World of EUC

Yea I read that and I put in a change to fix this. Is this not needed now?

This was not worded like this 24 hours ago.

When upgrading Delivery Controllers to Citrix Virtual Apps and Desktops version 1912 or 2003: Upgrading SQL Server Express LocalDB is optional. Local Host Cache works properly, with no loss of functionality, regardless of whether you upgrade SQL Server Express LocalDB. We added the option to move to a newer version of SQL Server Express LocalDB in case there are concerns about end of support from Microsoft for SQL Server Express LocalDB 2014.

When upgrading Delivery Controllers to Citrix Virtual Apps and Desktops versions newer than 2003: The minimum supported version is SQL Server Express 2017 LocalDB Cumulative Update (CU) 16. If you originally installed a Delivery Controller earlier than version 1912, and have not replaced SQL Server Express LocalDB with a newer version since then, you must replace that database software now. Otherwise, Local Host Cache will not work.

Well that’s a nub move by Citrix - I’ll see what we can find out 

Thanks James, I am thinking maybe they tested it, or accidentally add incorrect content? No big deal, I am going to upgrade it anyways tonight. But it was strange.

We upgraded some customers from 7.15 to 1912 and LHC was always working afterwards without updating SQL LocalDB

That is good to know. Is this something you need to do on both DDCs? Or each DDC that is?

image.png

Yea, you do. I should have know this. Dumb question to ask.

Upgrading or replacing the SQL Local DB for Local Host Cache for 1912 CU1.docx

Need to clean up the wording. But here is what I did.

am I missing something with Set-BrokerEntitlementPolicyRule? I thought excluded users shouldn’t be able to launch sessions?

For IGEL clients you can confiure this in the settings/registry of the endpoint

Alternatively, you could set the screen lock feature in the IGEL profile.

Thanks Guys for your inputs.
Let me check if this is also possible with HP TC.

I know I had tested that in the past, but just tried it in my O365 image (W10 1909). Not only did it slow the initial logon down by 10 seconds, but it's somehow breaking SSO for our O365 apps, as Skype no longer automatically logs me in, and I'm prompted to sign in manually.

wow, that's the complete opp to what i am seeing, my difference is insane

Maybe things work backwards in your hemisphere? :smile:

dude most probably - everything is all over the place

I'm looking at all of the default optimizer templates (Citrix and VMware), and don't see that service included in any of them. That'd make me a little suspicious of going down that road, personally.

oh i know its not included, and i have a feeling it will break initial profiles as it handles provisioning of appx packages (I think), but post that initial first logon, it appears to be nothing but a performance murderer, and causing no end of frustration

admittedly its combined with resource constraints, so i think the more grunt, the less impact

Sorry, should also note that I remove all UWP apps as part of my build, so the only ones in my image are the ones you can't really get rid of, like Cortana.

Somebody here recently pointed me to build 2004 resolving those App Readiness slowness issues. I think it was Trentent

<https://twitter.com/PieterWigleven/status/1284544962802016256>

So in typical MS fashion, you have to be on that build for the fix.

oh shit yeah i remember seeing this now - great call, this is exactly what i am battling

I am, too, though to a lesser extent (12 seconds added to my logon for those built in apps).

this has made me well happy - thank you :slightly_smiling_face:

Disabling app readiness broke my start &amp; search menu

Does the app look at a specific WMI value or variable and can that be masked?  In the past I've had to write logon scripts that created a variable with the client name for an app to work

that is a good question and one I haven't been able to get an answer from the vendor on.

Might be worth breaking out Process Monitor to see if it does, assuming the vendor is dragging their feet.

Yeah. One of my Team members is on a call with Citrix Support right now trying to figure it out.

ok, so finally got the information from the vendor.  There is a registry setting we had to go in and add with the clientname to use in it.  So we will set that at login.  Clientname String in the following key: HKLM\SOFTWARE\Wow6432Node\Citrix\Ica\Session

something is trying to log them back in every 90 mins or so, is this something receiver/workspace does?

It's not something like session pre-launch is it?

no pre launch on these. I turned off workspace control on storefront just in case it was trying to log in to a disconnected session somewhere

I see this as well in Director. Its hit and miss. I havent dug into it yet.

Confirmed: NSHELP-23834 HDX Insight data on Director not shown for individual sessions.

Thanks <@ULLH5JGFR>

That's what they said.  No ETA on the bug fix either.

U use another store for the second hop? Do u must activate das auth. on the internal store too. Do u have in das configured that the cert can be used from inside the first hop ?

<https://www.deyda.net/index.php/en/2020/04/02/saml-authentication-between-citrix-microsoft-with-azure-mfa/|https://www.deyda.net/index.php/en/2020/04/02/saml-authentication-between-citrix-microsoft-with-azure-mfa/>

Yeah got that configured.  I am using a different store for the second hop, but I don't have to.  Would i be better using a single store?  If so what auth methods should i have enabled on it?  (currently only  pass-through from gateway).

U must activate the fas auth for the store. 

the storefront auth. methods don't matter

:boom: that's him.  School-boy error :slightly_smiling_face:. Thanks <@UR9T47CRM>!

Does anyone happen to know if Debian is on the roadmap for Citrix Linux VDA?

why only 25GB? I can’t imagine your OS disk is only 25GB…

I keep it the same size as the OS disk to avoid issues

mine is 100GB right now with 12GB of RAM cache

anyone else have issues with VDAs in azure going into powerstate unknown?  Seems like it does that when the vm's are being reprovisioned from an MCS catalog.  What is interesting is it trickles down into other delivery groups that are unrelated

Beware of this. Prevent this update from entering your environment right now.

Does this apply, if you have AV exclusions?

<https://docs.citrix.com/en-us/tech-zone/build/tech-papers/antivirus-best-practices.html|https://docs.citrix.com/en-us/tech-zone/build/tech-papers/antivirus-best-practices.html>

Brokerservice.exe is included in the list for delivery controllers

I was cursious if the update totally ignored the exclusion.

Will let you know shortly, that GPO was not linked to one of our OUs in one of our sites and we are remediating

The other sites have not updated the definition yet

I am updating my lab now with an exclusion set

High Availability service would also mean potentially hitting Cloud Connectors also

i restored the .exe through defender, put the proper exclusion gpo in place, rebooted, and the broker service still wont start

it looks like the "network service" was replaced with "local service"

changing it back allowed the service to start

Thanks Neal, am tweeting your findings out for people to reference :+1:

What OS are you seeing this on? I just applied the patch to Server 2019 DDC, booted back up all OK. However am now running a full scan to make sure

Checked a controller with 2016 and 2003 VDA, doesn't seem to be affected.

No reports of Citrix Cloud executables being deleted yet.

We don't use Defender in Cloud, thankfully :slightly_smiling_face:

<https://support.citrix.com/article/CTX279897>
This seems to be the KB but at the moment I have no access... Anyone else?
Found here:
<https://discussions.citrix.com/topic/409971-windows-defender-version-418-with-antivirus-definition-132113190-is-detecting-citrix-broker-service-as-trojan-and-deleting-it/>

Didn’t Defender also break FSLogix a few months ago thanks to some update?

Yes it did - back in November.  It was fuuuun.

So if you have the exclusion in place does it still delete it?

 Not in my experience, sample size of 1 site though

Ok, I am big on AV exclusions. SO if it deleted it, then would it be safe to say its a good idea to check AV exclusions? however, this still may not be the case.

We had it happen on our delivery controllers from a windows defender definition update

Windows Defender flagged brokerservice.exe as Trojan:MSIL/AgentTesla.Z!MTB then quarantined it - guess we are missing an exclusion :face_with_rolling_eyes:

Great partner they are :slightly_smiling_face:

Had  the first customer on the phone …  world wide outage - great experience !!!!! I love MS

I think <@ULJM9DQF2> figured this out.  Might want to search on his twitter or see if he'll respond here

<https://twitter.com/guyrleech/status/1253092876248104962?s=19|https://twitter.com/guyrleech/status/1253092876248104962?s=19>

can this be run outside of the user session? Say I want to see the resolution for every active session and dump that to a file…

I know this used to show up for earlier versions of xenapp

Yes, I think if an admin queries then it will return  objects for each user session

Should be trivial to do through ControlUp <@ULLAD12P2> Just convert Guy's crazy one liner to a SBA with the session ID as an argument.

Ha, probably shouldn't have left this until Friday to ask...

Hey Rob, may want to check this out, if you haven't: <https://www.rorymon.com/blog/cisco-jabber-and-webex-in-citrix-virtual-desktops-published-desktops-and-remotepc/>. Tagging <@ULK5ZS52L> as well, as it's his blog post :smiley:

I think at this point, it's more the how the Jabber traffic flows, and not having it go through the expressway, but I don't know if there's anything that can be done about that.

I'm pretty sure the only way for that not to happen is to have user set up on a VPN. Not a Cisco voice expert, though, so take that as a guess :smiley:

AppReadiness service disabled?  Is WEM in use?

You got the mirroring set up for the required folders? 2016 is like Windows 10 RTM, it's shit

Yes UPM is configured fine. I found out that if the start menu is broken, other users on the same RDSH host are NOT affected. I get the following eventlog messages: Event ID 1000 Application error _ShellExperienceHost.exe_ and Event ID 1000 Application error _SearchUI.exe._ So Windows search again… :confounded:

I have further information after some investigation.  We use UPM with profile streaming and active write back.  Sophos is locking some of the files as they are streamed down and written to the local profile, causing significant delays to the logon process.  This is visible to the end user as the logon process showing "Waiting for User profile Service" for a prolonged period.  This also has knock on effects to WEM processing, which is also slower and sits at "Processing Filters" while it waits for the desktop to be ready.  The resulting session also feels sluggish compared to normal.  On logout, UPM cannot delete the locked files and they remain on the server.  This also appears to cause the next logon to be even slower as the UPM logs indicate it is still trying to synchronize the locked files.  If the user reconnects to the same server you will see a build up of profile folders in C:\Users.

In the Sophos logs you can see corresponding errors with Deadlocked files.

There is one thread with the same issues on the Sophos forums.  <https://community.sophos.com/products/endpoint-security-control/f/sophos-enterprise-console/122257/deadlock-detected-scanning>

RC2 of the CVAD V3 doc script was sent out to the testers.

If you are running CVAD 2006 and you want to test, let me know.

I hope there is only one more RC released before GA.

Is your browser set to “always launch” the ica file or do you click on it after it pulls it down to your machine?

NewIcon.png

LegacyIcon.png

Hi,
Yes you can swap out the desktop icon for the legacy one from storefront by copying the legacy .Ico file and overwriting the default store one in inetpub\wwwroot\citrix\STORE\App_Data\Desktop.ico

Its a recreate job my friend. I've fiddled with this in the past.

As I expected :slightly_smiling_face: Thanks for confirming 

cvadv3.png

RC3 of the Citrix Virtual Apps and Desktops V3 documentation script was just sent to the testers. If you are running CVAD 2006 and you would like to run the script, let me know.

I’m testing this too, so far it works with webex but not teams

Hi guys, sometimes some colleagues have to relogon in teams in the citrix environment. User don‘t get messages and send messages won‘t fired up.... anyone ever struggled with that?