World of EUC

I've done that by publishing a script that runs the apps for you.  I don't believe that Citrix has allowed multiple apps to be run simultaneously, though it could be a cool feature request.

I'll check this out. Would it be a batch file that runs upon login?

Put Box into [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\RailRunonce]

<@UL5TD2QM9> Thank you for the suggestion. I do not see that registry setting under Terminal Server on our session server.

Is it a key I have to create manually?

yes, just create it, same as with regular RunOnce. REG_SZ with the path/exe/parameter of Box you want to launch

the only caveat is that it will run for any user that logs into the machine

Unless you use an FSLogix Redirection Rule to point to a "valid" entry only for a subset of users

I saw the known issues in the 2105.5 and stayed away. Didn't realize it was already replaced.

Yeah, I try not to deploy every release and I was pretty far behind again. Luckily, there were only 2 users with the issue. They aren't willing to work with us to work with Citrix to fix the issue since they are working fine in another browser.

I have already done this, without success.

That grey screen is pretty common these days. I've had a case open for two months and it's going nowhere

I am currently testing CU3. But I don't think it will do anything.

You're getting that error after installation, and not after launching Teams?

Thankfully, I've never come across that on my VDAs.

Saw this in Server 2019 with installed AV or Defender without Exclusions. Use procmon to find out whats going on. 

<https://worldofeuc.slack.com/files/U015G4SG5LY/F01MX7SLJEP/procmon_ctxuvi.pdf|https://worldofeuc.slack.com/files/U015G4SG5LY/F01MX7SLJEP/procmon_ctxuvi.pdf>

We’ve also had a custumer with this weird grey screen issue. The last information in the ticket was to add “SelfService.ex;CtxWebBrowser.;Receiver.exe” to citrix hooking. Not sure if it resolves the problem - the customer went away from trendmicro. With the ne AV the issue was never seen again, so in our case it was directly related to trend micro.

I'm running Trend Micro Apex One and have never seen that issue...

We have the issue and are running Trend but the AV guys swear blind Behaviour Monitoring is off, which is what is supposed to cause the issue. FWIW I shut down all Trend services on a server and it still displayed the problem

I know I have Behavior Monitoring disabled.

Found it....

HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\SfrHook" /v Teams.exe /t REG_DWORD /d 204 /f

Delete this Key and all works like a charm ^^

Really? If that turns out to be in our image tomorrow you will be a hero

Well it's in there.......might delete it from some dev boxes and promote them. Interesting

Pls give me response. In my test lab and my customer this works. But in Windows Server 2019/2016 I have this key too. And no grey screen :sweat_smile:

<https://docs.microsoft.com/en-us/microsoftteams/teams-for-vdi#teams-crashes-or-the-teams-sign-in-screen-is-blank> interesting that this is on the microsoft doco site now

Oh I wish.  Or if the virtual channel was not established?  Nothing like webex blowing up when you activate your camera.

On the VDA, under HKLM\Software\Cisco Spark Native, if you create a DWORD of 'VDIFallBackConf' with a value of 2, that should disable audio and video when no plug-in is detected.

Sorry, should have added, 2 allows audio calls but disables video.  If you want to block both audio and video then set the value to 4.

If I am not mistaken, this key is for WebEx Teams, I'm looking for the same option for WebEx Meetings

I am not certain but the customer I am working with  uses WebEx Meetings.  I believe they only use a single product now but not 100%.  The registry keys certainly work for WebEx Web Conferences.  If no plugin is detected, the user does not get the option to enable video.

<@URNUQN4DC> This key has no effect on WebEx Meetings

Do u disable the fastreconnect "feature" in windows server 2019 ?

<@UNKP0TYKX> regarding fast reconnect, take a look at this article:
<https://www.mycugc.org/blogs/brandon-mitchell1/2019/09/22/not-so-fast-reconnect>

No, I haven't. Thought it was solved in never versions of the VDA :slightly_smiling_face: But can test it and see if it helps.

We are going on 2 years with the Windows Search bug in WS2019 :wink:

image.png

What about rights on the DB with machine account?

crappy stuff, added admin via Powershell and all good, thanks

Search for my post, u need appdata\local\packages

another comment here <https://www.jasonsamuel.com/2019/07/02/how-to-use-citrix-cloud-enabled-federated-authentication-service-fas-with-microsoft-azure-ad-and-citrix-workspace-for-full-windows-password-less-single-sign-on-to-virtual-desktops-and-apps/|https://www.jasonsamuel.com/2019/07/02/how-to-use-citrix-cloud-enabled-federated-authe[…]-password-less-single-sign-on-to-virtual-desktops-and-apps/>

I think it’s an older one. I‘m using server 2019 with a Citrix site based all on 1912 CU2 with FAS and all my VDAs are aad hybrid joined. Seamless SSO to all kind of o365 apps is working fine. On my VDAs the state is „AzureAdJoined: YES". I‘m using FAS in combination with NetScaler connected to aad via saml. No adfs in use. 

Very interesting Julian,  we are using Citrix Gateway Service.   We also get AzureADJoined - Yes,  the problem is get AzureADPrt = No, and IsUserAzureAD = No .    Do those show as Yes for you?

I'm seeing the same issue at a client.
If you lock/unlock the session do you get the PRT?

We are planning an upgrade of FAS to 2103 which has a Citrix_SmartcardLogon cert template improvement.

Hi Jesper, very interesting - yes we do if we lock and unlock!

this article says to run another /join in the pre-desktop stage.   This is more of an Ivanti Appsense concept, and it was written from an Appsense perspective.  Question is what is the most reliable way to run a command in that phase, without Appsense?  <https://desktopsurgery.com/2021/02/13/to-hell-and-back-with-hybrid-ad-join-for-vdi/>

Ok, I've triggered it in response to event Citrix Authentication IdentityAssertion, event 106.  As the earliest possible event, and the dsregcmd /join happens almost instantly.   Still no AzureADPrt.

By the way, we are using FAS 2103 and we still see the issue.

We just upgraded to 2103 and see no difference like you. Next step will be to implement a new Domain Controller Cert template which includes Kerberos. There are some similarities between the Citrix FAS setup and Windows Hello for business that makes me look that way.
<https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki>

That _should not_ be necessary. The cleanup utility is automatically run by the VDA installer from my understanding.

I do both, at times upgrades will fail, or a upgrade will install and I have seen issues. The I uninstall, the run the VDA removal tool again.  Then Install fresh.

the % of the time. I remove and reinstall is what I stick with alot.

VDA commlind util has some good stuff that may enable you to automate it via cli

So ray you'd say you normally just uninstall the existing and install new and only use the cleanup if you have a failure?  Thanks for the command line helper tool, I actually came across it before posting my question.

I recommend using the VDA Cleanup utility and reinstall the 1912 VDA. I have done this a couple of times and it was always the best way for me. 

<@U01BLNEMDFU> I do, But what Dennis just posted is ideal. VDA clean up Utility will do a better Job. To be honest, I need to just do that, instead of the old fashion uninstall. Which I run the run the VDA cleanup tool anyways. Why not run it first lol.

yeah that's what i was thinking, i mean if i have to go back and clean up lets say 50% it seems to make more sense to just run the cleanup first then the new install

After having so many strange issues with upgrades, I now always run VDA Cleanup and then install.

I have it all PowerShell scripted, which I have posted other places in the past before, but I think I have it much cleaner now than what I think I posted previously, using the command line options that the VDA cleanup will return codes if a restart is needed.

DM me if you are interested in my script and I'll sanitize the company specific stuff from it and shoot over.

looks like 2105 fixes some stuff, but was hoping for some peer information

We've got a lot of users on it. Get upgraded to the latest Workspace App version is first port of call. Make sure you're on latest Teams client too.

Had issues, and they seem to get less as you upgrade WSA?

TBH most of our issues occurred when we didn't have the Teams installer switches right in the build and users were trying to update profile-based copies, rather than being WSA related. We see occasional weirdness but normally just dumping the Teams cache rectifies these (we've set up several scripts to allow users to service this themselves)

it sucks we/you have to do things like that.  We are using the programfiles based version for sure

<@UL5TCSW3D> Well, initial test with 2105 over 2102 is night and day, holy shit.  Crisper video, cleaner audio, no delays.  damn.

And now there's all sorts of Gallery and Together goodness from the client end too

yeah, crossing my fingers this makes some clients happier

also tried playing with visual quality, but this seems to be the one that performs the best

<@ULM8XKAVD> You're the master of this.  Any thoughts here?

<@UK6S90JDR> You've done everything too..  But, appears as though you're away...

If you‘re using xenapp (server os) fps is limited to 30 per default. Checkout this regkey <https://docs.microsoft.com/da-dk/troubleshoot/windows-server/remote/frame-rate-limited-to-30-fps|https://docs.microsoft.com/da-dk/troubleshoot/windows-server/remote/frame-rate-limited-to-30-fps> 

Hey <@UTT4BTR1S>, Server OS (what NVIDIA would call vApps) is really there as an option for best density if you need some basic GPU acceleration for apps but not to drive a Workstation class replacement. Windows 10 Virtual (or Physical) desktop with discrete graphics will ALWAYS render the best and most performant option, but at the cost of density (ultimately $$ per user). Thank you for the plug <@ULHA2NPPX>, I really appreciate it. As <@ULCBD9AJD> mentioned, Server OS will ALWAYS have some limitations compared to Client OS with vGPU, the framerate being one of them. GPU API support being the other (things like CUDA, OpenCL, OpenGL, WebGL, etc.). At the end of the day this really boils down to best understanding your applications, your users, your use cases, and the different tools that you have available in the toolbelt. For years with GPU deployments I lean toward starting with Server OS + vGPU (or fractional/shared/partitioned GPU in the physical world), with Client OS + Dedicated being the furthest end of the sliding scale of graphics experience. Getting into Public Cloud environments with their GPU options is also a very enjoyable conversation I like to dive into during deployments. Please let me know how best I can help or if it would be better to setup a call. Thanks!

awesome. Thanks <@ULM8XKAVD>! Yeah we initially modeled this environment with Server OS and pass-through DDA with Hyper-V for a customer using AutoCad and Revit. All testing went well and they signed off on this. when we went to bring to production, we were hoping to save management since we are using MCS and move to a hypervisor that supported vGPU like XenServer. with Hyper-V and DDA, the limitations are pretty massive when using MCS. just a pain to keep assigning the GPU over whenever creating new machines and support will have trouble with that. So we put in XenServer and enabled vGPU on XenApp and it ran ok, but we ran into other weird performance issues with XenServer. I have been working with support, but its been a losing battle and just this afternoon wiped my XenServer host and installing Hyper-V again to make sure my tests were in fact better on Hyper-V. Thanks for all of the data and we have sure learned a ton here. Again, I think the client is happy with the environment, but I just like to see if we can make it better. Thanks for your quick response

My best guess is Storefront 1912 doesn't work with ADC 11.1 64.14

Love that issue… for me was the fix to hold storefront and adc up2date

I’m not seeing that in my 20H2 image on 1912 CU2. I assume the image is optimized (Citrix Optimizer)?

i am rerunning the optimizer. this image was 1909 originally and then got updated. and unfortunately I cannot revert it. There maybe other issues with it as it does have a bunch of apps. Also runs in Azure to make things more interesting

Bah use rendezvous protocol and achieve the same result - no ADC required - you can do what they suggest but there isn’t much point 

Right, that was my thought too. I'm not really sure why they're suggesting this over rendezvous/EDT.

Hmm, this will be a problem though:

"Citrix recommends using EDT through Citrix Gateway Service only with VDAs running on Windows 10 and Windows Server 2019. There are limitations on Windows Server 2012 R2 and 2016 that do not allow for an MTU greater than 1024 for DTLS-encrypted sessions, which can affect the performance and user experience"

<https://docs.citrix.com/en-us/citrix-gateway-service/hdx-edt-support-for-gateway-service.html|https://docs.citrix.com/en-us/citrix-gateway-service/hdx-edt-support-for-gateway-service.html>

Our Server VDAs are 2016.

well that is a new one - that is the first time i have seen that little snippet - must have been added recently - test it I would say...

Rendezvous had a some "growing pains" when it was first released, so definitely test before going all-in. For the ADC side, I don't have a CVAD cloud tenant in front of me, but does it allow you to add a NS gateway just for HDX routing (similar to how storefront on-prem allows)? If that's possible then your auth setup shouldn't have to change at all.

Cool, thanks gents. Looks like I have some testing to do. Much appreciated!

Are you using Citrix SD-WAN?  We noticed the same issue when we had a problem in our Citrix SD-WAN infrastructure.

We don’t. All users connected via Cisco VPN client. 

It’s difficult to troubleshoot as we have only ~20 users per day with such issue for 80servers with ~800 users daily. 

Could be a combination of the Cisco VPN client and MTU. Are you using EDT (UDP) transport?

It seems to be some issue with missing Heartbeats between NS. In the same time both were trying to be primary for 1-2 seconds. We are using EDT/UDP and some packets were not delivered. Not sure why Citrix did EDT in wrong way - EDT should be protected (shoud use TCP?) against missing packets during connection negotiation. 

You could use a proxy for the affected users. Are you sure it's related to the public IP?

surely it is a problem of geolocation of the ip.
At the moment the proxy is not among the options, we are evaluating the features offered by citrix first.

to my knowledge citrix is not offering a built in feature to modify your geolocation IP. Had a similar request to change the geolocation in azure (amsterdam) and managed it with a static ip on an azure loadbalancer.

The hypothesis was to redirect all internet browsing using a local browser of the endpoint, or a list of URLs to be redirected to the local browser of the endpoint.

I used to do this with host to client redirection <https://www.htg.co.uk/blog/using-host-to-client-redirection-in-citrix-xenapp> - however there are many other ways you could skin this now

Hi James, but does it work for links entered directly in the browser? What other methods could I look at in your opinion?

You'd have to look at content redirection for that

If I understand correctly the url redirect is also part of the local access apps, which requires premium.
Host to client I understand that it does not work for url entered directly in the browser, but maybe I'm wrong?

Check the article, I can't recall offhand

I think browser content redirection is the one you are looking for. Pick the client fetch, client render features and the local client contacts the url, renders it and blends it into the viewport.

also is cool if you are ordering a pizza as with BCR you are seeing your actual location instead of getting pizza restaurants from Rome on screen

Thanks Rob, I think it is the only solution that you can use in my case, I have not had a good experience with BCR lately, I hope it is good for the requested links.

BCR is available is all versions..
I had issues as well recording demo's, most were that the vda and my client had a hard time agreeing on something (I blame my wifi for that)..

the other option is to use CVAD service and create a pool in a US region

(always finish a sentence before hitting enter)..
collect cdf traces from vda and endpoint and the chrome debug log if you run into something I can drop them with the engineers to look at that.

could be something like a timing issue where e.g hdxvideo js is not loaded

well if we will consider this solution i will let you know, last time i had problems on a customer for example with teams via web or google meet, despite all the indications followed by citrix i could not get it to work.

Thanks Rob I'll let you know if there's any trouble :slightly_smiling_face:

Looks like get-brokersession doesn't take any pipeline.  Odd.

```(get-brokermachine -InMaintenanceMode $true).foreach({Get-BrokerSession -machinename $_.MachineName -maxrecordcount 999})```

I had to foreach it that way, using foreach-object preferable, but returned nothing.

(And assumed you wanted machinename, not clientname).

just tacked | select userfullname onto it and I have my list

<@ULL6F7DRA> would be your man for Edge know-how

I don't have any information about restrictions applied via registry, but I have written about how to make Edge nice and secure via GPO:
<https://virtualwarlock.net/microsoft-edge-in-citrix-revamped/>

Another question, configured IE11 Enterprise mode using GPO for legacy web app. IE11 mode kicks in after few seconds or on refresh, not immediately after opening the browser.

There is a 65 second delay on Enterprise Mode site list check:
<https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file>

Thanks. Have you tested Kiosk mode with read only address bar with MS Edge?

<@UKJTJD4KA> --app switch is one solution, but is there a way to delete the menu that you can get from right clicking the taskbar, or even stopping users pressing CTRL-T to open a fresh, not locked down browser session?

Zero idea on that one, I thought app switch did the majority of that in chrome days, but I’ve not needed it for a long time 

--app on both Chrome and Edge still give the user the ability to break out into a full browser, unfortunately.

Did you install Office in shared licensing mode?

excluded office rearm from prov scheme for now. looks like that eliminates error

We use it and don’t see that issue, use both clock to run and admin install.  But I have it set to shared license mode 

If I remember correctly, you can configure AD GPOs to restrict access to certain features in Remote Assistance

Thanks, I’ll check that out.  I bet it’s something like that.

You’d probably want to expand the sites to have zones in that case and have the other DC with the new DDC be in its own zone.

<@ULLAD12P2> Can you point us (me) at some documentation on how this might be accomplished? I am not well versed in Zones and if I can easily limit what VDAs contact what DDCs, it may be possible to reduce some complexity I have currently managing 2 different sites and just get down to using Zones.

I looked at them in the past, but didn't see how I could make it work the way we needed.

Thanks.

If there's a good reason that they are independent sites then you might not be able to make them 1 site with zones but you could make them 2 sites with zones. 

Zone preference and failover gets complicated quickly depending on what you're trying to do

You can also do multi site aggregation with failover in storefront which might be what you need

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/zones.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/zones.html>

<https://docs.citrix.com/en-us/tech-zone/design/design-decisions/storefront-multisite-aggregation.html|https://docs.citrix.com/en-us/tech-zone/design/design-decisions/storefront-multisite-aggregation.html>

Thanks for all of this. I am going to review again. There really isn't any reason not to use Zones other than they didn't exist when the environment was created, and I couldn't figure out how to limit registrations to the local site using Zones before. Not sure if things changed from when I first looked at Zones when they came out, or I didn't understand things.

You should be able to do what you want with zones and failover preferences

Yeah, should be able to do it, I think.

We are slightly different in how things work as each client gets a set of VDA servers, a machine catalog, and a delivery group. Under normal conditions, they never cross sites. I think with a primary zone, with controllers in each site, with no VDAs associated with the primary zone and satellite zones in the data centers with DDCs associated with the MCs and DGs properly.

Failover/outage situation would be bring up the replicated servers (including profile server) on a new IP addresses in the backup DC and the would register with the Primary Controllers. If it's bad enough to bring up over in the failover site, I'm going to assume the primary site is down and the Primary Zone controllers would be local at that point, or it would be a temporary situation, or I can move them to the alternate zone until the normal zone is functional again.

A couple questions about how Storefront would be ideally configured. Currently, all users connect to Storefront in Site A. Users with Site A VDAs enumerate applications much more quickly than users of Site B. Would the enumeration of Satellite Site B be any faster for the users continuing with this method, or would it be better to use the Storefront servers in Site B for Site B users? Would it really make any difference? Site A and Site B are connected via 10GB VPN connection with ~70ms (or less) latency.

I currently have HDX routing configured to use Zones and if I have a client with an ISP issue that prevents them from routing to their primary Citrix Gateway, I can move the catalog into the other Site Zone. This should still work, but the VDAs would end up connecting to the DDCs across the VPN connection or the Primary DDCs that are local to their site, for instance, if we blocked with firewall rules, the connection to the alternate site DDCs, correct?

Any considerations around the Site DB? I would only have one Site DB in Site A, which is already configured in a distributed AOC and replicated to Site B. Current Site B is also configured in the same manner with replication and failover to Site A.

I have Director already configured in both sites, and this seems like it would reduce the configuration needed there as well. It would only need to point at the Primary site that would pull the rest of the data in from the satellites, right?

Thanks for all the info. Much appreciated.

If it’s not active/active then zones might not make more sense than what you have now and you might be better off just using storefront aggregation and keywords. You could publish applications with identical names and they would always go to site A unless it was down, then it would try Site B which you could bring up manually if needed.
The enumeration speed is going to be slower if site A storefront has to talk to Site B DDC. Does site B DDC talk to a local SQL in site B? If it then has to talk back to site A it’s going to be even slower again.

I understand what you are saying. The main benefit for me would be a single point for configuration. The admins that do the client configurations would hate me if it forced them to do the updates in two sites. And I can guarantee that not all updates would be done in both sites. I have on my task list to write some PowerShell to keep the sites in sync on a scheduled basis, but that hasn't even come close to be being written yet.

If I were to direct Site B users to StoreFront in Site B, I could probably keep the the enumeration times to be about the same with moving the Site DB to Site A for Site B users, but the plan was to get Site B users improved enumeration by directing them to Site B SF.

I'll probably keep it the way it is and spend some time on the PowerShell to replicate the configurations. I appreciate being able to bounce the ideas off someone.

Are you using local host cache? You might see an enumeration benefit there with site B but you’d still want to use site B sotrefront

You might want to take a look at this to make sure your users are actually hitting the storefront that is local to them. <https://docs.citrix.com/en-us/citrix-adc/downloads/global-server-load-balancing-powered-zone-preference.pdf>

I have looked at that in the past and got as far as creating a static list of client IPs. There's no way I will be able to create this list in any reasonable sense that I could see. 100's of clients with 1000's of employees working from where-ever. I will be going with RTT and STATICPROXIMITY with a location DB, when I get to that point. It will just have to be "good enough" until something better comes along, or we decide to use location based login URLs, which we have been avoiding.

It's more the custom header and the redirect that I was thinking of 

I think I am totally missing how it works and what it's supposed to accomplish. I've read through it a few times, and still don't get it. I'll try again tomorrow. :slightly_smiling_face:

It's not an easy concept to grasp by any means

It basically sets up a vservers that has a redirect on it that captures your IP rather than the IP.of the DNS server you used and then uses that to determine which storefront server you should go to

the users pretty much get round robin'ed b/t the aggregated sites...once they are pointed to a site, then VDA load is used.

That's means if one user consums 50% of CPU Storefront continue to LB users to each site.
That's what I explained to my customer. I just wanted to be sure.

Don't forget - that option isn't necessarily, on - you can run aggregation without the load-balancing.

Set-Item -LiteralPath @("XDHyp:\Connections\MKN1CLOUC4CTX") -MaintenanceMode $InMaintenance

with $inMaintenance set to $true or $false

be sure to asnp Citrix* first, even within Citrix Cloud console.

I have never done it myself, but that seems like it should work. Worst case scenario it doesn't work and you VDA Cleanup and redeploy with new command line switches?

Thanks <@U012AAZRJ20> I ended up just going into Programs and Features and doing a "Change" on the CVAD install, it lets you add components through the GUI so I added UPM and UPM WMI.  I'm getting the proper data back into director now.  I actually went back to my 7.15 build docs and did not notice any option to add UPM from those screen caps so I assume Citrix changed the 1912 installer to not install UPM by default.  I guess I have to pay closer attention to these changes :upside_down_face:

Long live windows endpoints on small factor PCs - nothing comes close with handoff technology and raw compatibility considerations - just sayin :man-shrugging:

Yeah, for sure. We have a ton of those. But that comes with the management of Windows, which comes with its own headaches. Also, going with a Linux-based OS is gonna extend the life of these things by a significant amount. Windows is definitely the devil you know, though.

We've been using NComputing thin clients (RX-HDX and RX420 models) for the last years.   The Stratodesk OS gives us the flexibility that we need.  The devices perform well for general Office usage.  Teams/Zoom optimization is not possible on these models (ARM CPU), so we are now switching to Atrust T177L in combination with Stratodesk OS.

I was surprised to see Ron (IGEL) mention that the UD3 would basically be required for videoconferencing. Makes me wonder how useless the previous UD3 generation is in that regard, given that the new UD2 has better specs.

Yeah, and to offer up alternatives too. Was a little surprised at that, to be honest. I can as our rep, so no worries if you're not sure, but when did they refresh the UD2? As we had some in on trial, which we still have. But if they've all been refreshed, we're going to need to get some UD2s and UD3s to compare.

They refreshed the UD2 sometime last year.

Wait, I take it back, the UD2 was refreshed in 2019

Gotcha, thanks. We got ours pre-covid, so it's likely the older version. Good to know!

Yeah, we have a mix of both new UD2 and old UD3

The Dell 5070 Pentium on ThinOS 9.1 has been running nicely with Teams. I was about to throw in the towel on the Dell kit until they released ThinOS 9.x, regular updates have been coming through and there have been no real issues as yet.

If you've got a case associated with this issue and haven't heard back about workaround or fix details, you should definitely reach back out to support and request an update.

Fix will be available in CWA 2106 - I just need more details 

CDFMonitor should show something more… 

Director says smart card virtual channel is not active or disabled. I'll give HDX monitor a try.

Alright, we managed to find the root cause.
Upgrade restored the keys `HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Smart Card Hook` and `HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\CtxHook\AppInit_Dlls\Smart Card Hook` which prevent to map the smart cart reader into the user's session.
Removing them allowed us to use smart card reader.
Thanks for your help guys!

Heads up - Angelo Saraceno (PM for Web Studio and the underlying REST API) and I will be comparing and contrasting the CVAD SDK and REST API in the next Citrix Developer/CUGC webinar, 7/6 at 1pm Eastern US time

<https://www.mycugc.org/events/event-description?CalendarEventKey=e28ca41f-37b3-435b-9232-612f0bed45dd&amp;Home=%2fevents%2fwebinars>

So I'm upgrading FAS from 10.0.0.2 (that would most likely be version 1909 but Google only returns a lot of hits on VIPS) to 1912LTSR CU2. The FAS installer fails to install and just returns that the version already installed on the server is newer. I see some stuff on-line about StoreFront installed on the same servers that can cause this, but our FAS servers are dedicated. I'm hoping not to lose my maintenance window without a re-install :slightly_smiling_face: , so any advice on this?