World of EUC

I haven't. Usually new VM and reallocate licenses.

if you aren't changing license server versions just copy the license files off and re-install to a new machine, will take you maybe 10 minutes.

if you change machine names then yeah, re-allocate

Good point Mike. Names are staying the same.

I have done that. From Server 2016 to 2019 without any issues. I had a backup and was curious if it works. 

Thanks Dennis, I was hoping someone did it lol.

This guide is better:

<https://www.carlstalhood.com/citrix-director-1912-ltsr/#directorsson|https://www.carlstalhood.com/citrix-director-1912-ltsr/#directorsson>

Worked for me like a charm

Carl’s instructions are correct, but Director seems to have a bug with SSO, when using anything other than hostname to access it from another computer.  If you do get it working using a different FQDN, from another computer, please advise?  The Citrix instructions leave out the SPN (even though they correctly advise enabling delegation on the machine account when using the default of kernel-mode auth).  Their advice to enabled credential forwarding for all of Trusted Zone is also awful - that’s what we have Intranet Zone for.

<@UV3TVUW0K> did you create the SPN on that DNS record like <http://director.company.com|director.company.com> instead of <http://server.company.com|server.company.com>?

Oh yes, symptoms are not those of an incorrect SPN.  Do you have a working config you could share?  

image.png

I cannot get SSO to work with Carl's instructions. I am currently testing on 1912, and no matter what I do, I end up on the "default" user/password/domain page. I also see this warning in IIS:

I am testing with both IE and Edge (Chromium) on another machine, so no local logons at the moment

Warning can be ignored.  You’ll need an SPN that matches the hostname you are browsing to.  The SPN goes against the computer account in AD unless you are using a separate user account in the app pool AND have kernel mode authentication disabled, in which case it does against that user account.  Whichever account hosts the SPN needs delegation enabled in the AD object.  That tab only visible against a user once an SPN added to it. 

Start by using the computer FQDN/Director  as your URL.  Test initially with IE, make sure the URL is in the Intranet zone.  

I am testing with a load-balanced scenario, where I am accessing Director on a <https://director.domain/director> I have configured the service account in IIS as per the instructions in Carl's article. Kerberos delegation has also been configured on the director service account

I'll test the basic config with the computer FQDN

That is the bug that Carl refers to - it just doesn’t seem to work from another machine.  I have seen (brief) claims of people making it work, am yet to see a working config.  I’ve spent many years doing SPNs, have tried all sort of weird and wacky things to try to get this scenario working.  No luck yet :-(.  Only thing that works off-host for me, is using the computer’s FQDN.  Not much help if load-balancing Director, but does it really need it?

Hmm..how about using another browser than IE?

<@UNBRPVD4G> sounds like might have a working system - you using vanity URL / load balancing?

Yes load balancing via ADC. Let me check the differences

<@ULL6F7DRA> absolutely, just slightly more involved in getting credential pass through. 

Yay, it works with the director server hostname now, via IE

I might have laid the ground work during yesterdays tests, Edge just works in the first try

So if I understand correct. If you use a load-balanced Director, setup the SPNs accordingly, there is a bug in Director, which prevents SSO?

Yes.  Even if I cut out the LB, and just try any URL that isn’t the server name, from a different computer.  Fails. 

Well that's just great. Most setups I have encountered have load-balanced Directors, it's fairly easy to setup via Citrix NetScaler

I could see this working if a LB can do the auth.  Like the old ISA/TMG, then it connects to each node using FQDN thus the SPNs are correct. 

I suspect so, never done it (my NS not used for internal). 

i got a blog on it all you need <https://c4rm0.wordpress.com/2019/02/14/load-balance-citrix-director-on-netscaler-and-configure-sso/>

4.9 LTSR CU6 currently, but our 1912 upgrade will be completed tomorrow. We will be deploying CWA 2005 once it's released (because we need BCR).

I've got a customer on 4.9.9 LTSR who is being prompted to upgrade to WSA 1912.

Pretty sure they used the /LTSR upgrade switch or GPO. Otherwise they'd likely be asked to upgrade to a non LTSR version of WSA already

Split between both LTSR versions of receiver and workspace. We're going towards workspace once we can get testing done.

Receiver 4.9 LTSR is EOL on 12/31/20, FWIW.

So is window 7 but that hasn't stopped us haha

Been waiting for 1912 VDA CU1 to drop before upgrading. Seems there are a lot of issues people have been discussing

Looks like they still keep it up. "Modified: 03 May 2019" Then I would compare it with this on page 134 <https://docs.citrix.com/en-us/xenapp-and-xendesktop/7-15-ltsr/downloads/handbook-715-ltsr.pdf>

Try to create one with Premium and check custom properties in Studio - PowerShell

I first manually modified custom properties but new machines still come with standard HDD. Now I am trying to create new ProvScheme and running into issue in Azure.

Something about new-prov is giving me issues in my Azure setup. Would be good if I could modify existing one

Fixed the issue by creating provscheme from powershell

Flickering of video when using Citrix Teams optimization.mp4

is it just the video stream thats flickering or the main teams chat screen too? i've seen SOME of that w/ a video feed and super pixelated video but not in the chat window

Just the video from the webcam. Everything else is fine. Skype video is fine (because that's not offloaded) and as soon as I disable the optimization policies it works OK

have you actually had this problem in a video. I just read last night about how the video preview has a number of problems including frame rate and other issue. Im not sure if the test in this area is a true indicator of performance.

What version? We don’t Have this issue 

Yes happens the same in video calls as the preview. Version 1.3.00.4461

not yet.. been playing with this for the past several days because of a webinar I’m presenting with 10Zig later today.. I’ll forward you video to Ferndando.. let’s see what he thinks

I posted it in the HDX channel on CTP Slack as well

that flickering is definitely not what we've seen so mine must be something different. would it be normal for the video preview to be crystal clear but then your video on an actual call to look like a video call from the late 90s?  i thought when i've tried this in the past its been pretty good on the call too

Interesting! I was seeing this on my second monitor on a zoom call last Friday'

Hi <@UL5TCSW3D>: A co-worker is reporting similar issues, did you ever figure this out?

Yeah sorry! You need to update the webcam drivers to the latest level on the client, rather embarrassingly

I found this
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/1912-ltsr/whats-new/removed-features.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/1912-ltsr/whats-new/removed-features.html>

VDA 5.6 is announced as depreciated since 7.16. Perhaps is the reason why your VDA cannot register anymore

Too fast <@ULJMUPWHK> I was about to post it :slightly_smiling_face:

It looks like you'll  have to stay on 7.15 until you have dealt with XP and XD5.6 VDA

I think you mean this entry "XenDesktop 5.6 used on Windows XP. VDA installations on Windows XP are not supported" - am I right?
But if it's deprecated - and already removed in 7.16 - why is it still available to choose during creation of a machine catalog?

Perhaps lack of communication between developers teams ?

More seriously have you try troubleshooting tool Citrix Health Assistant?

Or XDPing (not sure Citrix Health Assistant works on XP or VDA 5.6)

Unfortunately I had not much time for extensive troubleshooting and had to do a rollback to 7.15 again.
So now I'm looking for a statement if it still could/should work or if it definitely will not work (because they removed the functionality but didn't update the gui) - then I can talk with my customer and define a new plan.

It was deprecated in 7.12 and removed in 7.16. It sort of makes sense that you will be able to select 5.6 in 7.15 as that version obviously was release before 7.16.

If you look at AppDisk, that feature is deprecated back in 7.13 but up until 2003, you could actually still configure and use the feature.

So my estimate is still that you can go no further than 7.15 if you have XD5.6 and XP in the setup.

I checked on another installation - I'm still able to choose functional level 5.6 on 1912 LTSR.. :thinking_face:

Interesting, I see that same in 2003 as well. So we have Citrix docs telling us that 5.6 is removed in 7.16 but we are still able to select it in 1912 and 2003??? Classic Citrix documentation :smile:

As Kasper said, App Disk is depreciated for a long time and we still see it in Studio, even in Cloud !

Hi, anything new here? Also have to move a customer using several xp machines for crap apps to 1912 :grimacing:

Is that with MCSIO or not? I am reading articles claiming 1 minute boot time in Azure

I'm doing this <https://support.citrix.com/article/CTX232699> to try and figure it

there are legitimate processes taking place outside of windows boot. such as VM creation and OS disk clone

but the article <https://www.citrix.com/blogs/2017/09/01/provisioning-xendesktop-on-azure-just-got-a-lot-faster/>

yes, on aws there is a image runner.. it creates two vms to create the master image

Just to close this discussion. The issues was related to the NV 4 instances. Looks like there is an active problem that MS is working with GPU vendor on. The non GPU instance type boot within an ok time frame.

I would just start with clean servers and create the Store

at the end Citrix Support will tell you to do the same cause they cannot find the issue

Well, that's disappointing. That will be a big chafe.

Is there something specific up with export/import then?

I actually just verified that this is only happening externally. Internally everything is fine.

ok, than its possible a mis config off your STAs

just happen with a customer of mine, so created a powershell script to rebuild 2x SF in 12 Data Centers

Correct. I believe internally goes via Citrix Gateway too? We have 'external only' ticked in the storefront settings

They all go to the same URL, <http://storefront.mydomainname.com|storefront.mydomainname.com>

Bearing in mind, I'm still very much a noob at this

no worries, so you use the same URL both internally and externally. test them both, to see it there is any difference

if you imported the settings, you want to make sure to point to the Delivery Controllers in DC2 and not DC1 on SFs in DC2

and the STAs in StoreFront needs to be the same as configured on the Netscaler

You can span storefront across data centres, that’s not a problem .... 

Not a problem, but the order should be set correctly. Also was about to ask about FAS, but if that where missing it should normally bring up logon screen asking for creds

FAS is in the mix too. For the side that isn't logging in automatically, you click the 'other user' option and you can provide creds.

I'll double check that order, I did earlier, but I will again. I've been staring at it all day

Hmm, I'm not sure where I read about the spanning datacenters comment. I think it was on Carl Stahlood's site, but maybe it was in relation to a specific situation?

<https://www.ferroquesystems.com/resource/howto-active-active-multi-datacenter-citrix-fas/>

Wew, that's going to take a while for me to pick apart. But, thank you! I will read through that

We went Active/passive at the GSLB level for our main URL, because persistence wasn't working. You'd ping our URL, and get one IP, wait 10 seconds, ping it again and got the other IP. Was bizarre. 

We set up OGR too, which seems to work well, according to the SSLProxy address in the .ICA file

Oh, I forgot to mention, if I log onto the desktops via Citrix Cloud (Workspace), then we don't see the issue

So, to circle back on this, it was FAS. Reading the article, we had the GPO that had the FAS servers for each DC (with the blank spaces) for the Storefront &amp; FAS servers, but didn't have all 4 FAS servers in the GPO for the actual VDAs. For some reason, that didn't matter when using Citrix Cloud. Anyway, I added all 4 FAS servers to the VDA GPO, and VDAs in both datacenters are logging in automatically now. So, cheers <@ULJ3D468M> for that article and <@UKJTJD4KA> for asking about FAS pointing me down that path.

Not scary.  Just make sure you have your VM and DBs backed up.

i've read that its recommended to get to CU4 first THEN to 1912 but i'll let others chime in on that. i'm looking at the same situation but currently at CU2

<@ULMF0PLH2> yep of course. Although I’ve never seen any official Citrix docs on how to roll back a failed in place upgrade. :grinning:

other than just snapshotting your servers and backing up the sql db first and roll back that way right?

Finishing up our 7.15 to 1912 upgrade as I type this. Nearly everything worked fine, except our W10 VDAs required 2 reboots in order to successfully register and work properly.

<@ULC9J5XPB> i think you had jumped to cu5 first and then 1912, right? or am i mixing you up w/ someone else

i guess not a huge deal to make that jump first to be safe

The upgrades are straight foward, Just snapshot everthing and backup DBs. I can send you a guide on what I did if you cant find any material out on the web.

Cheers all for the feedback. <@ULLH5JGFR> Obviously I’ve got the official documentation but would be great if you could send your guide. Anything extra is always helpful. Much appreciated. 

We just finished ours last week.  We went from 7.15 CU2 straight to 1912 with few issues.  I would recommend you download and install the .Net framework separately from the upgrade as it saves a chunk of time waiting for it download and install during the install.  Our biggest problem was updating the WEM agent from 4.7 to 2003.  The install had corrupted and wouldn’t upgrade or uninstall so we had to redo the Platform layer again.  We didn’t upgrade PVS as we are planning to move to MCS soon.

Have done a good few 7.15 CU4 to 19.12 LTSR, each one went off without a hitch, seems to be a really stable upgrade...

I second the .NET installs. We have two separate sites, and on the second site we pre-installed .NET before the installations because of how long that installation can take.

WRT App Layering, I wouldn't upgrade anything, personally. This calls for a new Platform layer.

I was trying to take a shortcut.  :astonished:  We will be moving from Server 2016 to 2019 for OneDrive support and I didn’t want to spend to long on the 2016 image.  I ended up spending longer trouble shooting WEM then it took to create the new layer.

<@ULC9J5XPB> for your site that you pre-upgraded .net, how long did the 1912 upgrade go then? we may be pulling the trigger on our upgrade from 7.15 cu2 to 1912 directly tomorrow night so just planning my outtage (2 servers only)

We jumped from CU2 to CU5 and then to 1912, and with all steps accounted for, I want to say it took us 4-5 hours? We were pretty patient and rebooted more than was probably required. Validating XenDesktop afterwards was by far the longest process.

ouch ok thats longer than i thought. i thought i remembered our last upgrade like this taking about 1-2 hrs but that was a direct jump. it sounded like Citrix says you CAN go directly from CU2 to 1912 i think though right?  db backups and server snapshots first of course

We took about two hours to complete the upgrade of four DDCs and the DB.  We installed .Net out with the installer but at the same time.

We saw some weird issues with the first upgrade - which was a jump from CU2 to 1912 - which is why we went to CU5 first on the second site.

cool thanks <@UQY354B9B>!  i'm hoping to do the .net upgrade tonight if i can.  i cant imagine the newer .net is an issue w/ the older 7.15 cu2 right if i do it ahead of time?

I doubt it will matter. One thing to note is we upgraded the first two DDCs then upgraded the database.  After we upgraded the second two, Studio prompted us to upgrade the database again.  It ran the upgrade and updated a few more things.  I had a session running the entire time and it didn’t skip a beat.  Good luck with the upgrade.  :+1:

awesome! thanks for the help!  arent you usually supposed to do 1 DDC, then db upgrade and then the reamaining DDCs? or i may be mixing it up

I think it’s half of them, upgrade then do the rest.

Yeah, half, update schema, upgrade the other half.

<@UQY354B9B>: We saw the same behavior, Studio prompting to upgrade the database after each DDC upgrade. None of us had ever seen that before.

We still had a crazy issue where my W10 VDAs had to be powered on and rebooted twice before they would register properly and start functioning (like receiving policies). Captured logs for Citrix, and in typical Citrix fashion, received the "this capture is missing certain files" reply (thanks, Scout!).

ok cool we only have the 2 ddc's so 1 upgrade, db upgrade then the other so makes sense and just expect a possible scheme update after each and possible reboot of desktops twice which shouldnt be a big deal. reboots are pretty quick on our setup.    <@ULC9J5XPB> when you say issue functioning how did you know they werent? not registering or more?

Don't forget to upgrade your catalogs and DG, too.

There were a lot of Citrix Desktop Service errors in the event log. They would attempt to register, then fail. The biggest tell was logging into a desktop and not having any Citrix policies applied.

yup no problem! thanks for the reminder!  i just noticed that our DDCs only have 4gb of ram too so i'll try and get us to 8 like the requirements say

good deal , good to know what to test right away ! thanks for the help

The one thing that stood out while troubleshooting was that *c:\ProgramData\CitrixCseCache\Citrix-Gpo-1-HDXSite - ComputerPolicy.gpf"* would always have an old timestamp if the VDA was broken. If the timestamp was from the time it booted, it was fine. Wound up writing a quick PS script to check this on all VDAs just to be safe.

nice! mind sharing that PS? i may be able to compare that w/ ControlUP but if you have something you found helpful i'm all ears!

```$ErrorActionPreference = 'SilentlyContinue'
$VDAs = Get-Content .\VDAs.txt
ForEach ($VDA in $VDAs) {
	If (Test-Connection -ComputerName $VDA -Count 1 -Quiet) {
		$File = Get-ChildItem "\\$VDA\c$\ProgramData\CitrixCseCache\Citrix-Gpo-1-HDXSite - ComputerPolicy.gpf"
		$Output = ($File).LastWriteTime.ToString()
		$VDA+","+$Output | Out-File -Append .\VDAResults.txt
	}
}```

i'd think i should be safe to upgrade .net on each DDCs tonight 1 at a time w/ out a maintenance window right since they are load balanced?

Just put your VDA hostnames into that VDAs.txt file.

It was different for us, but I'd have no issues personally upgrading .NET the night before the upgrade.

ya i  would think itd be no different than when i reboot them off hours 1 at a time.  could see that definitely decreasing the upgrade time

Stuff like this is why our organization wanted to go with 2 identical sites. Drain the first site, take it offline, then do what you need to do while everyone else is on the other site.

...until your org is pushing you to increase density so much so that you couldn't fail over an entire site onto the other. :disappointed:

right!  we're about 500 desktops right now so hasnt too TOO bad.  just have to make sure to get our RAM bumped up on those DDCs quick.  what do you have on yours for CPU / Ram?

is there an official cpu recommendation for 1912? i only see ram and looking at ours i see they only gave me 1 vCPU so that cant be good

<@ULC9J5XPB> apologies to ask, I may have missed something but can you explain a bit more about your 2 identical sites idea?  
As mentioned, I’m under pressure to upgrade from 7.15 to 1912 but obviously can’t afford any major issues at the moment. 
We have plenty of spare VM and DB capacity, so I have been toying with an idea of building a brand new 1912 site in parallel and then moving xenapp servers across in small increments. Therefore if we discovered a major issue in, for example 1 week time, we could just move users back to 7.15 farm.  After all it would only be 2 new DDCs and a new DB. Use the same SF servers and slowly move xenapp servers from old site to new?  The only part I’m worried about is the Citrix policies, as these would be time consuming to recreate. But this idea could be risk free, complete back out plan and zero down time. Is this same thing as you devised?

It's pretty straightforward - we just doubled up on everything. We have two datacenters, and in each of them we built a brand new Citrix site. Each site has: 3 DDCs, 1 StoreFront, 3 PVSs, 1 Director, and its own SQL cluster. We have a single license server handling licensing for both sites. In StoreFront we use aggregation to combine both sites so that users only see one icon for their apps/desktop, and can hit either site. Outside of the license server, our App Layering appliance and WEM are on their own islands being used for both sites.

The biggest drawback is having to duplicate all of your work. Set a policy in one site? Make sure you do it in the other. Same for delivery groups, etc.

Yes, so I think a very similar idea. Build new 1912, aggregate in SF and slowly migrate the users/servers. Users see same name desktop/app and don’t know.  Yes the policies are my biggest headache as you can’t import/export to different sites and I assume versions? Thanks <@ULC9J5XPB> at least the idea isn’t totally crazy then!!

if we are using citrix FAS, do we HAVE to upgrade those at the same time we upgrade VAD or can the older 7.15 version of FAS be updated later? just coordinating everything we need

The policies thing is minor, since it doesn't take long to configure. You just have to make sure you get into the routine of changing it in two places (if you use Studio).

no problem! thanks for the help! hopefully my .net 4.7.2 upgrade goes smooth tonight

@<https://app.slack.com/team/U011FR9G8LS|Jakspurs> this was what I did in my dev environment. Its not finished but will help you. (Note I did my VDA side first) The docs states you can do them anytime. Just something I did.

<@ULLH5JGFR> absolutely great stuff - thank you. Really useful and very much appreciated :+1::skin-tone-2::+1::skin-tone-2::+1::skin-tone-2:

quick question for the group here.....so i'm an admin on my DDC servers and Citrix admin but NOT on the SQL server that hosts our DB.  I am doing this upgrade this weekend along with my SQL admin so curious the best approach for the upgrade.  can i be RDP'd into my DDC's and do the citrix upgrade and him jump in to do the sql upgrade part w/ entering his creds or better if he signs into the DDC and runs it all w/ him logged in since windows authentication should pass through is creds for the automatic site upgrade for the db?

We use a service account to run the Citrix services and increased to permissions to dbo for the upgrade.

i may not be able to get anything like that changed prior to the upgrade this time i'm afraid but good idea .   so if i just have him logged into the DDC and we run the upgrade that way, have you found the automatic site upgrade to work well w/ 1912? i know in the past we had to do the manual script way

FWIW, I would upgrade your controllers using the same account that created the site. I’ve seen weird upgrade issues where an admin - even with the appropriate SQL rights - is unable to complete the upgrade process.

I’d also go the auto site upgrade route, personally. Just make sure you run your site test beforehand.

I have always done the automatic site upgrade.  I’m lucky that my DBAs are happy with that and do not insist on doing everything themselves.  

awesome thanks guys!  yup i think i'm gonna have my DBA rdp into my controller and i take over and run the install so it uses his AD account (since he created the db for me initially) just to play it safe. good call there.    I got the .net 4.8 upgrades done last night...thankfully only took 5 min on each doing it that way so hopefully takes some time off

It took 2 hours on one of our controllers, lol.

ouch! and that was JUST for .net you said right?  .net can kiss my ass lol

Yep, that was just .NET. Everything else was quick. Hopefully Citrix changes the PVS install behavior, because you think you’re done, and 3-4 minutes after staring at your desktop, the installer randomly pops up to finish configuration.

thats annoying.  i'm hoping since we just have the 2 controllers and .net is done and no vda's to worry about it wont take too long. i know my DBA isnt thrilled about having to work this weekend

alright last nights upgrade went great! 2 controllers done and systems rebooted in about 90 min.  taking everyones notes on what they experienced to know they were "expected" helped quite a bit and went very smooth! now the nervous 1st morning begins here! thanks for everyones help!

Our experience has been mixed as well. Either robotic or static noise and quite frankly it is pretty limited with the HDX Optimizations.

well thats not too reassuring....i'm trying to fend off my bosses wanting to ditch VDI for physical laptops solely for teams video so this wont help.  we havent messed w/ udp audio but wondering if that might help?

is there anything we can do to improve the video resolution for calls? the preview looks fantastic but the other end looks pretty grainy.  i thought i remember when we tested w/ skype it was pretty good on both ends but i know that optimization was handled a bit differntly

That’s actually a great request for bis-f <@ULLRRJRHC> 

<@ULLRRJRHC> <https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/secure-channel-expired-machine-account-password-concerns/ba-p/1333535|https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/secure-channel-expired-machine-account-password-concerns/ba-p/1333535>

I was more looking for a proactive scenario... I know how to resolve it once I see that the trust is broken.

If it’s in bis-f (for example) it would be pretty proactive I’d imagine....check and fix on boot - hell you could powershell that and throw it in as a custom script relatively quickly too :thinking_face: 

I do disable password changes in my master image (PVS). This only happens when a device sits powered off for a long time. There's a chance we had a GPO set to disable accounts that haven't checked in within xx days.

<@UKJTJD4KA> discuss this in the past here <https://github.com/EUCweb/BIS-F/issues/99|https://github.com/EUCweb/BIS-F/issues/99>

It looks like that was never added to BIS-F? I assume because of the credential storage. I wouldn't want to put that in my image, either, and I'm not sure that encrypting the creds would work correctly.

What scenario are you in where the machine loses trust? Machine account passwords don't expire, do you have something cleaning up their objects from the domain if they don't log in?

<@ULLRRJRHC> ah i hadn't seen that there before, guess it makes more sense to write your own custom script with secure credentials and get BIS-F to execute it via the custom folders

I also experience this behaviour in several customer VDI szenarios. Some VDIs are loosing trust relationship over time - even when they are powered on. From my site all is configured correct. I did not find a way to fix this by target side (reset-machineaccount, test-computersecurechannel), the only way i get rid of it is running a task on the pvs server to reset the PWD of all VDIs weekly. <@ULLRRJRHC> <@ULDHJB8BB> would be very interested in further tests, I run both cmds as local admin, as well as service user - nothing worked via Script. Logging on to the machine an run these comands manually works fine.

also if the TRS is lost all commands using domain credentials by script fail..

These particular devices had not booted since last September, I believe. I don't see any GPOs cleaning this up, so I'm not sure what happened with them. All I know is that I had to reset the machines in AD to get them functional again.

You could adjust the Domain member: Maximum machine account password age in GPO. Depending on how the secuirty measuremnts are handled in your enviroment.

it’s the client that initiates the change though, and it won’t do it until it can talk to the domain. 30 days is just the time at which it first tries.

“There’s a chance we had a GPO set to disable accounts that haven’t checked in within xx days.” That would do it. The only other way this would happen is if the machines were left on for over 30 days, the password changed, and then they rebooted. Non persistent machines would the try the old password in the registry and fail.

There is a one liner PowerShell to reset the secure channel. Microsoft has an article on it.  The article is an interesting read. 

i recently found that too and works awesome:  Reset-ComputerMachinePassword -Server  -Credential

<https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/secure-channel-expired-machine-account-password-concerns/ba-p/1333535|https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/secure-channel-expired-machine-account-password-concerns/ba-p/1333535>

Ah, you beat me to it :slightly_smiling_face: Reset-ComputerMachinePassword works great

sorry i JUST discovered that last week and was excited about it :slightly_smiling_face:

i first was using Test-ComputerSecureChannel to test, and if it failed i run the other and reboot and good

good to know!  when i ran it in my environment and then ran the test-computersecurechannel after it would still say failed until i rebooted. maybe not needed though

If you reset the secure channel, a reboot is required. A reboot is not required for resetting the machine password 

no problem! maybe we were having a different issue then.....i know that when we were getting domain trust issues ,  test-computersecurechannel would fail and after running the resetpassword command it took, but test would still fail until reboot and then all was good.  maybe in our case the securechannel was fine but the account password just needed fixing up

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/1912-ltsr/whats-new/19-12-ltsr-initial-release/fixed-issues.html|Issues fixed since Citrix Virtual Apps and Desktops 7 1912 LTSR (initial release)>  lol  404

lol always the case spend weeks planning and upgrading site and they release a CU the day after you finished

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/1912-ltsr/whats-new/cumulative-update-1/fixed-issues.html>
Want the CU1 Fixed issues.

Mine is planed for the 18th this month. Then I seen CU1. :unamused:

I'll treat it like I do FSLogix - let everyone else be the guinea pigs. :smile:

Is the image optimized (via Citrix Optimizer)? That'd probably be my first step. You could go down the route of logging the entire logon process: <https://www.citrix.com/blogs/2015/08/05/troubleshooting-slow-logons-via-powershell/>

the controlup script doesn't provide info other than pre-shell userinit is what's taking awile

I've disabled all gpo one by one and even all but domain policy just to see if its gpo related

The only other thing I can think of is going through the StubPath entries in the registry to see if one of them is causing the slowness. I know that a few of them - possible IE related - did cause slowness. I swear somebody here recently had similar issues, so hopefully they chime in.

so thats what I've been doing.. going through my activesetup keys one by one and disabling with a gpo reg item to delete it

I asked the same question, and we're seeing similar results. Using Citrix Optimizer and WEM. Win10 1903, CVAD 7.15 CU5. And FSLogix for profiles. Login is SLOW.

After your first login, are subsequent logins fast?

It's non persistent, so its the same login

Our VDAs are non-persistent, yet we persist user settings. First login for new profile is usually slowest, and second (and subsequent) are much faster.