World of EUC

image.png

Set the default brower on the session host to something other than Edge

Hi James, we want to open the URL in Edge. Do I need to force Edge as the default browser?

Oh right :slightly_smiling_face: It definitely sounds like it isn't finding the right association, that I'd say. Might be worth a try

Maybe the command wants to open the URL with the old Edge instead of the Chromium Edge. Which one do you use?

We have Chromium Edge installed. Works fine on my laptop, just not in Citrix.

(UWP) Edge isn't available on Server 2016. Which is the version of Edge you're trying to start with that association. On supported operating systems UWP Edge probably just starts Chromium edge, if available. Hence why it works on your laptop.

<https://superuser.com/a/1322286>

Ok so the protocol handler "microsoft-edge:" opens the UWP version of Edge. Got it.
The app would need to be modified to call Edge a different way on server 2016, correct?

I used a tool from Nirsoft, URLProtocolView, to double confirm that Server OS doesn't have the microsoft-edge: protocol handler built in. The application configuration was updated to use "msedge URL' instead which works fine. Thx all.

I have never tried it, but it should be possible to assign a specific type of license to a delivery group.
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/licensing/multi-type-licensing.html>

No: You cannot mix and match editions in the same site. For example, Premium and Advanced licenses. Multiple sites are required if you have licenses with different editions.

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/licensing/multi-type-licensing.html>

<https://support.citrix.com/article/CTX223926>

<@U0158E1NUGH> going through the documentation, I see that <@U0135QWMQAG> is right. You can only mix license models within the same type as configured on site level.

You need to reset the start number: <https://support.citrix.com/article/CTX217233?_ga=2.132403854.1634845943.1610962332-496864846.1580392699>

Assuming you deleted the #12, reset count to 12 but #13 #14 #15 still exist, will it create #12 and jump to #16 without any issue/error?
I was always afraid of this, thus never reset count when I was in such situation.

Have a sort of web based app that has a local component that won't launch without an explorer.exe process running on the server. May not be the same thing, but something to check. If you can publish an explorer.exe process in the session does it make any difference?  For my app, I just created a login script that applies to users that have the application that launches an explorer.exe process for them, and that process runs silently in the background and doesn't even hold the session open when other apps are closed.

i was thinking of doing something like this as it seems to be the most obvious difference between the app/desktop. Gonna try it now. I think i can achieve the same thing with this - <https://support.citrix.com/article/CTX236485>

That might be a better solution that what I did too. Mine is working for my current needs so not going to change it now. :slightly_smiling_face:

It’s a known issue: <https://support.citrix.com/article/CTX289547>

I saw that article, but I am running the LTSR. Does this issue apply to all versions of the WSA?

Ah, OK! That’s indeed very weird! This is not a known issue for the LTSR release!

Hey <@UTA8SF465> have you also got your updates restricted to LTSR only?

So we figured it out to only be impacting people who installed on personal devices or devices that the help desk uninstalled and reinstalled from <http://receiver.citrix.com|receiver.citrix.com>. We tend to stick to LTSR branches

<https://carlwebster.com/citrix-xenapp-xendesktop-7-8-documentation-script-update-version-2-38/>

<https://carlwebster.com/citrix-virtual-apps-and-desktops-documentation-script-v3-21/>

Thanks, James. I have a smaller customer (about 200 seats) where I was able to get some pre/post teams stats on CPU... they run about 10 - 12 sessions per host (CVAD 2009) and it looks to be about 10 - 15% uptick in CPU... this is aggregated data over a month or so, I haven't looked at login/launch spikes etc... are you getting much success with that launch in background (post initial login), doesn't graft for me... cheers

You mean the auto launch from HKCU isn't working?

auto launch is working but it pops the app opened, I was trying to get it to open in the background / tasktray...

I'll revisit this one... they need the client updated anyway :slightly_smiling_face: I'll let you know if Ive done something daft

Did you use the switches on the entry that launches it?
```--process-start-args "--system-initiated"```


I found this article that talks about disabling specific client drive mappings from enumerating within the ICA session <https://support.citrix.com/article/CTX135999>

It's done with a registry setting on the endpoint, and a non-separated list of drive letters is used to limit which drives are disabled between the endpoint and VDA, if I'm interpreting it correctly.  However, it doesn't appear to be working for us, and I'm wondering if it's because we're using the Workspace App and not Receiver 14.x, which the article cites specifically.

The Studio policies aren't very flexible, I've contacted support and they provided the CTX135999 article as the only potential solution, and stated that it's not possible to accomplish what we're after with the existing feature set.  So I'm wondering if I've overlooked or am unaware of an option that would allow us to prevent all but a single specific drive from mapping into the session?

Just to provide an update in case anyone else runs into this - we were able to get this to work after all using the reg entry to "hide drives" - which for us was 25 of 26 letters in a non comma separated string.  We had to also change another setting in the registry "NativeDriveMapping" from false to true as outlined in <https://support.citrix.com/article/CTX239029>

Not sure why yet, as I'd not encountered that setting or issue before, but it did allow us to mask 25 possible drive letters down to the single one we wished to pass through into the 3rd party's session.

Maybe you can find through the Monitor API? <https://developer-docs.citrix.com/projects/monitor-service-odata-api/en/latest/>

Early testing. Backend is CU6.

Today's bug discovery is the WEM client install. Have not had an opportunity to focus on investigating.

Zoom works though out of Bluejeanes, Teams, WebEx on double hop

Second hop offloads onto the first seemingly, causing all sorts of fun

That's what I figured. Given that this is healthcare, I imagine it would be even worse for us if the audio and video were trash.

If it helps, this was my immediate reaction when I was asked:

Lets me guess some manager said hey I have a :bulb:. Lets do this. Lmao

My manager is awesome. This was a requirement from a doctor (who has a lot of pull). I could see IGEL/thin clients being scrapped if it holds.

Ahh Docs. Yea I remember that. I worked for boorland clinic and they had more say so that most people.

What are you wanting in terms of HA? That’ll dictate what you need

if you just want external access to storefront, you can front it with a single gateway

without needing to make another store, you could just enable external access ont he existing one

for an environment that small, it would make sense just to use a single VPX, but again depends on what you need in terms of HA and how long the environment can afford to be down

they want to depend only on the hypervisor to provide HA, so nothing is redundant.  They are fine with outages that can be recovered in 4 hrs, it is quite intermittent use

yeah, you can do a single gateway to a signle storefront sever with a single store in that case

OK, that's what i will look into - thanks much

To have minimum infra I would recommend to use cloud option.

We did have that dicussion, latency to their backend app for when it is used killed it.

thank goodness someone does, feeling it this week :slightly_smiling_face:

You can have VDAs on premises while the control plane (including gateway service) will be in the Citrix Cloud.

<@ULHA2NPPX> Where is the "me too" emoji here? :older_man:

That would be an option, I'd have to see if their ancient thin clients can handle it.  I am bringing them from 6.5 /dedciated ica files etc.

I would say, if they can handle the onprem Storefront+Gateway they can do it with the cloud version as well.

I kind of inherited what someone else sold, and now need to make it go.  I know that NEVER happens to others but......such is the way of the world

Feedback from my local Citrix contact:
"I know this is a huge PITA but I can tell you that internally they are not going to change it. We had SIGNIFICANT abuse of this in 2020, way more than you would think, and they are taking a legacy view of it, that its not worth spending money to build a better system when we want everyone in the cloud anyway.

If you agree to link the license server to the cloud they will allow you to forego the legal process I believe, making it a bit quicker, but you are going to have add this into your planning that moving a license server will require this legal process and interaction with Customer Service.

Sorry mate, I will pass the feedback up – but we have had significant pushback already and they have been pretty determined about it."

I had to re-assign for a migration, honestly, support was really re-active (for once), I got my .lic less than half a day after my request.
But I agree, this is annoying.

If it's any consolation, we aren't exempt from this either and didn't get any advance warning. Biggest recommendation I can give from the networking side is to strongly consider using ADM service for licensing of anything that's software (VPX/CPX/BLX/Pooled capacity). ADM service express is free to everyone and lets you swap licenses around all you want without having to return/reallocate.

They don't make it easy working with Citrix products in our lab.

they don't want you working with and testing there on prem products it seems anymore :slightly_smiling_face: piss every on prem customer off so they move to CVAD service in Citrix cloud so they can make more $$$

I know, it is all about $ now :pensive: And there is no way to test Cloud for free like we can with a lab. They don't want us to learn their products anymore or you have to pay big $ - Knowledge is not free with Citrix anymore, shame.

not to mention the CVADS and NS Gateway service basically makes complex on prem designs, on prem installations, upgrades to existing on prem citrix infras a thing of the past we will all be out of jobs in a couple years lol as long as you can install a cloud connector and install a VDA on a VM in your resource location you will be good lol

Indeed, Techs is an eternal cycle, like Mode, on-prems will be back under a different shape. People with on-prems skills will always be on-demand as everyone else is moving to the Cloud and become a wizard Guru (no offense there, we're just lazy by nature ;)). But I still think that our job will disappear or change drastically because IA, automation. It's time to skills up in different areas if you want to stay in this job like security, IA, etc. but still keeping on-prems skills sharp. The future is uncertain.

do you know how it compares to crowdstrike?

<@UR9T47CRM> is it non-persistent devices?

I am going through this doc now, Anything else you ran into that is any gotchas? How is the performance as well?
 <https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi>

It looks straight fowared to me. For single entry for each device would be my non Presistent VDI devices, and For multiple entries for each device would be the XA(RDSH) Devices. This is all assumption still at this point.

<@UR9T47CRM> Let me know from experience if I am wrong if that ok with you man.

Yes it‘s straight forward. No problems :sweat_smile:

we are just starting the process of moving from Cylance to Defender too so i'll be going down the same path as you here. (persistent in our case though)

No issues from my deployments - follow the on boarding guide and good to go - obviously you need to configure defender to not belt your images, but ATP is simple enough 

do you guys still optimize these setting with CTX optimizer? I would think so being the are schedule task and not needed on non-persistent machines
Windows Defender Cache Maintenace
	Windows Defender Cleanup
	WIndows Defender SCheduled Scan
	Windows Defender  Verification

Hey guys QQ, Do you guys use the VDI onboarding way as well for W2K16 XenApp servers that are PVS provisioned as well? I see another option that is for servers, but I am not 100% on how that works for non-presistent Server based situations. I have ideas, but wanted to get some feedback on this.

Still on 1909 thanks to some XenServer agent issues in my build with 20H2.

thanks man.   now that they no longer give "business ready" classification i'm curious how everyone looks a the may/october patches (jump to them right away, only do the may or october, etc)

We're only doing the fall updates (20H2 in this case) because of the extended support.

kind of what i was thinking too to stick w/ the octobers in case we get slammed and want to stick on a build for a little longer.  other than your xenserver issues any other citrix related hurdles that would stop you from jumping on 20H2?

The only other requirement for us is a Trend Micro server upgrade (for 20H2 support). Everything else is good to go.

We are on 2009 (20H2) for 70/400 running on XenServer 8.2, it works well so far. We are replacing our current 1809 VMs. Even if Symantec doesn't officilly support it as not release at the time of the build, it works fine.

nice thanks guys!   for anyone running persistent whats your preferred update method? i'm using pdq deploy and an update package that works pretty well but takes about an hour per desktop (can do in bulk ) so figured i'd see if anyone has any time saving tips.  thinking not since its microsoft we're dealing with here :slightly_smiling_face:

We created our own PowerShell script to update our persistent VMs apps, it is not perfect but it does a good job for free and minimum effort.

cool ya pdq is minimal effort too but just wish that first reboot after the background upgrade would not be so stretched out.  usually i'll just schedule it for off hours but if one fails its a scramble to restore from backup

yes I heard good things about pdq, maybe that's something you can fix.

ya you can do a lot of cool steps with it and the initial upgrade is pretty seamless and silent and you can control it to reboot and wait after that step.  just would be nice if MS could make the entire upgrade complete in the first step so the reboot isnt so painful after

oh you upgrade to latest Windows 10 with pdq. We are giving a brand new 2009 with 2 weeks to migrate from 1809 and a process to ease the migration.

Business/enterprises should stick to the H2 releases for 30-months support and the fact that they are essentially the H1 release + 9months of stability and other fixes

awesome thanks everyone! the 100 or so vm's that we have currently on 1903 i was waffling between bumping them to 1909 to match the rest of if its just smarter to jump to 20H2  (if its stable enough) since we'd get there eventually

Hi Guys, hope you doin well. An customer asked me to adjust the language in appsilos. Is there an easy way to let the user define the language in the app silo (different from the ,,first" published Desktop. Right now, i only use an gpo with PS-Skript to set static with groups.

We redirect the desktop to a file share, and control access with ABE. No users are able to save anything to desktop, and we still control shortcuts (not through WEM, directly).

We're using OneDrive and Known Folder Move. That way, saving on the desktop is really saving to OneDrive.

I used to do this <https://www.htguk.com/creating-locked-down-windows-2008-r2/>

But now I'd go for OneDrive and KFM, if you can get away with it

Thanks gents. OneDrive a no-go at the moment due to the storage impact without files on-demand on server 2016. So gonna look at your method <@UL5TCSW3D> Trying to get my head around what permissions i need on the file share to achieve it.

i used to use a script that i used to run via Appsense EM Timeout /T 10

if %username%==administrator goto END


Icacls c:\Users\%username%\Desktop /deny %username%:(WD,AD,DC)
Echo Security applied
Exit
:END

I am not sure i can do it with WEM because WEM looks like it needs write permissions for the user to place the shortcuts.

<https://carlwebster.com/citrix-cloud-documentation-script-v1-11/>

<https://carlwebster.com/citrix-xenapp-xendesktop-7-x-documentation-script-update-version-1-46/>

<https://carlwebster.com/citrix-xenapp-xendesktop-7-8-documentation-script-update-version-2-39/>

<https://carlwebster.com/citrix-virtual-apps-and-desktops-documentation-script-v3-22/>

status unavailable usually means something like hypervisor cannot be reached by the broker.

Have you gone into the vcsa console and verified the services. I am still on 6.7 so I will assume the console is still accessed via 5480.

Have you restarted the vcsa and waiting the obligatory 20 minutes for all the services to start?

test the hosting connection in studio and see if there is any errors ? try restarting the citrix host service/broker service on DDC's, make sure you got connectivity to vcenter ping the vcenter fqdn telnet to vcenter port 443 from DDCs, check thumbprint of vcenter cert as well

Thanks all, the complete environment is automatically built as code (upcoming Automation Master Class). I've disabled the auto creating of the connector to see if there might be some bug. Problem John, when offline, its not possible to run tests.

Yes, the cert is automatically downloaded from the VCSA and imported. Just created a connection, and it did not ask about cert, which means its in the store. Still same issue and unable to run test. Funny thing I just see this on Lab1, on Lab2 its working!

Solved, thanks all. The License server was showing lics, but the license server name was empty. The Application Event Logs helped me find the issue

I have a strange issue, looking for ideas before opening a case. After some days, Interactive Session metrics reported by Director becomes inaccurate or fancy. On some VDAs Citrix Profile Management event 1000 is not getting generated and DesktopReady is not updated on WMI root\citrix\profiles\metrics. After restarting Winmgmt and BrokerAgent everything is back and running.

Private fix is available for session freezing on Snipping Tool after CursorShapeChangeMinInterval is set following CVADHELP-12886, please let me know if you need case details.

Hi everyone,
Does someone know what exactly allows the "Allow pass-through authentication for all ICA connections" policy? (It's represented by LegacyLocalUserNameAndPassword registry key).
Every passthrough manual recommends to enable it, but it seems that it is not necessary.
What exactly will not work with this policy disabled? Old Receiver? Old XenApp? Old end-user?

check this link in section Limitations. <https://docs.microsoft.com/en-us/microsoftteams/teams-for-vdi#known-issues-and-limitations|https://docs.microsoft.com/en-us/microsoftteams/teams-for-vdi#known-issues-and-limitations>

i know the limitations, my question was that there are more functions without redirections, when using the teams client, but for sure with bader experience in conferencing

Oh ok sorry then I misunderstood. I think you will not have more features if you use the machine wide installer

I use the machine wide installer, but without optimization i can share single applications. With optimization just the default screen like the limitations list descriped

optimizations limit the feature set to what the web version has essentially

We are having similar problems in our environment with VDA 1912 CU2 on Server 2016. This occurs on clients that are Windows, Mac, and Linux (IGEL), across different WSA versions. Sometimes a few users on a VDA will experience this, while others on the VDA will not. We also have problems accessing meetings, or randomly getting booted from meetings, or have all audio / video suddenly stop.

Thanks, Tim - yeah, this is a new build in pilot.. very random. Ive tried a few different client versions... this one is running Citrix Cloud, latest VDA (in azure) , cheers

<@ULHA2PS2H> - out of interest, are you using the fallback policy? cheers

Do the users also get the "sorry, we couldn't connect you" messages? We have similar issues with Teams. When the issue occur the Websocketagent.exe is not running anymore for users (user-proces). Still no solution to fix it.

Yeah, seen a few of them, Brian... very annoying...

We are not using the fallback policy, and yes, we get those messages. Also have problems with Websocketagent.exe. I would like to understand why it works so well for some organizations, and not ours...what is the commonality?

No proxy or strict network config in my current customer with the issue... cheers

<@U011KNA2PRT> - to elaborate on my last comment, we only have a small number of VDA's (at this stage) hosted in Azure going out via Azure's default route (No 3rd part appliance or proxy). Anything related to Teams/MS services is allowed in/out... this is the first time I've had so many report on issues, previous deployments didn't have such a focus on Team nor did I force the fallback option... I'm starting to think it might just be flakey with x amount of connection/HDX optimization failures being typical (the more a read and get feedback), cheers

We just updated machine installer to latest in our Test environment last night, will be testing that today. We also had some old SfrHook keys set in registry (necessary for Electron apps), and we removed those. Hopefully performance is better today.

Nope. Still have wonky random garbage happening. Had 3 Teams meetings today, only 1 worked. Had to exit (not log off) Teams for the other 2 to work correctly.

Disappointing that the issue isn't solved... I contact Citrix support about the issues we encountered with Teams. Still no solution from their side.

Did they at least acknowledge that it's a problem?

They didn't acknowledge but say "We see more reported issues of the same".

I'm just curious: For the people who got Teams problems: do you use Citrix WEM CPU/Memory or I/O management (our other product)?  Maybe this have negative impact on the Teams and WebSocketAgent.exe processes?

We use WEM, only with CPU management. Teams / WebSocketAgent are excluded from the list of processes.

Interesting... WEM in in place but nothing relating to Teams is excluded.. cheers

I thought it maybe was related to WEM, because we don't have any teams/websockagent exclusions. But you already have those exclusions, so this couldn't be the issue. 
Citrix support says that some issues with Teams redirection and Websockagent.exe are resolved in version CR 2012 VDA. (And in future inb 1912 LTSR Cu3). They pointing to CVADHELP-15611.

Interesting...so now we need an update. Thanks Brian. Hopefully it drops soon...

Mmm the one Ive had the issues with that prompted me to post on here is running 2012, cheers

Are you using vGPU? Any other optimizations (Skype, Jabber, Zoom, etc.)? What are your underlying hosts / hypervisors?

We use nVidia Grid K2s (they're old, I know), optimizations for everything under the sun (Skype, Zoom, Jabber, WebEx, Teams, etc.). Underlying hosts are HP Blades running Citrix Hypervisor 7.1 LTSR (last supported version for the K2s).

Found a document over on the IGEL slack community that indicates multi-stream ICA should be configured for Teams optimization in Citrix. That's one I haven't seen before...and I know we do not have that enabled.

Today my Teams crashed during a meeting, and will not reconnect to HDX. Disconnected my session (yes, not logged off), rebooted my TC, reconnect session, restart Teams, Citrix HDX Not Connected. Made sure that when Teams is exited that both Teams.exe and WebSocketAgent.exe are fully terminated. Looks like I'll have to log off / back on for Teams to work today.

We also using Jabber (optimization). We used our internal cloud solution to host the VDA-servers. Based on Vmware.  We performed an update to VDA 2012 on our test-server, still waiting on test result. Also version 2102 of the Workspace App does have some Teams improvement. Anybody tried this version already?

try the latest workspace as a test. I am wondering if it will make things a little better

I understand Citrix is releasing workspace alot, but I know its because they are trying to address all this issue we have. Some may think it crazy, but if you think about it, they are trying to really help us.

I have been looking over the troubleshooting Doc.
<https://support.citrix.com/article/CTX253754>
• 11/15/2020: VDA 1912 LTSR CU2 released, including important fixes for bugs causing Teams to load unoptimized . See <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/1912-ltsr/whats-new/cumulative-update-2/fixed-issues.html|Release notes>.
• In Windows 10 VDAs, disconnecting from a session by using the tsdiscon.exe Microsoft utility (as described in CTX225970 option#2) will cause Teams to load un-optimized when reconnecting to the session. We recommend using the Desktop Viewer toolbar for disconnecting.
So many things to keep up with :disappointed:

We've opened a ticket with both Citrix and MS to see if we can track this down. So frustrating! I just wish it worked as well as Skype Optimization.

I know man, I think it will get there soon. MS keeps pumping so much into Teams. I feel like Citrix is trying to keep up with them.

Yeah, the problem is that we need it working now. We have critical meetings with external organizations that use Teams, Zoom, WebEx, etc, and getting them all to work well within our CVAD environment is painful.

<@UR99U4W0Y> Do you do any optimization of your image? I'm wondering if this has something to do with that? We use Citrix Optimizer with some additional items we've gleaned over the years. Oh, we're also running our image on PVS, if that makes any difference.

<@UR99U4W0Y> Are you using FSLogix? If so, are you splitting profile and ODFC? I wonder if this has to do with that. We are going to investigate moving Teams into profile from ODFC.

<@ULHA2PS2H> - Missed your last few messages... the deployment in question is running in Azure, FSLogix Profile and Office container (Teams is captured by ODFC with some exclusions/redirections) ... from an optimzation perspective there is WEM for CPU/Mem and BIS-F  to seal the image (Running Citrix optimizer), cheers

I'm wondering if it's related to Teams in the ODFC, as exclusions only work on Profiles...

This may be it? "Teams is captured by ODFC" As you guys know the exclusions for Teams don't apply when it's handled by ODFC. I cant image why that would cause it to function differently though.

Another item which may be impacting this - we are running on Windows Server 2016 1607 (Long Term Servicing Channel), so maybe it has to do with that vs. SAC? What Windows versions are you using?

We just can't catch a break with this problem! Now, once it stops working in a session, even if we restart Teams, we get the "There's a problem with your connection. Still connecting to remote devices. Calling isn't available yet." We have to log off and get back on to a different desktop.

Moved Teams back to profile VHDX from ODFC. Seems to be working better. Only caveat is that I'm the only person on this VDA, so that could also be a factor.

Still having problems with this after moving Teams from ODFC into profile. Why can't this work as well as Skype RTME / RTOP? Any other things to try?