World of EUC

I’m just finishing off a fairly large 1909 VDI image at the moment.  It’s the first VDI I have done as we have been an RDSH shop up to now.  I’ve been using the guides from yourself and Mr Rankin and I’m pretty happy with how it’s performing.  I did get caught out by the WEM process names and path changes in our last update which meant the AV exclusions were no longer correct.  I do get a black screen on logon between the GPO processing ending and the WEM agent starting.  It seems to last about 9 seconds, so I would be interested in knowing if you see the same. 

Black screens we are working through at the moment but pretty sure we know the root cause - are you using FSLogix Profiles by chance? 1909 has been my least favorite VDI deployments - the compute requirements are much larger than previous even if you optimize the crap out of it

We use 1909; SEP sucks, we moved to defender. Not make sure the sep scans are set at night and ur exclusions.Also with fslogix I noticed my uwp apps go missing. I have an open ticket. Gonna downgrade to 7117. Can you set  it he DG to register on a delay? Is it the vdi slow when it's been on for a few minutes?

Bit I have not seen general slowness with 1909

there is a known issue with AppX and FSLogix in 1909 which is resolved in 2004 - that also impacts black screens from what we have seen - we have registration delays in place etc, looking at anything we can do in that warm up period to reduce the impact when the logon occurs - work in progress :slightly_smiling_face:

<@UKJTJD4KA> is that for all fslogix versions?

I think so <@ULC9J5XPB> pointed me at a twitter post - seemed to be 1909 related rather than FSLogix

The fslogix supper rep said if I enable the store it’s a workaround

my issue is the registration of appx packages happening at every logon and spanking the CPU

Yuck, I guess that’s a fix but does slow it down. I am not ready to go to 2004

I am - cant wait to get the 2004 image out there to get rid of this fluff for this customer

Is there a VDI/clone AV sealing procedure for Symantec?  

Symantec sicks massively mate, i have it in a current project on server 2019. Constant issues. Make sure its in the right container in SEP or it'll run like a dog. The machines have to be moved into the correct container manually or using a routinely scripted approach. You can check your current exclusions in the registry btw.... this was the heavy hitter for me. To test quickly, change the service state key in the registry if your image and roll an uodate, this will disable sep and see if your issues go away.

I am using FSLogix for the profiles, so any links to the black screen problem would be useful.  The only AppX package I use is calculator, everything else is turned off.  For warming up the image i'm doing an auto login with the Citrix Desktop service controlled by the <https://github.com/EUCweb/BIS-F/issues/270|script from Jeremy Saunders>, a scheduled task to update the WEM cache and BIS-F.  If your using BIS-F I found the personalisation startup script was doing a Win32_Product class WMI query that was causing all the installed MSI applications to reconfigure.  The bigger your image the bigger the impact and it may be exasperating your problems with Symantec as well.  I raised a bug report (<https://github.com/EUCweb/BIS-F/issues/270|#270>) and Matthias has a fix in the place for the next release.  You can download the updated script from the bug page.

thanks lads - had some exclusions updated which helps, also have a change in to get the "scan on definition update disabled", i need to look at the service state key :stuck_out_tongue:

<@UQY354B9B> interesting - thanks for sharing this - we are using the delayed desktop service with an insurance policy script i wrote here <https://github.com/JamesKindon/Citrix/blob/master/CheckBrokerService.ps1> &lt;- just protects against BIS-F failing to start the service...we are doing some warm up stuff and autologon will come in via sysinternals shortly - bloody App-V streaming is also kick the crap out of the image

Looking into the FSLogix black screen on 1909 it looks likes it Windows Search.  The FSlogix search roaming settings were miss-configured so I have set them up as per your blog post, reset the search index for my test users which has helped reduce the black screen time considerably.

Perhaps MS need to step down their release cadence a little, there really is so much to test now when pushing out a new image. Enter products like LoginPI (LoginVSI Entperise now) and ControlUp for the proactive monitoring.

What controls whether storefront disconnects your session when the web page times out? I’m on a mac and never get disconnected but some windows users are reporting that storefront is telling them they have been logged out due to inactivity.

image.png

ah thanks, what I was looking for was under workspace control

We are also seeing the same issue in 2016 and we have case logged with Microsoft And Citrix but it's already a month and they are still getting logs...

In my WorkSpace app prefs I can change how it sends Ctrl and Alt, but because the mac Alt key is not the base function of that key (it's the Option key), I can't pass it as just the Alt key. I can set it to send via the Command key though, so Ctrl+Alt+Shift would be Ctrl+Command+Shift from the Mac keyboard.

On a windows keyboard connected to the mac the windows key is the command key.

Full permissions to create machine accounts in specified OU?

well thats the tough part because i dont have permissions to see those permissions :slightly_smiling_face: i just know that i can create desktops so thought i'd match AD groups best i could to start.

do you know how best to check existing permissions so i can pass that along?

ad users and computers, right click the OU and check security/advanced, they need create and delete account objects

this is all i see so maybe i just dont have permissions  for that

yeah, looks like you’re locked out of that OU

figured as much! would the security/advanced option be in the base right click menu or deeper in?

you would need to be able to view properties first

ok cool ya properties view this is all i got.

Show advanced view in AD users and computers 

ahh right! ok i can see the existing groups in there now. weirdly enough i'm not in any of the groups in there but i can create desktops from studio just fine

i always assumed we set the main admin for this step in Studio and then thats the account that actually creates the AD objects and we can then set Studio level permissions to who could do everything else

I take it back, I see a 'Use all my monitors for the remote session' option now.

There is also the behavior in the Windows Workspace client that if the windowed screen is on both monitors it will use both screens when you then toggle fullscreen.  

If you drag the desktop/application window to top of the screen in the middle of the two monitors it should go across both.  The old XenApp would identify it as one big display, not two separate monitors.

Thankfully, with mstsc you don't have to actually drag across both screens and then maximize; just selecting that 'use all my monitors' option does the trick. Either way, having to use RDP via Citrix is lame as hell, but I expect nothing less from them given that I use to be their Citrix admin in my previous job and saw how they wanted to run things.

Anyone out there expierenced crashing Teams with per machine installation on second launch? no logoff in between. deleting settings.json under appdata\roaming\microsoft\teams heals it

Anyone using Adobe Acrobat Pro DC in VDI? For some reason "Adobe PDF" does not get added to my list of available printers.

I just installed it without modifying any settings. One problem is that it will prompt the user to update the application.

Couldn't find much in registry to disable automatic updates.

_Citrix Universal Printer_ (v3) for everything; no native drivers outside of _HP Color LaserJet 2800 Series PS_ (v3) for Mac/Linux clients.

So where do you get that driver to install on your print server? Or do you create mappings via policy? As you might figure, not been working with printers (luckily) for the last 15 years LOL

This is on the VDA itself. Our enterprise print servers have vendor-specific drivers, but none of them are brought over. Here's our Citrix policy for printing:

Are you using it together with the Citrix Universal Print Server?

Nope, we're not using Universal Print Server at all.

Nick - does this allow you to use all the functionality of the device (duplex, stapling, sorting, etc.)?

I'm 99% sure that the Citrix Universal Printer Driver does support both duplexing and stapling, but I haven't tried either of those features in years. Not sure about the HP driver for Mac/Linux clients, though.

Not really worried about the HP driver - that's what we use for our Mac/Linux clients for remote work. I am not particularly interested in what home printers our users have :smiley: Moreso want to see if we can dump some of our printer drivers in our image.

The customer has v4 driver on the print server, and the option to force Universal Printer does not work

Still get PP, the only one that work is the one with v3 driver on the Print Server

If using a print server, then set the gpo to auto install drivers from that server.  I will get the gpo in a few min

The policy is Computer Config\Admin Templates\Printers --&gt; Point and Print Restrictions

you can set to a specific Print server(s)  for Point and Print or just leave it open to everything if you want

crap, ended up reverting all print server drivers to v3. Already had the GPO Hal, though a bit more restrictive

You may have beeb better off just installing universal print server and enabling the policy. Looks like you cracked it though.

Make sure you have the latest AHV connector installed. Ive seen this before.

It's also been installed with the ALLUSER=1, ALLUSERS=1

Have you looked through <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/multimedia/opt-for-ms-teams/teams-monitor-ts-support.html>   and  <https://support.citrix.com/article/CTX253754> already?  Is anything out of line there?

I've had some issues with Workspace App on the client side, where I used the receiver cleanup utility to remove, rebooted and started fresh.  Fixed the issue once, the second time I followed the same steps, didn't work.. then randomly started working one day.  VDA 1912LTS and 2006 Workspace app in my instance.  Also not Remote PC Access.

Gotcha. Mine works without fail, but something's missing on this other one. It's annoying. I'll check that article, if not, run the receiver cleanup and perhaps VDA cleanup and start afresh

FYI, same issue with remote PC access and my workstation.

On mine, I used the VDA and Receiver cleanup, blew away the user's profile and started afresh. Worked fine after that. I suspect it's something within the user profile more than the other stuff. All the reg keys were in place. The user did launch Teams under their profile once, before the VDA and Receiver were installed. Just my hunch.

Getting full clones out of mcs is your friend, then you can go nuts <https://github.com/JamesKindon/Citrix/tree/master/Migration%20Scripts|https://github.com/JamesKindon/Citrix/tree/master/Migration%20Scripts>

Yea, I wish we didnt have to use them, However It was because of some pesky app that I have reversed engineered yet

Your scripts are really good. I wish I was better at powershell. I struggle at times and sometimes I don't.

:-) my scripting takes ages, some people are natural coders, others struggle - I struggle too 

Hey <@ULLH5JGFR>, pick something you want to do bud and we'll spend a bit of time and knock out a script. I'm not a natural coder, I just know what I work on the most and anything else; I look up.

That would be cool. James pointed me in the correct direciton. But I am looking to totally automate exporting Full clones and will permissions and re-importing it in another site or hypervisor connection.

The whole parameters just confuses me big time in POSH the syntax and layout .

Comments are your friend. Let me kbow if you need a hand and we'll pop something in the diary.

That shouldn’t be too crazily far from the scripts I have there Ray - I do it now by moving from mcs (full clone) to manual (power managed) on the same hosting connection, it shouldn’t be a big jump to convert/migrate and then switch hosting connections - keen as to script that, just don’t have an environment outside of azure to write it against (yet) - as per Lee, happy to oblige if you have the environment :the_horns:scripting ends up being all about bloody error handling! 

I agree man. If you want it reusable. I have a lab that can be used anytime. I can give anyone a login to play. I'm not precious.

Thanks guys,  James scripted is nice and it will help me big time. Thanks for the assistance guys. You guys rock big time.

I see not most of the time - life is better without profile management where you can - persistent vdi is the perfect case for leveraging local 

Yeah, makes sense. It would require some tweaks in AD so that the profile management GPOs don't apply to persistent desktops. Not the end of the world, but something we need to look at.

Definitely an opinion - some will have differing thoughts, just what I see mostly and tend to agree with 

The only thing it would help is if the persistent desktop blew up you would have their settings for a new one.

<@UK6S90JDR> thats the challenge we're going through now.  I am finding in our experiences  that i agree with what <@UKJTJD4KA> already mentioned about keeping it simple w/ persistent but trying to find the balance of how to keep some files/settings (in our case we redirect my docs/desktop) and looking to implement the chrome bookmarks/profile redirection to a network drive, etc) to try and get as much as we can to follow

FSLogix all the way :slightly_smiling_face:

As Jarian said, or if you need to roam those settings between devices.  I work in education where we have a high number of shared devices so we use FSLogix on the physical estate as well.

We still use fslogix for president desktops. Reasons are for local location of users data and roaming.

It always depends, DR is a real consideration here and sometimes you just want a light touch, CPM can help here with one way DFSR or something similar. Thats what I find anyway.

Are you using any ram caching? Are they PVS/MCS?

<@ULKDZHKFY> Indeed, it’s an MCS based machine catalog with 2GB cache

The black screen is usually a profile logon issue but ive also seen this when the machines been left on for too long and the write space is filling up.

Is there some key performance counters to monitor regarding the MCSIO RAM cache ?

There are perfmon counters for mcs io. You can use perfmon for that.

i just turned it off now, looks like it stopped

it seems to be the same one over and over becoming elected

I assume it's going back and forth between the 2 DDC?

This is dumb resolution, but are you or can you cycle all the services on one DDC?

only thing that stopped it was turning off lhc

and then it’ll go for a couple hours without doing it

That's definitely going to calls brokering issues. Man I'm kinda clueless now

it has been, our storefront tickets are huge this morning

I need to do an upgrade at some point anyway, was hoping this thing cold hold it together until I was ready to fail over to a new site

Nothing in the event veiwer about losing connection to the main SQL DBA?

there’s tons of messages saying it successfully connected to the database

no, only 1 whole 3503 in the logs from 7/7

I’m just going to leave it off, we’re almost all pooled random anyway

we used to do more apps which is probably why it was on in the first place

Noticed the same in my Citrix Cloud env, Broker Election process happens during normal mode of operation unlike LHC in IMA and this happens every 2 minutes. Checked with Citrix product team and this is normal behavior. Once an outage kicks in, all the VDAs re-register with the elected member and HA Service on elected member responds to XML communication. Election is done by alphabetical order.

it shouldn’t be normal to kill the xml service every 30 seconds, storefront relies on that for brokering

What is the event ID on StoreFront server? 4003 or 0?

neither, seeing a bit of this though “An authentication request was made before establishing a web session. This typically occurs when sticky load-balancing between client and StoreFront is misconfigured.”

<https://www.mycugc.org/blogs/brandon-mitchell1/2019/09/22/not-so-fast-reconnect|https://www.mycugc.org/blogs/brandon-mitchell1/2019/09/22/not-so-fast-reconnect>

Hi Brandon, no 2019 involved.  Windows 7, Windows 10 and Server 2016 VDA's have the issue.

Once you get some feedback. Let us know. I am curious

Seconding <@ULLH5JGFR> - please let us know.  I'm about to do similar upgrade 7.15.0 --&gt; 1912.1. 

Citirx just got back to to me. Problem was with our SQL Servers (always on availability). An Microsoft CU SQL update should sort it. I had to roll back to 7.15 yesterday. Ill be trying the upgrade again in a few weeks.

They are seeing a number of errors and SQL exceptions as well as a General Database error
“Cannot use SAVE TRANSACTION within a distributed transaction. ---&gt; System.Data.SqlClient.SqlException: Cannot use SAVE TRANSACTION within a distributed transaction.”

Their recommendation is to install the Cumulative Update in the MS article for the version of SQL in use.

-Unable to reconnect to disconnected sessions when using SQL Server 2016 SP2 or SQL Server 2017 in a in a SQL Server Availability Group <https://support.citrix.com/article/CTX263433>

Thanks, very useful info.  Am using AGs also.

Bit of a tricky one, a packet trace will show you a fair chunk of whats happening during the login. Other than that, you'll need to review your CA logs. Its not fun though and I think I'd definitely struggle to find the right thing. I'm sure you've walked over the config from start to finish regardless; that's worth doing if not though.

Cheers Leee will update when I get to the bottom of it.

I suppose I could send all the terminals to their own storefront which went to a different set of delivery controllers where they only had access to a single desktop, was hoping not to have to build out more servers though.

oh, I guess I could do it with powershell and the broker access policies, really wish they would build that into the gui, always forget about it

I’ve done something similar with Apps.  Have a separate Storefront and apply a filter to only display the apps with the defined tag in the description.  You may be able to do this with desktops as well. 

You can also make the connection pass-through the ADC Gateway and apply smart access rules. Of course will cause to use more resources in your ADC/GW if you have one, but will also give you more control, been possible to do also Endpoint analysis as well (depending what type of license you have).

broker access policies can filter on client name, all our terminals start with WT00 so I’ll just try that. I’m not sure we can do EPA on the terminals.

years ago.  worse than the licensing are the keyboards

Ha, I did hear that it needs some keyboard funkiness as well......one step at a time, I guess

<https://mw2301-my.sharepoint.com/:b:/g/personal/manuel_deyda_net/EUSmV4NwsL5OobXlN9nZAIoBuhOfwUwPHOMYOAcwBmALIg?e=uNTkLR|https://mw2301-my.sharepoint.com/:b:/g/personal/manuel_deyda_net/EUSmV4NwsL5OobXlN9nZAIoBuhOfwUwPHOMYOAcwBmALIg?e=uNTkLR>

Here are the instructions for the keyboards. :sweat_smile::innocent: 

I didn't have much to do with the licensing.  I only got into the project when the customer failed to get the keyboards to work.

That's pretty helpful, thanks! Now I just gotta figure the license bit out as well. Horrid-looking software

What I can see from our customers license still the same and you have to use VDI to be compliance. Said that I'm not a specialist in terms of BBG license and needs to be confirmed :)

Apparently it writes some device-specific serial number into HKCU

If I remember correctly there is a floating license for VDI/roaming usage. The other one is strictly tightened to a specific device. Make sure to get some CPUs with high GHz -&gt; Bloomberg will go mad. I have a customer with 350 Bloomberg VDIs powered by vGPU. If you need more information feel free to contact me. 

Great to hear, thanks, might just give you a shout. I can see the emails flying around about this and I just KNOW it is coming my way :slightly_smiling_face:

Be prepared for the traders. User-Experience is everything :wink: The Bloomberg keyboard was working without any problems for us. The trick was to only pass-trough the B-unit for the authentication. 

<@ULJUX26GG> indeed, and these folks are always hungry for resources, I got all running with 12vCPUs and 32GB of vRAM. Now I'm curious regarding vGPU + Bloomberg. Is there any material showing the performance with/without vGPUs for BBG?

Is that 12 CPUs and 32 GB RAM ...... *each* ?

<@UL5TCSW3D> yes it yes for each VDI/User, and I can tell you: if we reduce from 12 vCPUs for let's say 8 vCPUs, they can "fell the change" as soon as we change.

Holy flurking shnit. This is gonna cost 'em in cloud.

<@U019C4GVDN1>: To be honest we didn’t  saw much acceleration from the GPU. Overall it’s just making the whole construct more complex with dependencies with the NVIDIA host, VM driver and various HDX policies. With the latest GRID releases this should give you less headache. We needed it because multiple 4K displays got  attached to the workstations. Under 8 vCPUs you will not impress the traders. You really need some kickass hardware:rocket:

sometimes we've had the same issue with other software installations. most of the time it was an already running patching process in the background. after a reboot everything was fine. but I guess this is what you already checked.

Usually after a reboot this should work, but maybe something like a task that starts after every reboot? I had issues with this dams tasks before. There are lots of them… Chrome, OneDrive, Office, Edge…

yes. I added a GPU and turned it on RAM and CPU usage got cut in half

We don’t disable GPU - not sure if it’s worth the tinkering to disable it

Honestly, <@ULJM9DQF2> is a fabulous mentor. I've learned a shit ton from talking with him and walking through some of my stuff. Amazing fellow.

He's very knowledgeable about lots of things. PowerShell is only one of them ;-) A general community mentor is many ways. #Runspaces

Can you connect to the machine per console ? Or do u see a bsod ?

I can connect to the console, but it goes into that first time windows setup screen

<https://github.com/leeej84/PowerScale>
This might do some of what you want, would be a good starting point

In short - I don’t know of anything that exists, but should be easily (relatively) written in powershell - interesting use case 

They want it before the fall quarter, so the first edition will look like zork, then probably powershell studio for the GUI.

This looks pretty cool. I'd be interested in potentially working on this. I have a majority of the code written. Please DM me if interested.

I definitely will be contacting you on monday.

Monday is a public holiday here, perhaps we could do Tueaday instead?

I am working on something similar but using Remote PC. We have a timetabling system and an attendance monitoring tool. I am running a scheduled task every 10 minutes which pulls the information on who is supposed to have class at the time the script is running and who is supposed to have class in 10 minutes. If a student is not part of the group which will have class in 10 minutes, a message is sent out asking the student to save files and notifying that he/she will be logged out in 5 minutes. 5 minutes later the user is logged out and the second group is provided with a desktop. The script wasn't complicated to write, coming up with the logic took longer.

I am sorry for the late reply on this thread.  So, we are going to be doing stuff, and would love to collaborate with everyone.

At the moment, we are working on ADC HA which we should have finished by next Wednesday, and then the following week, I will discuss this with people on our team.  Then I can report back and schedule zoom session to work collaboratively.

Are you talking Citrix policy settings or GPOs in general? Citrix policies have several templates you can use within Studio (e.g. high-performance, high-security). With regards to other GPOs, it is unlikely we could recommend anything as a baseline as the unknowns in your environment (desktop/apps, security level, applications in use, etc.) would make it difficult for any baseline to be applied uniformly across all platforms without having side effects.

As James said it depends on your environment, I can only recommend you Carl Stalhood’s website.

<https://www.carlstalhood.com/citrix-virtual-apps-and-desktops-cr/|https://www.carlstalhood.com/citrix-virtual-apps-and-desktops-cr/>