World of EUC

QQ.  Is there a way of pulling out mapped client drive usage in CVAD?  We want to turn it off as we have OneDrive and a mapped home drive so they are redundant but we are getting the usual kick back about removing features.

from memory there's an --app parameter so you can load a website as a standalone app, you might need to wrap it with some other GPO settings to prevent breakout from that. Last time I did it was a combination of that and Ivanti Application Control to completely stop breakout

Nice... thanks, Andy. I'll do some digging... No Ivanti, running FSL and WEM... I'll see what I can find :slightly_smiling_face:

Thanks, John. I looked at it a while back, it's good from a security perspective but I believe the user can still freely open multiple tabs, cheers

image.png

You can use the Chrome.admx to do prevent breakout from the published app.

In "Block access to a list of URLs" Block * and chrome://*
and
In "Allows access to a list of URLs" allow the backend app URL.

This is via Ivanti Workspace, but it's just a UI difference, it is actually applying the admx settings.

MicrosoftTeams-image (5).png

have you run gpresults wizard to see if its a logon script ? i would check EM config if using appsense or if using wem check for external tasks assigned

I believe it could be part of a login script.

Statt cmd an enter the command rsop.msc. Look for any Startup or logon scripts. 

That's a logon script mate, running visible

Clearly an (old) logon script. Get rid of it! There are better ways. After logon start autoruns from Sysinternal tools. In the logon tab you should see where it comes from. 

Looking for input.

Why go for hp zcentral when you can use citrix remote pc for the same scenario? What makes HP zcentral different, other then having rack mountable workstations via HPs "rds" solution? (Assuming you already have citrix infrastructure)

Screenshot_20201202-183222.png

When you say you updated... Refering to updated the Edge application?

Yeah, sorry, patched the server, updated Edge. I was posting this for a colleague. Seems it's only the icon for Edge that's affected

And updated the VDA to 2009 from 2006, I believe.

Oh ok, So the published applcition ICOn from Studio is now showing that?

Can you just point it to a new .ico file? Find the edge install on another machine grab the icon file. Then point it to it. Assuming the app still works though?

Yeah, app launches fine. Cool, I'll have him try that

Or have him browse again to the icon from studio to the application path. It will pull in the app icon.ico.

How do i best calculate or measure what settings we should use for hosting connection to VMware. 
The default value is to low as we have 20 hosts in each DC and would like to start 1000 VDI in case of a disaster in one of the 2 DC’s?

As Kees says, testing in your environment with your VMs and your infrastructure is the only way to know.

I did a project where the VMware infrastructure was so overcommitted the defaults were to high. They found they could only start four VMs safely and six brought vCenter to its knees in pain.

Thank you, I will test and see where vCenter can’t follow.

I had this issue. I opened a ticket with Citrix. I'll grab the steps they gave us.

I put them into a PS script that BIS-F calls during execution

<https://support.citrix.com/article/CTX236683> ?

hopefully itsmore than that :slightly_smiling_face:

oh good, yes please please share :slightly_smiling_face:

Give me a few. On PTO today, gotta log in and whatnot. It's not nearly as exciting as you'd think it is

cause i am clearly missing a step from what bits i've found and put together :slightly_smiling_face:

(and I'm curious why CTX236683 was not updated if support knows how to make it work)

```Checking in with you to see if you have had an opportunity to try the steps I provided in preparing the image? 

From Admin CMD prompt

1-net stop ccmexec

2- Del %WINDIR%\smscfg.ini

3-powershell -command "Remove-Item -Path HKLM:\Software\Microsoft\SystemCertificates\SMS\Certificates\* -Force"

4-wmic /namespace:\\root\ccm\invagt path inventoryActionStatus where InventoryActionID="{00000000-0000-0000-0000-000000000001}" DELETE /NOINTERACTIVE

 

From Admin PowerShell

1-dsregcmd /leave

2-Rename-Item -Path "C:\ProgramData\Microsoft\Crypto\Keys" -NewName "KeysOLD"

3-New-Item -Path "C:\ProgramData\Microsoft\Crypto\Keys" -ItemType Directory

4-Get-Acl -Path "C:\ProgramData\Microsoft\Crypto\KeysOLD" | Set-Acl -Path "C:\ProgramData\Microsoft\Crypto\Keys"```

This is what they said about updating the article

Like I said, I converted all those steps and included them in a PS script, which BIS-F calls. No more duplicate SMS identifiers.

to be clear all 8 steps the 4 in cmd, 4 in posh?

cause i am doing 4 in cmd today, and no joy, but goign to try extra steps!

Yeah, all 8. But I converted the CMD ones into PS commands. So, 8 steps, all in PS

yea we have a reseal we use (got reasons for no bisf)

so no sweat adding all 8, thanks let me give this a go

on the wmic do you get no instance available at times?

Honestly, I haven't checked the output of the steps in ages.

cool, thanks! i'll let you know how this goes

It's essentially the steps from here:

<https://sccmentor.com/2014/03/05/implementing-sccm-in-a-xendesktop-mcs-vdi-environment/|Implementing SCCM in a XenDesktop MCS VDI environment – SCCMentor – Paul Winstanley>

But with the dsreg /leave (for if the master image has registered/joined Azure AD), and the CryptoKeys part. I never really looked into why the CryptoKeys steps were needed, but Citrix clearly knew about it, as they supplied all the steps.

yea thats where i got the 4, i didn't see the other 4 steps

Yeah, I've never seen them posted anywhere else on the web for this issue. Which is odd. We're very SCCM-heavy, so we need the VDIs to be in there correctly.

I know it's not always possible, but I think we had to delete any/all duplicates out of SCCM too. So that the HWID etc isn't retained in the DB. The SMSCFG.ini deleting *should* take care of that, so a new GUID is generated, but it didn't always work.

sadly i am waiting on confirmation of that being done

No worries. I'm just sitting here staring at this thread, waiting to see if it worked. I've got all day.

<@U0125D243RN> can you open up a feature request here and put all required informations together, <https://github.com/EUCweb/BIS-F/issues?page=1&amp;q=is%3Aissue+is%3Aopen|https://github.com/EUCweb/BIS-F/issues?page=1&amp;q=is%3Aissue+is%3Aopen>

bis-f 7.1912.6 will have some features for AAD as well, check out <https://github.com/EUCweb/BIS-F/issues/285|https://github.com/EUCweb/BIS-F/issues/285>

i went a 9th step and rename the CCMEXEC.exe at shutdown so during the MCS processes it can't possibly run

then on first boot rename and start the service

and now we can get some stuff to bis-f and maybe see an updated CTX article!

I created this issue here:

<https://github.com/EUCweb/BIS-F/issues/296|Include extra steps for ConfigMgr Client>

<@ULDHJB8BB> this is the thread in the open issue, FYI.

You can grab a copy of the SCCM script now from the developer branch, the last 4 steps are included now 

<@ULLRRJRHC>, I'm testing the new script today. I'm seeing my VM as AzureAD joined, and it doesn't look like the dsregcmd /leave step ran, according to the logs. I also noticed there was an 's' missing. I updated the issue with my comments. Thanks!

turn off Local Host Cache, delete the SQL Express install, problem solved

if anyone is interested here is my script to reboot machines in a desktop group while users are logged in. Puts a given percentage of machines in maintenance and waits for sessions to clear. Then reboots. <https://github.com/umn-microsoft-automation/UMN-Citrix/blob/main/Start-DesktopGroupReboot.ps1>

Updated script: Citrix Cloud Documentation Script V1.10 - <https://carlwebster.com/citrix-cloud-documentation-script-v1-10/>

VDA cleanup and reinstalling usually helps

That's a tough one. Explorer.exe running high on the black screen? Do crtl alt delete on the black screen to see if task manager opens. Looks at explore.exe. something with the shell is acting up.

Did something change recently? I had some  issues with upgrade from 1903 to 1912 CU1. Had to do VDA cleanup and clean install.

Please also check the antivirus software exclusions. There are some changes in 1912

Hence the reason why Citrix Optimizer is not using LGPO. There is a .pol file that you can copy from a clean machine over and you will need to modify an .ini file to increase version (so it is reapplied).

Should be in C:\windows\System32\GroupPolicy, but it's been ~15 years since I've done that last time (we used to clone GPO to LGPO to apply settings to NT4 users)

Use LGPO.exe, download it from MS. Unpack it locally and copy the resulting LGPO.exe file to C:\Windows\System32. Then LGPO.exe /b backup_path and apply to new machine 
LGPO.exe /g backup_path

thanks guys!  so if i understand right i could set my local gp the way i way ,  run a backup w/ lgpo, and then restore everyones desktops w/ that backed up copy?  (hopefully it will let me run lgpo silent)

so what about if you have a policy set in local gp and you want to undo it completely (set it back to not configured so the user can adjust)

Export from a clean machine with no extra lgpo and import it? Google search says 

RD /S /Q "%WinDir%\System32\GroupPolicyUsers" &amp;&amp; RD /S /Q "%WinDir%\System32\GroupPolicy"

wonder if thats the route i'm reading on now where you almost would do that to completely wipe out/reset local gp and then could import another that has only the ones you still want set

Let's see if Martin catches my emoji lol.

i would think i could automate all this with a single ps1 deployment to clear/import then.  thanks for all the help!

Sure can. What's with the lgpo though? Just curious.

well my gold image i ran citrix optimizer and a little bit of the vmware one so one of them must have set those things locally i'm guessing (sounds like probably not citrix from what martin is saying)

usually i try to stick w/ registry keys if i can if i dont set them in wem or ms gp

The VMware one is extremely brutal. It will jack up stuff. I ran it long time ago. You have know everything it does. If not, them it's a pain. It use to have verison control to show u want it modified.

i wonder if i could do that after the fact.  i did go through each entry pretty carefully i thought to make sure i was only adjusting things i wanted

Oh them sounds like you got it under control. I recall, it being able to revert. But it's been a long time. Once  Citrix optimizer came out. I dropped the VMware one.

Citrix one is alot more forgiving and support is 100% better.

But I think the lgpo will get you back into a good state.

cool yup the total reset then lgpo w/ a tweaked .pol files seems like it should do the trick so thank you for everyones help!

yup that vmware one seems to have add a boat load of stuff to local gp.  using rsop.msc to see whats set locally and gonna clear that all out and make reg entries for the stuff we really want for now for HKLM stuff and utilize wem for the hkcu stuff.

i think i'll be good.......still working on breaking out the stuff i want to keep/remove that was set w/ vmwares optimizer in local gp and then what is HKLM vs HKCU so i know what i just want in the image vs set via WEM.  the LGPO.exe you all suggested will be key then so thanks again!

the funny/dumb thing that brought all this on is people bitching about the lock screen Windows Spotlight slideshow not working in VDI like it does on their laptop.  found thats disabled w/ vmware  so that got me down this rabbit hole.  ultimately i found how to not lock that down but can't find how to set it back to the default again like it was (not that thats a deal breaker feature....or even a smart one to have on but wanted to see if it was even possible)

Maybe this? <https://answers.microsoft.com/en-us/windows/forum/windows_10-hello/easy-guide-how-to-enable-windows-spotlight-lock/c1f46556-d2fd-489d-b604-4d123efcf9ac|https://answers.microsoft.com/en-us/windows/forum/windows_10-hello/easy-guide-how-to-enable-windows-spotlight-lock/c1f46556-d2fd-489d-b604-4d123efcf9ac>

Only occurred once we went to 1912, was not present in our 7.15 environment.

What other Citrix components are in the mix?

WEM, Session Recording, profiles via FSLogix. Think that's it...it occurs whether users are inside network or outside, so not thinking it's related to that portion of the environment.

Our image build is automated, so literally the only difference between 7.15 and 1912 is the VDA version. We didn't upgrade SR at the same time, nor WEM (as we can do those out-of-band).

Nothing in event logs, occurs across multiple servers (all PVS VMs from same image) and hosts. We are currently investigating whether it's client related.

Weird, can you reproduce it Tim? Reliably?

Nope. It's completely random. Although once it affects a user, it seems to affect them more. Profile reset also does not resolve.

No =(. Was happening quite a bit before that. It's been ongoing for months now, just found out how widespread it is, though. It pretty much happened when we moved to 1912.

<@UL5TCKFEF> Was the issue you saw 2019 specific or might this be similar?

I'd go CU2 just to see, maybe just the VDA side for testing.

I would definitely try 1912CU2 for a test. This is a tricky one to be honest. Almost as if you need to run cdf traces all day to catch it. I do wish we had a better way to track this random issues. Cdf traces are hit and miss.

Trying CU2. We had 27 calls into the helpdesk yesterday for this problem. I was just afflicted by it. What a pain. Definitely seems to be on the VDA side, not client related as far as we can tell.

So the workaround is to setup with server 2016. Hmmm that's odd.

I think there is a reg key and <@ULJ3D468M> and I found.  Let me look it up tomorrow 

There are some registry fixes, which disables modern authentication. They are not recommended by MS though. I'll see if I can find them.

Are you able to hybrid join your WS2019 servers? I thing Aaron Parker mentioned that hybrid joining should fix the issues with WS2019.

Yes Hybrid join fix this issue. But remember to take the golden master from azure ad before deplyoment. bis-f developer path already has scripts for this.

<@ULL6F7DRA> <@UR9T47CRM>  would you recommend the hybrid joining of ws 2019 workers with teams and OneDrive etc. ?  

Yes, I always do. But note the above regarding azure ad generalization.

Thanks for Feedback <@ULL6F7DRA> &amp; <@UR9T47CRM> 

Worker are now hybrid-joined and issue is gone. Big Thanks!

I have no idea, maybe the WAM works better on hybrid joined devices

<@ULGR78LTW>  Did you mention this as a workaround?

It’s not a workaround, it’s the solution <https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join-hybrid|https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join-hybrid>

HAADJ is the feature that enables SSO. Here’s how <https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token|https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token>

<@ULGR78LTW>  Thanks! Since Citrix filed this as a known issue, I choose the term...anyway, things got clear. Thank you for your contribution on this one.

so the fix is or in better words the solution is "implement hybrid Azure AD joined devices"?

Which would explain why I dont see this in my enviroments.

Not seen this i would check the sql collation is set correctly and the DBA is running the DB setup scripts in sql cmd mode

If you haven't done so already get off web interface and get your clients pointed to storefront.  Aggregate both sites (6.5 &amp; 1912) in SF and give your new site priority.  When you are ready to migrate an app, just make sure its named exactly the same and apply your AD groups the application in the 1912 environment.  Users will see a single icon in storefront and when they launch it will launch out of the 1912 site.  As for automating the actual app creation process, there probably is way to do it with posh.  Lately I've been doing it manually as to not bring a bunch of unused junk from the old site.

Have you seen this? <https://docs.citrix.com/en-us/tech-zone/build/tech-papers/antivirus-best-practices.html>

There is also link to best practices from different vendors (including Defender): <https://docs.citrix.com/en-us/tech-zone/build/tech-papers/antivirus-best-practices.html#antivirus-vendors>

Thanks, Martin! I missed the Defender link :slightly_smiling_face:

anyone got the screen saver working on desktops? we put in the gpo + the regkey (<https://support.citrix.com/article/CTX205214|CTX205214> ) but no joy (1912 cu2)

Do they have a black square and the app if seem off on the screen?

I don't think so. This is a secondhand question to me, so I don't have all of the details. I just know that they've tried adjusting DPI on the CWA client to no avail.

KB10743-DPI scaling and Citrix workspace Client side issues fix.docx

That looks familiar, so you must have shared it before. I think what I was thinking of was having all three monitors at the same scaling.

The only caveat there is that this user is running CWA 2010 and still seeing the issue. Your one note makes it sound like it only affects Receiver 4.10 and lower.

I need to update it, I still applies to 2010 and below.

I update to 2012, and I had to adjust it again. something on my side

So you still need to have all 3 monitors at the same scaling percentage, even with 2012?

This morning, I had to yes. But I am alwasy messing with my machine. So it could be something I did

• Only thing i see in 2012 is this With High DPI set to Yes or No, when you launch a desktop session, some elements in the *CD Viewer* toolbar might not scale up to match the current DPI setting of the device. The issue occurs when the DPI setting of the user device is greater than 100%. [CVADHELP-15418]


Says it was fixed. But I need to test it 100%.

I saw that this morning, now that I think about it.

This is affecting XenApp apps, though, so no desktop involved.

Yep, that confirms where I see it as well. Only on published application is where I see this. No one has reported it on xendesktop

I have 3 monitor at home monitor 1 DPI is 100%, monitor 2 is 125% and monitor 3 is 100%. I just reset workspace, and Tried it and I got this.

Now if I moved it to 125% middle monitor, it this

So DPI needs to match across all monitors, or use High Res DPI in workspace settings

It has to be a scaling issue. He says that when he clicks on items, other items open up (like if he clicks at the far left, a menu a few inches to the right will open).

Gonna have him set the scaling to the same across the board.

And possibly ask why the hell somebody is running a single 4k and two 1440p monitors. That's just clown hour right there.

is there enough video ram in his session for that?

that usually results in black areas of the screen though

I did much testing to get mixed-scale and mixed-resolution screens working.  My golden rule is same zoom in Citrix as on local.  High-DPI laptop (150% zoom) with 2 x external low-DPI screens (100% zoom).  I'm using Citrix Desktops, not Apps, but only viable solution was:setting Workspace to high DPI / 'No, Use Native Resolution' (I used GPO).  Any other setting did not allow me to carry through the local DPI &amp; zoom settings.  Also used later version of client &amp; ensured toolbar enabled.  Windows still doesn't handle everything dynamically, so docking/undocking from external monitors can leave things slightly messy.  Logoff/logon for the win sometimes.

Yes I see this with surface pros, pretty much set the high dpi to “yes or the option on top” sucks! 

They apparently tried that and it's still not working, so I'm going to open a ticket for them and let them work directly with Citrix.

Funny they mention 2x2 view in VDI and mention Citrix and VMware but not WVD

so how would we go about testing it if its in public preview?  not sure if that would involve a preview build of teams or if its a different channel we'd have to change to for the new unlocked feature

Citrix was “a Windows Virtual Desktop”  according to CTX285059, they finally fixed that wording though

<https://twitter.com/O_P/status/1329227783126413312?s=20>

<@URVNXB96C> looks like it’s done via an O365 policy and can be applied to individual users or groups. It’s a new way to rollout preview features for Teams. 

<@URVNXB96C> Tested the gallery view today (1912CU1/win2016)... and worked really well.  
Did notice that the Teams CPU usage does increase a bit though...suppose extra video comes at a cost. 

<@U011FR9G8LS> awesome thanks for the feedback! yup that does make sense.

did you test with more than 4 people on the call? curious how it handles that for say the 5th, 6th, etc caller

Nope, I had exactly 4 today. 
I have a planned departmental meeting next week for that test :+1::skin-tone-2:

awesome thanks! so just a 365 policy assigned to you is all that was needed right?

Pretty simple. 
Create a Teams update policy with ‘show preview features’ toggle on - assign to users or group.
Sign out/in teams and then “about- and a new “public preview” option should be available.   
Agree to the terms and then I think it another sign out/in teams. Hey presto, done!!

Also Interestingly I found out that it looks like MS have enabled large gallery view (49 people) via the browser (edge/chrome).  Maybe I should look at BCR and teams again :joy::joy::+1::skin-tone-2:

alright we have the preview policy i place for myself and  1 other. i'll have to wait until next week to get a chance to test the 2x2 stuff out but thanks for the heads up on it!

any option to preconfigure this for a user ? With the policy setting activaated, a user needs to manually change his teams client to selct "public preview".

<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1605746542192400>

Been an issue for 20+ years over many OS versions and many Citrix product versions 

In task manager add the column for session id in details. You may be able to find a system process in the stuck session that you can kill instead of rebooting the server. 

Yes I have to reboot the vda, anyone know a better fix?

It’s the cmstart.exe that is missing. Run autoruns.exe from sysinternals and check the AppSetup regkey. Do you have Citrix Quality Indicator installed? Sometimes the AppSetup value gets broken and so cmstart.exe cannot be executed during a user logon. 

Another reason could be the VDA version. It’s a known issue that wfshell.exe crashes. What VDA version do you have?

Should be OK. So check cmstart.exe. A clean uninstall and install of the VDA also fixes it. 

<@ULTD5QMBK>  I assume you are having this issue when users log off but their sessions are left with those 6 processes and stay disconnected? If yes then In my experience it’s due to AV exclusions not being set properly or some other software hooking one of those processes... 

Exactly what <@UL8ACTGSF> said...  :confused:

its a german application for deployment planning

you tried disabling the ctx api hooks on the app ?

I will fiddle with SeamlessFlags and maybe adjust citrix graphics memory

Re SeamlessFlags I would start with the highest value and then lower it until you found the corect one:
Seamless Configuration Settings (<http://citrix.com|citrix.com><https://support.citrix.com/article/CTX101644|)>

black bars is usually graphics but that looks like it could be a bad font

RDP to the server run the app. If the application runs fine, then its something with explorer and the active shell. Then go the seamless flags route.

Citrix had a tool called FarmTWIHelper6.x that would adjust the Seamless flags on the Fly.

Hi guys, that issue is not fixed yet. I do not think thats an seamless flag issue when its running in a published desktop?

You can rule out seamless flags by doing the Shift-F2 thing and breaking out of seamless mode

I don’t think seamless plays into published desktop, so if it’s still happening in published desktop mode it sounds like it’s time for procmon to see if it actually finds those resources you show in the screenshot (font/images)

Yea Trent is correct. I miss read the thread, My bad guys

I just put the apps in MDT and run the task sequence.

For "emergency" updates, I usually create a vDisk version and run on that, until the image has been properly updated.

If you update directly on the non-persistent VM, don’t forget about that RAM cache

I’ve don’t it loads of times with computer startup scripts, whereby small files change on a regular basis. I’ve even use FSLogix App Containers for that purpose too. If its actually an installer then I rebuild the gold image.

<@ULLV6PW11> that’s new, I use fslogix for profiles never heard of using them for apps. 

Yeah it’s been in the product for ages, I’ve only used it on rare occasions and it’s only really good for mounting a read-only VHD that contains files and folders - it’s nothing like AppAttach for instance.

Look in the Rules editor and look at the App Container rule

Yes all our business apps stack + small apps (ControlUp agent for example) are installed dynamically at boot time, PVS house. End of the process, a file is created when successful and monitor in Nagios. It is a work of beauty in vbs + .ini working now for years and use to run multiple environment of our business apps.

Willing to share an example? Ping  <@ULJ3D468M> 

<@U011FR9G8LS> tested this yesterday i believe and confirmed 2x2 is working .  we applied the policy to a few of us as well but have not had a chance to test yet.   I may have a chance this morning. i'm curious how it handles meetings w/ more than 4 people for the grid

The extra folks end up grouped down in the bottom right, just above the call control bar, or whatever it's called

i mean how aggressively it would promote them up to the 2x2 grid .....before this when we just had the speaker view if you had multiple people talking it could get a little crazy flipping around

Ah, yeah. I'll keep an eye on it. It's not *too* bad, but this meeting is fairly quiet. Same people speaking too.

Thats so cool. <@URVNXB96C> What polices did you apply just curious?

Well, got to give them credit. Finally listened to us. Now if they can add more GPO options that would be cool.

Yeah, so far. Says it's HDX optimized. No video on this call, just video

I'm using RemotePC, as opposed to a virtual desktop though

<@ULLH5JGFR> i actually wasnt the one that applied the policy on my end but i'll see what i can find

I created a custom Teams Update policy, and flipped the 'preview channel' part on. Then applied it to users individually. Tried doing it to an AD group, that part still needs work. You can apply other Teams policies to groups, just not update ones, apparently.

once you sign out /in after you apply it you need to go to About the flip over to the Preview Channel manually (at least we did)

I am reading all the docs. Is there a new installer, or its all policy based. Sorry for asking, But I can go read so you guys dont have to keep explaining it.

Same installer, I believe. Just make sure you're up-to-date.

the more questions/answers we get here the better for everyone i say!