World of EUC

2203 CU3 released: <https://www.citrix.com/downloads/citrix-virtual-apps-and-desktops/product-software/citrix-virtual-apps-and-desktops-2203ltsr-cu3-all-editions.html>

Have the same 'problem' but at least with our devices all users have to do is X out the failed login window and press login again..

and you won't get much help on that front as Dell Wyse simply says unsupported for pretty much all Citrix Cloud SAML scenarios.  Such a PITA so we have to make sure SF around for supportability on those. They blanket call it out in the latest 9.x documentation. Everything seems to work, but for us, we have customer that want that support called out and Dell just won't do it for Workspace and GaaS

yeah, we’re having to put in SF for this client and they are complaining about needing to have stuff on prem with citrix cloud but we warned them about using wyse and they went and bought more of them anyway…

What's the reason for not just advising to close and re-open?  Seems a simpler fix to tell users to do that than implement a full SF / gateway solution.

they literally can’t do it, it stores something that only gets cleared on reboot so if they close and reopen it tries using the same expired saml assertion

Hmm. I got about 900 of these across the US, and seen this same issue with recent ThinOS release. Closing the auth box and clicking login on the redundant Dell login window clears it.

I don’t know when these were last updated but I’ll check, they are on some version of 9

we've a mix of 5070s and newer 3000s.  Release is "not current". Mix of ThinOS 2205, 2208 and 2303 which is the one we are slowly moving to.

Dell has been no help at all but I’ll see if they have a pending firmware update

My experience also.  I'd rather be using another vendor,  but not my devices.

same, we tried getting igel in there but no luck

Dell are very good at hanging on to clients

seen it happen in multiple places now where we hate them and they come back with some deal that management thinks is great and so we get stuck with them for another 3 years

I'm a little happier now there is a controlup agent available for ThinOS. But would still rather be with igel.

I would rather everyone at least be on igel OS, WDM is a nightmare

image.png

Which VDA version and polices do you have active?

GPU Settings:
This happened after an Upgrade from 1912 CU1. VDA Cleanup Utility has been used, tried with an inplace Upgrade as well. Same behaviour.

Anyone know if there is a parameter to cleanup.exe to NOT launch the workspace app window after reset?

cd "C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin"
CleanUp.exe /silent -cleanUser

Recreating the LHC db every time you want to force an outage isn't ideal

Yep, but that's not very useful if the LHC database is corrupt :disappointed:

It even says in the documentation that it can become corrupt after restarting the server

Yes, you can set up StoreFront with FAS and an Azure Enterprise app/app proxy for Azure AD SAML auth and putting the site in the app portal. However it will only work to launch apps when accessing it from within your network due to not being able to externally proxy ICA through it which you would still need a Citrix Gateway for (with no gateway config in Storefront the ICA files generated will reference the local network servers and not a gateway/proxy address). Haven't tested it with HTML5 only via StoreFront but it's possible that might work.

I had BSOD issues with Webex and 2203 CU2, but so far 2203 CU3 is working nicely. Webex client 42.12.0.24647 on the VDI VM, 42.12.0.24485 VDI plugin on my endpoint.

Also have Webex Meetings Virtual Desktop Plug-in 42.10.8.14 on my endpoint

I'll try re-installing Webex after 2203 CU3. With 2305 everything works as expected.

Still not working. I am running 43.4.0.25959 on the VDA, same for the plugin on the Windows client. I have the Webex app deployed in Dark mode. Normally the Webex meeting window turns white and it appends - VDI to the name. That's not happening despite having the VDI version installed and the health checker showing green.

Dumb question, but in the VDA's registry, in HKLM\SOFTWARE\Cisco Spark Native, do you have EnableVDI set to 1 or 2? Either should work, though I had used 1 at my last place. New place uses 2 to let it automatically detect the VDI environment.

Not sure what to tell you there then. You may have to open a case with Cisco... sorry in advance, they're not fun to deal with.

So with 2203 I get new meeting freezing and with 2305, I get this. As if it is trying to pass devices through and not use optimization. While inside the meeting, health checker says the "virtural" channel is disconnected. I think something is broke and will hopefully be fixed in the release later this month.

When you say 2305, are you talking CWA or the VDA?

What a Webex meeting looks like on my 1912 CU7 server. Same version. Installed the same way.

I have only been testing 2203 CU3 for a few days now, but in CU2 I was getting BSOD's daily. I have probably a dozen Webex calls per week, so if something is going to bomb, I think I'd probably have seen it by now.

And if I just jinxed myself, I'm going to blame you...

Ha! I'm looking at the release notes for 42.12.0.24485 and it says it added support for CVAD 7 1912 CU6. LTSR 2203 CU2 is not supported until 43.2.0.25157, along with CR2212. LTSR 2203 CU1 was added with 42.8.0.23214. I'm going to let this rest for a few more days while I wait for the next release. My problems may be related to a lack of support for 2203 CU3, but doesn't explain why CU2 isn't working.

I have this figured out, but I'm wondering what I can do different. The System event log and RPM errors are what helped crack the case.

I have the Virtual channel allow list enabled and populated with the following settings:
CSCOTM,C:\Program Files\Cisco Spark\dependencies\teamshvdagent.exe
CSCOMT,C:\Program Files\Webex\Webex\Meetings\meetingshvdagent.exe

I was seeing loads of RPM errors and they indicated Webex Meetings was running meetingshvadagent.exe out of my profile despite having Webex VDI w/ MC installed on the base image.

I added a 3rd entry to the Virtual channel allow list:
CSCOMT,C:\Users\*\AppData\Local\WebEx\WebEx64\Meetings\meetingshvdagent.exe

It is now working as expected. What a pain.

Ah, honestly forgot to ask about the VC since we just disable that policy and allow all. So dumb, though.

Sometimes you just have to nuke the Citrix registry settings...

Perhaps i'll try to uninstall first... I usually just ran the cleanup and everything worked perfectly find/great in the past

Yes.  But gotta do what gotta do.  Luckily i don't have to do it these days but that was the force install path in the past for stubborn setups on persistent VMs.

I thought the Cleanup utility is to be used after a proper uninstall and not instead?

sometimes you just know you'll need the tool, and skip right to it.  Usually on the third VM.....

this is computing.  Fuck with it until it works

I always recommend uninstall, cleanup reinstall.

Screen Recording 2023-06-05 at 9.58.21 AM.mov

Long shot - but anyone seen this kind of behavior?  Windows 10 non-persistent with userlayer, VDA 2203_CU2 &amp; CU3.  It's almost like a heartbeat but i can't find any process spiking in unison.

Hi Team, though datastore has got around 60 GB of freespace but while creating platform layer (ELM)is getting failed with insufficient diskspace.. Can someone let me know how much freespace woul be required

What kind of GPU do you have on the endpoint?

The endpoint (which is running native Windows 11) is a Surface 3 with an embedded Intel(R) UHD Graphics 620.
Do you mean I should check the hw encoding keys of CWA?

There were some issues with Intel drivers:
<https://support.citrix.com/article/CTX474990/hdx-microsoft-teams-optimization-crash-or-video-freeze-on-newer-intelbased-clients|https://support.citrix.com/article/CTX474990/hdx-microsoft-teams-optimization-crash-or-video-freeze-on-newer-intelbased-clients>

So I would suggest to check if their drivers are up to date. The minimum version is listed in this document

hmm ok, but basically there is no optimization in place.
For the teams session (which runs locally) this is just a window to share...

.. also noticed this today when I start sharing.. pink blur is displayed in sharing preview.

.. this happens only when sharing Desktop Viewer

Hello; Um how do I private you udjajoo  ???? I dont have your ID or anything to contact you

When passing from on prem to Citrix Cloud, is it possible to have a hybrid solution during? I would like the users to be able to access thru both URLs and then shutdown all their on prem

<@ULKK77J12> should be able to easily maintain this list

I have not seen any issues reported with CU3 as of now but recommendation would be to test CU3 in dev and then roll it out to PrD. I do know of some graphics memory issue with cu2 which is fixed in cu3 as the issue was reported to produt team from our end

thanks :slightly_smiling_face:  solid recommendation

I have one customer who is testing right now. CU3 has been released last week.

I have CU3 in prod for smaller size customer, no issue so far.

This is all very positive news.. Looking like CU3 is going to work out.. I'll do some testing on my end as well.. If I find anything negative I'll drop it in here

Answers in here
<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1683110218545409|https://worldofeuc.slack.com/archives/CK6TCV3JN/p1683110218545409>

Wow, is there a specific event that triggers it to offline the HBA?

Nothing that I am aware of other than vCenter seeing the HBAs as offline.

If you use powershell you dont need a machine <https://developer-docs.citrix.com/projects/citrix-virtual-apps-desktops-sdk/en/latest/Broker/New-BrokerDesktopGroup/>

thanks figured i could get around with powershell.  logic lines up with how the spa apps are bound that way.  thanks Rob!

Thinking of what you are asking here, they just released tool today that might help with what you are describing maybe.  Not sure, but yea. - <https://docs.citrix.com/en-us/citrix-secure-private-access/secure-private-access-for-on-premises-config-tool.html?s=31>

Ahhh no way <@ULEEXJUD8> Osborne (Oz) I was totally working on a script with prompts to do this.  :turtle:

Im still working on how to migrate part of my Citrix on prem (1909) to Citrix Cloud. The VDIs will stay on prem with the rest migrating to cloud. How can I do this while keeping both infraestructures up in a hybrid solution? I want them to temporarly access thru both and when everything is fine, shutdown the on prem servers and have everything keep working.

Hello :blush: Couldn't find to PM you. We have a issue with the tool: They are on 1909 and not on a LTSR so it isn't supported and we can't use it

Im on mobile but I don't find a way to PM you

You can ping me on discord or slack by finding me

There was an issue with apps losing focus and not being able to be maximised on certain CWA versions. <https://support.citrix.com/article/CTX463924/citrix-published-applications-minimizing-after-cwa-2206>

Screenshot 2023-06-08 151533.png

I remeber that one, but this happens with all cwa versions. The app doesn't loose focus, it's just black for a while when restoring the app after it's been minimized. Just like the screenshot

I vaguely remember running into an issue with published Word some years ago. Have trawled back through my email and found something. Word has (or at least did in 2013) an odd dependency on the desktop folder in the profile. This was being excluded and causing issues in Word. Not sure if related to your issue, but see this CTX article.
<https://support.citrix.com/article/CTX130329/error-word-cannot-open-the-existing-file-normal>

This also reminds me of a similar issue. I believe <@U01NDQN63GX> is right on the money. I had blocked certain top-level folders from syncing with the UPM profile and messed up Office apps. We had to get them added back to the profile.

Reviewing policies applied to Win2016 VDAs for a client, and discovered they'd pushed a group membership via GPO to add NT AUTHORITY\Authenticated Users to BUILTIN\Guests.  Turns out it's causing issues with their Checkpoint agent, but I've never seen this config before and not sure why someone would set this up - has anyone seen this done before?
(client doesn't know and their deployment was done by Citrix Consulting)

One of the reason to split profile and Office container is the data class. All things in the office container are a local cache from the cloud. So of the office container breaks, u can delete them and the user get the whole data fresh from the cloud. 

The profile container are another thing and data class. Because here u need a backup and so on because this data are unique and if something wrong with this the user experience are not the same. 

For installation u can use my guide. I must refresh the settings but the core is the same like today

check out our <#CKBVDG48H|> channel, lots of experts in there

Could you please tell me the channel to set it up? Thank  you

I imagine you mean this <https://www.deyda.net/index.php/en/2019/11/05/fslogix-container-office-profile-in-citrix-environments/> Right?

typically this is due to an open process that launches after the published app.  Find the process, then add it to the necessary registry location: <https://support.citrix.com/article/CTX138138/virtual-delivery-agent-session-not-terminated-after-exiting-all-applications>

Hi Steve, I'm aware of that option.  However, there is no process stuck.  If I kill all the processes through task manager, the session still stays in a "signing off" state.  Also, if this would be the issue, I wouldn't be able to log off the session through Studio or with the shutdown.exe /l command

still says signing off...hmmm.  Anything pertient in application event viewer logs, or the fslogix logs?

does it happen if you aren't using fslogix profile, aka trying a user in the excluded group

Not in the application events;
If I look in the FSLogix logs, nothing happens.  It seems like the logoff isn't initiated.  Only when I do it through studio or shutdown.exe /l then I can see the session logoff process in the FSLogix Logs

Yes, exact same issue without FSLogix Profile (exclude group)

if you log a user out, confirm they are still there,  and then restart the fslogix service, does it log them out?

<https://xenappblog.com/2022/master-images-patch-or-die/|https://xenappblog.com/2022/master-images-patch-or-die/>

PDQ, but you might find it helpful. PS Remote?

How about using the recommended removal using XenDesktopVdaSetup?

Could we run *XenDesktopVdaSetup* inside an RDP session without being kicked out?

Is the VM part of a Machine Catalog that is power managed?

Yes but that just means that a "Restart" is interpreted as a "Shut-Down", right?  I'd like to be able to *skip* any Reboots when trying to run either of these Tools (inside an RDP session)...

You have the VM in maintenance mode right? If not uninstalling the VDA will be seen as a problem vm to a controller and it would likly take power management action to take the VM out of service.

^^ This, hence my question. If it is power managed then it can reboot / shutdown on Uninstall. So you need to put it into maintenance mode

OK cool, easy enough to try.  Definitely use the /NOREBOOT switch, right?

Yea that should work but you'll need to put the machine in Maintenance mode otherwise the controller will see the VM go unregistered and will try and sort it out.

Got it.  Thanks guys, I'll let you know how that works out.

Also, from which to which version are you upgrading? With newer VDA installers you don't need the cleanup utility

Yeah that's a good point, we're trying out that new feature, too

just got this too.  didnt 2305 have an issue with cpm with a hot fix out as well?

Yes: <https://support.citrix.com/article/CTX559448/hotfix-profilemgmt235100-for-citrix-virtual-apps-and-desktops-2305>

The vulnerability doesn't sound very severe from how I read it. Users need to be authorized to launch an unauthorized desktop?

Well.. if proper lockdown settings are not in place, they could access applications and tools that are not published. So at least in theory this widens the window for other exploits I guess.

Monolithic for me as I work in large enterprise. Functional creates a huge number of GPOs in a large enterprise where multiple teams may be managing it across desktop, server, etc. Functional is okay when a small team is managing. Different use cases requires different strategies.

Functional for me, but not ridiculously broken out into tiny blocks like some mad people do

Functional, but try to keep it to "one GPO, one CSE". Which makes Administrative Templates massive but it processes better

Yeah, I always go toward Monolithic myself. I try to do very few GPO with all settings myself. I was being told this slows down logs where functional processes better. But it depends I would say. 

A couple of Group Policy MVPs (back when that was a thing) did a lot of testing on functional versus monolithic many years ago and found no performance degradation until you hit over 900 GPOs or a GPO with many hundreds of settings. I doubt any of us fit that scenario.

They tested, for example, one GPO with 100 settings versus 10 GPOs, each with 10 settings. IIRC, monolithic "won" with a performance increase of .001 seconds. In other words, it doesn't make any PERFORMANCE difference which way you go. Now the management of the GPOs and settings is another story. Would you rather troubleshoot an issue with a GPO with 100+ settings or a GPO with 10 settings?

Monolithic in the grand scheme of things, though I do separate some stuff out purely for ease of management. For example:

1. Base GPO: Windows and O365 settings
2. Edge GPO: Edge settings
3. Citrix GPO: Setting the DDCs (everything else in Studio)
If I had to separate them all out, I'd probably have another 2-4 GPOs to manage.

For me I only care about performance and logins to be honest. I certainly would lean towards 10 GPO for troubleshooting. 

Hmmm, i tested mixed-up CSEs versus "one CSE, one policy" and got my overall logon time down from 35 seconds down to 24....

Well, on that note, I don't use GPPs at all if possible.

Not talking filters here, just straight changes to CSEs per policy

WMI filters ain't that slow anyway, unless you use something crazy

Yeah, I figured as much. We've had a similar conversation in the past.

You haven't met the people I have, lol...

I had to go read <@UL5TCSW3D> blog again on the master logins series he wrote up. The data in his blog doesn't lie and that is what I use to show prove when I need to prove to client's on GPO logins and processing 

Shit I mean doesn't lie( fixed that typo lol)

Anyway, make sure you always test in the enterprise environment you're in - my test was done on an environment where I had _deliberately_ made the policies as convoluted as possible

Yeah agreed. Thanks for all the feedback and answers 

I have a client that went nuts on gpp and like 40 GPO with 1 or 2 settings. Massive drive mappings. It's just a dang mess. Even director points it out. 

I've got a client with 3900 GPP drive mapping policies (one policy, one drive map) and security filters applied to each. It actually works surprisingly efficiently, because each user can only see the policy objects they have access to (essentially it's just NTFS permissions from the security filter). But it must have been hell to set up

They originally used Ivanti but the overhead of spinning up 3900 threads to do conditional group checks (because that's how Ivanti works) was killing the logons. So this was actually the least disruptive approach :astonished:

The worst I saw was thousands of GPOs: one per user to map one printer and each user could access up to ten printers. They did the same for drive mappings.

Not so bad if you security filter them all, but hell to manage, yeah

My new place isn't awful, but they've gotten into the habit of doing stupid shit that leads to longer logons. I'm trying to address it as best I can, even though I don't own that space. Already shaved 100 seconds off the logon, and I think we can do more.

I say we, but I mean me. They're not getting the credit for this...

It's not really a shave, more of an amputation

The best logon performance increase I have done is from 9+ minutes to 35 seconds and then to 9 seconds. They used mandatory profiles, so you would have thought the logons would be fast. BUT - the person who set up the mandatory profiles did it logged in with a domain admin account and spent a lot of time on the internet before saving the master profile. When a user logged in, the profile copied 35,000+ temp and image files and all were scanned with their AV. All that with several 1000 users logging in at the same time.

Once they recreated the mandatory profile they were at 35 seconds. Then we analyzed a batch file used to map printers. It basically had:

If MemberOf &lt;group&gt;
map printer
wait 5 seconds
Endif

For 35 printers!!!

Just removing all the Waits, got the login time to 9 seconds.

PerfMon to the rescue for the mandatory profile issue

I shudder to think of the artefacts each user had in their profile from that mandatory one

This discussion right here is why this Slack channel is so valuable.

functional here for easier location of settings and troubleshooting

functional but not going too deep, I like balance:)

As I understand it if the AG is all in one subnet, it isn't required.  It's recommended so if the AG expands and is in multiple subnets then you don't have to reconfigure

Ahh, okay. Thanks for that. I did not realize that.
Thanks man, I understand now.