World of EUC

yes. Citrix tests major updates, not minor.  they do the same with sql server.

image.png

The GPO you can use to tell Windows to Hybrid Azure AD Join has options for decide registration in the device or user context. Set that option to use rue device context

hi, is that the MDM setting?   Or is there something else.

Thanks Aaron  - and that applies to Hybrid join problems too?  I can't see any other reference for it. FYI -  we aren't trying to use Intune or anything.

Actually my bad. I shouldn't multi-task. Not that policy. 

I typically find that a machine can take up to an hour to Hybrid Azure AD Join (I.e. Azure AD Connect to sync the machine object)

Is the computer account OU in scope to sync and have you waited enough time?

its been days since everything was synced.  I tried blowing out all the Devices in AAD, same problem.  The funny thing is,  it DSREGCMD / JOIN works fine post logon.  Although most articles suggest we need a two successful strikes to get the AzureADPRT / User SSO working.  But the prelogon attempt always fails.   I even tried a Scheduled Task to trigger it on machine startup - then running it 5 times at one minute intervals.  Each one fails with the same undocumented error.   Works fine directly on the gold master though, outside of MCS.

I don't use language packs but did you see this? <https://support.citrix.com/article/CTX268996>

Thanks. I just found that right after my post. I can't get the setting to stick, but not sure if it is a one time thing. I then recreated my profile and it's still not giving me a language bar.

I'm not 100% certain I'm doing it right either, of course. :slightly_smiling_face:

I have enabled it for Rendezvous protocol and no issues

I had it enabled for a farm with internal TLS encryption for years without issue.  As long as DNS is right you're fine.

I use this setting in all my citrix Cloud Sites. No problems since I activated it

There is a big difference between functional process and supported process. If you need supported process, I would reach out to Citrix Support.

Theoretically (depending on your environment and requirements), you could put all other controllers into maintenance mode. It's a method I've been using to select specific storage for provisioning.

Thanks.  My scenario is that I have azure catalogs that I need to create and we have several controllers without internet access.  So every time it elects those, the catalog provisioning process fails.

There is a concept of FMA services that are running on controllers - theoretically, you could use that to control provisioning. However I'm not sure about supportability (it works != it's supported).

Couldnt you set a preferredcontroller using set-brokerhypervisorconnection ? Sure i seen that parameter with the get-brokerhypervisorconnection cmdlet previously

Screenshot_20210610-002926.png

Can you clarify?  Using simple hostnames (not FQDNs)?

<@UV3TVUW0K> yes just jusing hostnames without /

I would create another catalog instead, static this time, for these users, with increased RAM and CPU.

I guess we also need a different delivery group?

Yep static assignment. Maybe look at tags.

I would do another catalog and delivery group with pooled assignment unless machines are persistent. Create another active directory group to manage access. Static assignment could be an issue if random machine crashes or does not boot

You can create a second machine catalog for the power vm‘s and put them in the same deliverygroup. Create a new ad group for the user, put both in a new zone and voila -&gt; users could fallback to the normal vdi‘s, when the power vm‘s are not available

For me, it's a number of factors: how many images you have to maintain (App Layering), whether or not you want to minimize management overhead (App Masking vs WEM vs AL), and what your goal is (hide certain apps from some/all users, etc.).

I'm down to a single image in my W10 VDAs, and used to use WEM for all custom application shortcuts, depending on the target user. Now, I App Masking solely to hide things I don't want anyone to access, bake the application shortcuts into the relevant App Layering layer, and use WEM to apply custom Start menu items because of the versatility in options, like enabling auto-launch, etc. I don't think you can go wrong with any method, but App Masking and WEM are easier to control in the final image versus App Layering, IMO.

For me AL is to much overhead when you only have to manage up to three images per customer. In smaller environment where often custom applications are used with an high rate of updates the administrative overhead is to much with AL. Manage Startmenu with WEM is also more complex - when using appmasking you manage the whole alluserstartmenue per groupside and flush the startmenu folder from the userprofile - done

I think Teams uses the default sound device in Windows

I found this.  <https://maartendamen.com/using-citrix-with-the-new-microsoft-edge-chromium-based/>

Maybe the customer forget to confirm the page that checks for a local CWA. You can perform the check again by cklicking on the Account Settings (right upper corner) and “Change Citrix Receiver”. After that choose Detect Receiver and Edge will ask you to open ICA files with the CWA.

Accepting the pop-up does add an entry into the toasts reg key, but it definitely does something else, as the value alone doesn't resolve it.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts]
"receiver_receiver"=dword:00000000

Actually, this rings a bell with other apps

Try modifying the "Define a list of allowed URLs" in your Edge Chromium GPO and adding "receiver://*"

Hmm, not working for me, even if I include <https://support.citrix.com/article/CTX285038>

That said, I know StoreFront isn't configured properly, either.

I'm testing on a Storefront site that I know is setup the way Citrix wants for Chrome/Edge Chromium, and it still isn't automatically launching CWA.

<@ULL6F7DRA>: You ever run into this/figure it out?

IE Mode in Edge Chromium works, but that's just a stopgap, IMO.

Yeah, we mentioned that with the customer.  As you say, it's a stop gap, but they would really rather not enable that if possible

I'm apparently blind. Check out the "List of file types that should be automatically opened on download" GPO setting. Enable it and add ICA, now Receiver works.

I'm testing with the other two policies mentioned above enabled, FWIW.

It does leave the old ICA file behind, though, so there has to be more to it.

<@ULC9J5XPB> I have not. The receiver://  value is usually enough

Damn. I'm almost there, but having the ICA file remain is a new hurdle.

Unless I just stop redirecting Downloads and call it a day

....and I have never changed anything on the StoreFront site to support Edge/Chrome

I'm going to create a new store and start my testing over, since I was just mucking around before. I have no idea what I actually changed in SF.

Geez, <@ULC9J5XPB> You're spending more time on this than I am!  :slightly_smiling_face:  I do appreciate it ,tho.

We're getting ready to move to Edge Chromium ourselves, so this is right in my wheelhouse now, too

Kasper, do you guys still have to click on "Detect Receiver"? That's one thing I was trying to address initially. Pretty sure that's a SF config file change.

Ugh, tested the same site on a non-Citrix VM and it looks like it's working without any GPO changes. So my Edge GPO has something borking it.

Yes, I think the very first logon always triggers that "Detect Receiver" box

If we manage to come up something for that, I'll post back.

Now I get to see what in my Edge GPO is causing the other issues.

Now that I'm in this rabbit hole, I've got a few clarifying questions. Currently, our Storefront URLs are in the local intranet zone. However, I've read conflicting material that says they should be in Trusted Sites for SSO to work in Edge/Chrome. Which one is accurate?

I'm just seeing weird results. On a test VM, non-Citrix, SSO doesn't work until I throw the SF URL into Trusted Sites. In my Citrix image, SSO doesn't work unless I use IE Mode.

Doing any modifications of the Local Intranet Zone?

The only thing I can think of is enforcing automatic logon with username and password

Are we talking SSO via native CWA or via web login? Or both?

Web login via browser. We disable all native CWA stuff.

I have just booted up a W10 machine here in my lab. StoreFront SSO works fint, but I see a username/password prompt on the Session Host I reach

I've seen that randomly in testing before.

So it's definitely something in my old SF site. Built a new one, and SSO works, after getting past a few nag screens (install receiver, initial Logon button press).

Just to clarify, SSO works, but is it autolaunching the session?

GOnna be testing that shortly. I had to modify my GPO to remove my SF site from IE Mode and from auto logging me in to my profile.

Yep, SSO works, and apps launch automatically

We're going to work on the receiver detection screen next. And if possible, that stupid Log On button.

#2 automatically disappears and moves on after a few seconds. It's the Log On button that I think winds up being the hard one to remove in the end. Could be wrong.

<@ULC9J5XPB> I am still looking at StoreFront web SSO and I keep getting the password prompt at the Session Host. I have SSO working in the native CWA. Did you change anything on the end point?

I haven't changed anything in this round of testing, but let me paste a screenshot of our endpoint Citrix GPO

A new, default SF site (we're on SF 3.12) worked just fine out of the box with regards to SSO.

I don't see WMI errors, but I also have Citrix resource monitoring disabled due to high WMI usage in versions long before 1912, not sure exactly when I disabled it, but I'm thinking around 7.9 or so.

This is the policy I have set globally:

Customer is using CVAD Advanced, so a maximum of 1 month duration in director. Anyone ideas on how to check specific user hdx sessions which are older than 1 month? Citrix Powershell or good old domain controller logs? Thanks!

Not sure if this will work...

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/technical-overview/active-directory.html>

vSphere 
• *Note:*Citrix performs compatibility tests only with the major updates of VMware vSphere, like Update 1, 2 and so on. The minor updates like 1a, 1b, 2a and so on are not tested, however, they are expected to work fine.


CWA 2106 was also just released. We started our 2105 deployment this week, so I'm going to cut them a slack and just skip this one...

Servers must be busy. Can't download it. Just get the spinner for a few minutes them a gateway timeout error when trying to get the ISO.

Joke’s on you - CWA is a perpetual QA cycle.

What this option does is that when brokering sessions, the broker will return the VDA's FQDN instead of its IP.
So if you were to open the ICA file for an internal/direct connection, you would see the VDA FQDN as the target instead of the IP. In this case, you need to make sure the client devices are able to resolve that FQDN to the correct IP.
For external connections, you won't see a difference in the ICA file since the target address or FQDN are never exposed. In this case, the Cloud Connector must be able to resolve that FQDN to the correct IP.

If the client and/or cloud connector is unable to resolve the FQDN, or resolves it to the wrong IP, the session launch fails

That makes sense. Just worries me that it's an all or nothing setting. I don't see it being an issue, but wanted to make sure.

On the flip side, if you see any issues, it's easy/quick to revert and get back to working state :slightly_smiling_face:

Appreciate the detailed response. I'm going to include in my change request! Ha!

(I'm the PM for that feature, btw, so happy to answer any questions)

Sorry to revive this old thread, but I have a change happening tomorrow night to flip this on! Excited to try it (once we get EDT enabled on the back end!)

<@U01067Q2QUV>, no issues so far. Thanks for checking. Next up is getting the prereqs for Rendezvous sorted. We have some juggling to do on that front. We ran into some issues, and support advised us to turn off Adaptive Transport (as well as something else that escapes me), so we have to put that in place, but enable it for the VDAs we want to test with.

something that got published recently... one of the pre-reqs for rendezvous is to configure a reverse lookup zone in DNS, or enable dns resolution in the CVAD site. We just added an option in Web Studio for the latter, so you no longer need to do that via powershell

In web studio, go to the Settings node on the left. You'll see an option for "Enable DNS resolution" that you can toggle on and off

Ah, yeah, my colleague noticed that in there, literally the day after I did my change. Ha!

Salut Julien, ce n’est pas supporté. Je pense qu’il faudrait créer un autre site Xendesktop pour le cluster en 2012R2.

Salut Ramzy,
Sérieusement ? C'est abusé si c'est ça. Tu as l'info officielle ?

A mixed Hyper-V cluster is not supported. An example of a mixed cluster is one in which half the cluster is running Hyper-V 2008 and the other is running Hyper-V 2012.

<https://docs.citrix.com/en-us/xenapp-and-xendesktop/7-15-ltsr/install-configure/install-prepare/msscvmm.html>

Mixed cluster = différentes versions d'hyper-v au sein du même cluster et non deux clusters différents

ok mais par défaut quand tu vas vouloir installer la console scvmm 2019 automatiquement il va vouloir supprimer la console présente. lorsque tu vas vouloir changer le repository pour avoir les deux versions sur les DDC il prendra la variable d’environnement par défaut

Before you start
• Check the supported operating systems for the console that are detailed in the system requirements.
• Review and ensure you meet the system requirements. <https://docs.microsoft.com/en-us/system-center/vmm/system-requirements?view=sc-vmm-2019|Learn about> system requirements.
• Make sure you have at least local administrator permissions on the computer on which you’re installing the console.
• The VMM version of the console must match the System Center version of the VMM server. For example, to connect to a VMM server running System Center 2016, the VMM console version must also be 2016.
• You can only install one version of the console on a single machine.


• You can only install one version of the console on a single machine.


bon, va falloir envisager un deuxième site je pense

L'option créer une zone dédiée est peut-être aussi une solution même si je ne suis pas fan

oui mais lors de l’envoi de requête de démarrage tu es sur de pouvoir controler le broker qui va réaliser l’action ??

From my experience in the past only one version of the console and also make sure you always upgrade that first before upgrading SCVMM server. 

Thanks everyone, we will create a new CVAD site because we cannot remove Hyperv 2012 and we need Hyperv2019

Or even a way to do it with SelfService.exe?  I can't find the switch to add a gateway.  `SelfService.exe -init -createprovider Corporate <https://citrix.domain.com/Citrix/Store/discovery> `

Maybe check the registry classes root for .cr files and look what command is being used?

application/vnd.citrix.receiver.configure

```C:\Program Files (x86)\Citrix\ICA Client\Receiver&gt;assoc .cr
.cr=cr.Document

C:\Program Files (x86)\Citrix\ICA Client\Receiver&gt;ftype cr.Document
cr.Document="C:\Program Files (x86)\Citrix\ICA Client\Receiver\SRProxy.exe" "%1"```

You're sure that gatway service is enabled on your workspace? Never read of any kind of autodetection. Is NLS configured on the cloud portal gui?

Yeah definitely sure gateway is enabled even triple checked that going a bit crazy. Where do you see NLS in cloud portal?

Oh snap, thanks :D will look again Monday

I just upgraded my lab last night and the Required SA date in Studio I see in the licensing section is showing as 2021.0515. Then again maybe I just got lucky as I didn't pay attention to the date shown when installing as my actual SA date is 2021.0824 so it would have just snuck into that one.

I would call Citrix Licensing support. It is a free call.

Citrix have updated the installation documentation with this issue.
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/whats-new/known-issues.html#install-and-upgrade>

The steps in this guide are the same whether running MCS or PVS:
<https://support.citrix.com/article/CTX284738>

thought this feature would use the identity disk to  save the AAD device certificate somehow and PVS doesn't have these kind of disk. so really no strings attached? No ADFS needed, Passthrough auth only? awesome

From what I can see, there is no Citrix technology in the mix here, it's purely Windows

well, that's the theory. based on MS non-persistent is still not supported for managed domains. my experience is this feature only works with non-persistent when using Citrix Cloud services, not OnPrem and only with MCS. I actually like to hear from someone using PVS hybrid join in non ADFS environment

It works with onprem as well, we have several customers using this approach

I have PVS with hybrid joined devices running here in my lab, works perfectly

I know <@UR9T47CRM> is also very vocal about hybrid joining devices and I assume he is working with both MCS and PVS setups

I do not have the skills to setup ADFS :smile:

Yes. Working environments with pvs and mcs :sweat_smile:. And we use phs or pta. Adds sucks :the_horns::skin-tone-4::sweat_smile:

and you don't have any orphanded entries of thee devices in AD?

guys, this would be really awesome. thanks a lot

The only thing that's needed is to run the dsregcmd /leave in your golden image, and then either add a startup script or a scheduled task to do the dsregcmd /join during startup

Nope. I have only some staled devices in aad. But that can you manage with PowerShell. Stale devices because of new image release with new Hostnamen. 

Use bis-f for dsregcmd stuff. :the_horns::skin-tone-4::the_horns::skin-tone-4:

<https://www.deyda.net/index.php/en/2021/05/18/why-a-windows-server-2019-vdi-should-be-hybrid-azure-ad-joined/|https://www.deyda.net/index.php/en/2021/05/18/why-a-windows-server-2019-vdi-should-be-hybrid-azure-ad-joined/>

To make this work you need have nFactor in place. <https://netscaler.dk/citrix-workspace-app-and-saml-fas/|https://netscaler.dk/citrix-workspace-app-and-saml-fas/>

Excellent, thanks. I already have nFactor in place with the multi-IDP configuration (<https://www.citrix.com/blogs/2020/04/23/multi-domain-citrix-gateway-nfactor-authentication-and-citrix-fas/>), but looks like Workspace App do not like it.

If I configure it without multi-IDP and according to the blog it works. That is nice I guess.

Any thoughts, <@UN1U1R69M>?

Hi,
Are you doing anything with the cookie in a rewrite or anywhere? I haven’t seen that issue before.
I would do a packet capture and decrypt the TLS, to see what is going on.

No, have not touched the cookies. Will do a capture.

Pretty sure this is the problem, but I do not see how multi-IDP is possible without it.

I had a support call open with Citrix for five weeks before we got this working with WorkSpace App.  Check your version of NetScaler/ADC as there was a bug fix for this in the 13.0 61.x release.  We also had to remove a line from the web.config file in C:\inetpub\wwwroot\Citrix\Roaming on StoreFront as well.  This was due to a bug that had been fixed in StoreFront 3.11 but would persist if the Store had been created prior to that release and upgraded.

Interesting. This was due to you configuring multi-IDP on gateway?

With onlyusername as login schema?

No, our authentication was configured differently as we were only using SAML, so nfactor with a single factor.  The Gateway redirects to Azure for our authentication.  The problem we had was Storefront was always looking for double authentication.  We always had two login prompts for StoreFront which we thought was due to having two stores.  Turns out it was a bug so Storefront had been broken since 2017.  :smile:  Once thing to check is nFactor only works with advanced policies so its worth checking your not using the basic syntax.

Back in the day, when I was configuring CPM, I always used Carl Stalhoods guide as a reference:

<https://www.carlstalhood.com/citrix-profile-management/>

Unless you have a very specific need for CPM, I would recommend FSLogix, no issues with start menu, sync/mirror of folders/files and stuff like that.

<@U01C633QTFV> what do you see with the Start Menu?  We have the Start Menu working but it wont persist any changes between sessions and we have everything configured as suggested.  we apply a default layout by copying the xml file to the default user profile and it looks like that is applying each time for some reason.

Do you have the GPO configured to enforce a Start Layout? If it is not persisting it sounds like that may be the issue

We apply an initial layout through the Layoutmodification.xml file copied to the default user profile.  Its not locked so the user can change it if they wish.  Unfortunately, any changes are overwritten on the next login.  I have monitored logging in and out with Procmon and I can see the Start Menu files are written back to the profile share (UPM) and written back to server on the next login.  If we disable the GPO that copies the layout to the default user profile the Start Menu tiles are the normal rubbish you get after clearing out the built-in apps.

a studio policy template that works would be nice?

Anyone tested Stylus Pen inside of a session? My customer says it doesn't work

I'd change the working directory. As long as you have the defaults for document saving and applications themselves set to the user's data areas, then I don't see why you'd need to set the working directory for the app to anything other than the default

Thanks, <@UL5TCSW3D>, i agree its the easiest and most stable option to change the working directory.  Do you use the folder redirection options with CDM?

Do you mean do we use the Folder Redirection GPOs to point to CDM? I actually map a drive and hide it, then point the user to a shell folder and use CDM just for maintaining auth. Occasionally we do redirect Documents to the CDM folder path (which we have to create by parsing the user)

I was meaning using the method in CDM documentation by setting the registry keys.  With OneDrive native client I would set Documents to the default path and let KFM pick it up.  That doesn't seem so simple with CDM as there isn't a sync directory.

Oh OK, no I don't use it. As I said, I use PowerShell to parse in the OneDrive path and store it as a user environment variable, then I just redirect the user's folders to the variable. Seems to work fine

ErrorUPM.txt

I'm guessing a problem with C:\Users\Default\ntuser.dat.

Try copying C:\Users\Default\ntuser.dat to a new file. Then use regedit to load the new file. Are you able to reset security (e.g. add a user with full control) in the loaded hive?

Hi Carl, I have to ask to the customer if he has made any changes to ntuser.dat, but I don't think so.
I will try to do what you ask me and test it.

Hi Carl, I have not found any problems on the ntuser.dat file, could it be at this point just an upm and vda agent version problem?
I will try to update vda agent

What is the format to allow wildcard URLs for a specific domain in Edge? Tried [*.]<http://company.com|company.com> but didn't work.

upgrade to latest CU, we upgraded to CU3 a week ago, and 99 percent of all reconnect issues went away. There are also a few other fixes to reconnect in cu3

It could be the "Fast Reconnect issue":
<https://www.mycugc.org/blogs/brandon-mitchell1/2019/09/22/not-so-fast-reconnect>

Or this - <https://support.citrix.com/article/CTX207524>

No, no Windows Defender. Thank you for suggestions. I guess we will start with C3 rollout.

what version of receiver is on the 5060? We had the 5060 zero clients (I think) and the version even on the latest firmware was so old it wouldn’t support a ton of new features

session-disconnect.png

it's mostly Thin OS 8.6.019 with Citrix Workspace app 14.0.52748, but looks like 5060 are EOL so not expecting much here. We have installed 1912 CU3 but still the same. User steps away, session goes into disconnected state. When they try to reconnect - getting event ID 40, reason code 0 in TerminalServices-LocalSessionManager

looks like the fast reconnect issue. we have added the reg key and so far no calls for the last 4 days.
```[HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Reconnect]

"FastReconnect"=dword:00000000```
