World of EUC

image.png

are you sure there isn't an extra older component on those clients? This is what you'd get if you still have an old online plugin installed aswell.

This happens sometimes when trying to launch from Chrome

installing with these tags... `/forceinstall /AutoUpdateCheck=disabled /silent /includeSSON /enabletracing=false /enableCEIP=false /allowsavepwd=S StartMenuDir=\LOBApps DESKTOPDIR=\LOBApps RemoveAppsOnLogoff=true RemoveAppsOnExit=true`

i know i don't need forceinstall, but we use the same choco package for older clients and new builds, so that's why it's in there

Just curious how are you installing it? All CLI correct?

I fix  this in the past, install those feature (in the end i just installed the WSA) from a location where the user has execution permission..  this trigger the same behaviour, but the user can run.
I assum, this is triggered when user launch an citrix application managed on the othersite which require the onlineplugin. (Proberly old farm or so) 
It might fix only in my case.

can you set install directory in the WSA cli?

According to the customer, the user's are probably accessing some kind of legacy Citrix setup, managed by another company

So, I don't see any way to set the EXTRACT directory in the installer

In my setup, this is not accessing legacy anything. It's going to our Internal NetScaler/SF setup.... and again, never see this error launching directly from WSA.. just from Chrome....

Edgium is broken..   Old Edge, i'm not sure.

When I get another one of these broken, I can test

Stupid question. Have u taken the chocolately part out and do old fashion cli. Shouldn't make a difference but I'm curious.

A long time ago I had this but it was due to app flow on the Netscaler. I know it sounds dumb as it did then. I turned it off and upgraded to 12.1 . I was on 11.1 when I seen this.

i'm pretty sure I have installed manually with CLI and still see it in Chrome.  Would have to confirm... <@ULL6F7DRA> You know why yet?

Me thinking here...... And searching around. Have u seen this? <https://desk.zoho.com/portal/advanceprotechnologies/kb/articles/how-to-fix-icawebwrapper-msi-issue-when-launching-app-from-web-portal|https://desk.zoho.com/portal/advanceprotechnologies/kb/articles/how-to-fix-icawebwrapper-msi-issue-when-launching-app-from-web-portal>

<@ULLH5JGFR> Sure, that's exactly how you fix it.  :smile:   I don't want it to happen in the first place!  :slightly_smiling_face:

Yea I get. Sorry man. Just figured I this it your way.

I too would like to know this! We are building a Win10 VDI environment "just in case"

I tested it in our W10 VDA a month or so ago. Seemed to work okay there, though I can't speak to S16/19.

Bild von iOS.jpg

<https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jvdi/12_0/windows/deploy/jvdi_b_deploy-install-jvdi-windows-12-0/jvdi_b_deploy-install-jvdi-windows-12-0_chapter_01.html|https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jvdi/12_0/windows/deploy/jvdi_b_deploy-install-jvdi-windows-12-0/jvdi_b_deploy-install-jvdi-windows-12-0_chapter_01.html>

But is it supported? That’s the big question 

I don’t think our end users care, they just wanted it working

Are you already using Jabber VDI version 12.6 which supports Citrix Gateway? Is it working reliable?

we’re on 12.7, not sure if it’s the VDI version or not, can’t see the jvdi agent running.

It worked for me, but I have a gig internet connection at home, others are complaining it starts out ok and then goes to crap

Okay thanks for sharing your experience :+1::skin-tone-4:

if you get it working 100% let me know, I’d be keen to get it working better than it is

the issue I ave is there is no jvdi client for mac, and a lot of us are on mac

Watch out for VPN Julian. If you have users that need it you'll need an IP assigned for each user. Fine on prem, no so much on the cloud.

VPN shouldn’t be needed when working with Jabber VDI Version 12.6 -&gt; <https://support.citrix.com/article/CTX234962|https://support.citrix.com/article/CTX234962>

No no, this is if it's cloud and users have laptops and VPN.

You are saying VMXE is not working when using Gateway as a service from Citrix Cloud? Fortunately not the case here.. 

No, just native jabber users using a VPN, if you happen to have a netscaler in Azure. Each user requires an individual IP limit in Azure is 255 ips. Nothing to do with ICA connections. That'll be fine. I thought I'd highlight this just incase.

Okay :+1::skin-tone-4: If this is going to happen it will be a 100% ICA use-case. 

our users are doing both right now :disappointed: VPN for jabber on the PC and then citrix hits storefront over the vpn instead of the gateway. This is why we’re moving jabber to VDI

Have you used SetFTA or just trying to get it to work natively?

Tried using the SetFTA utility, but the client doesn't want to force browser settings for everybody, and we don't want to manage that as users switch browsers. I'm not 100% certain the outcome of the SetFTA tool because it would set at every login, which isn't ideal either, but could work well enough.

And again, it works for "upgraded" profiles, so just seems odd that it would not work for new profiles. I am only attempting with default browser, and I know I can't publish the built-in default selector in 2019, which is a pain now too.

Is there a fix number I can provide to support? They aren't being helpful in looking for it.

Sounds like Citrix is going to develop a new private for our environment. Appreciate the responses.

<@U012AAZRJ20> do you have a fix number by any chance? I am seeing something similar and I am using setdefaultbrowser.

I don't yet, I will update when I get a fix. I am out of the office on Friday, so expect Monday or as soon as they get the fix.

Citrix came back with upgrade to 2003. I said no, I am LTSR. Waiting for response to that.

Citrix provided a Private fix, but no fix number, this morning. It is an updated UserProfileManager.exe.

This is the explanation and instructions for use from Citrix:

The reason this is happening is because the inherit permissions on HKCU\Software\Microsoft were removed by UPM 1912.

Instructions for deployment:

•	New users that logon with the private UPM in place will not see this issue.

•	For existing users, manually enable the permission inheritance of ALL APPLICATION PACKAGES to the HKEY_CURRENT_USER\SOFTWARE\Microsoft registry key:
•	Log on to the VDA with the target user account.
•	Open Registry Editor.
•	Navigate to HKEY_CURRENT_USER\SOFTWARE\Microsoft.
•	Right-click the Microsoft key*,* select Permissions -&gt; Advanced, and select Enable inheritance, Select the check box to apply the permissions to all child objects.
•	Click Apply and OK in sequence.

If you’re planning to remain on LTSR this fix will be available in the upcoming 1912 CU1 release expected this quarter.  This fix is also included in the CR release 2003.

<https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/1912-ltsr/system-requirements.html|https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/1912-ltsr/system-requirements.html>

Image from iOS.jpg

pretty sure that's the cipher related error.  Guessing it works if you use Receiver or workspace 1903 or earlier?

Yes, asked to downgrade Receiver 4.9 and waiting for a response. Does CWA has its own list of ciphers or it goes by the approved list on the workstation?

<https://support.citrix.com/article/CTX235509>

which comes from <https://support.citrix.com/article/CTX253819>

Thanks <@ULJMUV893> , I was told it’s internal users accessing web interface directly. I have a meeting with them tomorrow, will find out more

<@ULJMUV893> correct its ciphers related issue only. Client and Server cipher suites might be not matching

<@ULTD5QMBK> Are you using Citrix Gateway? or internal network testing?

Internal network and it worked with Receiver 4.9. So we are going to stick with version

it’s a total pain in the ass to get working right and if the certs don’t work for whatever reason everything breaks

I tried it once for a client and they determined it was too much hassle

You have 2 actually, Enable Secure ICA vs Securing ICA with SSL. But  Securing ICA with SSLIts a pain for non-presentient machines YES! If your talking about the one where you

This always helps me <https://discussions.citrix.com/topic/371258-enable-secure-ica-vs-securing-ica-with-ssl/>

Citrix SSL on VDA.docx

I wrote years ago, I havent verified if its still accurate. But I will point you in the correct direction.

Thank you. I’m just looking at the Secure ICA. Not looking to do SSL.

doesnt' work with HTML5 light client if you are using that. You would have to go the real TLS end to end encryption if so

Crank up the display memory limit setting? cheers

Ok, cool. Let me research that. Never done this.

Ok.. interesting point. I meant to hit you up a few weeks back... that support doc you made for all the DPI settings is great... but the issue I had was due to the memory display limit being on default... the users with issues were using mix of monitors with some 4k in the mix... in short, the default setting was not providing enough memory to support the displays/graphics demand resulting in lots of weirdness with pointer calibration and dragging windows around... I'll try dig up the article I used... cheers bud

Ok, Nice. That would help alot. Thank you John

Maybe this <https://support.citrix.com/article/CTX115637>

That's the one... I didnt get scientific with it... I bumped it up to 256 or 512MB from the default and all affected users reported the issues stopped :slightly_smiling_face:

This article is a bit confusing LOL. I have to read it a couple of times

Talks about editing the ICA fiel, but I am kinda lost LOL

Ahh I didnt see that in the article. Am I missing something or I cant read very well.

How did you take that article and figure out it was a Sutdio Policy. I am just dumb founded right now LOL

I was looking at a few... I started out there from memory...

I think these options are only available in GPO. I think Citrix Policies mostly deal with the VDA and what it has access to do, not anything Client/Workspace related.

hmm, field computers with no VPN, not connected to domain, ect, Sigh

this has to be the worst part of receiver to configure

For me I include all the registry keys in a batch file. once to inject the Trsuted keys, One to set generic if needed. I then share it with the users, when it installs it will set the keys on the machines.

let me know how it goes. Getting exe to them may prove to be just as diffucult as reg files.  However, I gues i could always put it on a website and tell them to download and lauch the exe

Check your Citrix policies for this setting: <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/reference/ica-policy-settings/bidirectional-content-redirection.html#copy-and-paste-between-session-and-client>

Rankin has a bass A$$ article on this. Let me find it.

Here it is
<https://james-rankin.com/articles/citrix-virtual-apps-and-desktops-clipboard-redirection/|https://james-rankin.com/articles/citrix-virtual-apps-and-desktops-clipboard-redirection/>

you guys rock!  thats exactly what we needed to be able to do......copy text client to session but thats it. looks like this is what we needed. thanks guys!

on this same topic, do you guys use studio or group policy for your policy management for Citrix.  i like the idea of using Studio but find it terribly inconsistent when it actually works

I use studio because I dont care to mix MS GPO with Citrix GPO. I used both and I was able to restore Citrix Polices from Studio hell of alot faster the MS GPO.

Same - Studio all day, every day. I don't have time to sit around and wait for GPO replication to test changes.

i'd really love to use studio but for some reason its super hit and miss on when it works/doesnt and support has been less than helpful on it.  our mcs persistent ones seem ok with them but non persistent/app layering not as much

7.15.2000 for back end, 1912 on the vda (coordinating the back end upgrade to 1912)

the issue with putting citrix policies inside group policies is that if you don’t have the tool installed to view them, the settings don’t show up at all which makes troubleshooting them impossible.

I agree... So how do you troubleshoot studio based policies when they aren't applying

Did Studio policies work when your VDA was on 7.15? I’d run the modeling wizard first to see if it shows that policies would be applying. Policies should be writing to c:\ProgramData\CitrixCseCache on your VDA, IIRC.

This may help: <https://support.citrix.com/article/CTX220739|https://support.citrix.com/article/CTX220739>

<@ULC9J5XPB> actually we had the issue w/ 7.15 for sure and been a bit since i tried since we moved to 1912 so maybe i'll have better luck now.  i actually ended up loading the citrix gp engine on my platform layer and imported my custom template/settings there since we dont change them too often. not ideal but got it working for now while i circle back to it....really want the studio way to work as i dont have access to our group policy side of things

so that worked great for text......anyone know which format i'd need to allow to allow screenshots from client to vda?

Yeah, that would solve the policy issue, but we still had all sorts of crazy DDC connection and registration issues. We're changing up our process today to see if things go more smoothly.

cool so you are changing how you deal w/ citrix policies or something different?

Nope, hopefully changing the status of this 1912 upgrade from 'disaster' to 'success'...

ahh gotcha.  we are planning our 1912 upgrade soon enough here too so any gotcha/s  tips you run into send em over! i saw the .net update first thing  so thats a big one

I normally use FoxIt which you can edit PDFs in to some degree.....seems to work fine and is a lot smaller than Adobe

<https://github.com/haavarstein/Applications/blob/master/Misc/Foxit%20Reader/Install.ps1|https://github.com/haavarstein/Applications/blob/master/Misc/Foxit%20Reader/Install.ps1>

I use FoxIt on my own machine, but it seems pretty severely limited compared to Acrobat.

Did you know that Word can now edit PDFs as well?

Yes, and it has to convert it first. The formatting is often screwed up when I've tried this.

Foxit as well. But like you said its limited

The new Edge browser can also handle PDFs

Yes, I usually see either Foxit or Adobe Reader

We've got Adobe Reader in there now. I think we're going to try App-V with Acrobat first, even though Adobe "doesn't support" it.

Perhaps Acrobat Reader and Pro can be used together with AppMasking and/or SetUserFTA. I think I already did that before but after all these projects I‘m not even sure :joy:. 

We have adobe pro and adobe standard don’t get me started, I have two different masters images. 

The paid alternative that competes with adobe are DocsCorp PdfDocs and Nuance Power PDF

I have a hate/hate relationship with Nuance, so that’s gonna be a hard pass right there.

I have recently used FSLogix AppMasking yo install Actobat Pro and Reader on the image and I set FTA wiyh SetUserFTA and it’s working great. so far! 

New blog post to walk you through hosting Adobe Acrobat/Reader DC on Citrix Non-persistent RDSH with FSLogix App Masking <https://bit.ly/3bX1eps> :blush:

Cool I think we forgot a few things on this right <@ULJ3D468M> 

should have noted that this is a published desktop.

I'd log a case for this. Makes sense because it's using the local browser engine but if say it's wrong. Had user experience. 1912 doesn't have BCR btw, latest release?

I am seeing the same with CWA 2002 and VDA 2003 on WS2019

I can adjust the volume just fine on the local device, as expected

May be worth checking release notes to see if it's a known issue. I can see why this may be difficult though. Which one should win?

I have a ticket open with Citrix on another confirmed bug in 1912 LTSR and 2002, so it wouldn’t surprise me if there are a few more.

What’s interesting is that this also happens when using the vdi version of zoom that redirects zoom to local client. I haven’t tried with on older workspace app but that says to me that the issue may be with cvad 1912 itself. 

That bit about the Outlook add-in is interesting. Oddly enough, even after adding those keys, I don't see Teams in my Outlook bar - even though if I configure the ribbon, it's there.

Usually I'd point to App Layering here, but I don't think Teams requires me to add my Office layer as a prerequisite, since those files are all in their own Teams folder.

Hmm...havent tried that combo...let me see if I can find a 32-bit Office somewhere

If I customize the ribbon and find "New Teams Meeting" in the list, I can then add it to a new group on the toolbar. The icon actually shows purple instead of grayed out, so it does work.

<@ULC9J5XPB> I have just done a quick test on a 32-bit Office 365 client, my registry fix works just fine here.

I'll see if I can find a Office 2016 ISO somewhere and do some testing

<@ULL6F7DRA> Nice article, is presence working as well? My case is still open...

Also seeing issues where ribbon is not there before teams have been started once. Reg values are added by wem, also tried registering the dlls before starting outlook, no go.

<@UTDUHR9FV> good point, I actually haven't tested. The tests I've done has always had Teams opened at least once.

Will test and update my article if necessary

Kasper, this is a big help. Wonderful Job. This will help alot of folks out.

<@ULL6F7DRA> did some checking. Addin gets loaded in outlook, files getting created under appdata\microsoft\teams\meeting-addin as normal (files also updates on every close of outlook). But as long as the user has not been signed in to teams once, the button is not available in outlook. You can add it manually-and it will show, but fail whan you click it. Not had any luck yet of bypassing the need for 1st login to teams.

Thanks <@UTDUHR9FV> I'll also have a look at it. Working with Teams during the last month or so, it really doesn't surprise me that MS made it that way...

<@ULL6F7DRA>: I can confirm that if you're using App Layering, you need to load your Office layer as a prerequisite when creating your Teams layer. Once I did that, the Teams meeting button appears in the toolbar without having to modify any keys.

I don't see that running, no. The other 2 servers finished, but the one I'm doing is still going.

forced restart and try again! whats the worst that can happen? :slightly_smiling_face:    is it too early for jokes?

I'm close to reverting the snapshot. This is absurd.

I cancelled the install, rebooted, ran it again.. finished in 5 minutes. JFC

I've experienced the same thing last week during a delivery controller upgrade. Forced a reboot and the install was finished in 5 minutes

We're one delivery controller away from completing this first site.

Done. Saw a weird issue where we had to run through Site upgrade twice.

Had the same issue with WEM agent, it also needs . NET 4.7 or higher now. Very annoying... :face_with_rolling_eyes:

YES! I install .NET 4.8 and Visual C++ bundle on all our servers with MDT for a while now. No need to reboot during CVAD or WEM setup anymore…

Nothing like waking up and reading about how .Net 4.7 can kiss you a$$. Funny

In hindsight, I should have gone the route suggested - installed 4.8 - but this was an oversight. We still have to upgrade our other site tomorrow, but so far everything looks good.

looks like we're still at 4.5.2 on our 2 broker servers.  so thinking best to upgrade those to 4.8 ahead of time and upgrade probably should go smoother? (in your experience at least)

Reboot your DDCs, then install .NET. That helped a ton.

CVAD 2003 requires .Net 4.8 I think. Not sure about 1912, but it's future proofing for upgrades for sure

We do! Historically (before FSLogix) we just used GPO to set the location of OSTs to a DFS share, and the same to control the amount of cached mail that lives in said OST. 

What part of FSLogix is unstable for roaming the OST? Are you just using office containers?

I’d add that GPO and DFS isn’t without its stability issues. We do see duplicates and get deadlocks. FSLogix has been working relatively well where we deployed it, just keeping the agent updated can be a challenge

Using the profile feature not office.  I get the ost is configured for a different mailbox. I might try the the office profile too.  The fileshare is a good idea, might try that

Update: No Issue on 7.15 CU5 VDA when using native Network-Twain with Client Twain-Redirection disabled....will open Citrix Call tomorrow.

Update2:
We were sucessfull with twnhook.dll from:
- VDA1903 (dll-version 7.21.09)
- VDA1906.2 (dll-version 7.22.0.14)
- VDA2003 (dll-version 7.25.09).

With VDA1909 (dll-version 7.23.04) and VDA1912 (dll-version 7.24.0.36) the issue comes up. So they broke it in 1909 i guess.
We already opened a citrix support ticket. Now we're waiting for a call back.

Ugh, let us know when you hear something, we have a ton of 1912...

Today Citrix Support finally called me. They recorded everything we found out already. Hope they release a fix for 1912 in CU1...We’re going VDA 1912 and dll-Version 2003 for the testing environment...
You may want to follow the discussion thread in forums:
<https://discussions.citrix.com/topic/408343-network-twain-not-working-unless-hooking-is-disabled/#comment-2063227|https://discussions.citrix.com/topic/408343-network-twain-not-working-unless-hooking-is-disabled/#comment-2063227>

1912 CU1 seems to fix this one. Going to test next week and let you know.

Fixed issue (Session/Connection):
After you upgrade a VDA to Version 1909.1, some third-party applications such as RemoteScan might fail to scan a document and become unresponsive. The issue occurs because of the faulting module, twnhook.dll. [CVADHELP-13937]

Deployed 1912 CU1 VDA just an hour ago...first test looks promising. Now PaloAlto TS-Agent tries to crash the party, but that’s another story. So yes, issue seems to be resolved for us.

awesome, thanks for testing that for all of us.  :slightly_smiling_face:

Answered my own question: "Check that the system clock is in sync between this machine and the delivery controller. "

Nevermind I found it <https://support.citrix.com/article/CTX126992|https://support.citrix.com/article/CTX126992>

It's just weird that we never saw this issue in months of QA testing. Almost done sealing the image after resync'ing the time now, so hopefully it's as simple as that.

I’ve seen this so often, had a machine that was waaaay out in tthe template and it took forever to sync time with the domain after booting up. Had to fix NTP in the master image before they would all register properly.

Sync'd time in the image, still broken. Citrix Studio policies aren't applying at all, but it's random. Love it.

is it contacting the domain successfully?

Seems to be. Hell, I can login. AD GPOs process, but Studio doesn't.

Seeing the following in my event logs:
```The Citrix Desktop Service is re-registering with the DDC: 'New Auto ListOfDDCs / ListOfSIDs, registered DDC not in new list```

I’ve seen issues where it tries to hit the first DDC in the list, but that got decomed

Yes, we have AutoUpdate allowed (via AD GPO)

dunno, I’d double check your list of DDCs/SIDs and make sure it’s still correct

maybe change the order if it’s having issues

Well, this was fun. The decision was made to restore everything to 7.15 tomorrow and run through the 1912 upgrade.

Wait, a roll back? What happened other than the time.

We've spent the entire day on the phone with Citrix. Just random DDC issues - either it wouldn't register, or would become disconnected, etc. The biggest tell was Citrix policies not applying.

When we went through the 1912 upgrade initially, we went through the automatic DB upgrade (one of the final steps). Then we upgraded the last DDC. Opened Studio a few minutes later, and it was prompting us to update the site again.

Oh, and those issues were completely random.

Our DDC issue was similar to this, actually: <https://citrixguyblog.com/2017/03/08/xendesktop-studio-gets-stuck-in-mandatory-upgrade-loop/>

<@ULJUX26GG>: When you saw this, did you have multiple DDCs for the upgrade?

We upgraded 2 of ours, did the schema update, then the final DDC. We'[re thinking of doing 1 DDC tomorrow, then immediately updating the schema, then updating the other 2 DDCs.

Which upgrade path? Didn’t read the whole thread. What’s your issue ?

7.15 LTSR CU2 to 1912. Basically followed Citrix's recommended path, but ran into a site upgrade loop when we got to the DDCs at the end. It eventually went through after a few reboots and retries, but we had random DDC issues with my W10 VDAs, with the main symptom being Citrix policies in Studio not applying.

We have 2 sites, so we just put this entire site in maintenance mode and enabled the other site. Going to restore the DB tomorrow and try again.

I have a upgrade in two weeks. I'm a little concerned now

Updated a customer yesterday from CU3 to 1912. No issues at all. But you will never know before. 

So I assume you will just go through the same process? Anything different you might do?

If you are coming from &lt;= 1811, I would always update to 1909 and then 1912. Had problems during one of my first upgrades. Database crashed during site upgrade. Even most of the 7.15 CU2-3 environments I update to CU5 first, afterwards 1912.

That's one thing we may change - going to CU5 first, and then 1912.

Yea, I will do CU 5 first. Hope it goes better for you Nick

If it doesn't, you'll hear me screaming from your couch.

Open your windows and you'll hear me screaming.

Upgraded from CU2 to CU5, then to 1912. All smooth. Same issues with Citrix Studio policies not being applied consistently. The weird thing is that after 1-2 reboots, we can't get one of the "failed" VDAs to ever fail again. It's almost like there's some corruption or something in the DB that is fixed by the VDA registering a 2nd time after the upgrade. I was able to get Scout traces and a ProcMon log over to Citrix, so I'm hoping they can find something.

Damn man. Well hopefully they point out what is jacked up.

I'm testing now, but so far it looks like if I power up all VDAs, and then reboot them, they appear to work as normal. I have no idea why that would be, but I'm testing everything now, and policies are applying - including new policies that I created in 1912.

Wtf? Just started working all of a sudden :expressionless:

Wondering what happens when u shut some down.

I've been rebooting all VDAs constantly. It seems as though after the 2nd reboot, everything works as expected.

Wich VDA 1912 / HTML 5 workspace app or native receiver ? 

VDA 1912, and Workspace app wie use the MS Teams App not Web

but are you connecting to your VDA via the full Workspace/ Receiver app or a HTML5 based connection?  reason i ask is we had a daylight savings toggle issue w/ the 1912 VDA after DST hit and needed a private dll fix (time shows fine but time zone is off so then calendar is off (outlook for us)

Workspaceapp.
They connect from our corporate device in APAC to the VDA which based in EMEA.
Corporate Device and VDA its selfe, shows the correct time zone as well as outlook.
But MS Teams is roughly 6-7 behinde.. which result that the Calander in MS Teams doesnt shows the correct schedules.