World of EUC

i got a vid on my youtube not BAGs i use always on availability groups but concepts are same. Only difference is you would need a Basic Availability group for each DB if using SQL standard edition and BAGS <https://www.youtube.com/watch?v=OLFkiLu5nO8&amp;list=PLLboZpnlvjGq7rlgzcp6zIuZ8jkgAjoDP>

also got various blogs new CVAD site using always on and migrate existing CVAD site to always on

<https://c4rm0.wordpress.com/sql-always-on-availability-group-setup-and-xendesktop-install/>

<https://c4rm0.wordpress.com/migrate-existing-xendesktop-site-databases-to-sql-always-on-availability-groups/>

I got up to the point of creating a BAG but it won’t synchronize

image.png

initial data sync ? which option you using ?

check the perms on the share from memory you got to have the cluster nodes and cluster account with access

I got it working, do I need a new IP for every listener? I take it they can’t all run on the same port on the same IP

Yeah each bag will have its own listener with its own ip

<@ULLAD12P2>: With SQL Standard Edition each Database needs to be in it's own BAG with a single IP.
If you want to put multiple DBs per IP you'll need SQL Enterprise.
<https://docs.microsoft.com/en-us/sql/database-engine/availability-groups/windows/basic-availability-groups-always-on-availability-groups?view=sql-server-ver15|https://docs.microsoft.com/en-us/sql/database-engine/availability-groups/windows/basic[…]-groups-always-on-availability-groups?view=sql-server-ver15>

that’s what I thought, we don’t want to pay for enterprise for this

now I’m seeing a message about read committed snapshots not enabled

read committed snapshots should be enabled on citrix dbs

another thing I have to go in and do, I’m getting the feeling it would be quicker to run the database scripts and then mirror those DBs than start with blank DBs and set up the BAGs and then point studio at them.

<https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/about.html#fixed-issues>

This is exactly the same as it was for 2103 - nothing about 2103.1 changes 

However this may have simply been overlaid onto the previous, I will ask Citrix

You are not really right... all has been switched to 2103.1 so nothing was fixed in 2103 ?

They rarely update the fixed issues list unless it was a major bug, like a few versions ago.

• Here is the answer - Incorrectly set permissions on the `C:\ProgramData\Citrix` folder might cause Citrix Workspace app to exit unexpectedly. [RFWIN-22753]

We haven’t noticed any issues in our early testing.

When you type does anything come through?

According to the engineer, no.  The keyboard pops up but no input passes through

Is this just a "regular" Bluetooth keyboard? Or is it the Apple keyboard / cover?

Alot of data here
<https://www.citrix.com/blogs/2020/04/22/citrix-virtual-apps-and-desktops-keyboard-and-ime-configurations/>

I was just figuring something in IOS 14 broke it. Nothing changed on the VDA side.  IOS14 broke a lot of shit in the same of "security"

Thanks Ray, sending this to my engineer.  I don't work with Apples...   :slightly_smiling_face:

I work with OSX, but not IPADs. But I just googled it and found that. Hope it helps him.

So much apple hate here, I use a macbook pro every day with citrix, it’s fine

at least there’s no stupid issues with DPI scaling and blurry text

or getting confused as to which task bar is the one you want to use

Every user I have with weird issues that nobody else gets uses a Mac

We don't have SOE Macs but some users raise tickets for their home Macs and some of them use old Macs with EOL OS and outdated receiver. Some don't even have admin access, someone set it up for them 6 years ago in Apple store. So yes - unique, not reproducible and weird issues. I have a feeling we will have more Mac users considering the price of new M1 Macbook Airs and what kind of  Windows based laptop you could get for the same money.

That is because its using the optimzied channel, which isnt really usb.

The generic USB redirection is prohibited altogether. Also plug and play USB and Twain. Its what <@ULLH5JGFR> said above a different type of redirection. Im sure it something simple but I cant find it :smile:

<https://support.citrix.com/article/CTX132764>

Yea its sounds like its using the Optimized channel. Which by default will pass optimized devices "USB" into the CTX session. Setting it to block in Generic might not block it because its not using Generic USB pathway

Ok i think I got it now. Prohibit Windows Media redirection and prohibit video conferencing

Pretty sure that you can also change the Client Selective Trust settings to 'No access' via GPO if these are domain joined machines.

in this case clients are all BYO not controlled at all.

Actually that is a good question. How do you block devices that are using the "optimzied HDX channel" that is labeled under the Generic USB rules.  You have another section for this stuff called  Client USB device optimization
No optimization mode - 001 which means redirect in generic mode/channel of ICA.
Interactive mode - 002 which needs less bandwidth (If you do not specify any rule for device under this policy, Your USB device will be defaulted to use Interactive mode)
Captive Mode - 003 needs high bandwidth (best suited if your USB device is Signature pads)

But I am unsure how to stop a pre-defined HDX optimzaed device from coming through. But sounds like you got it with the media policy which will stop the Optimized part

<@ULLH5JGFR> in the article that <@UK6S90JDR> shared there is a part about policies required for HDX optimization to work.

I may be missing it, But its around HDX Generic USB which isnt the same as  the Optimized Channel

By default generic USB is prohibited. I think media redirection is not related

I hope I am understanding what you are saying. Yea you are correct its disabled by default. But in your case setting it to block at the Generic USB policy will not block it. Based on what you described, Its using the Optimized Channel.
which is this

Did that do it? "Prohibit Windows Media redirection and prohibit video conferencing"

correct. in conjunction with USB plug and play

Cool man, Good to know. Ill add that to my handy dandy usb magic list.

<@ULLH5JGFR> may have. I used a masking rule to block a folder in AppData, but I’m pretty sure that there was something else required.

i can probably get away with killing the update.exe as a quick win and then force the reset of the teams data with the usual powershell

I was hiding *C:\Users\*\AppData\Local\Microsoft\Teams*. It worked in my testing early on, but that was a while ago at this point. I know others said that it didn't work entirely for them.

If you hide that folder and tried to run the per user install, the install would error out completely before it even did anything.

oh i have a hard kill everything masking rule, but i need to make sure that i am only killing per user components as the idea is to roll out teams appropriately - chicken/egg scenario

Likely overkill, but <@ULJM9DQF2> was writing a utility that intercepted processes before they actually did anything. Not sure if it could be useful in this scenario, though.

I’ve not got anything myself, but if I needed to do this I’d either mask the teams.exe in the profile or use a specify registry rule to set svhost.exe as the debugger for teams.exe IFEO

Not to Kill it, but to stop it from being installed. I know it will not allow it to run either because this is blocked.  I use to run a wem external task to remove it, but this just stops it. The shortcut will turn white though for the one that is blocked. Then when you install the Machine one it will appear as normal.

ill share once i have it 100% smooth :slightly_smiling_face: it'll likely be very basic

Somebody should invent a device that shocks the user any time they attempt to install Teams on their own.

Teams.zip

<@UR9T47CRM> sent me this and I use it now

Document1 (1).docx

yah cheers lads, this one ill just be slapping the per user executable and blocking the DL location via filename for teams i think

that way i can handle appropriate rollout without breaking the world

I really feel as though my shocking device idea is worth pursuing, though...

Cool James, Share it if you don't mind. I like to have options :slightly_smiling_face: <@ULC9J5XPB> HAHA

Nice find! Question - Is this only for 1912, or does it also apply for CR releases? As you mention does this apply to WS2016 and maybe also W10?

The wording says "Citrix hooking on the searchindexer.exe process is resource intensive on some VDAs"

Some VDAs? Does that mean not all VDA may be affected?

So many questions :)

<@UMMRWU8CC> do you have further information about this?

This is a great fine, But I have so many questions as well :slightly_smiling_face:

It’s really strange as ProcessExplorer reports loaded Citrix DLLs even with this process added to UviProcessExcludes

14 character limit on the process names...

we have had endless issues with search in VDI and performance and lag

I do see some search issues, but its way better than it was before IHMO. They key to all the is have calm nerves, which is hard for me as well.

Its not 2019. Its 2016 and Windows 10 1809. Which doesnt help you. Sorry Arthur

I always had the search disabled on server  OS :grin:

Advanced search is doing the job even if slower but at least it is reliable. Also we don't use FSLogix profile so the storage guys love me :wink:

I dont think FSlogix is the problem IMHO. Its server 2019 that blows. FSlogix is a solid product. If you take a look at most VHDX profile solutions they are almost the same. Support is a different story though :slightly_smiling_face:

It is most likely the best in its category but  like any product add a layer of complexity coming with his own prob, it is still one of the most active channel in Slack with ppl having issues. There is also issue with Windows Server 2016 for the search, no?

I don’t think you can move them like that. You should be able to move a non MCS MC. Add them as just power managed machines using the other technology option. 

You can remove them from a catalog and then add them as existing machines to a new one but then it gets messy with mixing when they were provisioned, etc. I’ve done it where you add them all to the same delivery group so that it’s the same experience for all users but I leave them in the catalog they were created. 

I’ve removed them from a catalog and added them into a new manual catalog, you can’t add them into a non manual catalog.

you can add them to the same DG as your other machines

Yep same experience as i've seen and done.

Yea I had a whole mess this morning. I just had to do a new machine catalog and move users to a new machines. It was very frustrating

We had a "Citrix Admin" in the past who just went nuts, and now I am cleaning up things to prepare for a cloud migration.

Unrelated, but as part of your cloud migration, if you are using Nutanix and PVS, keep in mind you can't add existing Nutanix PVS VMs to a catalog, you'll need to recreate them.

Actually you can add them to new catalog as existing power managed VMs. We recently were fixing this but Citrix has removed the ability in Citrix cloud to create a PVS catalog outside of the wizard.  The option is gone now. 

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops-service/removed-features.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops-service/removed-features.html>

I guess cloud first now means “you should have built it in the cloud first”

IF I had it my way, I would just use Nutanix in AWS for all. I say that based on a webinar <@UK6S90JDR> had about 3 weeks ago. It was good stuff. I don't ever see PVS being a option in Azure.

Hey Arthur. There is no setting for disabling the smart card VC. Why do you want to disable it? What exactly are you trying to do?

We would like to prohibit to use smart cards for work from hour users because of company decision. I’m looking for easy way to implement. 

Disabling USB devices do not protect against smart cards using.

Disable the Citrix Smart Card Service, we have it disabled since few years.

Got it. If you want to disable it only for certain users, that is not possible. You could disable the citrix smart card service, as Slimir mentioned, but that affects all users

It’s not the best solution as it should be disabled only for WFH users and it should be some kind of policy from Citrix but it’s missing/not existing currently. 

Unfortunately, controlling the SC VC via user-based policy is not an option. User policies are processed after logon. If using SC for logon, the SC must be available for the user logon, which happens before policy processing

SC should be prohibited after logon. Just should not be in use by WFH user apps. In my example we don’t use SC for logon. In such exaple it can be via user-based policy and we will be happy customer :wink:

are you issuing smart cards to your WFH users?

Some apps required smart cards but because of security reasons smarts should be in use only from office. 

The fastest and dirty way is the service. You may be able to setup Smart Access and tie it to a Studio policy blocking it.

Is it not possible to disable those apps if someone is working from home? Or do they need to login with username and password from home?

Some day from from home via RemotePC, another from office. Citrix service disable option seems to be the best so far.

Can't you disable the app based on the location? Most UEM solutions have this option

Not really. Statement from security team is clear: SC for WFH users have to be prohibited. So we can’t limit to any apps. Currently it’s more funny as we are working on allowing SC for some groups of users and for the reason should be prohibited. 

splash screen launches then that’s it. Director logs say it faults on SBDDesktop.exe

yeah, issues with both the oder ones and the new green icon

disabling the hooking didn’t fix it, maybe seamless flags

<https://support.citrix.com/article/CTX222592>

This tool is pretty cool, haven’t come across it before

I just clicked Try All flags and now the app works

The link you posted looks like its revamped for 7.x which is cool

it helped with the older apps but the new one still launches and quits

Does it work when you RDP to the machine?

Ok, Let me find my notes. I have something I used to do

Remember the "Runonce.exe /AlternateStartShell" setting?

I think the problem is, RDP loads all the Active setup pieces that is apart of Explorer.  In a Seamless applicaiton some applicaiton will open and close super fast becasue it needs some process loaded.

Published Explorere.exe to the server, then browse to the app.exe and opne it. Does it run  open and run?

oh lol, it’s having issues via rdp now too

Have you checked this yet?
<https://support.citrix.com/article/CTX200393>

I remember this one was a big one
LogoffCheckerStartupDelayInSeconds

I deleted my profile and tried again and now it works

Here is a example of something I had issues with along time ago. Sending it next

I do have an issue with the session staying open now, will look at this

LogoffCheckSysModules

<https://support.citrix.com/article/CTX891671|https://support.citrix.com/article/CTX891671>

ok, getting rid of the junk in the \HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fixed it, was probably vmware tool systray

I can get just about evert application running Seamless. Some take time but I script it all an d then publish that.

Sorry Julian, we block all client mappings :disappointed:

Thanks for confirmation, Matthias. I have to investigate further why it's not working.

I was wondering this too after looking at it yesterday, it looks like you could do it before it changed to kernel hooking

to support Workspace App, you‘ll have to make use of nFactor on the ADC

Thanks <@UL5TD2QM9>, we do have it configured with nFactor

I see that when BCR is enabled and u open something it's redirecting.

It went away once I deleted my fslogix profile and got a new one 

Maybe something to do with chrome profiles changing versions 

I think this maybe related to GPU acceleration in chrome. It can be disabled

it’s not doing it in edge which is the funny thing, pretty sure it was from moving profiles between chrome versions

Not a lot of sites but I use it for sharepoint, you tube and our lams training.  It actually works real well 

I’m really only using it for YouTube, and it works well in both Chrome and Edge Chromium.

<@ULLH59VQF> <@ULC9J5XPB> what’s on your clientside? All windows? 

The main thing is that the endpoints have enough grunt. Some Linux based endpoints can struggle with the local browser engine. BCR works well though.

Oh yea that's a good point. Most is windows laptops and desktops. But thin clients need to be reevaluated. I'll have to work with desktop engineering team on this. I architect and build it then hand it off to them. So good reminder Leee.

No worries. I've found laptops and desktops it's usually fine but legacy thin clients struggle and so the webpage performance can suffer.

<@ULLH5JGFR> we looked at the thin client market last year.  We went with Dell primary because of the quality of the hardware and it’s cloud based. So far so good except teams calls go to crap when you talk to more then one person and share your screen. 

We liked igels concept but didn’t like the hardware or the fact it was onprem. 

You didn't like the IGEL hardware? Kinda surprised, to be honest. Their newer UDs are pretty beefy compared to most other vendors.

To be fair it was 18 months ago. We also have a global agreement with Dell so pricing was low

Anyone using Azure for VDAs? What type of provisioning are you using? Is there a way to do MCS full copy type of build?

Mac 21.02.0.29 :grin: Works like a charm! F*ck Windows! I will never go back to the patching hell! NEVER EVER had one issue with Mac OS since 3.5 years!

Windows always works fine for me - conversely, Mac is where I see most user weirdness. YMMV

ok so the reason i ask is last week we had an issue with our vmware environment and 1 of our controllers went down but the desktops registered on that were not usable until that server came back up (or desktop rebooted) so trying to find out what SHOULD happen.  Looking at the application logs on one of the VDA's the last registration event happened when the desktop was last booted earlier in the week (so didnt even try to re-register as far as i can tell). wondering what maybe i have not configured right

Do you have all of your controllers set via policy?

In the Citrix GMPC extension, you can enable "Enable auto update of Controllers" and list your controllers.

we set it in the registry as part of the VDA install actually. could that be part of the issue?

If both are listed, probably not. I personally prefer using GPO in case shit changes.

yup makes sense.....if we have it already set in the registry from the vda installer, and now set it as a policy i wonder if thats a problem or only if we'd ever change the controller names maybe

Our XA guys hardcode that shit in the registry, so I doubt that's the problem.

Also if you use this, Make sure they are in the list as well.

Make sure you have that Enable auto update of Controllers policy enabled.

cool good to know. .....that access this computer setting i'm not sure if we set that on our end or not. i'll have to look into that one

ok so that enable auto update  policy we do not set (not configured) ...looks like it defaults to enabled so would we have that set or you saying we need to explicity set that for it to actually work probably

If the default is enabled, you should be fine so long as you're not explicitly disabling it in another policy

it does seem to load balance our desktops evenly across both so that is working right. just does not seem to fail over to the other like it should if one goes down

If all else fails, blame your network team...

lol thats my group unfortunately :slightly_smiling_face:

I would look through the event logs on the VDAs to see what controllers it acquired on initial registration.

The process, as I understand it from Citrix documentation, is that the Registry, Policy, AD, or MCS method is only for the initial contact from the VDA to a DDC. From there is should get a list of DDCs to register with in the future. There are events in the Event log that show what DDCs are in the environment.  Perhaps the DDCs aren't returning the proper list of DDCs?

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/vda-registration.html>

run `Get-WmiObject -Namespace "Root\Citrix\DesktopInformation" -Class "Citrix_VirtualDesktopInfo" -Property "PersistentDataLocation"` to see what DDCs are in the cache after the auto update

so at least on one vda that had the issue i looked through the event log and filtered down to just show anything DDC registration related and it did register on the one that went down a few days earlier. and nothing else after so it for whatever reason when it lost contact with that controller it never tried to register again on the 2nd

this is what output i get when i run that on my VDA.

oh, I misread what that command is actually doing, <@ULGKFDUVD> how do you view whats in the cache in that location when it’s locked down to the System account only?

Take a snapshot, change permissions, look at that folder and revert back - you can also impersonate SYSTEM (with psexec or other ways), but this is often fastest method, since manipulation with that folder is unsupported (useful for troubleshooting though)

I tried taking ownership and it still won’t let me look in there

It was a bit more complicated than that, try using psexec instead (there is a switch to execute under SYSTEM). Use it to laumch cmd.exe and navigate to that folder

Might be more appropriate in the citrix-adc channel.

It seems like this would be possible to me (I'm not an expert on any of this, I just learned FAS and SAML on the ADCs recently) because you would enable the FAS configuration in StoreFront. Once StoreFront is configured for FAS, all connections through that Store are FAS enabled. This would get FAS enabled and functional, then you could get the SAML portion working.

I am taking a different route and building SAML and FAS on an new ADC pair, but mainly because I am also getting rid of all Classic policies as I migrate services over to the new ADCs.

That was my thinking as well.  Also good point about the ADC policies.

For migrations i create a dedicated SAML/FAS enabled storefront store then use Nfactor (Group A gets AD and Radius / Group B gets SAML using AzureMFA ect) i also use AAA groups with a separate session policy/profile bound that uses the new SAML/FAS enabled storefront store. This allows me to test the new solution and migrate users in parallel

Depending on scale could you do a startup script that based on name of the machine sets the IP address?  Assuming you have a block to work with to make it feasible you could bake it into the image.  Just a first thought off the top of my head

Yea that was my thought too. Probably use a simple csv 

Dhcp with reservations not an option?  You could set manual mac's and based on last 3 of the MAC is the IP as well.

Or make the machine names 3 digit at the end and that be the last octect of the ip

You can also use custom personality.ini strings and a startup script. This is what I do for PVS. Haven't used MCS with personality strings. Happy to share my startup script to help you.

<@U011Z7F6733> I would love to see your startup script. Always like recycling scripts 

Please send it over <@U011Z7F6733> when you got some time so I can implement it :slightly_smiling_face:

PersonalityStringsforStaticIP.PNG

I really need to write this up into a blog, but here is what I do for PVS. The Personality strings I set on the Target Devices look like this...

Then I use a script to get them and set them at Startup. Actually, I use a Scheduled Task that is set to Normal priority so that the IP Address is applied without delay.

SetPVSTargetAgentStaticIP.zip

The following zip contains 3 scripts.
• SetPVSTargetAgentStaticIP.ps1 - This is the main script
• SetPVSTargetAgentStaticIPScheduledTask.ps1 - This creates the Scheduled Task
• SetPVSTargetAgentStaticIP.cmd - This deploy it via an app in MDT as part of the Task Sequence

We do kinda the same with personality in PVS.  We set WEM, DCs, SR, FileServer, and env (prod, train, stg)

Nice way to do it <@U011Z7F6733>! I have used personality strings in the past a long time ago to do something similar but you've taken a step further. :+1::skin-tone-4:

We use a script at startup to set all the needed env properties, registration to proper site.  That way we use one image across 3 different sites

So basically, this Scheduled Task and Script are deployed to every build we do. So the script will always run. If the EnableStaticIP string is not present or set to FALSE, the script does nothing. It just gives us so many options and allows us to quickly bring up Session Hosts if something happens to DHCP services. Obviously we also need BDMs with static IPs too, but that's a simple thing to create and apply.

No entries in ns.log or newnslog I can spot

We narrowed it down a bit, just a minute ago.
It works, when we switch between random public IPs

I asked the customer to check his Firewall

Now it works every time, even from the ips that didn't work before. Brilliant. I didn't change anything. Was jsut searching for logs.

What’s your ADC software version?  I can be software bug or some network issues. Just in case generate support file and verify via <http://cis.citrix.com|cis.citrix.com>

Latest
Already tried that, cis is down for me the whole day (europe)

What’s latest ? 13.0.x ? 12.1.x ? or 12.0.x ?

Whops. With latest I mean the most current of 13.0

Hi All,

Pre Workspace app 2103, did any of you guys disable VP9 in favour of H264 for users / use with Microsoft Teams within your Citrix env?

Curious as to what use cases you may have had for this?

I did see a few people rejoicing at the release of 2103 due to it disabling VP9 as standard.

Thanks

Citrix have a list of clients that have been tested with Teams optimization somewhere