World of EUC

just talking GPO here, not talking any 3rd party EUM stuff like WEM, EM, etc....

i know with appsense/ivanti EM you can apply things on disconect/reconnect, it wouldn't encompass everything tho.  Not 100% with WEM

You can configure WEM to apply on reconnect

Could you _please_ stick to the threads? It’s getting cluttered here in the <#CK6TCV3JN|> channel. Thank you!

Found the issue, we ran a command "sc sdset scmanager" to give access to our monitoring software, apparently it overwrote the existing permission set and we had to restore it. Good to know notifications relies on these permissions.

You can still reply back to message which keeps threads in tack in Slack.

image.png

I have actually never seen that.  Have you tried rebooting the appliance?  Also you did not change the name of the appliance in centos did you?

<@UM04QUUSJ> Thank you for your message.. Yes have already tried with rebooting. Host name is same and is trying t o access via IP

Has this ever worked or is it new? Do you have 3504 open from your desktop to the appliance

Also what version of app layering is this

Thank you <@UM04QUUSJ> for your inputs. I redployed the connector the ELM and luckily it worked... Thank you again for your inputs

I have a minor, but annoying issue on a CVAD 2302/Windows Server 2022 environment. I cannot log disconnected sessions off using Director or Studio. If they are active, they log off. They can be reset using *logoff x /server:vdaname* from the command line, or even using the legacy *tsadmin.msc* console. When I try to log them off using Studio/Director though nothing happens. Nothing is logged in the event logs that I can see either. Anyone else seen this? This will cause issues once I hand it off to the support desk.

EDIT. Same behaviour in web studio. Active sessions log off with no issues, even if lingering. Disconnected sessions won't log off. It is very odd.

In the FAS event logs do you see something like this for the new  SF server

[domain\servername-CSF2$] issued identity assertion [upn: user@domain rule Default, Security Context: []]. [correlation: Bunch of numbers

SF server has the GPO for FAS applied and you see the reg key here?

*HKLM\Software\Policies\Citrix\Authentication\UserCredentialService\Addresses*

Make sure the callback is listed under the Manage Gateway section in SF and the store has "Fully Delagated Credential validation to NetScaler Gateway" set. Being it's another SF server it should have it. But just check.

i figured it out...its the access control list in the FAS console...i had to add the SF servers to that list.

IGEL has a massive Slack community: <https://www.igelcommunity.com/>

We don’t have one here. Just a general <#CLM3Z9QQP|> channel. 

Technically there is alot that comes into play when files are deleting in one place but not the other. The first being there a syncing in progress in either the local device or the VDI. When you have multiple devices syncing files with OneDrive, conflicts can occur if changes are made simultaneously on different devices. OneDrive may resolve these conflicts by deleting files it considers duplicates. Check if any conflicts have been reported in the OneDrive interface or event logs. These are the sync folders on my test environment the VDI user is able to sync down from OneDrive. [2:58 PM] Files On-Demand are a headache in VDI if there are no DehydrateSyncedTeamSitespolices in place.  For example if you click on a shared sharepoint site the files-on demand will start downloading that entire site to your local machine or vdi and you will run out of space very quickly.  check to see if the files that are being deleted are in any of those sync folders.

Thank you Holmand. In my case, One Drive automatically  starts deleting the files which user has saved in One Drive ( in local machine)

what kind of profilesolution are you using? fslogix or upm? We've seen the same issue if there was a problem mounting the profilecontainer in fslogix

<@ULJM4N4JG>, Thank you for your message. We are using UPM

<@ULJM4N4JG> Could you please let me me know how you managed to fix the issue in your case

Sorry been out of town for a while. We didn't really do much, it was due to a issue with one of the profile servers. Which UPM version are you running?

<@ULJM4N4JG>, No problem Tom.. We are using Citrix Profile Manager

Thank you Holmand. You mean we need to enable this policy ?

Even though my VDAs are AAD joined ...that property always showing "NotAzureADJoined"

i think that is reserved for a future update. not all properties visible in powershell are useable at this time. i know. i spot them when updating my doc scripts and citrix tells me they were made visible by mistake or reserved for an update in the works. and even though citrix may explain the intent and usage to me because of my multiple ndas, i am asked to not use the properties, not document them, or explain them to anyone - even other CTPs.

What's the command line switch to keep the stub apps out of the add/remove programs list?

Can't imagine it would have a negative impact, usually LLDP is more for the network devices

Theres also this doc <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/secure/tls.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/secure/tls.html>

Thanks rob! This article is quite comprehensive, is using netsh still a valid means to check for TLS bindings on the VDA side? I think that is my issue.

I will also state, that the PS command of *Test-connection -computername VDAWTLSCERT.fqdn -port 443* also fails, despite the firewall being opened.

im not sure I havent done this in years either.  Let me try and find out

im not sure if the tls is only bound to our protocols or not the net sh woud probably only show if bound globally

On my windows 11 i had to use netsh http show sslcert to see certs.  I have not tried wiht the whole tls thing on the vda just on my normal desktop

Build vm - seal - create ami - update catalog with ami :joy: 

If there is an existing image do I still use ami or is there a method to boot master, update, snapshot/version etc? This is relating to the one I was talking about with portability service etc.. just need to get my head around managing an image first of all :slightly_smiling_face:

Think of an AMI as a snapshot of the vm with a Citrix lens - each update you do, you create a new AMI 

<https://docs.citrix.com/en-us/citrix-daas/install-configure/machine-catalogs-create/create-machine-catalog-aws.html|https://docs.citrix.com/en-us/citrix-daas/install-configure/machine-catalogs-create/create-machine-catalog-aws.html>

And that’s why we don’t blindly trust chatGPT. I’ll leave you to spot the massive fail in that process :man-facepalming: 

Just done it .. worked first time :stuck_out_tongue:

Ignored that obv... its 'mostly' good :stuck_out_tongue:

AMIs work alot better than Azure disk snapshots....easier to manage. Also becareful when creating an AMI to not bundle in the secondary drive as it breaks the MCS process - itll fail

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/policies-create.html>

An assignment’s mode determines if the policy is applied only to connections that match all the assignment criteria. If the mode is set to Allow (the default), the policy is applied only to connections that match the assignment criteria. If the mode is set to Deny, the policy is applied if the connection does not match the assignment criteria. The following examples illustrate how assignment modes affect Citrix policies when multiple assignments are present.
• *Example: Assignments of like type with differing modes* - In policies with two assignments of the same type, one set to Allow and one set to Deny, the assignment set to Deny takes precedence, provided the connection satisfies both assignments. For example:
• Policy 1 includes the following assignments:
    ◦ Assignment A specifies the Sales group. The mode is set to Allow.
    ◦ Assignment B specifies the Sales manager’s account. The mode is set to Deny.
• Because the mode for Assignment B is set to Deny, the policy isn’t applied when the Sales manager logs on to the Site, even though the user is a member of the Sales group.
• *Example: Assignments of differing type with like modes* - In policies with two or more assignments of differing types, set to Allow, the connection must satisfy at least one assignment of each type for the policy to be applied. For example:
• Policy 2 includes the following assignments:
    ◦ Assignment C is a User assignment that specifies the Sales group. The mode is set to Allow.
    ◦ Assignment D is a Client IP Address assignment that specifies 10.8.169.* (the corporate network). The mode is set to Allow.
• When the Sales manager logs on to the Site from the office, the policy is applied because the connection satisfies both assignments.
• Policy 3 includes the following assignments:
    ◦ Assignment E is a User assignment that specifies the Sales group. The mode is set to Allow.
    ◦ Assignment F is an Access Control assignment that specifies NetScaler Gateway connection conditions. The mode is set to Allow.
• When the Sales manager logs on to the Site from the office, the policy isn’t applied because the connection does not satisfy Assignment F.


the policy modeling wizard would be a useful tool as well

Ah.. that was the piece I missed.. I was trying to find exactly that :slightly_smiling_face: thanks!

It took me to the correct direct link <https://developer-docs.citrix.com/projects/citrix-daas-sdk/en/latest/group-policy-sdk-usage/#how-do-filters-get-applied;>  short version - filters of the same type are OR'd together, filters of different types are AND'd together.

<@UL5TCJ57D> Ping Matt on this, easy one for ya! :slightly_smiling_face:

Ahh yeah.  Haven’t done it with Citrix cloud did it with on prem CVAD but process is the same.  Just the connection to start is different.

Big thing is getting the correct business logic for data retention.  They say they want it termed automatically until that one time a lawyer comes and says ‘oh we needed something’

In this case seems like it's just a query for active session, if exists, log out

Ahhh I glanced over ‘sessions’ and was thinking just VDI overall.

I played a bit with the Rest API assuming there is a PUT for logoff, haven't looked

There is a get for querying sessions and a POST for logging off by session ID, I’ve done mostly with powershell in the past though

Has it stopped working in just this specific application? If you test the web cam using the browser in the session or in another application, does it work then?

Doe the webcam work with this utility?
<https://support.citrix.com/article/CTX547245/webcam-preview-test-application>

Hi All, Thanks for your reply, unfortunately turned sick the last few days, so apologize my late reply.
Teams is working fine and Webcam is working also fine. Also the webcam test worked successfully, it is just won`t within PDF Annotator

So they're using Server 2022 with the "/SERVERVDI" switch to make them dedicated persistent one-to-one instances?

The main gotcha you probably need to remember is there is no RDSH in the mix, so things like RDSH timeout policies won't work, you'll have to use the Citrix policies instead

Also I'd be concerned about the potential Office licensing removal as things move forward (which they might well change, but hey-ho)

Thanks for the feedback <@UL5TCSW3D>. I think that's how they have tested it. We are looking to support the build of a new on-prem DC (other bits in AWS) and manage this official build/deployment of the new VDI workloads.

We ran devs with one-to-one instances of Server 2016 in AWS though, and it worked fine

Yeah, the office is a slight concern I was going to call out... Im not even sure if they have the right licensing in AWS, that could be in breach but yet to confirm, cheers

Might need some significant retest when Server 2022 gets that awful Windows 11 GUI though

Good call.. I will voice these points bud :slightly_smiling_face:

Office is supported on Server 2022 through to 2026 if that helps.
<https://learn.microsoft.com/en-us/deployoffice/endofsupport/windows-server-support>

I'm working on something similar now with a couple dev teams but using win10. First thing i determined was a standard performance tier disk is the biggest bottleneck. easy fix though.

yup immediately had connection issues so rolled back until fix is released. There is a hot fix out at the moment but I wil wait more. I don't see any great additions in 2303 so happy waiting.

what version did you rollback to? We're upgrading from an ancient version lol

Mentioned here about support from June 2022 on Citrix DaaS.    Which is what we are using..

do we need 2206 minimum functional level?  :dizzy_face:

LHC will handle most of it on CVAD, pvs you need to enable the offline DB mode. But man that’s crazy to do a I place upgrade on a SQL box. I just went through this and migrated the databases for a client. 

Most configuration databases will be cashed locally in ddc's using local host cache.. however the loging will not be cashed locally. So the impact might be log files..   However if you have a availability sql configuration. Then it will not be a problem as you will be upgrading slave and then master..

Bear with me, as I’m not a DBA and so I may not be using the correct terminology. But, I was told by the DBA that our named SQL server is actually a SQL always-on cluster made up of three nodes. He will be upgrading each of those on different days. I think this means I shouldn’t have to do anything, but I wanted to verify. 

Lovely, thank you so much. I’ve learned a lot and now I’m reading about always on availability groups.

I think it should be ok.  If you get tested the upgraded node first on out of business hours with few administrative teams ..then you confirm that the upgrade has no problems. Alternatively you need to upgrade two nodes if your testing period leaves for 1wk or 2.  I am sure you will do backups first before upgrading then you always have option to bring back old.   Everything should go smoothly without pain .. but again we never know.

Regards to LHC: the registrations to vda with users will be impacted as it will will be looking for sql connections for new vda registrations ..but no problem for already registered vda configurations..

Are you referring to new user sessions, or just registered VDAs? I can make sure our VDAs don’t undergo scheduled reboots during the maintenance period.

The SQL upgrade maintenance period, I mean. 

Not completely  “During the time it takes all VDAs to register with a secondary broker, that service might not have complete information about current sessions. So, a user connection request during that interval can result in a new session being launched, even though reconnection to an existing session was possible. This interval (while the “new” secondary broker acquires session information from all VDAs during re-registration) is unavoidable. Sessions that are connected when an outage starts are not impacted during the transition interval, but new sessions and session reconnections might be.”

[<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/local-host-cache.html#what-is-unavailable-during-an-outage-and-other-differences>](<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/local-host-cache.html#what-is-unavailable-during-an-outage-and-other-differences>)

I just have a blanket rule. No in place OS upgrades, unless upgrading an NT4 PDC to AD. Then you have to, but not much call for that recently! Plus you immediately build a new DC and get rid of the upgraded one. Cant you add new nodes with latest OS, then decommission the old ones?

Unfortunately, the SQL servers being upgraded are controlled by a completely different team, and there are more than just my Citrix databases being stored there. I have no say in how it’s being done… I can only try to keep the Citrix impact to a minimum due the process. 

The CVAD should go into cached mode (users can only launch applications they've already launched previously) while the database is down.  However, PVS will likely go down and those VDAs will probably become unavailable. You'd have to confirm it, but I do believe that is what happens.

The SQL server that is being called by Citrix is actually part of some sort of node group of three SQL servers. These are being upgraded on different days. So, technically, the SQL databases should never be inaccessible. That is what I’m gathering at least. 

Ok.. if the SQL is fully HA, then it shouldn't be much of an affect on any of the VDA's.  The worst case is that an incoming connection doesn't work, they might have to retry.

Are you enabling the files on demand configuration ? What profile management solution are you using?

They normally roll out as soon as I get everything on latest CU. So anytime now since I am done with CU2. :joy::smile:

The preview was available a month ago with a deadline for feedback nearly 2 weeks ago, so it should be right around the corner.

Should be every 6 months, so I'd expect it very soon

New version of license server dropped. So, CU3 should be likely be tomorrow.

Once <@ULC9J5XPB> upgrades, he will let us know any issues  lol

Man, we still haven't even deployed 1912 CU6, you might be waiting a while for me...

We just updated to 1912 CU6 right before CU7 dropped.

That said, I will be testing the 2203 CU3 VDA the moment it's released to confirm that the BSOD issues that we saw in base 2203 and CU2 are truly resolved. The private hotfix we received for CU2 did work, and is included in CU3.

Thanks Nick for all the testing on that as well. It did not impact me yet. But thanks to folks like you and <@URVNXB96C> for ironing this out with support. Which makes it better for everyone.

awesome i didnt notice cu3 was released! i'll check it out. i've been on the early release of it for a couple of weeks now and zero crashes

ahh ok so still in beta/preview. either way im glad my crashes stopped! my long running case claims that engineering says that the fixes should not be related at all to our crash files that we submitted but both myself and one engineer have not had a crash since applying that private fix

support told me today cu3 isnt going to be until august most likely

I guess they found bugs and need time to pivot, since they were asking for feedback by 5/15.

His phrasing was by the beginning of August so maybe he's giving a high estimate to play safe

2203 CU3 released: <https://twitter.com/cstalhood/status/1664313906054004737>

That's about right after how that 8 month long ticket went:joy:

No, policies should simply work if in the correct order - maybe a policy cache issue locally? Or a hidden policy in a GPO vs studio etc?

Hey James! Thanks for your reply, just ran a group policy modeling wizard summary, and am not seeing anything that's over-riding the policy set by Citrix Studio. So, it's not clear where the over-ride comes from

is there a chance your policy set to allow isn't applying? I recall having this exact sort of fun with some keyboards (maybe bloomberg?) and having to get down and dirty with specific device redirections <https://support.citrix.com/article/CTX137939/citrix-generic-usb-redirection-configuration-guide>

FYI I deleted discord posts not in the thread that were spamming the main channel

ok! I reviewed the article, only policy option not enabled is shown below, I will have the client test again, I don't have access to the impacted physical device myself
In your case, <@UKJTJD4KA>, how much detail did you have to get into to resolve the issue with bloomberg keyboards? did you need to use USBVIEW to collect VENDOR IDs?

ah yep, it was about 12 months ago now, but had to go get the ID's and pass them in

This seems to be the culprit - testing this now

<https://support.citrix.com/article/CTX472865/cvad-version-2206-2209-gpss-fail-to-apply>

Confirmed, this does resolve the policy processing on VDA 2209

VDA 2212 is quite stable, should solve this as well

Good to know, im always hesitant to upgrade when a VDA install is solid

<@ULP1LG0R4> your twitter post led me in the right direction

<@UR9T47CRM>, Thank you for message,, We are using CPM

I think with cpm you have the same topic like with fslogix and the wrong container type

<https://www.deyda.net/index.php/en/2019/11/05/fslogix-container-office-profile-in-citrix-environments/|https://www.deyda.net/index.php/en/2019/11/05/fslogix-container-office-profile-in-citrix-environments/>