World of EUC

image.png

Screen Shot 2020-11-02 at 2.40.06 PM.png

We get this occasionally.  Have a filtered view in director to find them.  Note they won’t appear in director immediately, usually takes a half hour.

Wow, that shows up for me too under filtered.  Thanks <@ULLRRKZ8E>

Are you doing EDT to both DGs? If she connects via hot spot does it work? We've seen weird things like this for EDT with certain broadband carriers.

Tim is right! I guess EDT is causing the problem. You could disable EDT on one DG with a Citrix policy filtered by a tag. Tag the DG and apply the policy with EDT disabled on the tag. Restart the machine or execute gpupdate. You can check with netstat if the server still listens to UDP 2598/1494.

Turned out to be that brokered desktop, failed at logon, never fully associated with them.  Used the filter in director above to find a desktop assigned to N/A, force rebooted that desktop so it could reregister with broker with no user on.

We’re not using EDT, have it actively disabled. Still have 4 or 5 of these issues a day.

Same.  We have two farms.  Only the desktop farm has this issue, and only with more recent releases of XD.

I often wonder what the % is that disable EDT now.

with EDT you need to make use of MTU discovery and lower the MTU in the default.ica for reliable connections from networks not under your control. There are lots of carriers/providers/VPN users running below the default 1500 MTU size.

It’s only a regkey to enable MTU discovery. Give it a try! 

Do you find that setting the storefront side change is good enough? Or is the endpoint reg change necessary too?

My remind on notes for me. Just pasted it all here.
4. Add the MTU discovery Registry setting to Fix packet fragmentation. I originally did this with GPO, But from what Citrix and slack member are saying. It needs to be baked in the Golder Image.

What this key does….
This key stop the packet fragmentation from happing on version of Citrix workspace the can use this key and support MTU discovery to adjust the MTU size of the ICA session. If we find that we have version that can't work. Then you must edit the Storefront default ICA file. So in a nutshell, MTU discovery works on Clients that support it. Clients that doesn't support it. You need to modify the defaul.ica file to make it work fully <https://support.citrix.com/article/CTX231821>

	a. 1912VDA, add this DWORD: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\icawd
Name: MtuDiscovery
Type: DWORD
Data: 00000001
	• If you enable it on the VDA it works WITHOUT changing the default.ica. It is controlled by:
	Registry key on the VDA (set it in registry on GM, not with GPO)
	• Client (Windows CWA 1911 and later)
	
	Example of not have the key and using default MTU setting which is 1500.

Our users with problems were all internal accessing Citrix desktops across SD-WAN. All of our external users work with EDT without problem. My thought is it's either client related (Citrix Receiver/WSA version), or a problem with the SD-WAN config.

Another change on the vda too?!?!? That ping command is nifty

You can use my BGInfo script to check the client MTU size inside a VDA Session among many other things

<https://github.com/Mohrpheus78/Citrix/tree/main/BGInfo|https://github.com/Mohrpheus78/Citrix/tree/main/BGInfo>

BGInfo.png

I updated the script. Added WEM cache date and free size of FSL in percent :grin:
Script is now on GitHub

Your staff don't have a problem with BGInfo running in their session? Ours would probably flip. Plus, we have an organization mandated background within our desktop, so we'd have to work around that (there is a graphic in the bottom right corner)

yea I wish we add it. Users would FLIP out

Just use the BGInfo Taskbar script! No change of the background wallpaper, just a tray icon.

If you click on the tray icon you see all the informations :+1::skin-tone-3:

Now I have to go lookup how to add it. Been years since I looked at this.

Very simple. Start BGInfo-Taskbar.ps1 with WEM external task on logon. Just read the example notes in the script.

How does wem cope with PS execution modes being pushed by corporate policy?

I run a CMD file to set the exuction policies, then call the .PS1 files

WEM external task:
Path: powershell.exe
Arguments: -executionpolicy bypass -file “C:\Program Files (x86)\Scripts\BGInfo\BGInfo-Taskbar-Taskbar.ps1”

I had that at one time, and it wouldnt work. But I can try that again

Works 100 %. Make sure you don’t block powershell.exe with WEM (Security tab)

BGInfo-Taskbar.png

BGInfo Taskbar looks like this (after clicking on the systray icon):

I cant get it to load for me. Script runs, but I dont see the icon yet.

<@ULLRRKZ8E>, if you don't want to wait for Director to show up at the +30m mark and need to find the VDA that has the Brokered by not fully logged on session try this.  It'll show desktops in the process of logging on, from there you can infer if one is stuck in that state by running it again + your average logon time.
`Get-BrokerSession -DesktopGroupName "DGName" -SessionState Connected | select Brokering*,DNS*` 

Even with app virtualisation, you’ll have issues with 32-bit and 64-bit Outlook co-existing. Multiple images would solve the issue without additional products.

Ain't no packaging tech that can cross architecture boundaries, AFAIK

Cheers, lads. Thought as much, thought I'd check in before going back with a plan - thanks :slightly_smiling_face:

pretty sure <@U011AT3EESK> once alluded to this and said something along the lines of "even though you could, it doesn't mean you should" in relation to AppMasking in this scenario - multi image!

Got it... I think I recall that comment on one of his talks actually... Ok, I know what I'm doing :slightly_smiling_face:

I have to do multi image for 32bit teams webcam redirection from wyse terminals, I’m still trying work out how to handle session roaming as we want to restrict the 32bit image to launching from wyse terminals only.

I would suggest using SetUserFTA.exe...  Something like `SetUserFTA.exe mailto Outlook.URL.mailto.15`

yeah but Outlook isnt installed on the VDA

host to client redirection doesn't work there?

thats what Im trying, but can only pass HTTP or HTTPS to local

<@UKJTJD4KA> I remember you talking about this in the past.  Did they get it figured out?

I thought it would be possible when I saw this doc: <https://support.citrix.com/article/CTX120688>

and was thinking, oh they just need to post an updated method

but then digging into it, the protocols are very limited

Hopefully James will know.  I forget his timezone, so he might not be around

well I got a reply from the guys at MQ Technologies and they hooked me up with this tool:

it allows you to redirect the MAILTO protocol

just need their client and a server piece

yeah nothing native in Citrix for this that i know of - absolute pain in the ass and always has been :slightly_smiling_face:

Is there anyone hooked up with CVAD or cloud that is deploying to AWS?  Trying to track down an InstanceTypes.xml issue with my update script. <https://gist.github.com/ryancbutler/f2800c7a5e301545076b80cff508c827> is the xml if anyone has a chance to test and copy me the error.  Make sure to backup the original file.

<https://worldofeuc.slack.com/archives/CLDGD0KNV/p1604434705022000?thread_ts=1604434705.022000&amp;cid=CLDGD0KNV|https://worldofeuc.slack.com/archives/CLDGD0KNV/p1604434705022000?thread_ts=1604434705.022000&amp;cid=CLDGD0KNV>

I cant remember the details, But I thought the service reported back to director. However, that could be where some dont install it and I am getting it mixed up. So you are trying to test it on the same box that UPM is configured for users?

No reason to turn off the service.  Just set the excluded groups parameter to be the group name you are using for FSLogix profiles.

<@ULLRRKZ8E> thanks. So we'll have the excluded groups setup to exclude my test group for using UPM?  We don't have to uninstall any components from the image we're using.

That’s how we’re currently running our pilot with the same gold image. Have FSL set via a GPP to only apply to group XYZ and have Citrix profile Management set to exclude XYZ from processing.

Interesting, Thank you for clarifying that for me.

I'll be installing FSLOGIXAPPSETUP to the golden image and then use GPP to manage out groups.

Just in case u send see the response from them

We've migrated from UPM to FSLogix several times. No need to uninstall or deactivate anything in UPM, like <@ULLRRKZ8E> said. Just use the Include and Exclude Groups of both Programms wisely and you are good to go.

<@ULLH5JGFR> thanks a ton, I've learned now to keep an eye out on the threads view that slack provides.

<@ULHA2J7RT> thank you for adding your input.

Have you any experience with converting UPM to VHD?  I've got a script that I'm trying to make use of but running into issues.

Its no problem. I figured maybe you missed what they said.

We used <@ULKDZEST0> as an inspiration: <http://www.citrixirc.com/?p=848>

<@ULHA2J7RT> I was having trouble getting the linked script to work, however in the comments the user Franco adjusted some things to make it a little easier to follow. Also, user Stephane added some changes that address permissions issues they were experiencing.

Do you have any thoughts on those changes? I've yet to have a successful migration where a new disk didn't end up needing to be created.

Logon with a user on a VDA. Check in Citrix Studio if you see the username of the the session or just a hyphen (-) on this VDA. 
If you only see a hyphen this could be the problem. 

Thanks Dennis. I'm not seeing any users showing up as just a hyphen. If this is the case, what is the fix?

If it’s the case you have a problem with cmstart.exe and you have to check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup

We're not seeing any hyphens. We opened the PVS image, uninstalled, ran the cleanup utility, rebooted, reinstalled, rebooted, and we're still seeing staff have this problem. Our next step is full image rebuild. Fortunately it's mostly automated.

We have almost the same setup on a legacy farm, XA 6.5 on SQL 2008R2 SP3. We aren't forcing TLS 1.2, but your plan looks solid. Also make sure you have HRP07 installed prior to any other updates.

Another option might be stunnel?  We have used it before in legacy systems that couldn’t support TLS1.2.  

Lots of times on Server 2019 recently. We found that there was an issue with Fast Reconnect in Server 2019 that was supposed to have been fixed, but adding the registry key to prevent Fast Reconnect fixed our issue.

HKLM:\SOFTWARE\Citrix\Reconnect
FastReconnect
REG_DWORD
0x0

<https://www.mycugc.org/blogs/brandon-mitchell1/2019/09/22/not-so-fast-reconnect>

Curious if this applies to window 10 1809 ( which is same code level as server 2019)

I would lean towards it affecting Windows 10.

Yea, I can test this. Thanks man. Good information. Anybody else use this keey

No, but those are the cmdlets I recommend for that issue

I have that all the time when booting old MCS Masters. Then I use Reset-ComputerMachinePassword. Works very well. 

Yeah I put together a script but I’m not sure I’m proud of the security implications to make it all work - feels a little dirty but does self heal pretty well

Anything in events or MSI or xendesktop installer logs

i presume you have created a new maintenance mode vdisk version and set the maintenance pvs target device to maintenance mode and confirmed the vdisk is in R/W mode before running the vda cleanup utility ? is there any retries on the maintenance target device ?  worst case you might have to reverse image the vdisk back to the HDD and uninstall the vda and install then convert back to vdisk

Yes, sure. New PVS maint. version, no retries! I also thought about a reverse image but meanwhile I just updated the VDA without any issues. I always have a better feeling with a clean install… but hey, it’s working, so…  :man-shrugging::skin-tone-3:

It doesn't help but I create a new vDisk using MDT for a major upgrade to avoid those issues.

Not sure which channel this would fit in best.  Anyone know which licensing you need for Citrix Content Collaboration to connect to Sharepoint in office365? The feature matrix mentions on-prem sharepoint, but nothing about the o365 connector.  <https://www.citrix.com/products/citrix-content-collaboration/feature-matrix.html>

So based disk is clone for each VDA ? Citrix has not optimized its own Hypervisor !?!
I use 100GB on my master and 100GB for diff disk so each use 200GB ! Wow...

Not quite.  It’s down to how you have your storage configured.

Screen Shot 2020-11-05 at 2.37.52 PM.png

That particular store has a couple hundred MCS win10 machines.

You use Thin Provisioning ? My storage is mount by hba fiber channel and does not allow thin provioning

Our storage is all hardware HBA’s, and for the MCS shared storage we are using GFS2 thin provisioning, yes. I’m interested in other replies, as i’m not sure we are doing it the best way.

To your initial question, if you have HBA’s running LVM then the storage will appear to fill quickly - even if on the back end storage device you have thin provisioning enabled. Xen Server assumes each is a full copy, not a thinly provisioned clone.

As I understand,  GFS2 is only available for cluster mode and not for Resource Pool. So I have to understand the pro and cons of cluster mode

FWIW we tried using NFS.  It did not go well….:scream:  So GFS2 was the only viable alternative in our environment.

If you can, put some local storage in the hosts and just format them as EXT3 datastores. Using GFS2 will give you the same benefits of thin provisioning though. At that points it's more space efficient than vmware.

We're using NFS with thin provisioning, but since the move to Windows 10, we have more than doubled our space requirements. It is now ~40GB per user.

Even if thin provisioned works, and since Windows 10, it is not so great in term of space saved (5,298.7 GB used for 7,637.8GB allocated).

I am interested in this GFS2, we have more fancy block storage available than NFS even if I have no HBA at the moment on my hosts.

Last time I checked it was experimental feature (on 8.2 it seems production), and still in Citrix doc, they recommend NFS over GFS2.

Anyway looks like some of you use it in production, would you mind sharing like nb of VMs, space utilisation / allocated, how it running? version of XS. Thanks!

Workspace for HTML5.. Is the right click menu supported for pasting from a local machine to the remote endpoint? Or is it strictly ctrl c + v?

Hi, incorrect/not compatible SSL Ciphers or SSL certificate I would say

Only datasheet I got...they must be having Internal docs. You can get the same from customer login.

<https://documentation.solarwindsmsp.com/EDR/Content/Install/vm_vdi_deployment.htm|https://documentation.solarwindsmsp.com/EDR/Content/Install/vm_vdi_deployment.htm>

I think BIS-F can handle this in a non persistent environment. 

<https://eucweb.com/docs/bisf-7-1912/gpo-configuration/citrix/configure-ssl-for-the-citrix-vda|https://eucweb.com/docs/bisf-7-1912/gpo-configuration/citrix/configure-ssl-for-the-citrix-vda>

I don't do that, but I've read two scenarios from other - the ICA service times out because of something in Windows, and this: <http://www.jhouseconsulting.com/2019/03/04/controlling-the-starting-of-the-citrix-desktop-service-brokeragent-1894>

yea, I don't do it either. But I wonder if its why we get client connection failures a times.

You'd think that the event logs or Director would help out more with that, but here we are. We battle the same thing.

Yea it sucks, I have been trying to find out why. But its not consistent. I even have to exit workspace, the reopen it for a user to connect.

We went through the trouble of cracking open our image to enable CDF tracing (WTF DO YOU MAKE THIS SO CUMBERSOME, CITRIX?), and the logs showed nothing useful.

It's better in 1912 than it was in 7.15, that's for sure.

I agree with <@ULC9J5XPB>, 7.15 was so cryptic with the data that I don't think Citrix own tier 2 and 3 techs knew what to make of them. Had a customer receive directions to collect the useless logs and when why and what they expected find, the response was basically "cuz my directions tells me to ask for them"

we had to delay it because the machines would boot up so fast that if you let sessions onto them they would get stuck for 15 minutes.

Windows wasn’t ready to let people onto the machine but citrix was there throwing users at it

once we set a delay to 3 minutes everything calmed down. I haven’t had to do it in any other environments, but that one was an odd duck

I have our *SettlementPeriodBeforeUse* setting for my XD DGs set to 5 minutes. Originally, it was for App Layering, but since that's basically no longer required with O365, I guess I don't really need it any longer.

<@ULLAD12P2> do you see a high % of Client connection failures? I thinking is that maybe, the people who are not apply the Delayed approach would be contributing to this?

it would end up connecting twice somehow in director

Was that before the delay or is that before and after

interesting...... OK, well time for me to test this and introduce the delay. I might have to increase the timeout settings so it doesn't get unregistered.

I think we took our delay down to 90 seconds

they would boot up and register within 30 seconds, and GPO hadn’t even finished processing by that point, like the machine still didn’t have the correct time from the domain…

From what I am reading looks like you need to update MaxRegistrationDelayMin dword

that sounds right, there was also a tool that would do it for you, the citrix desktop helper

I use the Jhouse consulting script and we have ways set a delay to allow the auto-logon user to log off and the WEM cache to refresh.  Without it we would see people try to logon before everything was ready which caused a variety of weirdness.  It’s just habit to keep doing it now.

<@ULLH5JGFR> did you check DDC any events? For a customer i also facing the same issue Event ID 1116 on DDC

I have not, However I will look into it. Thanks Salim

You would have to set it up for specific sites which could be tricky. I did do this once but have to confess I never tried anything but IE

Can you just redirect the entire Teams web client back local?

Is it part of the Local App Access feature?

I think Teams is installed locally, and Outlook is accessed via Citrix, so whenever a Teams meeting invite is received they want the URL redirected to the local Teams

Local App Access deals with redirecting remote apps back to the local device to launch there. Host-to-client Redirection is the feature I remember <https://www.htguk.com/using-host-to-client-redirection-in-citrix-xenapp/>

You could still do Browser Content Redirection maybe though

I know, but I can see a URL Redirection feature when I enable Local App Redirection in a Citrix policy and a URL Whitelist and URL blacklist can control whether a URL is redirected or not

I did a BCR article about redirecting the Teams web client

<https://james-rankin.com/videos/optimizing-the-teams-web-client-and-streaming-video-on-citrix-virtual-apps-and-desktops/>

Oh god those FTA registry fixes for host-to-client redirection :exploding_head:

It looks like the Teams Web approach with BCR may better

Ha, just realized I promised to record a video on that - was only about three years ago

Will have to go "on the list" unfortunately, there's a lot of backlog here

I had to set up the host to client redirection thing once, it was awful

I think there are plugins to make it work for other browsers

yeah, it was an ancient farm, still in prod

I tried it and worked out that it was too hard, you have to edit the xml to turn on fallback by default otherwise if it can’t find the client it doesn’t work at all, which is the stupidest default setting ever.

I don’t have access to the cisco side of it, so can’t edit that file, so that was it for me.

What kind of information are you looking for? In our testing, if you have Adaptive Transport enabled, you 100%, absolutely, positively must use the WebEx VDI client on your endpoints, and the version must be greater than v40.9.6.11. Any lower, and the WebEx client would not show as optimized, and performance would be so bad that it completely locked up the session/

do you have a step by step with screenshots to edit the xml that I could point our cisco people to? The team that manages webex have no idea how to edit it

I have no idea what XML file you're referring to?

hmmm, maybe I’m getting confused with the jabber install

<@ULC9J5XPB> Webex Teams VDI on local computer and probably a machine wide installer of WebEx ?

We also set the following in our VDA: HKCU\Software\Webex\NativeVDI, VDIFeatureEnabled, 1 (DWORD), per <https://www.cisco.com/c/dam/en/us/td/docs/collaboration/webex_centers/esp/Cisco_Webex_Meetings_Virtual_Desktop_Software_Administration_Guide.pdf>

Endpoints: Cisco Webex Meetings Virtual Desktop Plug-in 40.9.6.11
VDA: Cisco Webex Meetings 40.10.3.10

The Webex Meetings install for theVDA is actually the same client we pull from our webex site (<http://corp.webex.com|corp.webex.com>)

Head office provided the link to the corp Webex site with all the required components

I can’t reset connection strings if the delegated service doesn’t work, the string in the registry looks correct though

On a DDC run asnp citrix* and (Get-BrokerController).State
Are all DDC’s Active?

Also run
`Get-ConfigServiceStatus  -AdminAddress "localhost"`
on each DDC

Did you also restore the SQL server or databases?
You have probably already restarted all servers, right?

yeah, one of the 2 has an issue with the delegated admin service

for some reason studio isn’t installed on both DDCs…

ok, now it wants to do an automatic site upgrade

and then says the database is already configured

Why did you have to restore? Was it a failing update? Have you done a database update?

If so, did the restore include the database?

ok, restarting the oher one again let me edit the connection strings finally

Maybe this is helpful 

<https://discussions.citrix.com/topic/390913-studio-mandatory-upgrade-loop/|https://discussions.citrix.com/topic/390913-studio-mandatory-upgrade-loop/>

<https://support.citrix.com/article/CTX212941>

So the user doesnt get Desktop notifications on the local computer while in full screen mode in a session?

No, he gets the notification on the local desktop it self, but it is not noticeable while the citrix desktop session is fullscreen mode... its kind of, the banner arnt able to get in front of the desktop session. So strange thing:see_no_evil:

Got it, the issue is on the latest Teams app, with all older Teams app it has worked.
Already opened a case at MS.
Since now more and more user got the new teams app installed its became more critical.

Dang man. I just starting to upgrade and havent seen it. I am sure I will now

<https://microsoftteams.uservoice.com/forums/555103-public/suggestions/35681143-incoming-call-notification-dialog-not-always-app|https://microsoftteams.uservoice.com/forums/555103-public/suggestions/35681143-incoming-call-notification-dialog-not-always-app>

Yeah, what's with the "Windows Virtual Desktop"? Does that mean *actual* WVD, or a virtual desktop running Windows?

Fucking stupid choice of words if you ask me

I assume virtual desktop running Windows. If it was only relevant for WVD, that would make my life a lot easier..

And thats just the root of C:\, not talking about subdirectories, correct?

Again, clear as mud. Users these days do have occasional write permissions into some folders of C:

From what I understand yes. The second vuln affects more users though, as it only requires you to authenticate on the server.

Please note that Citrix XenApp / XenDesktop 7.6 LTSR is not affected by CVE-2020-8270.

A remote compromise is only possible when Windows file sharing (SMB) is enabled on the Windows Virtual Desktop. If authentication is required for SMB then an attacker must also be able to authenticate in order to remotely compromise the Virtual Desktop.

Samuel (11/10/2020, 3:10:36 PM): 1) Only the following versions are affected:
Citrix Virtual Apps and Desktops 2006 and earlier versions
Citrix Virtual Apps and Desktops 1912 LTSR CU1 and earlier versions of 1912 LTSR
Citrix XenApp / XenDesktop 7.15 LTSR CU6 and earlier versions of 7.15 LTSR
Citrix XenApp / XenDesktop 7.6 LTSR CU8 and earlier versions of 7.6 LTSR

2) If you have Windows File sharing enabled, then you could be affected by the CVE

Me (11/10/2020, 3:12:09 PM): Please note that Citrix XenApp / XenDesktop 7.6 LTSR is not affected by CVE-2020-8270.
Me (11/10/2020, 3:12:29 PM): Is that only for this specific version?
Me (11/10/2020, 3:12:47 PM): And what is meant by Windows File sharing
Me (11/10/2020, 3:12:52 PM): That is extremely unspecific
Samuel (11/10/2020, 3:12:58 PM): Yes, only 7.6 LTSR (without any CUs)
Samuel (11/10/2020, 3:13:08 PM): Yes, please give me a moment to confirm on that
Samuel (11/10/2020, 3:14:43 PM): It refers to this specific feature: <https://zappiti.uservoice.com/knowledgebase/articles/1830778--network-smb1-sharing-protocol-on-windows-10>
Me (11/10/2020, 3:16:06 PM): So if those are not enabled, it's impossible to exploit the vulnerability?
Samuel (11/10/2020, 3:17:27 PM): For CVE-2020-8270, it would not exploit if SMB feature is not enabled
For CVE-2020-8269, it would not exploit if users do not have write access to C directory
Samuel (11/10/2020, 3:18:21 PM): You can refer this MS article as well to disable SMB (if enabled): <https://docs.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3>

Argh, just YESTERDAY I had to defend my stance on why internally we cannot upgrade to 2009.  (SR+AppFlow+&gt;VDA2003 = no connection)

I asked support for the priv hotfix, and they said they're not distributing it anymore since the actual SR+AppFlow fix is in CVAD2012

On the other hand thank you <@U0149SMF9AR> for the SMBv1 detail.  Fortunately that mitigation has been in place for quite some time.

Are we expecting 1912 CU2 soon to address this vulnerability and vSphere 7 support?

so this is only an SMBv1 vuln? Who still has that enabled after wannacry? And only if you changed the default permissions on the root of the C: drive?

That's what I read from the above chat, I'm trying to get a confirm from my SE.

This is a bit of a shitshow, they haven’t even published the cve yet

yeah... couldn't find it in Mitre... and couldn't confirm with Crowdstrike if they already have something in place.

Just heard from my SE, he confirmed, the scope is not limited to SMBv1.

My SE is saying that these only apply to MultiSession W10, hence the "Windows Virtual Desktop" call out.  (again clear as mud).

Just sent an email to my SE aswell. If this WVD thing is correct.......

HackerOne are the ones that found it, I just sent them an email asking them to confirm the details

Yeah - this article needs to be more precise.

I'm having both real WVD environments as CVAD in general, so I am very curious to get explained exactly what this vulnerability is affecting :open_mouth:

There's yes'es and no's conflicting on the same question here :neutral_face:

Everywhere VDA versions in questions are installed are affected.

That’s not what Citrix SE’s are saying and it’s not what the article says

Our Citrix contacts have confirmed that the issue is in the VDA, regardless of where it's installed. Not a WVD issue.

I'm pretty sure this bit is incorrect too - can someone else validate too?

"CVE-2020-8269 – This issue is only exploitable if low-privilege users have been granted permission to write files to the C:\ directory. This permission is not default in Windows and Citrix recommends that users are only granted the permissions they require."

I was wondering about that too. Users by default can create new _subfolders_ in the C: drive. Is that what they mean? Or is it permissions to write *files* into the c: root only?

I’m sure users can write files too. I’d need to boot a VM to validate on Windows Server / multi-session, but I don’t think it’s different than Windows 10

I'm testing Server 2016 and they have Special permissions by default which allow Write on Subfolders Only

+1 on the subfolders only in our environment.

I had the guy that found CVE-2020-8270 reach out to me on twitter, it’s all smb BUT it’s a vuln in the citrix appv service, so if you aren’t using that then you’re fine.

So does it mean if the App-V integration service is *running*? Or *actively used*?