World of EUC

image.png

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/multimedia/opt-ms-teams.html#enable-optimization-of-microsoft-teams>

Should be supported imo

I’m doing it, if you go any higher than 1912 citrix support will tell you to upgrade your backend

TBH instances of it failing are pretty low, as long as the client version is up-to-date. So if your clients are on the required levels, which you _can_ see through Director, it shouldn't be an issue

Would be nice to show in Director though...

I believe there are some moves afoot to put this into some monitoring products (not Director AFAIK though)

You can get the status from WMI. I’m working on a script to get show it. But MS seems to be displaying the info in Teams soon. James already saw that notification. On the other hand it’s very unlikely that a client fails if all requirements are fulfilled. 

BISF-Konfig.jpg

It depends o the size, number of programs installed, and how deep it needs to recurse within your Program Files folders. The script in BISF that hydrates is single threaded, so it can take a while after startup to complete the hydration process. Typically you be more specific and pick the subfolders for the main business apps, but everyone is going to be different. Hydration makes a big difference to app startup times.

Yes, of course. I agree 100%.
But the question comes more from the technical direction, whether it works at all with MSC IO.
No, I have to put it differently.
Why should it NOT work with MSC IO?
Because PVS and MSC share the driver at this point.

I think it’s a server based optimization. It has nothing to do with the RAM cache of the client. The PVS server puts the data in the system cache so that app execution is faster. Or am I completely wrong? Ping <@ULLRRJRHC> 

Yes, it works with MCS. It even works with a traditional persistent build. It's about reading the data into system cache after a reboot. It's a similar concept to "cold starting" an application.

for testing with MCS it’s require a Code change <https://github.com/EUCweb/BIS-F/blob/develop/Framework/SubCall/Personalization/10_PersBISF_HydratePVS.ps1> for a quick test you can comment out line 40-49

I would remove those lines altogether so it always hydrates when enabled.

Please create a feature request <https://github.com/EUCweb/BIS-F/issues|https://github.com/EUCweb/BIS-F/issues>

Hi, yes you can configure this by a conditional access policy in Azure. 

<https://www.deyda.net/index.php/en/2020/04/02/saml-authentication-between-citrix-microsoft-with-azure-mfa/#Microsoft_Azure_Multi-Factor-Authentication_with_Conditional_Access|https://www.deyda.net/index.php/en/2020/04/02/saml-authentication-between-citrix-microsoft-with-azure-mfa/#Microsoft_Azure_Multi-Factor-Authentication_with_Conditional_Access> :eyes::eyes::eyes:

I work with Adam and we just tested Conditional Access and the Workspace App still works even if MFA is set to enforced. CA did affect browser-based logins but not the one's from Workspace App. Seems Workspace app is using Azure's Seamless SSO feature (Integrated Windows Authentication) and CA doesn't seem to take effect.

Activate the Sign-in frequency setting on CA– set it on – 1 Hours. This is working for me 

NOTE:
1 Hour is the lowest you can configure to enforce this setting.

The problem is that the CA policy is not being triggered by the Workspace App login process. We tried disabling all logins via a CA policy, it worked for Browser-based logins, but not for Workspace.

I cannot confirm that. It works for me in the Workspace app as well as in browser.

Enable Force Authentication on the SAML Server within ADC?

yep, just enabled that setting on the SAML policy and now it actually goes through the whole login process instead of using seamless SSO in Workspace App.

I think my use case is different <@UKJTJD4KA> - I‘d like to evaluate the device compliance state and/or AAD join state. For this MS seems to access certificates of the endpoint and those are not available through the native workspace app. Basic MFA works for both, browser and app.

<@UL5TD2QM9> Workspace App seems to be in a weird state.  As I understand, on-prem gateways/storefront are still using IE where cloud/workspace service configs are using Chromium.  And the Chromium build doesn't support extensions so you can't add Windows 10 Accounts extension...hence CA fails for me entirely with cloud.

<@URYSHN7EY> Basic CA for Cloud Workspace works for me, i.e. MFA prompt based on location or user group. On Windows and Linux afaik they use the CEF for the authentication process for federated auth against Azure AD, which probably is limiting the features.

Ahh yes - same here.  It's device compliance that fails for me.

I'm not good at these tools so my messages wasn't complete yet :slightly_smiling_face:

your outlook issues sound like they could be related to the account being stuck in online mode, is it creating an ost?

Hi,

Thanks but is more complex than that.
The problem is releated to windows server 2019 + citrix profile manager + o365.
I'm afread to solve all problems with o365 and server 2019 that I have to deploy a windows 2016 server.

I see the same but haven’t found a solution yet

So... I have found that if the session lasts for more than 5 mins it doesn't happen... myself and testers on the client side have noticed it with constant logging in/out.. not as bad as I though, seems to have started since I  added a 3rd language pack.. pulling it off now to see if it goes away, cheers

<https://wvdcommunity.slack.com/archives/C012H886WBF/p1614174281021100?thread_ts=1614170984.020500&amp;channel=C012H886WBF&amp;message_ts=1614174281.021100|https://wvdcommunity.slack.com/archives/C012H886WBF/p1614174281021100?thread_ts=1614170984.020500&amp;channel=C012H886WBF&amp;message_ts=1614174281.021100>

A lot WVD users have seen this issue when they run the WVD optimisation script. Disable the Sync Lang Settings scheduled task

Image from iOS.jpg

If you can’t see the slack link about this, here is the text


Yep... does the  job :slightly_smiling_face:

Anyone got the actual PowerShell txt for me? Easier than typing what is in the screencap 

Yep, seems to work pretty passably. I just do desktop. All it does is redirect your Desktop folder to \OneDrive\Desktop so it can sync them to the cloud

Thanks. Came across the GPO setting and thought it would be a nice way to redirect Desktop/Document folders instead of a fileshare. Will give it a try

Bear in mind that the "original" folder needs to be local, not redirected. So if you're already doing redirection to a file share, you need to turn it off and copy the content back local, then enable KFM and let it move it to OneDrive

Did a large environment with a similar principle in place and worked very nicely.  We did standard folder redirection to OneDrive folder for users Desktop, documents, favorites etc. and it worked like a charm tbh

Anyone seen any issues if the user has two sessions on the same server? One Published App and one Desktop session? FSLogix doesn't always handle concurrent sessions very well on its own.

Hmmm, not sure OneDrive works with concurrent sessions, FSLogix does with the right settings but not sure on OneDrive

The OneDrive app is not supported as a RemoteApp or published app and multi session access is not supported either:
<https://docs.microsoft.com/en-us/onedrive/sync-vdi-support>

Onedrive absolutely will not work with concurrent fslogix

you’d need to split the sessions out entirely, have the apps use UPM or another profile disk

KFM works well once it’s configured, it can be bumpy getting there though

From my experience VDAs can be a higher version. I would test one to make sure.

OK ta.  Now I just have to sort out all the thin clients running fossilised version of Receiver.

We had non-issues with that configuration and Citrix TRM confirmed it to be a valid config

Just to add a little bit, my understanding is that it is a supported configuration, but you won't get all of the features of the higher version VDA until the DDCs are upgraded.

Lovely, thanks guys.  My v13(!) and v14 Receivers could be fun.  Anyone else been stupid enough to run those again 1912 VDAs?

We're still using v13 Linux receiver with 1912 vda and send to work fine for the most part

Thanks <@URVNXB96C> - very useful to know.

I am not using a Jabra headset, however I do know there are some headset requirements when it comes to Teams

MS has a list of Teams approved devices here:
<https://www.microsoft.com/en-us/microsoft-teams/across-devices/devices>

Locally on a Laptop its running like charm. The issues seems to be more related to the usb redirection itself. The device is not getting redirected whatever I do (I think I have read all Citrix KB's regarding USB redirection), also a  rain dance is not redirecting the device ;-)

Well, if a rain dance doesn't make it happen, nothing will :smile:

I have a Jabra headset and it works fine in multiple Citrix environments on Teams

However the hardware buttons only work occasionally, we just use the UI buttons, not that big a deal

<@UL5TCSW3D> With UI Buttons you mean the PickUp and put down buttons directly from Teams? How have you redirected the devices, we cannot see the device in Jabra device manager on TS.

I mean use the user interface to control calls not the hardware. My jabra headset is detected automatically, always has been

ok, understand. Wired, why it is not for us. Maybe it's related that it is an Engage 75, will try with a Pro 930.

On most machines we are getting the Headset as Policy restricted, even though we have settled the local USB redirection policy to ALLOW: (so Allow all)

Mine is wired too. The headset works on an unamanaged and managed device

Its a wired USB? We are having USB Station with DECT to Headset

HID buttons - Answer and end call are not supported. Volume up and down are supported. 	Citrix Workspace app limitation

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/multimedia/opt-ms-teams.html#known-limitations>

ok, so in your cases (for the customers) you are leaving the headsets locally, passing through the audio and tell the people to use the ui buttons, correct?

that’s really the only option you have unless you have them use teams locally and switch back and forth

Ok, thanks also for that Input. I will inform all end users about that - hoping that some day in a different universe this will work ;-)

Teams mute/answer/hang up is super annoying in general, especially as you need to focus the window for the keyboard shortcuts to do anything, I’d love a hardware device that actually worked for this

I’m guessing it’s all to do with the fact it’s an electron app

Having to find the active teams window and click the icon is painful when you have multi screen and multi virtual screens within them 

Try having four different Teams sessions in different virtual desktops :cry:

Try having 4 different meeting providers all optimized on the same virtual desktop :P

Problem I don't have :slightly_smiling_face:

And then have people on wyse terminals tell you the webcam doesn’t work in one of them

Did you checked that passthrough is working in general? Had this problem a few times: <https://discussions.citrix.com/topic/404523-domain-pass-through-not-working/> and enabled passthrough via ps:
&amp; "C:\Program Files\Citrix\Receiver StoreFront\Scripts\EnablePnaForStore.ps1" -SiteId 1 -ResourcesVirtualPath /Citrix/&lt;StorefrontName&gt; -LogonMethod sson

I have just gone through a very similar exercise, let me know if you still need any help 

Thanks <@ULKDZBMSS> I'll check a couple of things with the customer and get back

Nice, I'm basically doing the same, only using uBlock instead of the built-in tracking protection.

Somebody was already brave enough to enable "Startup boost" in a RDS/CTX/VMW Environment?
Any downsides/improvements?

Really nice! Do you still need to add the msedge.exe process to the UviProcessExcludes registry value?

<@U011Z7F6733> No, it's no longer needed.

There’s a YT video from a wild bunch of folks recorded at Synergy 2019 (SYN217) that touches a few of these topics 

<@UK6S90JDR> <@ULHV2NMGQ> and <@ULNE983N3> for in depth knowledge 

<@ULJM98FME> I've just migrated from a single site/zone to multiple zones, in order to move from one DC to another (all single Citrix site).  All on-prem.  Let me know if I can help.

Is the issue that opening PDFs prompts you to select the app? If so, does that only happen for existing profiles (where new profiles open with Adobe without prompting)?

Hey <@ULC9J5XPB>, there are no prompts, pdf default app is set to Edge. Doesn’t matter if it’s existing or new profile... Cheers 

What Kees said - SetUserFTA will be your friend here.

Same issue here. We use the SetUserFTA as well.

Thanks guys, I have tried SetUserFTA and the native WEM method... after about 2 mins the test pdf files on the desktop revert back to Edge... just about to run RegShot to find whats changing, cheers

I never had luck with WEM yet, I havent put in alot of time either on it. So I assume its me.. I use the one that is here
<https://kolbi.cz/blog/2017/10/25/setuserfta-userchoice-hash-defeated-set-file-type-associations-per-user/>

<@ULL6F7DRA> may have a better experience with WEM FTA

Same, I just haven't had luck using WEM for it, and the only thing I've ever tried to use it for was PDF associations.

I still use the tool you refer to <@ULLH5JGFR>

yea, same thing here Nick. I could not get WEM to do it.

99.99% of the time I'm just using a custom OEMDefaultAssociations.xml file in my OS layer.

Tried the older method with SetUserFTA which JK wrote about many moons ago.. <https://jkindon.com/2018/01/02/file-type-association-with-wem-and-setuserfta/>

And tried the native WEM way using the newer feature.. some other process is changing it back to Edge shortly after logon.. and once its changed it's set for that profile.. whenever I make a setting change it seems to work for a few mins then bounces back :disappointed:

If you change it for the user only while they are logged in, do you have something set to revert it?

Just for the hell of it, try this registry key:

*Path:* HKCU\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts
*Name:* MSEdgePDF_.pdf
*Type:* REG_DWORD
*Data:* 0

That's what I had to set in my image so that Edge Chromium stopped trying to take control over PDFs for users who went from 1909 to 20H2; new profiles were fine.

That is good to know, going to steal that. Thanks Nick

Intersting... this is 1909 - will give it a try

I have it in my Citrix Optimizer template, but am applying it via WEM.

Yeah, it's a random one for sure. Hope it winds up resolving yours, too.

That Reg entry is a in place... I'll see what I can find

<@ULLH5JGFR> - Got a little side tracked... I found a couple of cache keys got updated/changed using Regshot. Had a quick sync with <@UKJTJD4KA>, thinking something maybe cached on the master - I'll run an update tomorrow and ensure the FTAs are set correctly on there at machine level before sealing and feedback :slightly_smiling_face:

Goodbye GPO's ever applying to master images, die. in. a. hole. (that's if of course, that's the situation :P)

Nah, only GPO is BIS-F... still fiddling :slightly_smiling_face:

Ok... fixed. There was AppMasking rule for Acrobat writer that was hiding required FTA keys impacting Reader... Uffffff!

Yeah, I was chatting with <@UKJTJD4KA> earlier and said I was going to review AppMasking rules... he was like "You got AppMasking in the mix? Shit! I had this issue too... 50 bucks says its that!" :stuck_out_tongue:

This will restore UWP apps _Get-AppxPackage -allusers | foreach {Add-AppxPackage -register “$($_.InstallLocation)appxmanifest.xml” -DisableDevelopmentMode}_l

You had these zoombie issues as well <@ULLH59VQF>

<@ULM6WD9LY> as user or adminrights required?

My experience is, wait for 2103.1 before testing

no issues so far, but only upgraded on my machine

I think you're going to get a lot of "it depends." :smiley: For us, we have a single published desktop, single image, via PVS. We use FSLogix AppMasking to present apps employees are authorized to use, and hide those they aren't. All of that is done by Security Groups in AD. We also use WEM to handle all profile customizations, file share drive mappings, and printer mappings. We run our CVAD VMs on Citrix Hypervisor, and "pin" the vCPUs to pCPUs with no over-subscription. With our current hardware, we run 4 VMs / host, with 10 vCPUs and 60 GB RAM. We're in healthcare, and get ~20 users per VM. YMMV. Before implementing, we used LoginVSI to run scaling / performance benchmarking, which is what landed us on the pinning of the vCPUs. We saw about a 10-15% performance increase by doing that.

How many apps do you have? Do they play nicely together? What kind of hardware? is vGPU in the picture? What's your timeline? Are you planning to automate the image build? Use an application virtualization product (AppV, Numecent, MSIX, etc.)?

We currently run win10 machines with all of our apps installed there using FSLogix Appmasking.  What I'm looking to do is move some apps outside of that and into xenapp to present to our physical desktop users.  I have 4 apps in mind to start with and they all work fine together on the win10 machines.  We're using nutanix w/ vGPU's.   I've thought about trying AppV or MSIX later.  I'd like to automate the build, but a couple of these apps have been very difficult to automate on our win10 image.

We mostly do Windows 10 VDI for full desktops and RDSH for published apps only. Always try to keep them stateless, so MCS/PVS - which one depends on your hosting technology, and preferences of course :wink: Try to avoid silos - go with as few master images as possible and make use of app masking if really needed.

That said, as a Nutanix AHV customer you should definitely go with MCS. Btw. you also can stream/publish your apps into the Windows 10 VDI - so not physical only.

don’t find any advantage to use PVS any longer. It still is the go-to solution for physical XenApp servers but now everything is virtual, I’ll do MCS.
We have MCS VDI and XenApp servers (publish many apps each one) but also one or two stand-alone servers that publish a couple of apps to a couple of users, so no need for scaling in that particular case.

Most of our customers use PVS with a single published Desktop. PVS is easy to handle and very fast even if the storage isn’t. Most of the data is handled with the help of RAM. Avoid silos and use FSLogix for profiles and AppMasking to hide apps or redirect things. WEM for the user environment and ControlUp for monitoring and management.

This can help with deciding (PVS or MCS): <https://docs.citrix.com/en-us/tech-zone/design/design-decisions/image-management.html>

I would say also Latest -1, but advise to directly test after release if there are new capabilities that would help (like with 2103 now)

Right on cue <https://www.reddit.com/r/Citrix/comments/m6duvo/remove_citrix_workspace_2103/>

That post is quite vague, they had "all kind of issues". I just tried uninstalling 2103 which worked correctly.

My point was not that there *are* issues, but that some people will *always* have issues. Hence better to allow others to take what pain there is and wait a few weeks for the next version before deploying.

True, but don't forget that most people only post issues rather than successful upgrades. But for sure, don't go day 1 in production

Webex Teams? No, but we do use Webex Meetings with the VDI plugin.

so Teams works great, but this Webex meetings + plugin has been a nightmare.  Works for me, works for anyone using my pc, but can't get it to work for others on their laptops.  Workspace installed, then the VDI plugin.  I'm looking for the "VDI" in the title bar as the tell that its working

We haven't had any issues with it yet, but don't have a lot of users actually using Webex Meetings in Citrix desktop. I've tested it on various hardware (my home built PC and our standard Lenovo and HP devices), and haven't had any issues with the newer clients. We're running Webex Meetings 41.1.5.10 and the VDI Plug-in 41.1.5.10. Earlier versions of the VDI plugin - I want to say 40.9.x? - simply did not work. Optimization never happened, and Webex was completely unusable.

The download site only has up to 41.1.0.17621
Perhaps that might be part of my issue

Use your site's Webex URL for the downloads:
Client: <https://yoursitedomain.webex.com/webappng/sites/yoursitedomain/dashboard/download>
VDI plug-in: <https://yoursitedomain.webex.com/client/T33L/webexvdi.msi>

their versioning sucks.

41.3.0.18191 client
41.2.0.71 vdi plugin

We’re using it now, seems to work pretty well. You need to restart workspace app for it to pick it up.

can you have both webex teams and webex meetings optimized together there seems to be separate VDI plugins

<https://www.webex.com/downloads/teams-vdi.html> &lt;&lt; that looks like its the webex teams vdi plugin where as on your internal webex site eg <http://corp.webex.com/download|corp.webex.com/download> it has the vdi plugin for the webex meetings app

not sure on that as we don’t use webex teams but I don’t see why not

i can only seem to get one or the other working not both together i currently got webex meetings optimized it says webex -vdi in menu bar when i start a meeting but when i run the health checker on webex teams its moans there is a VDI plugin mismatch and its not optimized

if i dont have the webex meetings vdi plugin then webex teams health checker says its optimized and no errors reported

This sounds pretty typical of Cisco stuff

Just be glad you don’t have the jabber plugin too

hehe yeah i finally managed to get it sorted there appears to be a seperate VDI plugin for both webex teams and for webex meetings got to have both installed on the users endpoint.  My teams health checker now says it is connected to VDI plugin and optimized and my webex meetings when i start a new meeting shows VDI on the menu bar so also appears to be optimized

Oh I thought you had both and there was a conflict 

yeah i had to remove the webex HVD client on the VDA (i got from our internal webex site) and install the webex HVD client on the VDA from <https://www.webex.com/downloads/teams-vdi.html> instead

once i did that the vdi plugin mismatch went away with both VDI plugins installed on the endpont (meetings vdi plugin and teams vdi plugin) pain in the ass software

it really is, it also doesn’t see the full webcam resolution if you don’t have the plugin installed and try to use it with hdx webcam instead. It even crashes in 2012 VDA, need to test it in 2103.

It is stated in the article:
To resolve this issue, the cipher suite order list on Citrix ADC must include only the TLS_ECDHE_* cipher suites. If you have assigned a delivery controller server as STA Server in Citrix ADC or Storefront which is outside your site, the cipher suite order list on StoreFront must also include the TLS_ECDHE_* cipher suites AND these cipher suites must precede any other cipher suites.

<https://docs.citrix.com/en-us/storefront/1912-ltsr/known-issues.html>

Any idea why Citrix did change between CU1 and CU2 ??

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/2006/secure/tls.html>
I see the first mention here, in the CVAD 2006 release, which is not supported on 2012R2.
So I think they now use different Ciphers (to reflect with Microsofts OS support) as only 2016/2019 are supported.
But as StoreFront remains on 1912 LTSR, some customers still use 2012R2 on their environment and this means that there is incompatibility between those Ciphers. So that's why it's added to the docs (1912 LTSR CU1 was released before 2006, CU2 after).
But this is what I suspect, you should ask support if you want the complete answer.

To conclude: I would advise to use the same OS version on all the Citrix backend components (Delivery Controller, PVS, Storefront)

Just asked support. It’s LTSR and they should NOT change anything, just fix bugs or security related “things”.

I didn’t find anything related to change in ciphers in CU2 documentation. 

By the way: it’s not “know issue” in CU2 - it’s in opinion undocumented change from Citrix for CU2

They didn't change anything in the LTSR, it's only in this case:
This issue occurs if the delivery controller is installed on Windows Server 2016 or Windows Server 2019, and StoreFront is installed on Windows Server 2012 R2.
So I assume that Microsoft changed their Ciphers and this is why this is happening

We are using W2K16 for SF... after change in ciphers on NS all works again. 

No issues before CU2 installation.

Did you change the Ciphers on that machine? (You didn't mention SF on 2016)

Yes - we didn’t touch anything on server.

I mean, did you change the default Ciphers on the SF machine in the past?

Not sure to be honest but CU1 was working fine CU2 didn’t and ciphers on NS VIP update (adding few more) was required to make CU2 operative. 

As it is load balanced, this issue applies:

Applications in a StoreFront store fail to enumerate and launch and an SSL connection error is reported. This issue occurs if you use the Citrix ADC load balancing feature to distribute the load to the delivery controller servers, and StoreFront is using HTTPS to communicate with the load balancing delivery controller services. To resolve this issue, the cipher suite order list on Citrix ADC must include only the TLS_ECDHE_* cipher suites. If you have assigned a delivery controller server as STA Server in Citrix ADC or Storefront which is outside your site, the cipher suite order list on StoreFront must also include the TLS_ECDHE_* cipher suites AND these cipher suites must precede any other cipher suites. [LCM-9308]

So, for security purposes I assume, they changed the Cipher suite. Which is something they should also do in CUs, but it should be better visible in the release notes / upgrade notes.

Just got email from Citrix. It seems to be “undocumented change” as they don’t have more details „Our Developers asre still actively investigating into this”

I asked support to update pre-requirements.

cu2 xml lb issue.docx

something deff changed between cu1 and cu2 i load balance my DDC's (XML Service) on my Netscaler and it stopped working when i upgraded from CU1 to CU2 i had to play around with the SSL profiles on my netscaler to get it to work i found it was related to the ciphers

Secure front end ssl profile uses secure cipher group which has these ciphers

Yeah that looks like the known issue mentioned in the docs when using ADC.

It’s not an “issue”. It’s for sure undocumented change from Citrix in CU2. We as customers can’t tolerate it especially for LTSR versions.

yeh i came across it a few months back when cu2 first came out had me stumped for a while

Tomorrow I will dig “deeper” to find source of this change. 

i also came across another annoying issue where if your storefront servers are 2012R2 and DDC's 2016 you have to change the SSL Cipher suite order on the DDC's that was well buried as well

Yeah that is also now mentioned in the docs, as mentioned above it first came across with CVAD 2006. It's now also in the known issues of SF 2019 CU2

hehe keeps us in jobs :slightly_smiling_face:

Haha, yeah and a reminder to read the Known issues before upgrading to check for such issues.

It should be part of “pre-requirements” instead of “know issues”.

tbh i did my cu2 upgrade on the day it was released and i didn't see anything mentioned on the known issues at the time related to my issue.  i fixed it by using the secure front end profile so didn't bother to report other people must of raised it and then it was added as a known issue

With CU customers do not expect any new changes... OS / NS reconfiguration should not be required.

Yes and no, sometimes changes need to be made due to security concerns or if another vendor like Microsoft changed stuff.

If it’s planned chang than it should be mentioned in “what’s new” and part of “pre-requirements” not just as “know issues”.

Source of issue seem to be Citrix.SSLSDK.dll file. CU1: file version: 1.3.0.1 CU2: file version; 1.4.1.108 I need to confirm it with Citrix

And above has been confirmed by Citrix. It seems to be unexpected impact for customers :man-shrugging::skin-tone-2:

Storefront 1912 CU2 seems dodgy since its release and that's why I am holding of to upgrade from CU1.

Only on a redirected Start Menu, Win 2016.

I have never seen ShellExperienceHost crash on a 2019 server. With 2016 I have seen it plenty of times.

Are you configuring anything around the start menu with WEM?

Do you have Symantec endpoint protection ?

I will soon publish a blog post about this topic with some best practices. So you want to read through it and give it a try?

We had something similar when using fslogix and AppSense together.

I resolved by doing two steps:

1. Add a shortcut to c:\windows\system32\ctfmon.exe to shell:common startup
2. if using AppSense then add shellexperiencehost.exe to the following registry key:
\\HKLM\Software\AppSense\Environment Manager\AsModLdr\Exceptions

Am sure there is a similar regsitry in WEM to remove shellexperiencehost from personalisation scanning

Disabling the service stop logon metrics reporting to Director. 

Install the WMI plugin and it will report metrics to director just fine

<https://support.citrix.com/article/CTX223972>

Don’t disable it if you want logon times, you need it AND the WMI plugin

“Logon time requires Citrix Profile Management service to be installed and running. In order for VDA to pull the User Logon Information, Citrix Profile Manager needs to be installed on the VDA and the service needs to be started even if you are not using User profile Management for managing user profiles.”

<@UL5TCSW3D> <@ULLAD12P2> - we have a disagreement. Either of you labbed this?

Will have a look, I tend not to use director in my deployments so could be wrong

<@UL5TCSW3D> reply raises doubts so I disabled the service and no more logon metrics from this VDA

I have run into this with clients who disable it and then complain director stops working

Thanks, so my final decision is that i will not disable the service. Just wanted to know if this can be a option. Thanks for all the answers

*Microsoft Edge Chromium - high CPU usage*

We just figured out that the GPO setting "Enable startup boost" disables the functionality of the GPO setting "Continue running background apps after Microsoft Edge closes".

This can lead to high CPU usage of "Microsoft Edge Chromium" processes (even in disconnected Citrix sessions) with "Microsoft Edge Chromium" version 89. The problem seems to start after a user closes "Microsoft Edge Chromium" version 89 and starts it again. You can also recognize flickering desktop icons in a published desktop session or when you are logged in as administrator on the server console.

Version 88 just does not close all "Microsoft Edge Chromium" processes if you close the browser but it does not show the high CPU usage.

So, the recommended settings are:

"Enable startup boost" -&gt; disabled
"Continue running background apps after Microsoft Edge closes" -&gt; disabled

You have to enable SAML on your Storefront store by running a powershell script that modifies STFClaimsfactoryname/STFStoreLaunchoptions you also have to fully delegate the credentials to the NS GW as well as remove the SSO domain name from your session profile