World of EUC

image.png

We also had problems with msra. Here's how we fixed it.

I need to know this as well. Not 100% what rich grapic means in a policy term?

these are settings i normally use with Nvidia gpus

<@ULLH59VQF> It depends, what is your workload?

<@ULM6WD9LY>: I would advise to NOT combine Allow visually lossles with Build to Lossless, this will result in an incorrect behavior of the encoder.

Just office and generic no high end graphics 

I would do For Active changing regions with hardware encoding enabled. Quality set to high

Hi
Have you looked at the known issues and limitations in the doc? <https://docs.microsoft.com/en-us/microsoftteams/teams-for-vdi#known-issues-and-limitations>

It states the following for Calling and meetings :
Outgoing screen sharing:
• Application sharing is not supported.
Give control and take control:
• Not supported during a screen sharing or application sharing session.
• Supported during a PowerPoint sharing session.


Thanks for this hint <@UN02H1YHE> , this will be a crap...:see_no_evil: will goinh trough. Thanks agian meanwhile

Cool thanks. I need some advice for this. My security team is wanting it in Citrix asap. But i need to understand the impact.

RUN! Or prepare the security team for the invoices for the additional kit you’ll need.

Carbon Black even with proper setup for Citrix still has extra overhead. So by additional kit Kees means additional hardware as it will impact performance and density.

Everybody, please meet <@UK6S90JDR>, my newly build ’Translation As A Service” bot.

we went from 18-23 nodes with CB on there - you will 100% need more hardware to cater for the existing workloads - same user load / same spec VM’s

Damn, does it impact user logins as well?

it can do - need to be very careful with the config

Thanks for the information. Ill do my best to not allow this.

thats going to depend on the security posture of the company.  There are other products but there is every chance that you will be mandated to put this down along with a whole host of other security products and agents.  There is nothing wrong with this - just need to make the business aware of the additional compute requirements as well as test pre and post deployment for performance hit.

Cisco AMP is another product that treats virtual workloads the way Fred and Rose West treated babysitters

What are other products that will work well in a citrix environment better?

Centralized offloading as discussed here <https://docs.citrix.com/en-us/tech-zone/build/tech-papers/antivirus-best-practices.html|https://docs.citrix.com/en-us/tech-zone/build/tech-papers/antivirus-best-practices.html>

They're not doing the same thing since those are AV products not really EDRs but EDRs were not built for VDI. That's the sad reality

Yep depends what all you are required to have.

We just switched over to Palo Alto Traps, it's been pretty good so far.  Low impact.  Bitdefender was good to us as well., but our security team wanted something different, hence the switch.

I’ve seen good results with crowd strike 

<@ULHV2NMGQ> Did you apply Vmware's "Citrix Policies" when you did your testing?

and i mean the Carbon Black policies designed for Citrix

ahh - sry - at the all team meeting and missed this - no - we have a bunch of settings mandated by SOC teams - will check that out tho

No worries.  We are testing it out, and they gave us some "Citrix Polices" to apply on the console.  I just wonder how much they affect performance.

Unfortunately, there is no easy way to see the delta between the two.  You literally have to edit each policy and review the settings. I will get it together and send you something.  Unless you know something I don't

Yes, i'm going to find some time today to get those for you guys

<@ULHV2NMGQ> <@ULLH5JGFR> Ok, proof of "trust but verify"  VMWare guy made a new policy for "Citrix" and applied "custom configuration" to it... All he did was disable "Run Background Scan"  :confused:

Im not following, vmware guy made a policy? Assuming CB is apart of VMware now. They have a CB policy that disabled "run background scan"?

CB is owned by VMware, yes.  and yes, the CB policy for "Citrix Servers" is identical to the default policy, with just "run background scan" disabled

We have it running on our internal Server 2019 CVAD 1912 environment with about 50 users.

Thanks Ryan. So no tweaks? Just base install and good? No special CTX policies to make it work better?

I have done nothing special, and I get no complaints from my users.  No CPU alerts that it's killing servers.  :laughing:

The consumption depends on how many public and private channels and chats the user's is a member of but also on how many Slack teams the user is joined to

so no tweaks to disable auto updates or auto launch at startup even?

We actually force our users to auto-launch at start, so no.  I will check on auto-updates. We update the gold image regularly

we have had issues when it attempts to do updates, and it will break slack from opening. The way we have fixed this is by adding it to the ctxhook exclusion: HKLM\SOFTWARE\Citrix\CtxHook\ExcludedImageNames: slack.exe

also HKLM\SOFTWARE\Wow6432Node\Citrix\CtxHook\ExcludedImageNames: slack.exe

I do not have slack.exe in ExcludedImageNames, fyi

Josh's environment is clearly broken.  :wink:  :laughing:

<@UTT4BTR1S> You're running the machine-based installer?  not the user-based one?

I don't appear to be running anything special. after looking over my choco package, and my GPOs for this enviornment

yeah machine installer, but then users will get updates and it will move to their appdata. then it breaks

its def not for all users, but we have seen it enough times that we stuck it in excludedimagenames and that fixes it

looks like i have to use this command line to get slack working on our SHD when using ICA or RDP. slack.exe --usehwacceleration=false

So actually that didn't work every time. Seems this was necessary. <https://slack.com/help/articles/360035198374-Troubleshoot-Slack-in-a-Citrix-environment>

Looks like slack stores the data in %userprofile%\appdata\roaming\slack

I have that Syncing but the stored authentication token is not stored there apparently.

Odd. If I close slack and then log off the auth token seems to be sync'd.

So I got slack working on our CVAD environment. We are using RES for the user profile stuff. I noticed that when a user logs off, if slack is still open, it won't sync important files to the user profile because they are open and in use. Any RES experts out there I can talk to about this?

Never used RES, have you tried LogoffCheckSysModules?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI
Value Name:LogoffCheckSysModules
Type:REG_SZ
String:MyAppName.exe,conhost.exe

Nope. I’ll read up on what that does and consider testing it. 

I think that’s a good option, or force a slack logon during logoff events via CLI and have RES sync the config after that.

LogoffCheckSysModules had no effect on this.

well, that defeats the purpose for it. It is supposed to end it.

I used LogOffCheckSysModules when a process hangs at log off. Slack isn't "hanging". It closes properly but apparently not in the right order compared to when RES syncs the profile. Yep I'm going to test a script

Ahh yea, good point. Not hanging.. Right, didnt think that through

Logoff script did it! Thanks everyone for the suggestions.
taskkill.exe /IM slack.exe /U "%userdomain%\%username%" /S localhost /F

err.... false alarm. It's kind of sporadic. I'm opening a case with support to see about graceful exit via CLI

Hi community, is anyone had work on Linux vda on Debian ? Yes I know not supported :) but I like challenge :grin:

This appears to affect all Win10 / 2016 clients, running any version of Receiver or Workspace App.  To reproduce, you can minimize and restore repeatedly from the taskbar with certain apps, mainly my blasted EMR.

<@UK6S90JDR> is Jason Helms in this workspace?

Cerner has their own system for handling printers.  It used to be and may still be called WTS.  It uses the client name to handle “front-end” and “back-end” printer mapping.  It is unique because many of Cerner’s print jobs originate from the AIX servers.  (At least when I did a big project with them 3 years ago)

Thanks for the description <@ULMF0PLH2>. I feel this topic is not dry yet and others will add more (up to date) info

Is Helms some kind of a Cerner Superhero?

He works for Cerner and supports over 400k users in Citrix. Largest install in the US last I heard. He sees problems at scales most of us couldn’t fathom. He co-leads KC Metro CUGC with Jarian. 

400k is the largest environment I ever heard in the world. VMware/Citrix/RDS/anything other.
The 2nd largest is 350k, a bank that is in process of migration from Citrix to VMware (it was political)

I’ve heard of the client name thing before with this, I think they use a login script which sets the client name variable to the endpoint and passes it through. 

Yes, that is how WTS works.  There is a table that all of the Cerner parts refer to for printing.

Hahah  the Bank that starts with  a D moved from Citrix to VMware.

<@ULLH5JGFR> I was referring to bank's name that starts with C, based in New York. Are you sure about the "DataBase" bank too?

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/general-content-redirection/host-to-client-redirection.html>

This may work, not sure if PDF is supported, but worth a try.

Possible but didn’t use it in years. Easier/Less problems with local installed PDF viewer 

Local installed def works great if everyone is licensed for Acrobat DC pro vs standard, vs reader

looks like this method won't work for me <@ULW9PENH2>
```The following URL types are opened locally through user devices when host to client redirection is enabled:

HTTP
HTTPS
RTSP
RTSPU
PNM
MMS
To delete and add URL types, you can change the list of URL types for host to client redirection. URL types include custom types.```


<http://draw.io|draw.io>  so much faster than VISIO

Instead of the app opening the pdf file, could it "print" the pdf file using the Citrix PDF Printer? That usually passes the file to the client device and opens it in the local pdf reader.

really good idea... unfortunately no explored that already

keep em comin'.  Someone here is going to have the answer, if it exists.  (edited for <@ULHA2NPPX>)

I don't think there is anything built-in that can provide this feature, best I can find is this 3rd-party software: <https://www.mqtechnologies.com/en/product/Remote-File-Transfer>

It’s possible, but unfortunately pretty extensive. You can use/abuse any of the custom url types like pnm:// to send an argument to the client. You’ll need something on the client like a powershell script or custom written launcher to be started whenever pnm is put through that will then just have arguments like the app to open and the path to your file location for example.

That's if the local client computer even has access to where the file is stored, otherwise something on the host side would need to copy it locally first.

So basically this assumes the clients to be managed and would prefer the file to be network located accessible by the client. 

Exactly, was typing with one hand putting daughter to sleep ;). I’ve set it up so ping me if you need further details or help. But you see that it has its limitations already

Host side copy would be pretty easy though if cdm is allowed

If the file is accessible to the local client, then Local App Access may work for this situation, not much setup needed for that.

It wouldn't be accessible in 100% of cases... So we'd have to file copy and now we're starting to get so complicated that we're just trading the issue of licensing Acrobat for something that could be difficult to support. <@ULKKN0B44>  let me think on this and i'll reach out if i need any help getting it going...  Again thanks to all for the ideas

True, don’t see many platinum licences out there though :). Or did they move it again.

It let me enable without plat.. but there's a good chance that I would have had an issue there as well.

to be clear.. I'm talking about setting the policy which I would certainly not expect an alert about licensing at that point

Yeah you can even technically use it without . But pretty sure you still need plat for it eula wise.

Talking about local app access now btw, the host to client pnm thing is not plat.

While I kindof want to mess with the solution you're describing just to make it work.  I can't in good conscience hand that to my support team to support if something doesn't work like it should

probably best to go the route of installing Acrobat on the VDA

PDF files.png

Drew a quick diagram as pictures make things like this easier to communicate.

<@UL5TCSW3D>  i know u have some comparisons lol

I never see the black screen tbh......what does a ProcMon say?

I need to run a remote proc mon. I just watched o e of James videos. I see it as well. Maybe my expectations are to high.

Bear in mind my videos were shot in a lab where I can pretty much make everything as I want it........in the enterprise, pesky things like security and governance can sometimes get in the way. I usually go by the "rule of 20" for enterprise customers - 20 secs or less is good.

Although I did get a healthcare customer on VMware Horizon down to 7 seconds for logons not so long back :-)

I don't understand how u did that. I followed everything out there.

I have 7 seconds for published apps. But not desktops

Auto logon was the final two seconds' worth

Auto logon and logoff, a la George Spiers' article

Yea i do that as well. Shell keeps getting me with UFH/SFC key. Its killing me

I followed you fast login article u wrote about a year ago. 
The preloading exe I couldn't to work. But others i did.

You ripped everything out of the default profile too?

I'm in the middle of working on a script to do it

Ahhh i was looking for that. That will help alot.

Having some issues with 2016 though :man-facepalming:

Ok. I assume that is the link you referenced in the article fastest possible login times?

Stay tuned for a article dropping soon. On default profile exclusions

So if you trim the default profile. Is this only for the first login? Or is that applying Everytime?  Because once they get those settings then will all the work and data they modify their profile base on the work flow.

Yep, just applies first time, but should also ensure that the user profile is all correctly permissioned and whatnot

Gotcha. We use LTSC as well. I need to figure out how to do this. This will help shave off time.

Session Hosts up to date and registry "patched" for the local profile firewall bug?

On Windows 10 firewall rules tend to "accumulate", if that's what we're driving at

Don't have a link but check HKLM\system\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules on Windows 10

and this can cause that "black screen" issue?

Philip sent me a link on another thread. Trying to find this.

It can cause slow boots/logons, not sure on the black screen

<https://support.microsoft.com/en-us/help/4467684/windows-10-update-kb4467684|https://support.microsoft.com/en-us/help/4467684/windows-10-update-kb4467684>

wonder if that's the same on server 2019...

aha, they've fixed it then :slightly_smiling_face:

<https://worldofeuc.slack.com/archives/CK6RVLZ8S/p1580308618076800?thread_ts=1580308618.076800&amp;cid=CK6RVLZ8S|https://worldofeuc.slack.com/archives/CK6RVLZ8S/p1580308618076800?thread_ts=1580308618.076800&amp;cid=CK6RVLZ8S>

Looks like the patch didn't fix it. The reg key is still needed?

I'm setting up a GPO for that right now :slightly_smiling_face:

Where is said powershell script for that login time?

The ControlUp Analyze Logon Duration (ALD) script is here <https://www.controlup.com/script-library/Analyze-Logon-Duration/b636f434-2843-4a5c-a21a-eed7a02d0946/>

Run it outside of CU, where you need to see logon detailsm with parameters domain\username 0.0 sessionid

I have control up. For the black screen. Its shell.

I also use this script for looking at what processes started/stopped during the logon, especially at the times where the black screen starts and ends. Needs process creation/termination auditing enabled but the script can do that for you <https://github.com/guyrleech/Microsoft/blob/master/Get%20Process%20Durations.ps1>

And this script to trawl all 300 + event logs again so you can sift through for interesting/relevant events around black screen start/stop (updated today for combing multiple machines but that's more for when you have load balanced IIS servers, etc so don't know which server has a problem) <https://github.com/guyrleech/Microsoft/blob/master/event%20aggregator.ps1>

I don't have CU.. will try running manually

nothing's easy... `Failed to retrieve logon session for TEST\testuser from LSASS`

James, how so you know what exactly to delete in active setup with breaking things? I see some things related to like adobe, IE. I have no idea what they do? Trying to some type of correlation.

They're static per user config, really, so you can override with other methods

Yea i did a lot of reading on it. Cant believe i haven't paid attention to that.

To bad BISF couldn't do it. Well it could but not sure if he would add it

I stick a script in to do it all after build

<@ULJM9DQF2> Have you tired to put these Posh scripts in CU?

says #requires -version 3? POSH version 3 only?

<@ULJM9DQF2> what's the 0.0 signify in that syntax?

A citrix specific delay that ControlUp would normally fill in in the parameters it passes when the script is called via their console

so, the syntax is... `.\Get-LogonDurationAnalysis.ps1 TEST\testuser 0.0 &lt;sessionid&gt;`

FWIW, one of our XA admins currently testing 1912 LTSR says that fixed the black logon screen thing for her.

Not seeing this on ws16 or ws19, fully patched

thanks for the input!  we're on windows 10 1903 for reference

i'm trying a simple image (we also are an app layering shop) w/ just the OS layer, platform layer (version 1 that just has the vda install) and cqi layer and still stuck at collecting data so i am stumped.  does anyone have any ideas how to even troubleshoot that if its stuck at that step like what i might be missing in there?

what version of .net do you all have? i'm at 4.8 and wondering if thats part of the issue?  cannot get it to go for some reason

Given that we are on 64 bit OS, i would say no for session pool size reg keys.

Is there any need to change any of it anymore? It used to not handle multi 4k monitors that well, but I know the memory limit changed at some point, and it's different between xenapp and xendesktop too...

But then again, i cant even figure out how to optimize a default user profile for windows. So im questioning myself.

what I find confusing is the differences between xenapp and xendesktop settings don't seem that well documented, as some articles say settings apply to both when they don't. Like increasing the virtual GPU memory on the VM side doesn't seem to have any effect for XenApp as it doesn't use it, but it helps for XenDesktop

Yea i understand what u mean. I dont have a clear answer on this. Other than Shared vs single. But thats a educated guess.

The only semi recent xenapp setting I can find is the display memory limit in ICA policies

I'm trying to explain it to a client and running into the limits of my knowledge

This is alot to swallow.
<https://support.citrix.com/article/CTX115637|https://support.citrix.com/article/CTX115637>

yeah, that's what I was looking at, the reg keys only seem to apply to xenapp 5

and then the MaxVideoMemoryBytes key only applies to desktop vda

I don't think xenapp even uses the wddm driver

True, however its for For XenApp 4.x, 5.x. if the doc is accurate.

I guess that means you don't need to mess about with it in versions after that as it's all dynamically allocated?

Lets see if anybody has more input. But i am with u on that.

I thought ctxgfx used WDDM ? But its gets confusing!?

Does this help? <https://discussions.citrix.com/topic/393776-citrix-display-drivers/>

that helps for desktop OS, but what does server OS use?

The Citrix WDDM driver is no longer installed with VDAs after 7.16...  <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/whats-new/removed-features.html>

Which aligns with this. You taught me something new. Cool man. <https://support.citrix.com/article/CTX237608|https://support.citrix.com/article/CTX237608>

I was just reading that but still not sure if that applies to server 2019 as well as windows 10

It's hard to find anything specific to RDS and where it allocates display memory from

my guess is that it's available system RAM when there isn't a GPU, but exactly how that works now, I have no idea

Found something by Shawn Bass saying that it's essentially a software GPU so you should disable anything that wants to use hardware acceleration as that will tax it

it's an old article though, so not sure if the OS/programs still see the IDD device as a real GPU.
<http://shawnbass.com/psa-software-gpu-can-reduce-your-virtual-desktop-scalability/>

Try to disable Citrix hook on the process (need a reboot)

Start for zoom
<https://support.zoom.us/hc/en-us/articles/360031096531-Getting-Started-with-VDI?mobile_site=true|https://support.zoom.us/hc/en-us/articles/360031096531-Getting-Started-with-VDI?mobile_site=true>

First try Ray's advice then if not works try mine

One more

<https://help.webex.com/en-us/WBX16945/Does-Webex-Support-Citrix|https://help.webex.com/en-us/WBX16945/Does-Webex-Support-Citrix>

I know zoom works, when i did my control up on boarding. The guy was using zoom in vdi and he explained to me they just set it up. Its similar to all other vdi calling software. Offloads hdx to local client and does it magic.

is there a optimization pack ? if not and its not a optimized hdx realtime UCS app all you can really do is lower audio quality to medium optimized for speech/ enable audio over udp real time transport / enable microphone redirection / enable audio redirection

The audio set to medium is ok. But its still wonky.

I just delete the OEMDefaultAssociations file :slightly_smiling_face:

That's probably not going to work for me, lol

You can put the default associations into the default profile

Now I wish I hadn't deleted the damn default from a vanilla 1909. There's probably something in there that I need to change/add in mine.

The last time I ran into this, I had to create half a dozen entries in _HKCU\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts_ in the registry, mostly for IE, but also for .pdf files. Do I still need to worry about the _Shell\Associations_  and _FileExts_ keys in the registry?

At this point, I'm just trying to figure out my next angle of attack. I reset the XML to the default 1909 file, but it still threw the same exact reset errors at logon.

Found a few threads of people who are running into the same exact issue as me, right down to the same exact app reset messages: <https://www.reddit.com/r/SCCM/comments/eopjw0/avalanche_of_default_app_resets_upon_login/>

Doesn't exactly bode well for me for this in-place 1909 upgrade.

Looks like it's a confirmed bug by MS, with no fix yet: <https://social.technet.microsoft.com/Forums/en-US/ad37cd15-315e-4f9b-ba34-bcbd987981fc/quotan-app-default-was-resetquot-error-newly-sysprep-windows-10-ltsc-2019-enterprise-image?forum=win10itprosetup>

My 2 vCPU target devices don't see the errors, but my 4 vCPU target devices do. JFC, Microsoft.

Glad u found this. Atleast something is cooking on it.

In case anyone comes across this, Microsoft has said that it will be resolved in April's patch Tuesday.

If you have the subscription available, I‘d recommend to go with Office 2019 KMS or preferably ADBA

nice one, i see you have BCR extension installed in Edge, is it working?