World of EUC

image.png

Sorry,insert individual computer objects into the policy.

Create a security group that contains the required servers. That way when a computer is removed from AD it is automatically removed from the GPO and you are not left with an orphaned SID in your GPO

how can i send  provisioned servers automatically into the security group?

dsquery computer "ou=Servers,ou=Citrix,dc=Domain,dc=tld" -limit 0 | dsmod group "cn=ServerSecurityGroup,ou=Servers,ou=Citrix,dc=Domain,dc=tld" -chmbr -c

This will take all computer accounts in the Servers OU and put them in a cleaned out security group named ServerSecurityGroup

Take and modify for your use and env

Look no further:
<https://virtualwarlock.net/microsoft-edge-in-citrix-revamped/>

or use evergreen scrip :slightly_smiling_face: <https://www.deyda.net/index.php/en/evergreen-script/>

<@UR9T47CRM> I am using the Evergreen script in my article. Edge requires a few customizations, currently the Evergreen script does not support app customizations.

ok I'll take a look at that and include as far as possible ^^

It's this issue: <https://discussions.citrix.com/topic/412245-vda-1912-cu2-random-disconnects-on-server-2016>

I know this was an issue in earlier versions of 1912 on 2019. <https://www.mycugc.org/blogs/brandon-mitchell1/2019/09/22/not-so-fast-reconnect>

Can anyone confirm if this is a problem in 1912 CU1?  Am about to roll-out CU2 but have some concerns about quality (e.g. Process Logging / Top 10 Process just doesn't work, confirmed by Citrix but not on Known Issues webpage last time I checked). - EDIT: Yes.  I can see from that 1st link that Patrick Matula has same issue on CU1, amongst other versions.

Got this happening with one of my main clients. 1912 CU2 on win 10 1909. Case to Citrix went nowhere as we thought all the disconnects were on IGEL thin clients , but I updated a script last week to prove it’s affecting all clients: osx, windows , thin. I’ll post updates as I have them. Next week, we will work to get workspace app updated where it’s out of date on some clients 

Seems to be a fairly recent development, wasn't happening three months ago

Also appears to be a combination of Event Log and DHCP Client services, rather than particularly one

I have only seen that when an admin inadvertently set  the scope's lease  duration to 8 minutes instead of 8 hours (using PoSH). That meant every client was attempting to renew their IP address every four minutes. &lt;sarcasm&gt; That also happened at the same time they saw a spike in network traffic!!!

This is more like every 30 seconds and we see it on all of our Server 2016 instances

Is there anything in the DHCP-Client event log?

Nope, literally just one event :disappointed:

I think it's more Event Log than DHCP Client TBF

doesnt the dhcp client service run under the svchost process ? you had a look at what other services are using the same svchost process ?

Yeah, Resource Monitor shows it breaking down individually. It's about 3% DHCP Client and 7% Event Log over a period of time, on average

Maybe AV? You can probably get a better breakdown with Process Explorer. This can go to stack/thread level. Even Process Monitor too, although too much data to trawl through. If you have an MS support agreement, get a memory dump and get it off to them.

Wireshark and check what is going on with DHCP traffic?

I think a cname only works if they aren’t on a domain

```--app=<https://www.whateveryouwanttocallme.com.au>```

Nice... yep, the target bowser will be Chromium based :slightly_smiling_face:

Like the pub app instance cant be used to browse elsewhere?

There are ways, but for the most part it does the job, treats a web page as an app - no nav bar 

Nice.. that will prob do. I'll do some testing... you can stick this on my tab :wink: :beers:

You should be able to configure a second LB vServer for the "backup" storefront, then add that as a Backup vServer for the first one - would take care of failover

It’s usually because the DDC can’t talk to the hyper visor 

You can try putting the machines in maintenance mode and taking them out again 

Only had it with SCCM during a role failover. Putting the hosting in maintenance then out, restarting the Citrix services did the trick.

Citrix support are telling me it should automatically recovery.

but the repolling only appears to happen, if you edit the hosting connection, stick it in and out of maintenence mode, or restart services.

You can try editing the hosting connection and re-entering the same password again, this forces a re-polling

Yes, just re-enter the password in the host connection. 

Running server 2016 in PVS, 1912 LTSR CU2 if that matters.

I don't think it works like that. You match shortcuts up, so if a user launches a Microsoft Excel shortcut (for instance) in the virtual environment, it opens it up on the local client instead. Matching links might be a case for host-to-client redirection instead maybe? <https://www.htg.co.uk/blog/using-host-to-client-redirection-in-citrix-xenapp>

or maybe I was thinking of vPrefer :slightly_smiling_face: there are a lot of Citrix features in this space <https://james-rankin.com/videos/quickpost-using-vprefer-instead-of-keywords-with-citrix-virtual-apps-and-desktops/>

So you will have to look through all of those, but I don't think the mailto: protocol (which is the one it sounds like you are looking for) is supported to do this. There's also FTA redirection but not sure that would work.

Yeah, Local App Access just enumerates user's local shortcuts into a hosted desktop, so I think host-to-client redirection is what you need to look at for your use case (sorry for the deluge of messages, but these different features all get me confused)

Thanks for the information! I'll check host to client redirection if it could be used for something like this :slightly_smiling_face:

mailto links are also a special case and don't work properly with browser redirection stuff either

If user's connection requires to start a VDI (because no powered On VDI is available or his dedicated one is turn off), it will fail. Other than that, I don't see any.

Yeah no power management operations will be pretty bad if you got pooled VDI and shutdownafteruse is being used . You can run get-brokerhypervisorconnection on your DDC to check the state. You can try restarting the Citrix Host service/Broker service to see if it fixes it. You could also run a hosting connection test in studio and confirm the hosting connection is ok (bad creds)  most of time i seen power state unknown its because the hostedmachineid doesnt match

Issue is seen with multi-session VDAs. Power state issue is resolved after vCenter is back online. Wanted to understand how Unknown power state impacts session launch.

was the hosting connection to Vcenter in maintenance mode in studio ? if it wasnt in MM and you had session launch issues i am guessing its because when you created the server os catalog you chose the option "machines that are powered managed" as part of the DDC brokering process it checks the status of the VDA and prepares it for the incoming connection maybe without the hosting connection being available maybe that wasn't possible hence the launch failure?

i will test it now and let you know i will power off my VCSA but leave my MCS provisioned machines running on my ESXI hosts

catalog.JPG

launch.JPG

unknown.JPG

norm.JPG

vcenteroff.JPG

tested it just now my desktop launch was fine when the power state of the VDA was unknown (MCS Server OS power managed machine catalog) i powered off my VCSA and power state of the VDA went to power state unknown and hosting connection state was unavailable with get-brokerhypervisorconnection but it didn't stop me from launching the desktop

Difference - In my environment, it’s PVSwith Citrix Cloud. 

Yes, hosting connection was in MM. Tried to resolve the power state by putting in MM for few minutes and taking out. Could be that’s the reason. I will do further testing on some scenarios and update. 

<https://www.rorymon.com/blog/citrix-power-state-unknown/>

This can happen if you change the SSL cert on vcenter

If you use the self signed certificate that comes with VCentre then after a major upgrade the certificate is re-issued with a new fingerprint.  You have to run the powershell command:

Asnp citrix*
Cd XDHyp:\
Dir (this will show 2 folders – Connections and Hosting Units)
Cd .\Connections

Get-ChildItem XDHyp:\Connections | Select-object &lt;HypervisorConnectionName&gt;

$cred = Get-Credential

Set-Item -LiteralPath "XDHyp:\Connections\&lt;HypervisorConnectionName&gt;" -username $cred.username -securepassword $cred.password -sslthumbprint "XXXXXXXXXXXXXXXXXXX" -hypervisorAddress &lt;vcentre FQDN&gt;

Where XXXXXXXXX is the new cert thumbprint, it has to be in upper case

Best way to avoid this is to have a genuine wildcard ssl cert issued by yourself applied to each vcentre.  If you do this, the thumbprint doesn't change.

Thanks for the inputs. We built new vCenter as we are not able to restore old vCenter, as a result new cert was issued. We are using internal CA issued certificate for the vCenter.

<@U011F8B8A6N> - Is there a way to check existing SSL thumbprint? ls XDHyp:\Connections\ command return empty SSL Thumbprint.

That means that either the thumbprint wasn't pulled through by the hosting connection, or that not all of the DDCs have the certificate in the Trusted People store.  Every DDC in the farm has to have the cert exported from VCentre and imported into the trusted people store, and then either reboot the DDCs one at a time after importing the certs, or try restarting the Hosting Service (sometimes restarting the host service isn't enough).  If the cert still isn't pulled in and all the DDCs have the cert in the trusted people store then run the powershell command I did above against that hosting connection to force the thumbprint, then restart the DDCs or hosting service again and see if the thumbprint starts comms.  The other thing you can do is edit the hosting connection from any DDC and re-enter the password, if it's the first time any DDC has seen the new cert then you will get an option to trust the cert,m selecting this will set the trust at the farm level, I don't think this can be done at powershell level..

I believe whatever you mentioned is true for on-prem CVAD site, ours is CVAD Service and we don't have control over the DDCs.

Hi <@ULTD5QMBK> sorry, missed that part, in that case the only way you can only update the thumbprint via the powershell (see <https://support.citrix.com/article/CTX277468> - it's pretty much the same process, but you use Get-XDAuthentication to authenticate to Citrix Cloud first).  Ifd it still doesn't work after that then I would edit the hosting connection inside studio and see if that resolves the issue

Saw that article, I edited the hosting connection and re-authenticated that could have updated the SSL thumbprint. Didn't do the powershell method, all good now. Wanted to know if there is a way to check thumbprint using PoSh before modifying.

Thanks.

CVAD 1912 CU3 released: <https://www.citrix.com/downloads/citrix-virtual-apps-and-desktops/product-software/citrix-virtual-apps-and-desktops-1912ltsr-cu3-all-editions.html>

Hey everyone, we’re wanting to run our ERP as a virtual app. In testing, we’re having these issues:

• office asks for activation, would this be because it’s a separate machine catalog? 
• When exporting an excel sheet, we are having
 trouble with Box Drive being available in windows explorer as a save location so that the document can be shared outside of the Virtual App environment. 

Any recommendations on what we can do here? 

Good morning!
He contacted me via mail. Solution will be posted here.

my mistake :&lt; i have choosen the wrong trigger

Hi james, could be an profile problem. Are u using fsl? Check your redir/exclusions

I agree with <@U0158E1NUGH> could be a profile issue

Had the problem also after I migrated profiles from citrix upm to FSL. In my case it was the ntuser.dat that was corrupted

yep FSLogix. Log on once, its fine, logoff, log back on to the same machine, fail, reboot machine, log back on, fine - amazingly, if you land on a different machine, its fine - so it seems to be a link between the user, and a specific machine - I believe other users can logon to the "broken machine" whilst the broken user cannot - clear as mud?

Check the event logs. May be permissions in the profile

Yeah event logs show a challenge with ntuser.dat on unload but what gets me is after a reboot of the problem machine it’s fine AND you can load on another machine OK 

are you deleting local profile content on logon?

sounds like it’s trying to grab that old ntuser.dat file

I had this issue with Server 2019 CVAD and FSLogix some days ago. It was an old local user profile that had not been deleted. 

No trace of anything local that I can see, disk mounts and then bam... I haven’t traced it or gone too far, just checking if there was a quick known... I’ll pass on to customer 

udadmin will clear down 90 day per user/per device licenses

udadmin is what i use (command line and a gui tool) to manually clear ones i know are gone but what if we've had waves of people leave in less than 90 days that we just want cleared now to get a level set of what we have left in use

in that scenario i have ran scripts in the past to clear all the per user/device licenses when they log back in the license will be re issued
```for /f "tokens=1,2" %i in ('udadmin -list ^| find /i "_ud"') do @udadmin -f %j -device %i -delete```
```for /f "tokens=1,2" %i in ('udadmin -list ^| find /i "_ud"') do @udadmin -f %j -user %i -delete```


nice i think that would be similar to just clearing the local cache file (so clears things and then just re-populates as people sign in).  Obviously in this case its not being used to get around licensing limitations but more get an up to date picture of whats in use so i'd hope its not a compliance violation or anything like that

MCS full clones or use something like MCS and User Personalization Layers. Have also used automation tools. Still save off data. I’ve seen some customers use Profile Management or other tools to keep user settings.

Yes right now mcs full clones work, just trying to think how this will scale and manage in the long run . I am still nervous on the UL, curious if anyone actually uses these in prod. 

we do full MCS clones (not using user layer anymore to take that filter driver out of the equation).    decommission is a little less automated right now than we'd like but when we have a term employee we throw into maintenance mode and apply a Studio tag for a short period then delete after that

I know customers using UL and UPL in prod. If you are not using App Layering today, go with UPL if you go that route. For regular MCS full clones persistent most customers I know use SCCM or other tools to manage after deploying. Pretty much manage similar to desktops.

<@URVNXB96C> similar decommission to what i've seen.

we used UL for years (w/ non persistent).  it really is amazing technology but you have to watch for when its filter driver conflicts with other technologies (not as much as it used to ) but we ran into issues w/ some performance things there that we didn't w/ the persistent/nonUL setups so got pressure to move away from it

cool good to know we're on the right track!  would love to be able to automate some of that but haven't had the time to dig into it yet

Really wish Director would let you manage Tags so i could get our help desk more involved w/ that

Yep driver altitude is something to look out for if using other technologies with UL.

need to really watch for application specific  files that can sometimes get pulled into the UL and conflict.  more of an issue w/ non persistent though I think

Yes my first thought was mcs static clone with sccm.. Good to know others are doing this too. Yea maybe I will use the UL for some time to see how my apps work just for me.  I guess with auto scale we can just see who has been powered off for x amour of days and delete. 

for example in our non persistent environment we'd run into the situation where some app would have some dll files or something pulled into the UL, and then when we'd push an update to the main app to the image, it would conflict w/ the files that got pulled into UL and the app would break until you scrubbed it out

but like i said, i really loved the UL technology....we used it going way back to the early Unidesk days.  makes management really easy if everyone is on board

just makes troubleshooting a little trickier, especially if you have to deal w/ vendor support

When I was on the customer side we scripted the VM creation and addition to the catalogs and delivery groups.  I've never been a real fan of MCS for static (partially still some leftover pain from before full clones).  Used vSphere plugins for VM creation from template  and then CVAD plugins for adding to machine catalog and delivery group

i forgot to mention w/ our MCS static setup we use a generic naming convention so we just have a small amount of overhead/ready to go vm's waiting and assigned to a group so new employees only need to be added to an AD group that is assigned to that delivery group and it auto assigns a desktops first login attempt so pretty hands off

Yes that how I have the few I have setup now, just monitor the dg for machines and hands off. 

MCF full clones with Server VDI and SCCM to patch. makes decom easy too

late to this party but we run a bare image with UserLayer.  Working flawlessly since we put it in place a year ago.

<@ULLRRKZ8E> do you put any apps on the image? (Office/snag it). I assume you just use sccm after that? How big do you make your UL disks? 

We use Applayer. (eye roll from everyone in 3…2…1)
The initial image was stood up with just office, chrome, edge and our base security monitoring tools.  UL does not recommend spinning up a brand new image each time so we split this one off from our main MCS based VDI pool and just update &amp; snapshot it monthly.

UL disks are 100G via a registry setting in the Group policy for this pool.

They are primarily used by our developer teams. So a minimally managed non-persistent base image that they can install their tools on was the best compromise. Handily they work real nice as a Citrix admin desktop also, and i have been using as that since we spun them up.

Hmm, probably not. I was just following that article and used '*Add-PSSnapIn citrix*'*

Is there a specific module I need to import?

Yeah, but I am leaving for a long weekend. Maybe <@ULA39697C> can tell you

<@U0125D243RN> Have you installed the Remote PowerShell SDK? Did you use Get-XDAuthentication to connect to Citrix Cloud first?

I was able to able to see the results of the *Get-ProvScheme command.* 

Try this <@U0125D243RN> *New-PSDrive -Name XDHyp -PSProvider Citrix.Host.Admin.V2\Citrix.Hypervisor -Root XDHyp:\*

I was getting XDHyp not found error when checking hosting specific commands, after importing modules using "asnp Citrix*" it worked.

So, to close the loop on this, the Remote PowerShell SDK I was using was 7.26.80. I updated to 7.30, and now I can see the XDHyp PS-Drive. I didn't realize that there was a newer version. I swear I've done things fine with this version of the SDK before. But, there you go. Appreciate everyone's advice/suggestions

What kind of EUC tools do you have available at your fingers tips?

This is a hunch based on what you said, I would lean towards something modifying the session and applying different permission that exclude a admin being able to log them off. If I understood it correctly. I assume this happens on all 3 of the OS as well correct? Do you have Control up?

I remember u stating you had some issues on CU2 with 1912 a while back, do you feel that it was after that or was it happening before that?. I realize this isn't a easy question. I know procmon can monitor all processing for all users but and dump it out. Anyways Just throwing out things.

I’ve seen this issue with CVAD 2012, as of yet I’ve not managed to pin point the issue.

We do have 2008 servers in the mix that are being phased out, which I have not seen this issue on. It does happen on 2012R2, 2016 and 2019 with no particular pattern that I can see. We are evaluating Eg and ControlUp, but neither are currently running in the environment. We have Check_Mk for monitoring, but the capabilities for this sort of issue are somewhat limited.

It isn't that the admin can't request a logoff, it is that the processes in the session are stuck waiting on other processes in different a different session. I'm pretty sure it is in the printer drivers based on past troubleshooting, but I'm not 100% certain on that either of course.

This is not a new issue by any means. As we add more clients, it occurs more often, but we had it happen since 7.6 CVAD and I hadn't really done a lot of troubleshooting, just was restarting the servers and not watching until more recently as it comes up more often now.

I hadn't thought to take a ProcMon during the issue, just to see if anything can be gathered information-wise. I will do that next time as we have that as part of a standard server build. I appreciate the idea there.

<@U01FHEAMDML> I figured others have to have seen it, but may not really have tried to troubleshoot it because it really is pretty uncommon in the grand scheme of the number of sessions logging in and out.

<@U012AAZRJ20> It’s become more apparent for us since users worked from home with printers which only support type 4 drivers.

<@U012AAZRJ20> See if this will help you. Its around how to caputure a user session wiht procmon
<https://forums.ivanti.com/s/article/Capturing-a-logon-with-Process-Monitor?language=en_US>

Ignore the product in the link, but focous more on the procmon stuff.

<@U01FHEAMDML> That is very interesting. Been doing some reading on type 4 drivers this morning. Lots more to read and look into, but it gives me another direction to look at as well and makes some bit of sense as well.

I will keep researching on how to capture it more in-depth. Because I need to do it at times as well. We are all  on the same team even though we work for differnt companies

An customer called me early today. As soon as Teams starting the explorer crashes in the vdi, then we have to start explorer over taskmanager. After teams starting again - explorer crashes immediatly. Nothin changed, no receiver update, no teams update. PVS Image unchangen since 3th may. After disabling teams redirection the system stay stable.

Is that hosted independently of the store?

Then you can use the policy to install from a file:// location

Cheers mate, no rush, it's on my to-do list for later today :-)

<https://admx.help/?Category=Chrome&amp;Policy=Google.Policies.Chrome::ExtensionInstallForcelist>

<@US423Q1PU> does that work if the store is blocked at the perimeter though?

how did you block it? we configured the policy to block all extensions * and and are installing with force install policy<https://admx.help/?Category=Chrome&amp;Policy=Google.Policies.Chrome::ExtensionInstallBlacklist>

also if the other solution would work, how would you deploy updates of the extenions?

You would need something like evergreen which downloads updates of extensions but then it should work

We rebuild every month so a line of code to grab the latest, evergreen-style, would do

So, download the google chrome .crx file from a machine where you have store connectivity.  I think you can use the Get CRX extension to do this: <https://chrome.google.com/webstore/detail/get-crx/dijpllakibenlejkbajahncialkbdkjc>

Once you have the .crx file you can use the policy Selimir mentions

Copy the .crx to for example C:\Extensions folder and use the policy _Google &gt; Google Chrome &gt; Extensions &gt; Configure the list of force-installed apps and extensions_ ADMX policy can be set with a value of &lt;extensionid&gt;_;file:///c:/extensions/&lt;extensionid&gt;.xml_ to force Google Chrome to load the extension from the local file system.

&lt;?xml version='1.0' encoding='UTF-8'?&gt;
&lt;gupdate xmlns='<http://www.google.com/update2/response>' protocol='2.0'&gt;
  &lt;app appid='&lt;extensionid&gt;'&gt;
    &lt;updatecheck codebase='file:///c:/extensions/&lt;extensionid&gt;' version='1.5' /&gt;
  &lt;/app&gt;
&lt;/gupdate&gt;

update the &lt;extensionid&gt; with the real extension id in all the sections above

Installed my first test server with CU3 this morning and do not have the same issue. RDP works normally on 2019 VDA with VDACleanup followed by installation.  Interested in seeing if this is more widespread.

I do not use PVS, MCS or any other such services. Machines are static builds, so that is a difference to be noted.

Had the same issue with one manually installed VDA out of several (no PVS or MCS) with 2103. Did a reinstallation without VDA cleanup to get it back again. I thought it was a one time occurance, but maybe 2103 and 1912.3000 share some bugs...

Well that doesn't give a warm and fuzzy feeling  On another note <@U012AAZRJ20> did the CU3 fix your deregistration issues?  I have it running on my test environment and no issue with deregistration.

<https://enterpriseproductregistration.nvidia.com/?LicType=EVAL&amp;ProductFamily=vGPU&amp;ncid=undefined|https://enterpriseproductregistration.nvidia.com/?LicType=EVAL&amp;ProductFamily=vGPU&amp;ncid=undefined>

This one?

Idk if this is only for WIndows 10, but have you checked this setting? <https://admx.help/?Category=Windows_10_2016&amp;Policy=Microsoft.Policies.Printing::LegacyDefaultPrinterMode>

I'll go ahead and reply to myself lol.  I upgraded FAS to 1912 CU3 with the rest of the infrastructure on 7.15 CU5 and StoreFront on 1912 CU2.  No issues with the upgrade and things appear to be working normally.

Hello, I remember entries for O365 into Windows credential manager. 

In AppData\Roaming\Microsoft\Teams there is some information about tenant ID, user ID etc. in the desktop-config.json and settings.json

<@UL5TCSW3D> i figured out that teams needs the appdata\local\packages\Microsoft.aad.brokerplugin* folder. appdata\local\packages is in the default exclusionlist. i removed it and it starts working.  Maybe an s2019 issue? on s2012r2 and 2016 its not needed!

i'm not happy about that.... but i can't find any other solution :disappointed: maybe the better way is to include in an upm vhd

Yeah just use the full UPM VHD instead then, easy way out

Should just change the VDA DDC options and be fine.

Ok! Great, I will proceed, thanks for your reply :slightly_smiling_face:

After doing some testing via the on-prem DDC, the issue isn't tied to Citrix cloud, and our case was shifted back to Nutanix. They are recommending we update from LTS to 5.19.2, i'll post back the final results, and probably write a blog post on the topic, we've been tracking this issue for a week, and it's been quite a story!

I got to say, not just as you work there, but Nutanix support has been much better than Citrix on this issue. Hope to have full RCA next week, i'll keep you posted

I forgot to include the image we are seeing on Citrix cloud, here it is:

we have this happen when VM's loose their domain trust relationship.   noticed this recently after a WEM v2103 upgrade (sounds like a few others have as well)

same thing though......if they dont register for some amount of time , vm shuts down and i have to console in and run a PS command to fix the trust and all is good again until the next monday when a handful more happen (open ticket on it but they are ignoring me at the moment :slightly_smiling_face: )

Hmmm, this is Windows 2016, I'll check the WEM version, but the thing is that if we start them manually they do register successfully. Just a couple of VM's, I'll try expanding the restart window.

ok maybe not the same thing as us but we do see similar behavior w/ it shutting the vm down i guess but that doesn't help you much

What is non registration complaining about? I would start there...

Its default behaviour if a power managed VDA cant register after a specific period of time (20 mins default) it will shut down this reg key controls the behaviour  DesktopServer\MaxRegistrationDelayMin. How are you defining the controllers via controllers policy or manually during vda install? have you checked the desktop service logs to see why the VDA is failing to register ? Time/DNS/SPN/FW ect XDping/Citrix health assistant are decent tools for checking

Low level question from me Eric, is the machine actually alive on VMWare when it becomes unregistered?

also if using bis-f check the policy for delaying the citrix desktop service ive seen issues with that where it disabled the citrix desktop service and is meant to start it once the bis-f personalization scheduled tasks completes but sometimes it doesn't which leave the desktop service in a disabled state and VDA unregistered

On the WEM thought from earlier... Doesn't sound like what you have going on but we actually went from 1912 to 2103 so if that is playing a role like the weird similar thing we're seeing could have been any version between those 2 I guess

Do you use BIS-F (I guess you do). Check the logs, maybe the pers. task never ends and the Desktop Service doesn’t start. 

Thanks all for the great ideas. I just checked the logs on VCSA and they don't match up. At the same time as the reboot, there's a backup job running, so something is being messed up in terms of API communication to the VCSA.

<https://support.citrix.com/article/CTX207624?utm_content=buffer85bfe&amp;utm_medium=social%2520media%2520-%2520organic&amp;utm_source=twitter&amp;utm_campaign=CVAD|https://support.citrix.com/article/CTX207624?utm_content=buffer85bfe&amp;utm_medium=social%2520media%2520-%2520organic&amp;utm_source=twitter&amp;utm_campaign=CVAD>

Upvote for Health Assistant for checking registration.

For those looking at bisf, I wrote a quick script a while back to tackle this... <https://github.com/JamesKindon/Citrix/blob/master/CheckBrokerService.ps1|https://github.com/JamesKindon/Citrix/blob/master/CheckBrokerService.ps1> just in case bisf doesn't finish.. it’s an insurance policy 

I think I found the problem, the VMs with issues where hanging on "Getting Windows Ready, Don't turn off your computer". I deleted those VMs today and create some new ones. Let's see tmrw

I've usually seen a hang in vmware when this sort of stuff happens frequently. Good luck for tomorrow.

Hey, whats the reason for moving to a new catalog? If its to resize or the like you can do a fair bit with Powershell without needing create a new one... if a new catalog is required you could remove the VDA's from the existing then create/add to the new. You might need to remove / readd to the delivery group so to your point, there would be some downtime, cheers

The reason is, the machine catalog has two different kind of VDI's (memory cpu).
Its a failure in design and I would to create a new machine catalog and move there the VDI's with different settings.

When I try to add the stopped machine this comes

This might help <https://github.com/JamesKindon/Citrix/blob/master/Migration%20Scripts/MigrateMCSToManual/MigrateMCSToManual.ps1|https://github.com/JamesKindon/Citrix/blob/master/Migration%20Scripts/MigrateMCSToManual/MigrateMCSToManual.ps1>

Looks like you are trying to create a VM with the same name as an existing in the new catalog. Before creating the new catalog you would need to put the VDA(s) in maint, remove them from the Delivery Group then delete from the existing Machine Catalog then create/add... Try James's script :wink:

Jame’s script works well, just make sure you don’t end up with machines with a null published name

I forgot to copy the name over and caused myself some issues

would this script help at all in the situation where a machine catalog was created w/ 1 set of CPU cores / ram and you need to update it for future VM creations so that they get the new specs?

no, this moves machines into a manualk catalog

you can do that with powershell so new machines get the new number of cores

so you're talking outside of the studio machine catalog for that though right?

Yeah I don't think you can change it through studio unless that changed recently

or i guess you could use this script to migrate to a new catalog that has the new specs too so you can get rid of the old

I don't think you can migrate into a non manual catalog and a manual catalog doesn't have specs 

If auto-update is enabled, it should still try and register within 10 minutes if it fails to register. I think the auto-update list is populated every 90 minutes.

i think that applies to if we set the controllers via Citrix policy though right?  what if we manually have both controllers set in the registry under this?  wouldnt that mean it knows of both options  if it goes unregistered?

almost just seems like if it looses registration , it gives up until a manual intervention  but i do remember seeing a re-try in the event log in the past w/ other troubleshooting so not sure why it didnt work when we had our outtage

are you setting that key manually? Is it FQDN followed by a space and then the second FQDN?

there’s nothing in the logs showing it trying to connect to the other one?

what about in the DDC logs showing a failover? Maybe it didn’t properly fail over

it should do it automatically if you have more than 1 entry, you don’t need auto update but it is on by default

well at the time we were not quite sure what our outtage issue was and how widespread so did not think to check that unfortunately.   i guess now we're more looking to make sure we understand how it SHOULD work so if we had to take one server down for whatever reason or if we had an outtage would we have any downtime because of it.

you should be able to restart the broker service or thew whole machine without an outage

true i was thinking more like if this happened at say 5am before we're all in would the desktops recover and re-register w/ the working controller prior to the workday starting rather than us needing to manually intervene to restart that service

yes, they should fail over pretty much instantly

Do you have "EnableAutoUpdateOfControllers" set to 1?

That might be in SOFTWARE\Policies\Citrix\VirtualDesktopAgent