World of EUC

Looks like it's a very old build, too. The May 2021 build is the last one, as far as I can tell, and it's much newer than that one.

its odd, they updated the support pack, but kept this old tool in it? Weird

The tool also shows updated timestamps in the actual exe, so yeah, weird.

Version number first, then it's missing options like selecting MCS or PVS as the master image, etc.

It also has Personal vDisk listed in the excluded components section

I see. well darn, I thought it was back lol

The file size is smaller than the last one I have as well. I guess they forgot to remove it and the dead link. Def will throw folks off.

I would avoid it, it's buggy and outdated

Funny- updated recently but outdated :flushed: :hear_no_evil:  

_Revision/Version history
MK 7/10/23 updated to ver 1.7.2 per Alex Wang_

I don't recall seeing anything like that ever and I've been doing MCS for 15 years.  Perhaps on XS it could be quicker as it can use an SSD as some sort of a cache drive I remember, but I'm an ESX shop and you just gotta wait for ESX to do its thing.

I can't remember the actual parts, I sound crazy I know. There was something someone motioned in how to revert the images on a MC. I could be totally wrong. I thought Jarian had some workaround or trick. Sorry if I sound crazy

Do you mean ti witch to a new image.  I normally woudl define two catalogs and A and B wiht only half the vdas running at a time then then you can apply to the off oen then swap by rebooting

What does it mean rolling catalogs? 2 DG perhapse?

You don’t upgrade catalogs in place. You make a new catalog and shrink old or put in maintenance mode. If you shrink, just expand again if you need to rollback.

looks like its not new but i dont know what it is.  Ill try to find out.<https://discussions.citrix.com/topic/405037-citrixlocalusergroup/>

Ok looks like its only on multisession vdas ill try to find out what its for

CitrixLocalUsersGroup is used when using non-ad users with non-domain joined machines.
Citrix Local User Manager Service is service that is responsible for creating local users when non ad users are to be used.

What version of Citrix? Just make sure you account for space and performance.

is this still needed for 2019 and above and multi session? Similar when compared to the FSLogix (Windows not FSLogix) search issue.
I personally have not deployed this in citrix for a while now. Mostly because clients jump on the FSLogix train, although it did well from my experience.
<https://support.citrix.com/article/CTX270433/outlook-search-indexing-fails-on-windows-server-2019-vda#:~:text=Set%20the%20following%20registry%20value%20if%20not%20present,or%20already%20set%20to%200%20%5BHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows%20Search%5D%20%22EnablePerUserCatalog%22%3Ddword%3A00000000|https://support.citrix.com/article/CTX270433/outlook-search-indexing-fails-on-windows-server-2019-vda#:~:text=Set%20the%20f[…]%22%3Ddword%3A00000000>

As Ray says, if you are using 2019 servers, don't use the Citrix way. The Microsoft method is better, but they both have issues.

<@ULLH5JGFR> - looks like this can only be configured via Group Policy.

If you are asking via your original Link, Yes, I done it via GPO. I am not 100% on the Search Reg key anymore to be honest. I think it was Citrix way of dealing with the Search issues back then. The MS way <@U012AAZRJ20> may be referring to is setting up the schedule task that will trigger a restart of the Wsearch if Event ID 2 is triggered. Again, I am guessing that what he means by MS way vs Citrix Way :man-shrugging:

Push users to OWA and no need for this (my dream)

i guess what i am asking...can this only be configured in MS GP like said here - <https://docs.citrix.com/en-us/profile-management/current-release/configure/citrix-profile-management-profile-container.html#enable-the-profile-container-for-a-portion-of-the-user-profile|https://docs.citrix.com/en-us/profile-management/current-release/configure/citrix-profile-management-profile-container.html#enable-the[…]ser-profile>

ray and i check the citrix studio console and i just see options to enable the outlook search to roam.  i don't see the option to enable VHDX for outlook.

Citrix Roaming Search vs Microsoft Search in the Roaming Profile (we use Citrix Profile Containers for the Search Index, but that isn't required).

image.png

i don't see this setting in citrix studio policies but it is in GPMC.  not sure why its not the same

Sorry <@UM2G5G8E5> The profile Container option is in Studio. That will allow you to put files/Folders or * will do the whole profile.

 its the  "*Enable search index roaming for Outlook" I don't see in Studio. I could be missing it as I am multitasking*

This is the outlook portion if you only wanted to use  the VHDX Outlook part for the UPM file based Policy. I have not used the profile container myself 100% yet with outlook. Use it only for base testing, but no outlook was captured. I would expect the UPM container to capture it like a normal Profile would.

The EnablePerUserCatalog =0 part I was referring to is if you bolt on the "Enable Outlook Search index Roaming" with UPM File based. At the link provides this towards the bottom of the Citrix Docs.

 Maybe <@U012AAZRJ20> can share his experience with you on configuration.
I don't know if this applies to Profile Containers though? <@U012AAZRJ20>
Can you shed some light if this is needed for Profile containers on Multi Session "The EnablePerUserCatalog =0"
<https://docs.citrix.com/en-us/profile-management/current-release/configure/enable-native-outlook-search-experience.html>

that's only for outlook search index. you still have to enable the vhdx on the gp side, at least thats what it looks like to me.  i can't lab everything out since i don't have outlook in my lab environment, unfortunately.

yes I understand, that is why I said "This is the outlook portion if you only wanted to use the VHDX Outlook part for the UPM file based Policy"
 "I don't know if this applies to Profile Containers though?"

What is profile solution are you trying to do?

Which one as in UPM Container or UPM file base(The one that has been around forever)

all they want to do is roam outlook using a container

so all i have to do are these settings - <https://docs.citrix.com/en-us/profile-management/current-release/configure/enable-native-outlook-search-experience.html>

Okay, so UPM File based.

Part 1
From when I set this up a while back. Once you enable the "Enable search index roaming for Outlook" It will take the Outlook Section and store it in the UPM file "Profile Store" Location. It's been A while for me, so I am looking at my old docs myself. Based on the Link, It looks like it will store a Folder "UpmVhd folder"
That option is in ADMX/GPO and Studio

Based on the docs( Again it's been a while for me)
the UpmVhd folder is created at \\Fileshare\UpmStore$\.
A file UpmParentVhd.vhdx in the UpmVhd folder. This will contain the VHDX Outlook container like option you are after. UPM will do it's things and outlook is in a container option.

Part 2 ( This was not apart of your question but more around any gotchas to look out for Additional Information that may bite you)
The reason I mention the  EnablePerUserCatalog = 0 part, was because of the search behavior that changed in later Operating systems.  Citrix Released a doc that talked about it.

James Kindon talks about it some in the blog as well. At well as the intail link I posted, and of course its at the bottom on the main Link you posted as well.



<https://jkindon.com/windows-search-in-server-2019-and-multi-session-windows-10/>

It's no problem. I did not want to give you bad advice or lead you down a path that is wrong. As things change, I could be missing something. If anyone comes behind us maybe they can confirm a bit better.

Configure KCD and perhaps CBA as well for that 

it's an IIS website, and for SSO you can configure that with kerberos constrained delegation, and for a dual factor enable e.g. certificate based authentication on it.

or replace that one with SAML, haven't tried it with Director but it should work as well: <https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/citrix-netscaler-tutorial|Tutorial: Azure Active Directory single sign-on integration with Citrix ADC SAML Connector for Azure AD (Kerberos-based authentication) - Microsoft Entra | Microsoft Learn>

If you can live without having SSO and need MFA to reach the director page you can create a simple but not perfect solution. It would be basically the same as Henry posted, missing the KCD/SSO part. So nothing has to be adjusted on the IIS or machine accounts delegation.

• Create a Load Balancer for the Director and configure this with AAA-preauth with SAML. 
• Create a dedicated Enterprise Application for the director Web App (If you are using Azure) and enforce MFA by Conditional Access policy binding
Technically you have 1FA on the IIS after MFA pre-auth but inside SSL. So i am not sure if it might be sufficient. Kind of fake MFA :slightly_smiling_face:

Not sure how helpful this is, and I've never tried it myself, but got asked about implementing SAML2 authentication for my Self-Service Session Reset Tool. You could look at doing this at the IIS level using the <https://www.shibboleth.net/products/|Shibboleth ISAPI Filter>, which is part of the <https://www.shibboleth.net/products/|Service Provider> product and free for commercial use. There is plenty of helpful documentation on it.

I used it before, and from my memory I installed it via the VDA switch.

Example
WindowsSensor.MaverickGyr.exe /instal /quietl /norestart CID=############ VDI=1

Cool. Thanks <@ULLH5JGFR> :slightly_smiling_face:

Ran it for years in PVS at another org and it behaved nicely. I did put Citrix recommended exclusions in. 

I meant to say that as well. I had to put some exclusions in after working with support, which they stated it should not be needed but we did and it fixed performance issues

This says Chome only <https://docs.citrix.com/en-us/citrix-workspace-app-for-html5/configure.html#microsoft-teams-optimization|https://docs.citrix.com/en-us/citrix-workspace-app-for-html5/configure.html#microsoft-teams-optimization>

<https://www.carlwebster.com/group-policy-settings-reference-citrix-xenapp-xendesktop/>

For this one he stopped at 7.15 for the regkeys

They are all 50GB by default. You can adjust the initial size In registry.

Yea I get this at times, depending on the user setup.
The link you sent was one of the many possibilities.
does this happen for all or some?

But it is still a new test-setup and we are not using it yet for production.

I don't know what all you setup. So I am going to post things that you may already checked.

On the VDA/SF/FAS do you see the FAS listed in the registry? Assuming you used GPO to deploy it, but check here to make sure it knows.
*HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\Authentication\UserCredentialService\Addresses*

Did you syn all the required ad attributes as defined here? See the Active Directory Section <https://docs.citrix.com/en-us/citrix-cloud/citrix-cloud-management/identity-access-management/saml-identity.html>

Might be that you are passing the AAD SID and not the AD SID

<@ULLH5JGFR> Policy is applied and I see the correct addresses in the registry location. I also see the correct certificates when using Get-FASUserCertificate on the FAS servers.

<@UM04QUUSJ>But logging in to Citrix Workspace works, shouldn't that also be broken when I'm missing certain attributes?

That's not using FAS so it takes your upn (name id) and logs you in wiht that.  FAS kicks in when you open a resource.  I woudl check the attributes

Ok, I will. Thanks :slightly_smiling_face:

Curious if anything shows in SF at this point? The App logs?

No worries but sine he is able to launch a reosurce the answer is yes

If you have an on-prem Citrix license server (would be needed for PVS or XenServer), that would be ideal for co-locating RDS licensing

nope nothing on prem anymore outside of cloud connector and fas

In that case, would recommend  standalone VMs

so I might as well leave it where it is? just sucks to waste an entire server for one role.

well, usually we recommend HA :slightly_smiling_face:

High Availability for what? Citrix is all Cloud

high availability for your RDS license servers to store your CALs

I likely dont understand why the need. there is a 120 or so grace period if no CALs detected. why the need for HA?

120 is the out of the box grace period. "Once the grace period ends, clients must have a valid RDS CAL issued by a license server before they can log on to an RD Session Host server" <https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-client-access-license>

Here's the need for HA: <https://social.technet.microsoft.com/wiki/contents/articles/21180.remote-desktop-licensing-demystified.aspx>

If you're using per device CALs, if your single RDS license server goes offline users will be denied connections. if you're using per user CALs and it goes offline, users will be permitted connections but you will be in breach of MS EULA . Thus RDS License server HA is recommended for prod environments

Where no other servers are available I've used a cloud based DC to host the RDS CALs.

thanks for the feedback everyone. will likely leave them in the current location then and look into HA

Correct you can only use site aggregation to a on prem site with the workspace service in Citrix cloud

Thanks John,

Just wrapping my head around the key differences in the connection chain

Just be aware that Service Continuity is not supported with site aggregation to on-prem deployments. <https://docs.citrix.com/en-us/citrix-workspace/optimize-cvad/service-continuity.html#site-requirements>

<#CKL5SR3PH|citrix-wem> <#CLDGD0KNV|citrix-profilemgmt> <#CK6RVLZ8S|_general> Does anyone know of a tool or technique to migrate VMware DEM to Citrix WEM?
Slack Conversation

Yes you do need a hosting connection per region.
When you create a connection with the wizard, it will only see the AZs available for the region it has been set to.
If you need another region, you'll need a new hosting connection because the wizard won't allow you to pick another region from an existing hosting connection.
So you also need at least two Cloud Connectors per region.

I can share some screenshots if you need ;)

Couple little nuggets I am going through now
<https://www.controlup.com/resources/blog/entry/5-key-updates-to-controlup-analyze-logon-duration-appx-package-load-times/>

what kind of series are you using? preferred one for me is D4adsv5. NetApp Premium FileShare for FSLogix

Right now it's Standard D4s v5 (4 vcpus, 16 GiB memory)
No profile yet, as I am trying to eliminate parts.
But the MCS device are premium Storage.

I am entertaining testing this now.
<https://www.controlup.com/resources/blog/entry/5-key-updates-to-controlup-analyze-logon-duration-appx-package-load-times/>

I have removed all the appx packages. it's apart of my tuning process I follow. But its the system ones that I need to figured out why they are holding up.

Typically I remotve the Store, but in the case the client wanted to disable it. But it's an option.

Yep. Unless AV in the CVAD hosts can pick it up

Do you have access to the license server? might not be historic data but could be something there to get?

If Director is axed, is the Monitor Database still available to be poked at? or its that far gone

Or if WEM is present - you could probe that

Thanks, Nick. I just found this which looks like their issue: <https://support.citrix.com/article/CTX202564/citrix-director-becomes-unresponsive-after-accepting-user-credential-when-xframeoptions-is-enabled-in-iis|https://support.citrix.com/article/CTX202564/citrix-director-becomes-unresponsive-afte[…]epting-user-credential-when-xframeoptions-is-enabled-in-iis>

Brilliant.....good luck ! :slightly_smiling_face:

When I say customer, its presales. Don't want to get sucked in too deep at this stage. IVe sent that link, lets see :slightly_smiling_face:

if you're using user/device licensing, then the number of user sessions per day might give a rough number on the usage.

Thanks - its concurrent but there could be bursts to cater for. We only have a couple of days looking at peak times. I'm hoping the above fix works :slightly_smiling_face:

We tried a bunch of fixes outlined in articles etc. In the end, adding more memory to the DDCs sorted it :slightly_smiling_face:

I solved it, by restarting the Spooler on every VDA. I have no idea why.

```$vms = (Get-BrokerMachine | Where-Object { $_.RegistrationState -eq "Registered" }).DNSName
Invoke-Command -ComputerName $vms {
    gpupdate /target:computer
    Restart-Service -Name Spooler -Force
}```

would this do? <https://docs.netscaler.com/en-us/citrix-adc/13/networking/best-practices-network-configurations.html>

have you ever seen an issue where a user session does not work remotely via SF and freezes either during or after logon.    However,  internal or via netscaler vpn it works fine.

it happens to a select few users...we uninstalled and reinstalled the workspace but that didn't fix it.

Anti virus exclusions all set on the endpoint?

if the user tries from my system he's fine

soooo...he's going to work on troubleshooting that.

To be less specific, does anyone do WebRTC with BCR for the offloading? It's for real time audio call.

Hey, did you manage to get anywhere with this by chance?

Hello; Im doing a 2203 Citrix on prem and there is a issue where a laptop's internal smartcard reader is not passing thru correctly and the certificate is not shown in the user session. I have a lot of doubts because AFAIK, Im setting that the USB redirection should be done directly and automatically but its not showing up

i have a  similiar issue with usb security tokens but only have two users that use it so we are working around. Would be nice to figure out why its not working

I had to enable this value on a new 2203 CU3 VDA. Users were getting disconnected from sessions and unable to connect back to them.

Just as an additional data point: 2203 CU3 removed the EnforceUserPolicyEvaluationSuccess registry entry that we needed in 2203 CU2.  Ever since we upgraded to CU3 in our environment, that registry entry is no longer needed, so I haven't added it back.

Bildschirmfoto 2023-07-27 um 10.30.29 AM.png

Maybe this is intentional, because we have to use the new Export Devices Wizard from the PVS console?
<https://docs.citrix.com/en-us/provisioning/current-release/configure/export-devices-wizard.html|Export Devices Wizard | Citrix Provisioning 2305>

I think I found a solution:
• Exit Studio MMC
• From the folder „C:\Program Files\Citrix\XenDesktopServerSetup” copy the files „Citrix.Diagnostics.dll” and “Citrix.Diagnostics.Recorder.Cdf.dll” to the folder „C:\Program Files\Citrix\Desktop Studio”
• Start Studio and the error should be gone

Makes no difference, the dll is missing in both cases.

The approach to update application is correct. After you select the package, it is expanded to the system 8n the form of the original form. Once in monitoring mode you can edit or copy over that file.  When you want to save the package you have a choice  to save the package as an update or as a new package (with new pkg name and id guid).   If this is a file that will naturally be openned for write (whether or not it actually changes) AND the package has been deployed, you probably need to use the save as new package option, remove the old app and supercede with the new.

Watch netscaler syslog for "SSLVPN LOGIN" and "ICASTART" messages while logging in/launching sessions - you should be able to validate which (if any) tags are being sent to SF via the list of session policy matches

Check the "Require Token Consistency" box in Storefront for each store (I can't remember which SF menu its on). As far as I remember it disables Smart Access filters

For the browser itself? If so, chrome has a GPO now like sleeping tabs for for edge. I believe it’s call high efficiency mode. I haven’t used it so I can’t tell you the pros and cons. 

Maybe <@ULDHJB8BB> has details on his experience 

Used to use "The Great Suspender" in Chrome to help on old Xenapp boxes in the past (before it got blocked by Google for having possible malware introduced after a new company bought it). These days I just use the builtin modes mentioned above in Chrome and Edge as they seem to now work quite nicely.

you can replace that specific Driver via Citrix Policy

What are the endpoints?  Could be the LaserJet Color 2800 PS Driver is missing if Mac/Linux.

Hello have a huge production issue that I hope someone cna help out