World of EUC

Thanks for the notice!  I’ve let the Citrix Social team know.

image.png

There's a CPM hotfix for this issue: <https://support.citrix.com/article/CTX559448/hotfix-profilemgmt235100-for-citrix-virtual-apps-and-desktops-2305>

thank you its to new for google only found old articles :slightly_smiling_face:

Haven't had a chance to try myself, but so far, just the CPM issue I have seen. Curious on what others might pop up as well. letting dust settle like always

pretty sure that issue with reconnecting due to the change to the citrix graphics service is still ongoing and needs the fix applied.

<https://support.citrix.com/article/CTX547782/cvad-2303-users-stuck-on-welcome-screen-when-reconnecting-to-a-disconnected-session>

<@U03E3RH2J90> that fix is included in 2305:
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/whats-new/fixed-issues.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/whats-new/fixed-issues.html>

<@UNBRPVD4G> oh nice! I didn't notice that...maybe Ill give it a whirl as 2305 includes quality of life improvements namely the volume slider

Haven't seen it in Known/Fixed issues, but any chance CVADHELP-20832 has been addressed since 2212 <@UNBRPVD4G>?

<@ULN862X8E> do you have a support case open for this issue?

yes a customer of mine deployed it in prod last week, they have 500 users on Win11 22H2, things are pretty stable so far

<@ULHA2J7RT> AD multi-domain/2 way trust, VDA unregisters upon launch attempt

Only problem I had was moving from UPM profile folders to Profile Containers, where I had to roll back to 2212 due to an issue with not being able to migrate to use Profile Containers on an Azure Files  even though the share already hosted the profile folders and Outlook cache/search vhdx files. Will be logging a ticket for it when the client next has a window to do further testing.

<@ULN862X8E> Your issue has been fixed in 2305, see:
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/whats-new/fixed-issues.html#vda-for-multi-session-os>

Thanks <@UNBRPVD4G>, weird I didn't see it when I CTRL+F'd doc was updated today though.  Was it a late add?

It was just added, so hence why you did not see it before

use kms or adba. those will license the machines that mcs creates.

They use a key they get from the Microsoft Volume Licensing Service Center

Does this help?
<https://support.citrix.com/article/CTX128580/xendesktop-support-for-microsoft-kms-and-mak-activation-with-machine-creation-services|https://support.citrix.com/article/CTX128580/xendesktop-support-for-microsoft-kms-and-mak-activation-with-machine-creation-services>

Microsoft Volume Licensing Service Center has MAK and KMS. Like <@UL8ACTGSF> stated, if using KMS it will handle it.  Citrix does supported MAK based now, but it's in recent versions.
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/machine-catalogs-create.html#volume-licensing-activation>

The documentation is kind of confusing. I'm using MCS to create new VMs. I get that I have to install the key on the master image. Do I do on-line activation or offline?

i would not recommend doing so. import the vcenter cert into the ddc.

It never works; Im having to send up editing the thumprint in the database

<https://carlwebster.com/06-building-websters-lab-v2-install-the-vmware-vcenter-server-appliance/|https://carlwebster.com/06-building-websters-lab-v2-install-the-vmware-vcenter-server-appliance/>

go to figure 37

Always: <https://support.citrix.com/article/CTX224551/delivery-controller-cannot-contact-vcenter-server-after-certificate-update-on-vcenter> <https://support.citrix.com/article/CTX138640/errorcannot-connect-to-the-vcenter-server-due-to-a-certificate-error> <https://support.citrix.com/article/CTX277468/citrix-cloud-hosting-connection-to-vmware-vcenter-server-fails-after-certificate-update>  None work

Link was broken: <https://carlwebster.com/06-building-websters-lab-v2-install-the-vmware-vcenter-server-appliance>

Problem solved, missing "DigiCert Trusted Root G4" root certificate

It depends on the criteria and customer relationships engagements between client and citrix.   Usually citrix will give some grace period on special cases if they are being notified prior to actual end date.

I would think it should be like warranty, if reported while supported it should continue

One would think... but I'm getting pushback.  Ultimately I should get on 13.x across the board anyway.  I just wasn't planning on doing it next week.

If the situation is urgent the speak to your point of contact citrix account manager. He will be able to help you out for possible very short extension.

I feel if I can get notifications to work through BCR, I can probably get the WebRTC to redirect

Good questions, hopefully someone will be able to shed some lights as I have the same! So far my experience with BCR hasn't been great. Can't get redirect working well with even YouTube when I do server fetch via proxy.

I was thinking if we do only audio, do we really need BCR or will the HDX standard audio redirect be good enough.

I'll do some tests if I can get this bloody BCR working, I'm on VDA 2203 CU2 on w2016.

according to docs, Citrix will only support BCR on CR for VDA and on CR for CWA.  I can get BCR to work everytime.  I am doing full client redirection and not using the proxy aspect though.  it is the notifications that are getting me

On a side note.  I have learned on 2019 RDS, if you set the GPO to remove common programs it will break notifications from apps
 HKCU:\software\microsoft\windows\currentversion\policies\explorer\NoCommonPrograms dword:1 
Set it back to 0 and apps will be able to send notifications again

I am completing my final update to the CVAD doc script. If you would like to test the script, email me. webster at carlwebster dot com

To add, the FAS server also runs as a subordinate CA. All of these errors are on FAS02 which is 2nd on the list so it like its failing on FAS01, moving to FAS02 then generating the RPC error. Very strange its only happening a couple of times per day.. and fine for most folks, cheers

Sounds like firewall related or RPC not available: <https://theitbros.com/the-rpc-server-is-unavailable-0x800706ba/|https://theitbros.com/the-rpc-server-is-unavailable-0x800706ba/>

Are the CA’s using random dcom ports? You can also try and set a static one <https://social.technet.microsoft.com/wiki/contents/articles/1559.how-to-configure-a-static-dcom-port-for-ad-cs.aspx|https://social.technet.microsoft.com/wiki/contents/articles/1559.how-to-configure-a-static-dcom-port-for-ad-cs.aspx>

Thanks <@U03H4LZRCBY>. Looks promising, will do some testing :slightly_smiling_face:

The VDAs have the domain firewall disabled, its enabled on the FAS servers via policy. I have temp disabled the domain FW via local policy for now to see if the errors go away, cheers

Arghhh, still seeing it this AM after disabling Windows firewall. I just found this, sounds like the issue: <https://support.citrix.com/article/CTX461416/single-sign-on-not-working-when-going-through-one-fas-server-the-rpc-server-is-unavailable>, I'll try this next, cheers

how is the health of the CA itself? can it validate all AIA/CDP locations?

and if it's a parent/child relationship do you have AES enabled? (or any hardening that disables the older ciphers in kerberos) have seen that one as well, and with the latest ADCS update you'll get the new hard matching capability (which is going to be enforced later on, but that's a logging entry at this time not RPC unavailable)

Hey Henry, CA looks good but that's an interesting call on the ciphers. Just found a LOAD of these:

I can see the client has got a CIS GPO attached to the OU housing the FAS servers...

can you do a check in het GPO for which allowed kerberos ciphers are being used, afaik this one disables the older ones

I had the same sort of impact at a customer where we implemented True SSO (VMware equivalent of FAS) which magically stopped working. Issue was hardening (CIS levels) put in place but not only on the clients also member servers etc. (the ADCS machines) and the issue was there that it had a parent/child relationship for the forest/domain. By default the forest doesn't enable AES, this is a check mark to be set which in turn forces it or you need to manual put it in with ksetup for legacy support if needed.

Thanks, Henry. This is whats in that CIS policy. Odd that its working for most, Ive been on this gateway for 2 months. Zero issues.. I am seeing about 20 on avg rpc errors per day and all those cipher errors..

Is that on one machine ? Check others, but make sure whateve account your using is actually authenticated to Azure Active Directory (Azure AD) when signing in to the device.

Run through these links 
<https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/windows10-enroll-error-80180002b|https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/windows10-enroll-error-80180002b>

<https://learn.microsoft.com/en-us/answers/questions/621740/azure-sso-problems-(azureadprt-no)-on-aad-hybrid-j|https://learn.microsoft.com/en-us/answers/questions/621740/azure-sso-problems-(azureadprt-no)-on-aad-hybrid-j>

Thank you Ray for your message,, Yes it is Azure AD joined and issue with all the VDIs.

Sorry are you saying it’s the Same issue with all VDI? 

yea issue with all the VDI,, Office SSO is not all the users.. I believe this may be cause

Are you using Azure AD and using FAS? If so, that is a known limitation in that scenario with cert based auth. If not that scenario, then PRT should be there just fine

What OS?  We are seeing the same issue with 2016

Speaking of that <@ULEEXJUD8> any idea on work around or product enhancement? No biggy if it’s unknown. Just curious 

<https://www.jeffriechers.com/wiki/azuread-prt-with-fas-certificates/|https://www.jeffriechers.com/wiki/azuread-prt-with-fas-certificates/>

<@UK89L1Q02> WS 2016 has a lot of missing features with AAD Hybrid Join. The functional level is 1607. 

Oh wow <@U015MJK0XBM> I did not know that. From others and research I thought it was a limitation myself. Not to hijack this thread. 

Yes, on the above workaround, we have had pushback on the public facing CRL even with trying to lock it down. We are looking forward to Azure AD SSO where we don't need FAS

This maybe?
<https://updates.cloud.com/details/sso-for-azure-ad-joined-virtual-desktops-(without-fas)-hdx51158|https://updates.cloud.com/details/sso-for-azure-ad-joined-virtual-desktops-(without-fas)-hdx51158>

Thanks a bunch each and everyone. Yes we are with FAS

<@ULEEXJUD8> Could you please share the doc stating limitation M365 SSO with FAS,It just for my reference

<@U04UMT2V3SA> if you do a quick google search  for "Citrix FAS Azure PRT issue" you will see many Citrix discussions about this and others are having issues.

Examples
<https://discussions.citrix.com/topic/417047-issue-getting-prt-from-azure-ad-for-sso/>
<https://discussions.citrix.com/topic/418232-configuring-azure-for-seamless-sso-when-using-fas-for-citrix-issues-with-prt/>

Thank you <@ULLH5JGFR>, Yea i have already gone through the community update . Wsa looking for KB from Citrix actually

What KB were you looking at <@U04UMT2V3SA>?

[thread]: Is that a storefront event logs?

Hi Team, Can some let me know what is Peak and Average value.. I have gone through the

Hi Team, Can someone help me to understand what is Peak and Average usage... Based on that how we can calculate resource is in crunch ?

this was posted by @Cathy Leik here, is this what you are looking for?  [Azure Certificate Based Authentication for Citrix FAS Breaks Windows Hello PIN Provisioning Process - IT-Adventures](<https://it-adventures.com/azure-certificate-based-authentication-for-citrix-fas-breaks-windows-hello-pin-provisioning-process/>)

It looks like we’ve been able to sort this now by following the steps here: <https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/active-directory/devices/enterprise-state-roaming-troubleshooting.md>

Clean up the following files:
• Settings.dat in `C:\Users\&lt;Username&gt;\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\`
• All the files under the folder `C:\Users\&lt;Username&gt;\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Account`


<https://worldofeuc.slack.com/archives/CLSHNTWLW/p1687466674686059>

Wrote the above before catching up on Slack. Interesting find you have there too.  Thanks for posting.

It's about time they posted a kb for this.  We had to figure it out own our own as it's been showing on our scans for a year.

Maybe they will “force” new configuration in next version of License Server. It would be good solution for everyone :wink: 

As in, DDCs are gone in this scenario? If I remember right, you'd need the DDCs too. Otherwise the database will have records of DDCs for brokering and managing the farm but if they don't exist it won't work. And you can't join a new DDC to the farm without one of the old ones at least.
Now I am open to correction if anything has changed

Yes, It does need DDCs otherwise it will not work.

Probably got some window that has popped up and needs responding to

There is a timeout on launching published apps. Extend this first and see if that's your issue. If the sessions closes without notice you are prob hitting this limit. <https://support.citrix.com/article/CTX128009/published-application-fails-to-appear|https://support.citrix.com/article/CTX128009/published-application-fails-to-appear>

If the session doesn't end on its own eventually possibly what James said.

The session does not end on its own and is marked as active in Studio.

In Citrix Connection Center you can see the Server Name you are connected to, but not an actual published application.

The emtpy Connection Center speaks against your theory, does it <@UL5TCSW3D>?

What are they publishing? Do you see that process in task manager? Is it installed on the VDA or does it need a mapped drive or something else that maps on logon?

Babtec
Yes, I see the process in the Task Manger, while the user doesn't see anything.
It is installed on the VDA and the exe should be available

Citrix recommends their own profile solution :smile:

Microsoft recommends only using the FSLogix profile container.

Citrix also recomends using FSLogix.  I dont know where I got the idea to use FSLogix + O365 from a Citrix site :frowning:  They are not in production. Is it difficult to remove? Or just disabling the GPO will be enough?

disable the O365 container and delete the Office containers, that's it

next Outlook launch will be slower since the OST will rebuilt itself

it will also reduce by half the number of files open on your file server

each user will mount one VHDX instead of 2

Well- if you're a fan of including your Outlook cache in your backups by all means put it in your profile.

But to your question, up until recently FSLogix was the higher performing option and many Citrix consultants including myself recommended evaluating it. WEM even has some methods to help manage it, so there is a good... synergy... there.
BUT:
People often mistake a recommendation to evaluate and compare to a recommendation to use, however.

i chose to separate the two due to space and backup/restore constraints.  Not going to worry about OSTs in DR, online mode ftw.

I haven't played with it yet, but it does appear that UPM is letting us get waaaay more granular these days as to where things can be stored. I haven't tested dedupe yet but I'm excited to do so, exactly for active-active concerns I'm seeing in the world lately.

In Fslogix, Login time is pretty much fast compared to CPM as AVHDX file is getting attached

UPM also has VHDX containers available as an option nowadays. 

Don't forget, FSLogix tattoos the Registry - on persistent devices the settings that drive it will stay until you delete them

UPM containers is overtaking FSLogix, the only thing IMO FSLogix has going for it is maturity. Breaking OneDrive on older versions was the end of FSLogix for me

Thank you <@ULHA2J7RT>.. for the info something new to me

Want another reason to go CPM container? You won't have to deal with MS Support.

I would go with Citrix WEM but they don't have access

We use WEM to apply CPM here and it works fine, but if I had my way I would be using a Studio policy.

I don't see any benefit to adding another broker in between those settings getting applied or not.

I would like to jump in and ask a question regarding UPM Container vs FSLogix, which haunts me for a while:

_(Ps.: I have never used UPM container, just following the debate here in Slack and reading all the changelogs)_

How am I supposed to switch and manage versions?

With FSLogix I was independent of the VDA version. For so many reasons (not relevant for that discussion), most of my customers are still on 1912 CU3, yet still on a recent FSLogix version. Or in other words, I have a very mixed CSP VDA environment, yet all have the same FSLogix version.

Now first, I don't know how I could ever switch from FSL to UPM in an up- and running environment, and I guess I shouldn't.

But even if I would start a new project next week, which I do, I would decide for 2203 CU3 and that would cut me from the latest features like OneDrive support I guess. So I guess on 2203 UPM is still not attractive enough to ditch FSL?

But UPM is tied to the VDA afaik. I know I could upgrade UPM manually to a higher version, but I guess that would get me unsupported? Unsure about that one. But if I would need to stay on a lower version, like we all do with FSL sometimes, I think I couldn't, so UPM might block my VDA upgrades if there might be an issue through the upgrade?

I'm very unsure about the tight integration between the VDA and UPM, leaving me unsure about the stability and supportability from my side as a partner.

My guess is that you'd have to run the latest CPM on your 2203 VDA.

Stability I wouldn't worry about personally, but support is another issue. Citrix could easily say 'go back to 2203 CPM and test to see if it fixes your issue'.

FSL to UPM migration is easy. UPM is not tied to the VDA version

Migration: How so? You leave me confused :smile:
Version: How would that be possible? I exclude UPM from the VDA setup and install my preferred version afterwards?

I know, but it never came to my mind, that I can leave it out, during the initial VDA setup.

To migrate FSLogix profiles you need to change the folder structure slightly and then simply copy the VHDX

•Create folder structure and ACLs
•Remove FSLogix settings completely
•Copy container across
•Rename it to ProfileContainer.vhdx in the UPM folder
•Mount it
•Rename the “Profile” folder in the root to “Profiles”
•Log on with UPM container enabled

see <https://jkindon.com/citrix-workspace-azure-ad-dsauthazureadnestedgroups/>

I've had a ticket open with Citrix on this, and (at least according to them) this was turned on a couple of weeks ago. Didn't help though, I had to switch all the on-prem groups from local scope to universal scope. That finally got most things to show up, and stay that way.

The problem I've got now is visibility settings with nested groups.

is big important app a traditional published app, or a 'citrix managed' library app?

is this still a requirement? to ask support to enable <https://support.citrix.com/article/CTX495517/intermittent-enumeration-of-resources-azure-ad> ?  We use AD Universal Groups for delivery group and application permissions, and seem to have issues once our nested groups get beyond 3 levels.

I ran into the same problem with nested groups. Having Citrix throw that switch didn't help, since we have some extremely deeply nested groups. I switched to SAML authentication, which is enumerating everything properly. More of a pain to set up, but it gets the job done...

Forgive me, but did Microsoft change their stance on nested group support in Azure AD?

I had the Problem weeks ago. The resolution was to disable the app readiness service. 

Updates will fail if App Readiness is disabled though.....

I should mention that the slow logon is via Citrix only. WHen I RDP in its fine

Windows Updates tend to fail with App Readiness disabled

Hmmm no problem on this side with this image. :sweat_smile: 

I tried disabling it to stop UWP apps and the upshot is is WIndows Updates fail

ok disabled service and did a few other things. boom. much faster logon.  but not sure now what did it :smile:

2305 super fast with WEM IE4fix thing setting

So going back to this, the much faster logon I saw was because of my own subsequent logons. If I reboot the VM the initial logon is still slow :disappointed: I think <@UL5TCSW3D> had something about subsequent logins being faster in his blog. regardless, things are still not fast. thinking of trying the LTSR VDA...

I've run AVD inside a Citrix session.  No issues

i mean, i was just administering stuff, so it was fine.  I wasn't trying to run Teams in there or anything

I have a requirement where customer from IN having client is US. Client in US gave WVD access to my customer which can be accessed with US Region IPs only. As of now they are using some sort of Proxy to get the US Region IP Address to access the WVD in US.

If you need to do officey type work, outlook/excel/web, it should be fine

not sure youtube would be too great.  But, I did not test this.  I could fire it up if you really would like

but, it's all US based for me, no cross country.  That extra latency could be brutal

if you do, let me/us know.  :slightly_smiling_face:

I am working with another solution also..if that works will let u know

SecureICA is not the same as ICA over SSL/TLS... if you want to do TLS encryption end to end, ie even for local connections that don't pass through a NetScaler then follow the instructions here. I'd suggest using BIS-F to configure it on non-persistent VDAs.
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/secure/tls.html#tls-settings-on-vdas>
BIS-F:
<https://eucweb.com/docs/bisf-7-1912/gpo-configuration/citrix/configure-ssl-for-the-citrix-vda>

If your connection passes through a NetScaler, then it will be SSL to the NetScaler, then unencrypted (ie over standard 1494/2598 ports) from the NetScaler to the VDAs

I'm not looking to do ICA over TLS. Which is installing certificates on every VDA and sending VDA traffic to Delivery Controllers and clients over TLS. I really just want to do SecureICA, but I'm confused how to validate it is working. It seems to be just a check box on the Delivery Group, but how does one validate it is working? ctxsession -v?

Ah ok, you are looking for this then - either in Connection Manager or as you say ctxsession -v

I have not used SecuraICA in forever. Good to know  it's still in use. I do the ICA of TLS now or try to.

For now, my standards dictate to use SecureICA. I'm looking at ICA over TLS for my MCS clones, but man, it scares me the same way FAS does. I should note when I run ctxsession -v on Win10 XenDesktops, the ICA Encryption field does not exist. But Daniel's last reply was exactly what I was looking for.

We do lots of ICA over TLS for end to end SSL in defence and finance &amp; banking environments etc, adds some extra considerations around HA for PKI that people might not have considered previously but overall not much changes.

Hello All,
Would you have a setting to obtain excellent audio quality without having a delay with the microphone? I've tried several settings, I get good quality playback and microphone, I get an input delay of 600ms, I should be under 300ms.

The only settings that were very responsive but not qualitative enough were :

Quality (medium)
Audio Over UDP (enabled)
Realtime through Netscaler (enabled)
Realtime Audio (enabled)
Adaptive audio (disabled)

Client side and server side

I deal with OST file issues constantly, but not sure that they are normally corruption based. The vast majority are caused by Citrix UPM Read-Only containers and getting different versions of the OST Files (basically) so the user gets "You are using an old copy of the OST" and can't log in.

How often does that occur for your users? We have that FSLogix feature to delete old OSTs turned on. Wish there was an easy way to track down what’s causing it.

We deal with probably about 5 - 10 users per week.

I think you can use Multi-Site Aggregation in SF and point a specified AD Group to the new DDCs <https://docs.citrix.com/en-us/tech-zone/design/design-decisions/storefront-multisite-aggregation.html>

You aggregate all of the Citrix sites behind the same StoreFront servers either the new or the old and you cut applications over from one site to another

with that configuration we have the same front door but behind the scenes you run applications on whatever server, nothing to teach the user in terms of new URLs or reconfiguring workspace app

Thank you for your quick response <@U01GWFT2BDJ> and <@ULMD920DC>

The last CVAD documentation script update from Webster.

<https://carlwebster.com/citrix-virtual-apps-and-desktops-documentation-script-v3-41-final-update-by-webster/>

I have updated every GitHub repository of mine with all the relevant files from my local release folders. Maybe someone who knows GitHub can create these mythical creatures called Releases &amp; Packages. Maybe even create real README.md files.

<https://github.com/CarlWebster>