World of EUC

<https://www.citrix.com/blogs/2018/01/08/citrix-vda-commandline-helper-tool/>

<https://support.citrix.com/article/CTX234824>

Do you use ADC or VPN? EDT doesn't detect MTU size. So you need to lower that manually in some scenarios.

Do you use default MTU (1500/1512) on your network? Are you seeing packet fragmentation on the endpoint (using Wireshark)?

Sorry for tardy reply.  Yes, default MTUs, haven’t looked at fragmentation, will check it out.  Is there a recommendation from Citrix on MTU?

No as it depends on your situation. But with ADC I would recommend 1480

I've seen the same. Most likely offender: ads.

This is where I wish uBlock Origin made something for IE.

Activate Tracking protection. It really helps! <https://virtualwarlock.net/internet-explorer-tracking-protection/|https://virtualwarlock.net/internet-explorer-tracking-protection/>

Some bloke talking tosh <https://www.youtube.com/watch?v=RAvHgXViRFk>

I use WEM actions for that. You have to copy some files in the user profile and set some registry keys. 

Looks like I know what I'm doing tomorrow.

I can confirm that Tracking Protection in IE is an absolute must.

I can export my WEM actions if you want. 

That would save me a bunch of time if you don't mind!

Just got the tpl files and placing them into my central store now.

GPP config in a link in the "Updates" section at the bottom of this article, if you're that way inclined <https://www.htguk.com/improving-citrix-xenapp-session/>

Sure! I think there are about 40 actions only for the Tracking lists. Ready in about one hour. 

<@UL5TCSW3D>: That script at the end will definitely come in handy.

Looks like the URLs have all been updated since these articles and videos.

The stuff is four years old.....quite possibly :disappointed:

Gotta think that any competent admin would notice that and wouldn't manually type out what they see in the video. If they did... fair game.

IE Tracking Protection WEM.zip

Here you go, you only have to edit the lists if you wish to use other ones.

This is one of those areas where I'd almost think about using reg.exe to merge a single file.

You are welcome, that’s what World of EUC is for :blush:

Well look at that, same URLs as James and the links still work.

TPL shaved off 100MB just on <http://MSN.com|MSN.com> alone, lol.

Too bad it didn't remove that Dow Jones update, too. Oof.

One thing I'm noticing is that the new URLs that Microsoft uses seem to show an old modified date. If I use the old URL and grab the list, it's definitely larger in size and has a newer date.

UpdateTPLs.ps1

In case anyone wanted to automatically modify EasyList, EasyPrivacy, and Google blocking in one shot.

That would be nice, wouldn't it? :slightly_smiling_face: Not yet

Yeah...when can we expect that <@ULGKFDUVD>? :wink:

Well my Citrix partner login does not grant access

So it must be some top secret article :smile:

There's a brief description of the fix here: <https://www.jgspiers.com/citrix-fixes-xenapp-xendesktop/>

I got that CTX Article form above blog only

anyone here can help me with this CTX Article

i think i found my issue. vc++ runtimes not present creates the issue.

yea, C++ is what creates need for extra reboot. More of issue now with 1912 remotepc

You may have seen this <@UKJA0MZN1> but I believe Dan runs through some install scripts on this Tech Zone article.
<https://docs.citrix.com/en-us/tech-zone/learn/tech-insights/remote-pc-access.html|https://docs.citrix.com/en-us/tech-zone/learn/tech-insights/remote-pc-access.html>

Did you also observed four process running for that disconnected session

Hmm not sure, tell me what you know!  I saw something on another thread here about that I think. 

<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1583584574212200?thread_ts=1583584574.212200&amp;cid=CK6TCV3JN|https://worldofeuc.slack.com/archives/CK6TCV3JN/p1583584574212200?thread_ts=1583584574.212200&amp;cid=CK6TCV3JN>

Ah, no, mine are very normal-looking disconnected sessions.  I can see user name, they can reconnect OK, I can log them off OK.  The only odd part is that many (or all) users are getting forcibly disconnected even while working. 

I am not facing this issue with VDA 1912 with WS2016

If so.... extend the drive. They are duplicates and standalone vms.

If they're linked cloned that's easy, expand the master, create new ones and delete the old ones.

<@ULLAD12P2>: where is it greyed out though? Inside the VM?

that would be normal if you haven't added disk space on the hypervisor/storage side

I think it might be a vmware rights issue and it’s only greyed out for me, I can’t add a disk to it either

I’ve just never heard of adding space to another drive and having it show up ont he C: drive

In VMware you can't edit disk space if it has a snapshot

As Ray states, it prob a snapshot that's stopping you from expanding.

Screen Shot 2020-03-17 at 5.56.23 PM.png

As far as I know Citrix Receiver is End-of-life (except for 4.9 LTSR): <https://www.citrix.com/support/product-lifecycle/milestones/receiver.html>

EOL, i understand, and if it was up to me, all our end users would be on the latest version of workspace.  But we have a lot of end users who are on devices managed by third parties.  So while prior to 4.9 may be EOL, i was wondering if there was a technical reason for their connections failing.  All our clients support TLS 1.2, since we enforce that on the netscalers, so the versions these users are running are not a lot of revisions behind 4.9.

VAD 1912 page states 4.9 LTSR is the only supported version of Receiver.  (Plus any supported version of Workspace).  No idea on the technical reasons, but try this: <https://docs.citrix.com/en-us/xenapp-and-xendesktop/7-15-ltsr/downloads/citrix-receiver-feature-matrix.pdf> and this <https://www.citrix.com/content/dam/citrix/en_us/documents/data-sheet/citrix-workspace-app-feature-matrix.pdf>

Are you allowing UDP at all, directly or via NetScaler?  Usually the first thing I try turning off when looking at issues like yours.

what version are those clients having issues? I will try to get a technical reason for you if you can give me those details.

If found ghis helpful : <https://blog.ollischer.com/citrix-xendesktop-7-x-query-citrix-receiver-versions-connecting-to-your-environment-xls-report|https://blog.ollischer.com/citrix-xendesktop-7-x-query-citrix-receiver-versions-connecting-to-your-environment-xls-report>

While Microsoft work on a fix, could we redirect these reg keys with FSLogix AppMasking?

I do not think they are working on a fix, the problem exists very long...
I hope they will reply to my issue :slightly_smiling_face: I will also open a case next week

one more reason to look at fslogix appmasking then

<@ULL6F7DRA> FYI i have the keys as well if you need them

OutlookPresence.reg

Change the path of Presence Addin to your paths an import this to the user

Also you need to enable the Teams Setting "Register as Chat app....."

<@ULL6F7DRA> do have the same problem in your environment? with the machine installer? Need to verify before opening  a case

I don't know, I haven't gone that in depth with testing yet

I have been trying to solve the basic issues

Just launch Outlook and Teams and set teams as Chat app and restart Outlook and check if you can see someones presence in Outlook (green or red bulbs)

<@US423Q1PU> where are you configuring Teams as the default chat app?

In my setup, Teams is the default chat app and I cannot change that and I am still able to see presence

OK has teams been installed with your account? and are you using it with ALLUSER=1 VDI Installation?

installed with a local administrator via MDT

Well I don't know, there seems to be a few different Teams-issues going around at the moment

Hey Guys, Are you seeing any longer login with VDA 1912? We use FSlogix for Profile Managment. VDA 1912 is delaying logins in my testing Windows 10 static images.

It’s bad enough that we’re telling people not to use it

we just enabled softphones for everyone and already had the jabber client in vdi, so now we’re telling people to use the VPN just for jabber

One of our guys tried it today from a win10 vdi and it wasn’t too bad though, I imagine it would be worse on a shared server os

That's what I figured. We're still not set on going the Jabber route, but I'll likely be adding this to my image for users on corporate devices.

This would be on W10 1809 on CVAD 1912 LTSR.

Tried it last week with VDA 1912 und Server 2012 R2 -&gt; Jabber is not usable at all. We had better results with the Avaya Softphone client 

really? I heard nothing but horror stories from a client that tried to get that working in VDI

although they were cloud based for their SIP stuff, not on prem…

Definitely check out Ray Davis blog post on Generic USB direction guys. Very relevant right now and very useful.  <https://www.mycugc.org/blogs/ray-davis1/2020/03/10/how-to-get-udp-audio-in-citrix-vad-working><@ULLH5JGFR>

is there any way to get UDP audio through citrix cloud gateway?

that was my recollection, just didn’t know if they had changed it

Nope, to the best of my knowledge. You'd need an on-prem gateway.

We're all set on the Citrix side of things over here.

Just need somebody with juice to decide if the direction is going to be Teams. Or Jabber. Or WebEx. Or whatever... just choose and let us know.

Just no BlueJeans. That shit is straight up trash in Citrix.

don’t use webex right now if you are US, audio was down most of the morning

We are in the beginning stages of our O365 migration, so Teams isn't available to everyone yet. That is the obvious solution to me.

I hate Teams, but it's better than the others.

I don’t know if it’s just the way we have it set up but I have to log into voicemail, then phones, then accept 3 certificates before jabber will work

lol, I literally just finished scripting that damn cert import.

```Function Import-Certificate {
     Param([String]$certPath,[String]$certRootStore,[String]$certStore)
     $pfx = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
     $pfx.Import($certPath)
     $Store = New-Object System.Security.Cryptography.X509Certificates.X509Store($certStore,$certRootStore)
     $Store.Open("MaxAllowed")
     $Store.Add($pfx)
     $Store.Close()
}
 
Import-Certificate "$(Split-Path $MyInvocation.MyCommand.Path)\cert.cer" "LocalMachine" "root"```
^Code used.

Even better with UDP audio. I got avaya working as well without the VDI communitor.

Setting the citrixaudio service to realtime helps on the vda. I'm been building a emergency vdi environment for that last 3 days. It's all ingraned in my head lol. Thanks Leee

Screen sharing was always the issue for me in BlueJeans. It just stuttered badly, and font rendering was atrocious. Never had either of those issues with the other systems.

Did you use the VDI version? It was sent to be about 5 or 6 weeks ago. It's better that the original one.

Blue jeans is a bit behind but I have the contacts to the people who is making it happen.

If I had to pick one. Based of my research it would be zoom.

No, it wasn’t a VDI version. This was a while ago... and I think I was talking to you about it in another thread?

It took me a while to get it. But I kept knocking on doors. Finally got it.

Unfortunately when companies purchase software without consulating with the experts that have to check compatibility (us). You go to deep measures to get what you need to be successful. It was tough, but fun as well.

image.png

Please install the following BlueJeans app within the Citrix desktop environment:
	<https://swdl.bluejeans.com/desktop-app/VDI/Tech%20Preview/BlueJeans.2.17.791m.msi>






	Local machines is there laptop, personal pc. It is only compatible with Windows 
	
	
	 BlueJeans VDI Connector:
	 
		· <https://swdl.bluejeans.com/desktop-app/VDI/Tech%20Preview/BlueJeans.VDI.Client.msi>

So both of those are needed in the Citrix image? I'll check it out.

One in the image, one on the client. LIke the the HDX RTME pack

Is there an install missing then? The above links I assume both go in Citrix, but where is the install for the client's endpoint?

Sorry man, The top link goes in the VDA, the bottom link go in the local client

Been working 18 hours day. my company waiting last minute, and I am deployed machines left and right :disappointed:

No worries, I was in your boat 2 weeks ago when I was asked to quadruple the size of our XD environment. :slightly_smiling_face:

What worse for me, is we have poop software, so I have to do most of them as static desktops

Our desktops are pretty vanilla, since we put a lot in XA. I've been fighting that battle, and will continue to do so.

No, I am not putting Bob's Phlebotomy app in the desktop.

We have Cisco Call Manager for our phone system and use Jabber in the image for IM only.  Until recently trying to offload VOIP to the endpoint was not possible because we did not have Expressway deployed to facilitate the Jabber/VDI client communication on the endpoint.

Had limited success even with Expressway and VDI client

Then you run into the scenario where if someone connects from an unmanaged device that does not have JVDI client but has the expectation they can make calls, then it'll render server side which has terrible results.

Now that we have more people working from home we're seeing them try to use it for calls/server side.  Probably going to have to disable microphone redirection to keep people from trying.

Jabber is just horrible in general, I hate it.  But...we're stuck with it.

We deployed it for emergency purposes for CV-19, but only on thick clients.

We can't even share images in IM now because nobody took into consideration that when they put in Expressway to enable Jabber on mobile devices that they also enabled the ability to exfiltrate data :hankey:

So they had to disable file transfer entirely, which is how images are shared in IM

Recently we have 2012r2 xenapp servers stuck on welcome screen. The strange thing is this only occurs on a domain that that has a 2 ways transitive trust. Anyone every seems this? Happens on both 715 and 2012r2. 

Similar connections issues for me.  Very small scale rollout.  I consider it flakey. 

We are rolling it out actively now when needed. One thing we did to help out the install was to package the C++ pre-reqs separately, reboot and then run the install of the VDA

Not that error, but check if the "cmstart.exe" key is present in the following regpath:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"AppSetup"
Usrlogin.cmd, Cmstart.exe

I know if the cmstart.exe is missing, no phyiscal drives or usb drives will be redirected

1912 Site with Win10 Build 1903 fully patched (VDA 1912) RemotePC. First Login and Desktop start -&gt; Fine. Second Login -&gt; Screen shows up for a second, freezes, no mouse or keyboard action is possible :confused: Reboot physical PC -&gt; Ok for the next login. Only Eventlog which is generated at the second failed login is "Event: 1050 Connection validation failed on domain for user for reason 'HashExchangeFailed"

I only can find this error with the reason "Deny" or sth else, NOTHING about "HashExchangeFailed" - Any ideas on this?

Andy Morgan has written an alternative, he's soon to post a link.

I am having the POC tmrw and customer is not having ConfigMgr

<https://twitter.com/andyjmorgan/status/1240763365817008141?s=21|https://twitter.com/andyjmorgan/status/1240763365817008141?s=21>

I have added a comment to see if Andy can ping up a link

<https://twitter.com/andyjmorgan/status/1241124707237335042?s=21|https://twitter.com/andyjmorgan/status/1241124707237335042?s=21>

Tha sky dealing with this right now! I am shopping too. 

I was expecting the VDA to manage the power management

Set the connections times with a MS GPO (Remote Desktop Connection). They also work for Citrix HDX sessions. 

This works on Citrix Xendesktop machines as well? Really wow never knew that

I tested this on Citrix Xendesktop windows 10 machines. Perhaps I miss understood you. Dont appear to work on Desktop OS.

We don’t have a mix in our environment, but my session times are all in Studio policies. I don’t use AD GPO for any Citrix policies outside of Receiver.

I use 8vCPU 2sockets 4 cpu a piece. I try to stay within physical NUMA nodes. 16gb-20gb ram.

CPU: Consider NUMA rules, but min. 6 vCPU
RAM: Depends if you use PVS RAM cache, but I suggest min. 24 GB 

What is your hypervisor?  We just did this w/ Nutanix and i worked w/ someone that created an awesome automated script and paired that w/ a controlup script to initialize/format/mount which let us do it in bulk

here's the info in case it helps w/ any other hypervisors. my only addition was the simple controlup script.  <http://blog.myvirtualvision.com/2019/11/19/nutanix-ahv-and-citrix-mcs-adding-a-persistent-disk-via-powershell-v2/>

VMware. I assume MCS can't have a D drive in it's template? I'm so used to PVS. It a new change. I need a D drive to store wem cache, logs, and pagefile.

i dont think Citrix allows it by default but could be wrong. and  yup thats exactly why we did it, to redirect windows logs to try and track a blue screen issue back in the fall.    the controlup script should be linked in that article.  i'll ping our nutanix SE to see if he can ask the author about vmware options

I have went through this process. Assuming MCS can't ha e a persistent drive in it's template. I could add it to my master image. Do what I needed to. Seal shutdown.  Deploy machines. The run the script to add the extras drive so my logs all all that starts on D. However I am not sure if I can just use the MCSIO drive as well? Can I?

hmm that i am not sure about.  w/ pooled we ran into the issue even adding to the image that it NEEDED to be setup on each pooled machine, initialized and mounted for it to work for us

So when the MCSIO drive is created is it shown up as a drive like PVS write cache?

we actually dont use the MCSIO since i guess its not needed in a Nutanix setup we're told (similar benefits just w/ their tech) so cant say for sure.   for us we only see the c:\ so needed to go the script route

Yea I'm pushing for Nutanix as well man. Definitely want that beast in my environment

mcsio will give you a persistent disk but you’ll need to build a new machine catalog to use it

it uses the same driver as PVS now, so it’s the same idea.

Yup mcsio is good now (not the old crap release in 7.15) and the persistent disk can be leveraged the same as pvs (BIS-F support makes it too) - else it’s a manual task 

Nice. That's good to know. But I guess where I am confused at is. I take a window 10 image. Spin it up do whatever it is I need to do. Typically I would have a non presissent disk as a drive drive. Then I would covert it to a template. Then spin it up. Each machine would have it's logs and other stuff on D. I guess I am not positive how it works in MCS pooled now. If I don't have another drive and I seal it with BISF. Not sure how it would work if there isn't a D drive for example. Where does all the logs go, wem cache, ect. I'm also assuming that once the MCSIO drive is spun up I could redirect event logs to it without impact. I just have to run through this

This clear up 90% <https://www.google.com/amp/s/appdelivery.wordpress.com/2019/03/28/mcsio-reborn/amp/|https://www.google.com/amp/s/appdelivery.wordpress.com/2019/03/28/mcsio-reborn/amp/>
Just need to figure out now how to do this in my master image so my data can be presistent.

Are you sure you need a persistent WEM cache drive?

No old habbit. I can change my ways. I just burned it in my head years ago when it was a thing. James told me about 2 years ago it's not needed.

Well this is another one I didn't know

<https://eucweb.com/docs/bisf-7-1912/gpo-configuration/citrix/configure-citrix-mcs-device|https://eucweb.com/docs/bisf-7-1912/gpo-configuration/citrix/configure-citrix-mcs-device>

Ahh long time ago. James guiding me lol. Thanks again bro.

<https://www.mycugc.org/blogs/cugc-blogs/2017/11/30/wem-advanced-guidance-part-1|https://www.mycugc.org/blogs/cugc-blogs/2017/11/30/wem-advanced-guidance-part-1>

You don’t need dedicated drive for WEM cache. You can add drive via hypervisor after VM deployment. It does remain even with updates. There’s the MCSIO route in 19xx versions but I haven’t really used MCSIO.

Thank you all for the information. I appreciate it very much. I'm getting away from PVS slowly. So its a change for me.

whats making you move away from pvs to mcs out of curiosity? i've always favored mcs myself but curious what others have gone through in case i have to help justify it w/ other examples

On your master image add a D drive. Configure BISF policy accordingly. When you seal, bisf will do redirects etc. when you create catalog, mcs ignores the second drive on the master and adds it’s own if you choose mcsio, bisf on start ensures that things line up. You may need a reboot after provisioning and in azure there are different rules 

PVS is way more efficient on prem if you don’t have amazing storage. MCS in Hyperconverged or flash based arrays is great - time and place for both depending on your needs and backend infrastructure 

Zero reason to have wem on a persistent drive

ahh yup thats what i remember.  when we were moving to our new setup we also were switching to nutanix and were told about the hyperconverged benefits . (and that we wouldnt need mcsio w/ that setup)

pvs also makes image management a lot easier. Much quicker to swap between images if testing too.

MCS can do quick swap if you change your process. Rolling catalogs for the win.

I had WEM’s cache on a persistent drive until 1808ish. Went back to the default based on an old thread here... old habits, n’at.

Thank guys. I'm preparing for the azure move in 1 year for us. That why I'm forcing myself to move

Ok cool so the template deal still applies. BISF is my key.

Hey <@ULJH9ED53>!   didnt know you were in here too

for controlup one of their techs got me a powershell script to pull reports for a user that spans multiple sessions......wonder if it can be tweaked to add multiple users

we basically use Director trends data, anything outside of that will require PS or OData queries you need to build yourself

i have the ps1 that a CU tech got me with some instructions if anyone wants to try. it outputs a csv or excel file so not super pretty but gets data

alright i'm attaching the ps1 file (rename to remove the .txt) and also the instructions i was sent

this is setup for 1 user but maybe can be tweaked to add multiple?

the main thing we requested this was because natively you can only export 1 user/1 session report at a time and most of the time we'll get a request for a users report over the course of several weeks (which would be several sessions)

I’m not sure I’d recommend it just yet

i've been pushing for a multi session user activity report w/ controlup for the past 3 years and multiple times told they can do it and should be ready soon and never happens.  thankfully the last tech i bugged got me this ps1 and does the job pretty well....just not in a pretty pdf report format insights web will get you for a single session but gets the job done

ugh, this became a sticking point at a previous job. pulling tattletale reports like that distracts admins from their actual job imo - if there's a people problem that should be going through HR instead of making IT babysitters.

especially because I’m logged into like 5 machines at any one time

yup for us users only have access to 1 desktop at a time so not so bad.....the report i sent has proven to be fairly accurate if you have controlup BUT have to make sure the agents are reliably connecting in and uploading data to Insights.   i always told HR take with a grain of salt and i always HOPE it would just confirm what they already know rather than being the ONLY factor used

We were asked for peak numbers. I wrote two PowerShell scripts to gather this data throughout the day, and I just relay the highs for now.

that works too!  way back before we had reports like this we did simple powershell reports on windows lock/unlock events to kind of give a picture of activity (ie. if you see a lot of locks and long stretches between the unlock event obviously thats a long idle....or if you see a lot of locks and immediate unlocks could indicate someone half paying attention)

i always hate giving those reports though

Yes, we are but here to serve…. Most of my employer’s fee income is from time-based billing, and this whole Work From Home thing is a major paradigm change that has been effectively forced upon them with no real notice, so there is a lot of catching up to do in terms of management, trust, etc. They’re clearly very nervous about the whole workforce being at home and effectively ‘unsupervised’, as they don’t have the management skills or processes in place to deal with that yet. I am hoping these basic reports they’re asking for are enough to help them relax a bit, but to be honest if a few company-wide reports highlight the odd abuser then I won’t be losing any sleep at night…

Thanks for the CU script - will take a look.

no problem! and yup totally agree with what you said......this is a lot of people working remote that normally wouldnt so have not built up that trust level yet so i've been waiting on the requests here too.   just hasn't ever been an easy convenient way to get them.  this script was the closest i've found. good luck!

The password for the user is throwing me off?

well, windows media player and that sort of thing

nevermind windows media and flash redirection is not enabled

I deleted my profile, loged back in to this delivery group, and i could briefly type into ie

then a dialog box was displayed in the session "changing keyboard layout to united states english" and it stopped working

keyboard may have been a red herring.....seems like disabling protected mode on the internet zone "fixes" the issue

not sure why it just started occurring now