doesn't accidentally disconnect a network adapter.
rem To hide it, subtract 4 from the capabilities of any device.
REG.EXE ADD "HKLM\SYSTEM\CurrentControlSet\Enum\XEN\VIF\0" /v Capabilities /t REG_DWORD /d 00000012 /f
REG.EXE ADD "HKLM\SYSTEM\CurrentControlSet\Enum\XENBUS\CLASS&IFACE\_" /v Capabilities /t REG_DWORD /d 00000032 /f
REG.EXE ADD "HKLM\SYSTEM\CurrentControlSet\Enum\XENBUS\CLASS&VIF\_" /v Capabilities /t REG_DWORD /d 00000032 /f

This worked for me on Windows XP so I imagine that it should work on Windows 2003 Server with out any modifications.

Since my VMs are done through MCS I needed to add the part 2 reg keys to the login script.

Reference：http://forums.citrix.com/thread.jspa?threadID=296397