World of EUC

Hi Guys, anyone is having issue with HDX RealTime Media Engine for Microsoft Skype 2.9 CU2? Users on our Thinclient cannot connect and some users from Windows complaining they are not able to answer to a call or even initiate on... Forced to revert to 2.8.

image.png

As I understand it, FAS has nothing to do with passwords. It simply gets the SAML token and makes it a certificate for the login. The only one that gets the password change is the Azure AD or the local AD if you log in with username password.

Thanks, Manuel. That's how I understand it too... it looks like it passes the token/smartcard but as the account is set in AD to be changed it fails to show the password update/confirm option, cheers

This won't be related to FAS. How much time has elapsed since the password change and the user attempting to sign-in?

The customer will need to align AD and Azure AD password policies - these things are different. <https://docs.microsoft.com/en-us/microsoft-365/admin/manage/set-password-expiration-policy?view=o365-worldwide|Set the password expiration policy for your organization - Microsoft 365 admin | Microsoft Docs>

Better yet, implement MFA, Azure AD Password Protection and disable password expiration, but that won't help you today of course

Thanks, Aaron. This is not a major drama at the moment. Just keen to know whats expected... the initial feedback was they have to use their old password for the gateway... I explained that was due to the change not syncing (yet)  via AD Connect to AAD...  I did get the same issue following a successful sync - I'll have a read at the doc... the customer in question does have an up and coming project to consolidate and tidy up lots of overlap in services between Azure / on-prem so this might fit in nicely :slightly_smiling_face:

With regard to my test... I done a reset and checked 'change PW on next logon' , I auth'd via Azure AD using the new PW (so it had successfully sync'd via AD Connect), I then got the message telling me the PW had expired and needed to be updated (again, this is good and expected), when I click 'Ok' it hangs and bombs out after about a minute... while I wait the only option is 'cancel;' as per the screen grab.. cheers

On prem AD is expecting a reset to occur. You ticked the box telling it so... azure AD doesn’t abide by that tick box. Your password as it stands is syncd and thus works in AzureAD, you are then passing a saml request to FAS, getting a cert for the user based on that request, the VDA is trying to auth the account with that cert which will fail, as the account is pending a password reset :grimacing: untick the box!

Yes, it will detect the largest smallest needed size among all the different components.
So if you have 1000-1150-950-1450 Bytes on the different components, it should use max MTU 950

I have to do monitoring for EDT to EDT Lossy switches. Does HDX Insight in NS MAS monitor switching?

I know it tracks TCP vs UDP as a counter, but I don't know offhand if that's something you can compare over an aggregate timeline.

Hey <@ULL7R5KT6>. That doesn't sound right. Could you provide some details on the environment? (VDA version, CWA version and platform, are you using Gateway, etc)

Cisco VPN Client (connection from user to company - we don’t use NS / NSG)

VDA 1912 CU1, Workspace App different versions (BYOD). It’s connection to Citrix Remote PC (physical PC’s with Windows <tel:10 17763.1577|10 17763.1577>) 

<@U01067Q2QUV> Did you try to test how works EDT with situation when trying to switch to TCP and communication via TCP is not possible? 

Do we have communion check via TCP before switching from UDP to TCP?

Hey Arthur. Thanks for your patience. We currently don't switch from EDT to TCP. If the session is successfully established with EDT, then it sticks with EDT

When using Loss Tolerant mode, the graphics virtual channel will switch between EDT and EDT Lossy based on latency and loss, but never TCP

Thanks. I hat can be the reason from UDP to TCP ? :thinking_face:

Do I understand correctly that you hadn't enabled the MTU discovery? 
If so, this is why MTU discovery is there. 
For non MTU discovery scenarios you need to set the MTU size manually, see:
<https://support.citrix.com/article/CTX231821|https://support.citrix.com/article/CTX231821>

You can combine this with MTU discovery so that Linux or Mac clients use this manual set value as they don't support MTU discovery. For Windows endpoints who do support it, the values in default ica are ignored

Lack of MTU discovery should not generate such issues. It should generate packets performance impact (because of packets fragmentation). Not sure why it’s generating “back screen” however it “know issue” as we are using Cisco VPN client.

Thanks for your support. :+1::+1::+1:

Well, to be honest, that's more a protocol (UDP) issue then an Citrix issue.
This is the reason why MTU Discovery was added, without it UDP can't check on fragmentation etc. So it's hard to adapt on these situations.
I can imagine that the Cisco VPN Client has a very low MTU (I see &lt;1200 bytes often).

Off topic, some may see difference. But all honesty, I have seen much savings in UPD edt side of the house. But then again my ISP is good. Seems like udp edt is more of a headache for people just looking to check a box and get it working. Many seem to not understand the tweaks around it to fine tune it.

<@ULCBDG9MF> Does this ring a bell? :arrow_up:

<@UM8ML9HPY> you can take a look at your IIS log and see if there is any configuration issues at IIS.

I patched a few servers on Friday and not seeing this in my environment currently.

I assume that in the Application log and just curious, what's the event ID?  I did a search on the error code on a few servers. My VDAs are mixed 1912 CU1 and CU2.

I have checked logs on:
1912 CU1 - 2012R2 and 2016
1912 CU2 - 2012R2, 2016 and 2019

I don't have a patched 2019 server with CU1.

Also getting stacks of these in the system log

Don't have a dwminit on 2012R2 or 2016 servers...2019 has that source.

Not much help since I don't have a 2019 patched server on CU1, but I'm very interested in this and I may see if I can find one to get patched urgently.

Really? I could have sworn I was on Server 2016....

That's interesting that I don't have dwminit on my 2016 servers...

Or, I'm stupid and confusing my servers. I found it on one now.

&lt;wipes brow after questioning sanity&gt;

No event's for dwminit on 2016 - 1912 CU1.

Similar feel to that Chrome issue a while back?

Rendering of hidden area optimisation stuff-up.  They failed to take into account multi-session, and whenever any user session was locked (e.g form screensaver), whole lot (on that server) would go blank (or logoff maybe).

Ah no, I'm conflating the white screen issue with something else that was triggering session logoff.  <https://www.theregister.com/2019/11/15/chromium_silent_experiment_breaks_citrix_and_more/>

Interesting a lot of Google hits for similar stuff relate to graphics drivers.  Those GPU servers?

They have GPU, but they're not being used (AFAICT)

Any agents upgraded alongside it, think we had an issue with a customer a couple of years ago where ivanti app manager was leaking memory and caused this issue. Maybe RamMap might help?

Looks like it might be WEM memory management that has something to do with this.....

What version of WEM? (curious) I have WEM memory management enabled on WEM 1912. I know that's slightly old, but I haven't seen anything to justify the need to upgrade as we only use it for CPU/Memory management.
These are my WEM settings for memory management:

Interesting. (not a big fan of most cloud services, but that's besides the point.)

Haven't seen that either, but on prem 2006 verison.

I'm seeing this with a few of our AWS VDI's... Also running WEM and memory management.

Anyone else noticed the same (CVAD 1912 LTSR CU1)

Specifics for my environment would be CVAD 1912, Server 2019 VDA w/Teams machine install.

Talking about Browser Content Redirection BCR? This only allows for offloading of web content (Linux, Windows endpoints only). Teams Optimization for ChromeOS isn’t there yet.

Thanks <@UL5TD2QM9> - I had originally spaced the official name for it (Teams HDX Optimization). That is basically what I had found.

BCR is of interest for us as well, but for another app.

Thanks again for the confirmation!

End Fullscreen, drag the Receiver/WorkspaceApp window across all monitors and maximize Again. It should take the full space of all monitors. Not sure about different resolutions though.
Is the laptop monitor set to DPI Scaling 125 or 150 percent?

Thanks mate - If I change the laptop from 150% (Recommended) to 100% it works as required for Citrix sessions... but! It leaves the laptop painfully small scale... I'm not sure if theres a way to set that change while using Citrix so its set as required when using the the laptop and using Citrix, cheers

Yep. Good old DPI scaling. I think you can change this in compatibility settings John.

According to Citrix it should work with different DPI settings. <https://support.citrix.com/article/CTX202319>

Never had luck with it though

Cheers, lads. Will give this a go :slightly_smiling_face:

We have this issues, set workspace to use high resolution on the advance setting as another workaround. Other than that DPI setting need to match across all monitors in my experience.

<https://support.citrix.com/article/CTX230017|https://support.citrix.com/article/CTX230017>

Image from iOS.jpg

Why is it that every time I add a FAS server in Azure my FAS breaks. Not even in the GPO anymore. Just deleted everything in Azure. Is there somewhere else we need to clean up?

what method did you use to secure the ra key and user keys?

Add a persistent disk, configure the dump to use that disk?

I have persistent disk but I need to grab content of existing machine

<https://forums.ivanti.com/s/article/Collecting-a-Memory-Dump-from-a-VMWare-machine-for-use-with-WinDbg?language=en_US|https://forums.ivanti.com/s/article/Collecting-a-Memory-Dump-from-a-VMWare-machine-for-use-with-WinDbg?language=en_US>

Thanks <@ULNFS3KF0> the vmss file is very small. is that normal?

Thats depends on your VM RAM sizing but it seems weird

Strange issue. Some kind of A/V / Web-Protection in place at the Client side?

Is an ICA file even generated/downloaded? Check the STAs at the Gateway vServer and the Ports from NetScaler SNIP to VDA.

I had the same issue last week, and for some wierd reason a failover of the netscalers solved it. When I tried to check the logs on the netscaler most of them stated that they were to big to open, but after a failover everything worked perfectly again, and has been working for a week

Not that this is the issue, Do you have session Reliability check on the NetScaler side? Just in case a NS did failover.

To me is sound the there is a time out when brokering the desktop from the Netscaler (STA) to the DDC. We have this at times, and I tell the service desktop to exit workspace and re-open it up. Almost like workspace app get confused and uses a old cached ICA file. It doesnt make sence to me why it happnes.

In this case, it's a single Netscaler Appliance.
No cluster or HA pair

it wont be the STA if you don't get the .ica file downloaded the STA's are only checked by the Netscaler when the workspace client connects to the NS GW (sslproxyhost) specified in the ica file once it is downloaded. Prior to this During desktop launch (user clicks the desktop) the netscaler will pass the launch request to SF which will then send the request to the DDC via XML the DDC will query the SQL DB to find a suitable host (vda) to fulfil the request, The DDC then sends this info about the VDA back to SF, SF will then speak to the DDC to request a STA ticket, SF will build a launch.ica file with the STA info in and pass this back trough SF&gt;NS GW  channel so this is where it is failing. I am surprised you don't see anything in the application logs on the DDC's you checked them all on all DDC's ? are the VDA's within this DG powered on and registered and not in MM ? to rule out a client issue you reset workspace app and uninstalled/reinstalled ? i would say to do a packet capture using nstcpdump or nstrace but if you are not getting the .ica file it wont show nothing

What version of ADC/Netscaler are you running?

I think one of my customers has the same problem, I will ask for more information.

Thank you, Dennis! It's causing our providers to refuse to use thin clients right now.

What version of Receiver / WSA are you using inside the first hop? I think we had a similar problem...

Every one available - 1810, 1912, 2004, 2010, and 2012. Same issue with every one of them. Found one thread in IGEL's Slack, but no resolution.

Well, some said they changed the default cursor on the XA servers, but that won't fly here.

Our Citrix contact confirmed that it's a known issue in Linux CWA, and that the registry workaround I found is their solution for now... lol. Ugh.

The issue has apparently been around since Receiver 4.9 CU3.

And, in case somebody actually comes across it, setting *ica.wfclient.cursorstipple*  (IGEL profile &gt; registry) to *solid black* makes it look normal after applying that registry fix on the VDA.

Thanks Nick! I just upgraded a client to 1912 LTSR and ran into this exact issue. I applied the registry key on the VDA as well as the IGEL. Fixed!

Just use my script.
<https://github.com/JonathanPitre/Apps/tree/master/Oracle/Java|https://github.com/JonathanPitre/Apps/tree/master/Oracle/Java>

It's not about installing Java, it's about not having that trash in my desktop at all...

if some legacy app needs it what choice do you have ?

I've tried AdoptOpenJDK with IceTeaWeb and some JNLP app won't work at all

App-V will break more than just java if it's not done right

The app owner is telling us that the console runs slow, on his brand new i5 powered HP devices. He seems to think that it will run better on Citrix.

Most of our published apps are in App-V. So far, it has been fine.

on rds/citrix some java parameter must be change to provide a better performance

I'm just not interested in adding this to my image for a handful of users, and then dealing with Java requirements that are years old.

I'm just trying to help you here pal, if you're client needs it, you're job is to make it work the best possible way :smile:

Oh, I think I'd be in a much different scenario is I were a consultant. :slightly_smiling_face:

<http://Turbo.net|Turbo.net>? They can do Java and app sequencing as well...and it's completely sandboxed.

Are they willing to pay? What I’ve heard the EULA is crazy. Heard that Norways biggest oil company is paying $1 million in lic for 1 app!

<@ULDHJB8BB> Are there any parameters you can share, our main business app is Java based and we are already doing some tuning

it's all done automatically using my script and I documented it.
<https://github.com/JonathanPitre/Apps/blob/master/Oracle/Java/Install.ps1>

Ensure to download the Config folder as well since the deployment.config contains all the required settings.
<https://github.com/JonathanPitre/Apps/tree/master/Oracle/Java/Config>

this can be done via GPO as well
```# Fix javaws.exe performance over RDP/HDX <https://communities.bmc.com/thread/111844?start=0&amp;tstart=0> <https://www.rgagnon.com/javadetails/java-set-java-properties-system-wide.html>    [System.Environment]::SetEnvironmentVariable('JAVAWS_VM_ARGS', '-Dsun.java2d.noddraw=true', [System.EnvironmentVariableTarget]::Machine)```
this is the only way to truly disable the outdated version warnings
```# Disable "Java version is out of date" message <https://www.wincert.net/microsoft-windows/disable-java-version-is-out-of-date-message>    [System.Environment]::SetEnvironmentVariable('deployment.expiration.check.enabled', 'false', [System.EnvironmentVariableTarget]::Machine)    Write-Log -Message "$appVendor $appName $appVersion was installed successfully!" -Severity 1 -LogType CMTrace -WriteHost $True```


Question about Local Host cache. We have 1912 CU1 but SQL express is still from previous deployment. Originally I read that you are supposed to upgrade to 2017 or LHC wont work. Now I see this: <https://www.mycugc.org/blogs/ray-davis1/2020/08/12/upgrading-or-replacing-the-sql-local-db-for-local> Has anyone tested LHC with old ver of SQL Express?

I believe <@URVNXB96C> as well is doing that

Yea I have some yea, Moving them to non-presistent

I can update the base image and it works on newly deployed device as well. For MCS persistent

yup we switched from MCS non -persistent to MCS persistent late last year.  Once deployed you obviously can't update the existing machines via Studio anymore so we let WSUS handle the Windows updates and I have some automation setup w/ PDQ deploy for software updates.   Then once a quarter i update the master image and set that as the new version for MCS to create new machines off of (via Powershell)

<@URVNXB96C> curious on why you switched? Do you power off the vms when not in use? My thing is I just can’t keep up with the app requests and we already have sccm and patchmypc doing the physical desktops. It also seems to run faster with gpo and and less ost issues and I can use uwp apps. 

That is why we got away from MCS Static. Things got out of control fast for us.

Reboots in Studio
<https://citrixadvice.blogspot.com/search/label/Citrix%20MCS%20Static%20Reboots%20in%20Studio>

Updateing  new devices Only with MCS Static
<https://citrixadvice.blogspot.com/search/label/Citrix%20Updating%20MCS%20dedicated%20Images>

<@ULHA2PS2H> Gave me a script as well from one of his Citrix admins. I used it as well.

I am still in the fence about static vs non persistent 

<@ULLH59VQF> for us, we have had a mixed setup w/ the majority being non-persistent/app layering and app dev having persistent for the longest time and anytime non persistent would have an issue leadership would immediately ask is it because its layered and non persistent? we had a lot of weird issues when we tested moving Exchange to the cloud (since we had to use ost's) w/ non persistent so all in all i partly just got tired of arguing.  the other side is they let me implement PDQ Deploy/Inventory which helped tremendously with our dev machines for app patching/deployments so while its a work in progress yet the automation options w/ that have been huge

<@ULLH5JGFR>  what script are you talking about? just to update the gold image your mcs persistent desktops use as their base? or more?

This is where the user layer would be great! Just not sure if it will just give me more issues

We used user layer a lot. It did work really well... However there was some issues with application updates, files that would get pulled into the user layer and breaking the application so there was always the question if it's a desktop/app issue or a user layer one. They do have a very useful repair utility though for elastic applications for that which can help

It does work great the majority of the time..... And may be application specific for the issues we had but usually it works be something a config file or dll that would get pulled into the user layer and mess it yup arrive ANY change to a dime will automatically pull it into there (since that's how it's designed to work).  Chrome would break fairly often when we'd update the version in the base image and then find that something changed enough while the user layer was mounted and chrome was in use so chromes program folder would now be in the UL . since anything in the UL takes presidence, that's when things would get weird

Seems that if I just put core apps in the master image then the issues might be very low. I was thinking deploy base image (office/Adobe/sap/edge) and let the UL do the rest with sccm

<@URVNXB96C>  it was just a reboot script man.

The whole user layer side piece In studio, sounds very cool. Looks like you can install software for that user on one off situations. Says it preserves users data. But just not something I ever played with to be honest. Curios if it comes of be used as a profile option?  I'll test this in my lab. I'm curious now.

I just want people to stop asking me to “update the master image” when we have the physical desktop all automated 

yup fslogix and user layer are based off the same idea but instead of just the profile , UL is ANYTHING you change (file anywhere on the  c: , registry, etc). so that part is cool but also the part that bites you in the ass most times.   So <@ULLH59VQF>,  thats pretty much how we had it too (core apps in the base image) but you have to be super careful to make sure all those apps do not update automatically or thats where things go south.  we had to clear user layers for 300 desktops one day because office pulled down some update even though we had updates disabled in 3 different areas.......one other thing to watch for with Chrome is it will do something similar (not a full update but SOMETHING in the install dir and then when you update the base and publish,  users will get the Chrome side by side error and you'll have to manually mount the user layer and clear that c:\program files\google. folder or it wont work.  honestly thats the part that got old for us and we were using UL since day 1 (and unidesk going way back before Citrix bought them).  amazing technology but just have to think totally different how you manage and support

<@ULLH5JGFR> cool thanks! any reason you dont just use reboot schedules in Studio for reboots?

We get the same thing as well. I feel like I can keep the images clean in non presistent. Presistent just seems in time to become sluggish. <@URVNXB96C>  I do now, I. posted how it did it couple lines up to share. I like having more than one way lol.

Good read though
<https://www.citrix.com/blogs/2020/01/07/citrix-app-layering-and-fslogix-profile-containers/|https://www.citrix.com/blogs/2020/01/07/citrix-app-layering-and-fslogix-profile-containers/>

If you do go down the UL path though and run into any questions for em over .... Good chance I've run into it

Nice thanks! Ya I just use the studio way because it's built in but not the quickest method so I'm always up for alternate options!

Yup that article breaks it down great. Like I said it's pretty great how it all works... Just need to get a good understanding how differently things work with it

The risk is higher if we loss the profiles. Something else to consider. 

Well depending on how you handle profiles, UL basically is your profile management (more or less fslogix on steroids) so if you run into an issue like I mentioned with an app getting pulled into the UL you either have to spend time manually cleaning that disk up, revert to a backup or clear the UL disk.. we've always used network redirects for desktop, my docs though so even when we've had to wipe they disk out we didn't lose much.

We used to use appsense personalization that really helped with that stuff too years ago

That’s a good point.  And with sccm user deployments the apps will just show up again in software center. We also use redirects. 

I do really miss elastic layers though...... So damn simple to setup once and our hello desk only had to add someone to the right AD group and done. Made new user setups pretty easy. Now we have almost everything in our persistent base and use fslogix hiding rules based off those same AD groups so almost as easy except ones we don't have in the base like acrobat standard (vs just reader that's in the base). For that I push it via pdq which is simple but haven't found as easy way to automate that deployment based off the user group like we had with elastic layers

We have patchmypc and migrating sccm to all user based deployments along with an internal app request process.  This so why I am thinking of migrating to a persistent or user layer image.  As we grow it’s too much to keep up with.  

Does Patchmypc seem better?Sccm is just bloated and I like presistent desktops for some use cases. If I can get Evergreen working all the way it will help us alot.

We are looking app flex apps by liquidware for app layering. Seems so easy

Haven’t looked at flex app. Patchmypc works in intune and sccm. They have the best repository for evergreen. We already have all The sccm deployed. <@ULJ3D468M> is testing some app attach for us using pmpc


Citrix MCS - CentOS 7.9 - VDA 2012
Hello All !
I have an issue with MCS and CentOS 7.9 with VDA 2012. Everything works on the master image but VDA inside the catalog deployed with the master snap does not register.
On those VDA, the command net ads info works wbinfo -u list users but wbinfo --krb5auth=domain\\user%password does not work; I think the problem comes from Kerberos but I can't find what I miss.

Any help will be great !

Thanks

asnp Citrix*
Get-BrokerMachine -MaxRecordCount 10000 | Where {$_.InMaintenanceMode -eq $true} | Set-BrokerMachine -InMaintenanceMode $False

I’m still on a 7.15 backend :disappointed:

Spot on with Steve's comment above. Powershell scheduled task on a ddc.

We had similar issues, and "solved" it by making the help desk accountable. Monitoring alerts when servers are in maintenance mode and anyone that puts a server in MM must email all support staff that they are putting in MM before and why and again when they take it out. (They are supposed to put in downtime in monitoring too when the put in MM so a ticket isn't generated, but that gets missed probably 50% of the time still, but we do not have servers hanging out in MM any more).

Not really... in large international companies with hundreds of offices it’s a challenge as it’s managed by different teams. I just need monitoring to find such issues where connection negotiate half-duplex

any particular reason for the multiple interfaces on servers?

Maybe you can change the network interface order to set the ica interface as first interface?
<https://docs.microsoft.com/en-us/windows-server/networking/technologies/network-subsystem/net-sub-interface-metric>

The customer has reasons for wanting the multiple interfaces (they have software they want to talk directly to services in each subnet) and I've tried to talk them out of it, a possible solution is a single interface on the Citrix server then jump via RDP to another server that has the multiple interfaces, but that's another server to manage and backup etc.
Martin I will give that a go, cheers.

It’s not related to high numbers of VDAs. Was a problem in older 7er releases, fixed in some newer releases, but back in the latest releases. I read different details about this issue. To keep it short and simple, use a script which checks after the reboot schedule and booting up the few VDAs which not powered back successfully. I‘m doing good with the script of Julian, checkout <https://citrixguyblog.com/2020/08/13/virtual-apps-and-desktops-vdas-will-remain-turned-off-after-restart-schedule/|https://citrixguyblog.com/2020/08/13/virtual-apps-and-desktops-vdas-will-remain-turned-off-after-restart-schedule/> 

Cool thanks. How many VDAs are you dealing with? What are your settings here?

I had this issue in smaller environments as well. This RegKey fixed it. <https://support.citrix.com/article/CTX214838>
Was running VSphere, not sure about SCVMM.

I've never seen a way to disable that entirely, but you should be able to control some of that access via GPO:

There's a separate policy under *Remoting client devices* that will allow you to disable the microphone.

the policys are already set, but the user can set ip manually :disappointed:

there’s a whole bunch of reg keys you can mess with but no easy way to do it

Best option for me should be to temove the entire tab or grey out

Okay to be sure, is there anything inshould activate or like that? License etc?

<https://support.citrix.com/article/CTX137939>

can you use GPO to do it? Otherwise have a look at the reg keys that those policies control

Ah, yeah, I've seen that on various blogs posts. At the risk of sounding cheap, is there a trial/free version?

I do not believe there is (I could be wrong, we have the purchased version, and have for years). We use it when we are testing new apps / hardware.

We're a non-profit, so...yes? :smiley: Depends on your definition of reasonable, I suppose.

Right? So hard to answer that question. I've learned over the years that my definition of reasonable does not always match anyone else's. It's not super expensive. We are licensed for 250 test users (logged in simultaneously), and it's less than new beefy server, per year.

there’s nothing free that is as easy to set up as loginvsi, so while there are tools that can do parts of it, it would take you ages in time to roll your own and it would be a mix of different stuff.

I haven’t found anything open source that’s aimed at logon performance, it’s all mostly around web apps.

if anyone finds anything I’d be keen to build it into our automation stuff

I found some powershell tools before we invested in LoginVSI, and those seemed to work well. Did quite a bit of the same types of testing. Let me see if I can find it...

Found it, wow, that's shocking :smiley: <http://blog.eastern.nl/2015/09/workplace-and-vdi-test-automation-with-powershell/>

Noice, thanks. I've already started harassing my boss' boss about buying something. So, we'll see :smile:

You could also look at LoadGen, which is used by Go-EUC for their load tests. <@UMVNUT9C6> could tell you more about it

UberAgent for me. easily compare A to B (after making changes for instance) startup times, process iops,cpu,ram and latency to network backend. love the tool and it free for 100 users

Oooh, nice. That's great to know, thanks <@U01M5HW3SBX>!

And thanks <@UNBRPVD4G>, I'll check that out too.

<@U01M5HW3SBX> it seems like Splunk is a requirement. Is there something you do that is different?

Actually, seems like there are other options. What's been your most tried and tested?

i always use splunk free edition has a 500mbit limit of data per day. should be enough. 5x Xenapp or 100 users should stick under 500mb

I can also show how we use LoadGen in GO-EUC and if you want more information I can get you in contact with the CTO who is always willing to help out.

That would be great. Is there something I can take a look at? What's the setup process like? Was talking with out dept this week about it. There doesn't seem to be an appetite to purchase anything until we can prove that there's an issue. Which is kind of a catch-22, but there you go. I already started looking at Uberagent (given it's free for &lt;100 users), but I'm all for looking at alternatives. Uberagent's reliance on Splunk/Elastic might be an issue, but we'll see. Appreciate your  response!

I think you can request a free trial on the website of LoadGen. There is a getting started on the support site: <https://support.loadgen.com/en/getting-started>.

I'll DM you to share some contact details.

In Receiver/Workspace client, you can type which factor you want in the second password field (i.e. push) and it will send a push notification to the enrolled device.  But it won't give you a set of buttons to choose from.

when I type password,sms i get invalid logon

do you have two fields on Workspace App for password and then MFA, or are you trying to do it through a single form box?

We have two separate fields on Receiver/Workspace App - one for the actual password, and another for the MFA option/pin

ok. something is not set up on the NS im guessing. Will need to build test VPX and play around.

Are you using the Duo authentication proxy as a RADIUS server?  Do you have a Primary and Secondary authentication policy bound to the gateway?

Yes to both. The environment has DUO proxy and two policies.

I'm not familiar with the single password/passcode field, sorry!

Citrix ADC? Do you use NFactor or primary and secondary authentication policies?

For WorkspaceApp you have to switch the policies, so that Radius is the first one as far as I know. <https://docs.citrix.com/en-us/citrix-gateway/12-1/authentication-authorization/configure-ldap-radius-with-mobile.html|https://docs.citrix.com/en-us/citrix-gateway/12-1/authentication-authorization/configure-ldap-radius-with-mobile.html>

primary and secondary authentication policies

like i said it generaly works, but only with default push method.

Yes they are fine. Radius is primary for Receiver and Secondary for web.

are you sure that the "," character is the correct separator for the password and the MFA type?

I am not. Thats what DUO instructions say. Maybe there is a way to define it

"The comma is Duo's default separator character between your password and the Duo factor. Your administrator may have changed this to a different character. Be sure to follow the instructions sent to you by your organization if they differ from what's shown here."

If you're the Duo admin then I guess you'd probably know if the character had been changed from default

ok so here is the deal. , options DO call the phone BUT authentication fails afterwords with . So the , thing is correct.

without , options it defaults to push and works fine

<@U0125S0736V> the duo guide is not complete/correct. You can look here: <http://arnaudpain.com/2020/09/08/citrix-gateway-and-duo-step-by-step-guide/|http://arnaudpain.com/2020/09/08/citrix-gateway-and-duo-step-by-step-guide/>
Feel free to reach me if you have question regarding the article

Thanks

still no go. tried several different configs. updated DUO proxy.

CitrixAGBasic single sign-on failed because the credentials failed verification with reason: Failed.

Hello
Sorry too busy today :confused:
Will look later or early tomorrow morning 

Thanks <@U01BDK36C9G> I went through your doc again and my configs. The issue is really limited to the comma use. The storefront errors are very odd as NS is doing the authentication and from NS debug logs everything looks ok

Was busy on other projects this week. Citrix rep mentioned a similar support case. Their solution was to put in traffic policy on NetScaler to strip everything g after comma in a password. That works but I cannot use it unfortunately. The environment in question has 10000s of users and odds are some may have commas in their password. <@U01BDK36C9G> so again the issue is the LDAP authentication fails - either on StoreFront if I have authentication box unchecked on NS LDAP server, or on NS if the box is checked. The concatenated string is being read as part of the password. I know I misconfigured something so I am going to try to completely reconfigure my test NS and see what happens.

Got the passcode field to work. looks like nfactor may work too. but I never used to. so have to figure out how it works

Opened case with DUO who sent me to Citrix. And Citrix support said concatenation wont work with Workspace client :smile: I guess I will need to setup nFactor

Im sure it is but I havent dealt with it before. Adding few days on the calendar to figure out how it works :smile:

Just to wrap up this topic. I setup nfactor authentication with LDAP and DUO and that resolved the issue with needing to use commas. The DUO option screen now comes up on Workspace clients as well.