World of EUC

Strange one - MCS driven AWS 2019 image - results in a grey screen when power controls are driven via Citrix (non persistent catalogs) - a user initiated reboot via AWS or the VM itself brings the VDA back to life - boot via Citrix and its busted again - anyone got any pointers? BIS-F seals the image...

sorted it bloody enviroment had to set "Do not allow an ost file to be created" to disabled also set "default location for ost files" to appdata\local\microsoft\outlook i now see the ost and cached mode shows as enabled :)

No such thing as overkill to me. Safe or sorry, But I that looks about right

I always ask for Sysadmin on the DB with a service account. But that is just me.

Well I didn't get a warm and fuzzy when I attempted to update the ddcs in my test farm and it failed on the first one.  Ended up having to roll back the snap and the db :rage:

I'm not exactly sure where it failed. I've done a few upgrades on 7.15 without issue but my first attempt in test from 7.15 to 1912 hosed up.  Studio was hosed from what I remember...it was a few months ago.  So I rolled it back and tried again and it went through.  I just chalked it up to test environment gremlins but it still puts me on edge when touching the prod environment.

I find it easier to build new and migrate 

If using SQL AG, check your SQL Logins (usually delivery controller computer accounts) on secondary node(s). 

Snapshot DDC's, backup DB, sysadmin perms for person performing upgrading and make sure they are local admin on DDC's and full Citrix admins within studio , check SA dates on licenses and always make sure you upgrade your citrix license server first before any site upgrade, Check hypervisor/VDA support,  I always run the preliminary site upgrade tests on each DDC before upgrading as well

Oh yea hard lesson learned too update all your delivery controllers within 4-6 hours, if not it’s bad. 

I had some schema upgrade issues when I went from 7.15 to 1912 with no CU. IIRC, it was in the management DB and running the upgrade a second time magically allowed the upgrade to complete successfully. Then had the same issue going 1912 to 1912 CU1, but I looked at the logs a bit more on this one and saw there was some version mismatch mentioned in the logs. Again, a second run allowed the upgrade to complete successfully. 1912 CU1 to 1912 CU2 had zero issues with the upgrade.

Interesting so on your first attempt, did the installer itself fail out and you just re-ran the install or were you seeing some other odd issues like in studio?  In my case I was upgrading from 7.15 CU5 to 1912 CU2, the upgrade appeared to have gone through but studio seemed to be messed up, I ended up having the dba restore the db and I restored the 7.15 snapshots and went through the upgrade again and it was succesful

The install went fine. The DB upgrade from first launch of Studio would fail, and then work on the second launch. The version mismatches appeared to be something didn't get registered properly from 7.9 to 7.15. I was all prepared to get Citrix support involved in the CU1 to CU2 upgrade, but it just went through, so I have no real clue how the issue cleared up.

CDF Traces. Are only some of the TMF files needed to run CDF Traces still available and still need to ask Citrix Support for analysis?

image.png

That still looks right - they use 1912 and 7.24 interchangeably, from what I've seen. Which HDX section of Director are you talking about?

Unless you're talking about HDX Insights (which we aren't licensed for)...

If I go into a user session in Director and scroll to the bottom under HDX, there's the area for mapped drives, graphics, network, etc, in that section it lists the VDA as 7.24 and if I click on that it lists some of the components as 7.24 but up top on the same screen under machine details it shows 1912

7.24 = 1912. at some points the old naming Schema is still present. 

They'll get this corrected and start using a uniform version scheme around the time they change the product names back to what they should be - XenApp and XenDesktop...

Haven't tried it yet, but it's on my long list of things I need to do. What are you seeing? Care to share any code to reduce my coding time?  :)

<https://github.com/JamesKindon/Citrix/tree/master/Migration%20Scripts|https://github.com/JamesKindon/Citrix/tree/master/Migration%20Scripts>

Export and import appgroup scripts in there 

Ahh shoot, You gave me this before. Thanks man, that is perfect and just what I needed.

Its funny, because I literally just found this in my script notes where you gave it to me. LOL

Cusomter had an DELL R740 Server with S2019 as standalone hyper-v Server. The SMB Client Performance is really bad. CopyJob for big files is ok, but when starting a copy job for a foilder with much small files the calculating is really slow. When i copy an folder to the local Drive D:\ and copy a folder from D:\test to D:\test2 than its much fast (allflash). When i try to copy from \\localhost\test to \\localhost\test2 is slow Oo..... VMQ and RSC disabled. Any ideas?

27000 - Default port used for accessing the external Citrix License Server.

7279 - Default port used for checking Citrix licenses in and out.

That's true for the internal network, but I was more after the destination addresses the license server is reaching when it's connecting internet to update the installed license packs.

A very long time ago I saw that happen.....

<https://www.htg.co.uk/blog/quickpost-citrix-xenapp-published>

Well I'll be damned, I do see weird Citrix data in that key in his AD account.

Gonna give this a go and see if we're good - appreciate it!

Urgh, I remember writing code to pull apart that attribute into its component parts, it contains all the useful user profile (tab) stuff.  <https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsts/15f8b01d-900d-4f89-a3fa-1681e55f383d>

<@ULM5TEQAK> I think I read a Reddit comment of yours, where you saw better performance with MCSIO off. Is that still the case?

I also gave this a try and „performing better“ in my test means less cached ram (as there is no cache to ram) - so more free ram to use for the user / apps and less issues with cachedisks getting filled up. I was able to reduce 4 GB of ram per VDI. 
If there’s allflash storage, I don‘t use MCSIO. 

Without MCS I/O if Using Nutanix Distributed file system. I have seen PVS actually do the same things on 40Gbps connections and NVMe. it seems that the Technology is catching up where some of these things we did, may be not needed. But its environmental, use case in my opinion.

I have a question out to our storage folks, but I'm lead to believe we have pretty fast storage. But, suffice to say, I'm starting to think that it's not needed in our environment, given what we just saw.

So, I found out our storage is flash-based. And NVMe at that.

:question:Does Desktop Lock work with Citrix Workspace app configured with multiple stores? Scenario here is migrating from on-prem CVAD to Citrix Cloud where the environments will run concurrently (and separately) for a couple of months.

Did you whitelist <http://Content.youtube.com|Content.youtube.com>?

yes. Even setting to all sites accept all cookies brings the loop unfrotunately

You must add <http://Content.YouTube.com|Content.YouTube.com> into the browser content redirection authentication Sites policy 

<@U01DCQGUJMT> unfortunately that does not make any difference. so far, only have youtube in de  allow list, and added <http://consent.youtube.com|consent.youtube.com> to the browser content red auth policy but without sucess.  Again, when we sign in  with a youtube account it works and keeps working. When we click agree  (not everyone has a youtube account) it fails and gets back to the same :" before you can continue to youtube "  site

<https://www.youtube.com/*> for the Browser content redirection Access Control List (ACL) policy settings

and <https://consent.youtube.com/*> for Browser content redirection authentication sites policy

yes we know.  That part is working fine. Once we are on the youtube ( by signing in with google account) it does not g oto consent and BCR is working super. However not all our end users have accounts with access to login to youtube or don't want to login to youtube but just watch vids

<@U01DCQGUJMT> kudos !  fixed. It was the * missing on the end ot the <http://consent.youtube.com|consent.youtube.com> url . I need new glasses :wink:

You have a very short project in front of you. :)

<https://docs.citrix.com/en-us/provisioning/1912-ltsr/system-requirements/vdisks-os-volumelicensing.html>

"Citrix Provisioning does not support MAK activation for Microsoft Office products."

I have some old guides that were around office 2013, I am not 100% if its the same now, but I can send them your way if you wanted to get a idea of the steps. Its not to bad, biggest thing is you need KMS licesning, and Re-arm setup. If you use BISF then it will do that.

KMS, or indeed activate with script. check if that is allowed with your license. Previously we used it that way, together with VAMT. now moved over to MCS and there  KMS is a requirement.

Thanks for the feedback. The company doesn't have enough clients/servers to justify setting up KMS (as i understand you need a certain amount for KMS to actually activate). Ended up having them get E3 licenses so they can actually use SCA, problem solved. :smile:

Yes, you are correct. I think its 25 before KMS starts to work. But O365 is the way IMHO

Five for Office

<https://docs.microsoft.com/en-us/deployoffice/vlactivation/configure-a-kms-host-computer-for-office>

ahh, ok, I had the OS and office reversed I think. Thanks Carl.

Same but different case here, was always using KMS as my default. Now customers (as it’s the new way from MS) getting their server datacenter and Office licenses via CSP - there are also only MAK keys, not able to request for KMS, MS confirmed. Wondering how Citrix / Citrix consulting will handle this in PVS / MCS sites? 

I usually point TCs to a separate store, configured with appropriate settings for those special endpoints, like disabling HTML5, downloading of CWA, etc. 

<@UL5TD2QM9> do you do this automatically some how?  Or use a profile with a hardcoded storefront URL for the thin clients?

It’s a static assignment of the profile, in our case in the IGEL UMS <@ULJM98FME> 

Does this return anything for you?

```Get-BrokerAccessPolicyRule -DesktopGroupName "YourDGName" | Select IncludedUsers```

It does and it includes sids which is why i find it strange that when i inlcude | where {$_.IncludedUsers -like "s-1*"} nothing comes back

that object includes more than just the SID.  that's prob why.

get-brokeraccesspolicyrule -maxrecordcount 10000 | where {$_&lt;http://.Includedusers.si|.&gt;<http://Includedusers.si|Includedusers.si>d -like "s-1*" now brings back results but some of the DG's it has listed dont have sids listed when i check the user assignment in studio i believe when using $_&lt;http://.IncludedUsers.si|.&gt;<http://IncludedUsers.si|IncludedUsers.si>d its showing the sids of valid groups/users. basically i want to show all DG's that have sids under the DG user assignment

do something like | Select -expandproperty IncludedUsers | where-object {$_.name -like "S-1*"}

thanks get-brokeraccesspolicyrule -maxrecordcount 1000 | select -expandproperty IncludedUsers | where-object {$_.name -like "S-1*"} returns what i want but i cant pipe | remove-brokeruser onto the end any ideas ?

<@ULJ3D468M> / <@UL5TCSW3D>: You guys seeing this? The related system event IDs are usually 1050 iirc

If you did see it, did you apply the windows defender work-around? Seems a bit un-safe to me

Putting in the proper exclusions solved it for us.

<@USL6AQT9A>: That's the thing, we've had our exceptions in place for almost 2 years. Were you just using the ones from the above KB?

The issue isnt necessary the exclusions but the newly released Defender client (not definitions) released from MS

<@UMH935X7H>: Yes. We had forgot to put in exclusions for one specific environment. That environment was the only one affected. Have not had any issues since adding exclusions.

I know its old and "shouldn't" apply, but I would give this a try, recently had it work for Win10 1909 black screen issue w FSLogix etc, close to what you are describing. <https://support.citrix.com/article/CTX235681>

Yes I remember this one, it's still present on our 2016 VDA. Thanks I'll try that.
Do you know if it needs a reboot?

I believe it does actually, but I could be wrong, may be worth trying without, and then seeing how it goes

Does the black screen appear for several seconds, or does it remain?

I believe once CVAD is added to Win 10 / 201x, a black screen just before the full windows desktop is shown is expected, however, how long does your black screen last for?

Check for bloated registry keys. These are the usual suspects, with the first one being a common cause of long black screens at logon.
HKCU\Software\Microsoft\Windows\CurrentVersion\UFH\SHC
HKCU\Printers\ConvertUserDevModesCount
HKEY_USERS\.DEFAULT\Printers\ConvertUserDevModesCount
HKEY_USERS\.DEFAULT\Printers\DevModePerUser
HKEY_USERS\.DEFAULT\Printers\DevModes2

The black screen seems to remain. The customer had some sessions in this state for about 15 minutes until he disconected the sessions.

I'll try to configure the setting from CTX235681 and I'll also check for bloated registry keys.

Now that you talk about bloated registry, this one also comes my mind: <https://www.phy2vir.com/windows-server-2016-2019-rds-server-black-screen-or-start-menu-not-working/>

I'll check this as well

Yeah, you should have this in your image:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
DeleteUserAppContainersOnLogoff (DWORD)
Value: 1

I now only see the occasional black screen in certain scenarios. It is consistent. I'm 99% sure it only happens when users are using multi monitors and mixed DPI scaling, It's really only an issue for our vGPU pools. But I wanted to be in this thread because there are so many "black screen" issues and statements that I wanted to be sure myself that I had covered all bases.

Ok I'll keep you posted if the issue gets resolved with those 2 registry settings.

I'm also affected by this, since ages. Never found a solution, I opened World of EuC Slack just a few minutes ago, to ask the same question as you.

I see it more and more often with different customers that the users only get a black picture when logging on to the published desktop.

Details about the systems:
Windows Server 2016 Datacenter de-DE
CVAD 1912 CU2
FSLogix 2.9.7654.46150 (2009 HF_01)
With or without Citrix MCS
After restarting the VDA, the error is gone for a few days.

If that happens, you can see from an admin session in the Task Manager that the session has been fully loaded. All processes are there. You can also log off the session cleanly. You can see both the login and the logout, only the actual desktop is black.

We had this issue with a new environment right after going into production. At least for today we didn't have any issue. Hopefully those 2 settings resolved the issue.

So which two settings did you apply to which OS? (Sorry I’m on mobile right now)

These two:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
*DeleteUserAppContainersOnLogoff* (DWORD)
Value: 1

Path : HKLM\SOFTWARE\Citrix\Citrix Virtual Desktop Agent
Value Type = REG_DWORD
Value Name = *DisableLogonUISuppression* 
Data : 0 - Feature enabled (LOGON UI SUPPRESSION – No Black Screen)

After we configured these two registry settings we didn't have any more issues. Before there were black screens almost twice a day. Hopefully they're gone now.

Awesome. Thanks for looping back and letting us know

I can also confirm this *DeleteUserAppContainersOnLogoff was put in my enviroment about 1 year ago. The black screen is about 2 seconds now*

I've got a similar set of settings on a Win 10 VDI image, black screen is about 3 seconds. If we could get rid of App-V, it would be less.

Oh I only do it on Server 2016 for now. I will try it on Win10 as well

build your golden image to the highest spec you need then you can deploy with a lower spec later. If you add CPUs to a non persistent machine you are in for a world of pain

if your CPU hardware is different across different hosts you need to seal the image on all of them too so it has each cpuid otherwise you can’t migrate them.

Give them non persistent with user personalization disk 

All great info. That's fantastic. How does one deploy with a lower spec later from the same image?

in vmware you can clone from a template or snapshot and as part of that change the underlaying cpu and memory count

it asks you in the gui and you can specify it with powercli

I haven’t tried the pvdisk replacement mainly due to being burned on pvdisk one too many times, is it more stable now?

Ah, gotcha. Sorry, I was thinking natively in Citrix. But yeah, that makes complete sense.

You can specify different ram and cpu to the template in MCS as well I think

Yeah, definitely RAM. I'd have to look back at CPU. The disk is cloned from the Master Image, so is sized the same, if I recall. I hadn't thought of just cloning the master image though, that might work.

You can pretty easily change CPU with powercli as long as the machine is off, so you could do it in 2 parts 

So get MCS to build them all out then scale them down 

Yeah, I'm thinking that we can use the workflow in SNow and service catalog tied to SNow automation to kick off a script using PowerCLI to change the config. Just curious if/how others have done it.

You could have different templates all using the same disk if all you need is different CPU and RAM and then just have multiple machine catalogs

Any pointers on how to get AirPrint printers redirected from iPad to ICA session? Running latest CWA for iPad, VDA 1912 CU2 and Citrix cloud infra. 

I can’t eve get the iso to play around.

Not installed the VDA yet, that's on the list for the weekend, along with Server 2022

<@ULLH5JGFR> I don't think that there is an ISO yet, you've got to install Win10, join Insiders DEV and download the Windows Update to get to Win11

yeah, I used Win10 Insider (activated with an old Win 7 key) then upgraded, did a reset to flush out any Win 10 remnant config. Used the Enterprise sku to avoid all the consumer UWP apps.

No, but it will prevent non-admin users from installing printer drivers, which usually isn't a bad thing

so user print mapping will still work even if I dont have their drivers loaded on VDA?

I am guessing universal print driver will still function?

Yes, disabling point and print restriction should have no effect on client printer mapping

<https://support.citrix.com/article/CTX319956>
This says it has not been fully tested and could cause unknown adverse affects.  Anyone seen any impact from rolling this out?

I did see that article and it is rubbish!!! It mentions that citrix has not fully tested the patches from microsoft but then say they expect those patches to break Citrix universal printer server and affect citrix users? how do they know that if they not tested it ? but then say they have performed functional testing and dont expect issues:joy:

well, I am not sure what to say :disappointed:

I had some issues with USB device on the initial release of version 9. Have not tested new updates though.

You could expand on this to first open and read the .rdp files: <https://www.pdq.com/blog/rdcman-file-powershell/>

Following… we have cyberark let me know what you come up with 

Following this too.  Was just a recent development

i didnt think so but just trying to be cautious!

cool thanks guys! i was pretty confident i knew it was safe but didnt want to start the week off w/ a fun surprise :slightly_smiling_face:

I have mine set to advanced with no controllers set during install. Set them by GPP. No issues with registering on first boot. MCS non persistent and full clones along with PVS. Works fine.

We're not using Cloud, but we've been setting the DDC's with GPP. It's solid

yea. sounds like my problem is the images were originally setup pointing manually to DDC's. Looks like that is where the issue comes from.

When you use GPO, are you just setting the registry keys, or are you using the "Controllers" option?

I always use the "Controllers" option in GPOs and not GPPs. IIRC pointing to DDCs via GPO or GPPs will take precedence over the settings in VDA.

Regarding 1912, hotfix only available on CU3… If we are on CU2, basically, we have to upgrade to CU3 first? Am I right?

I wonder if there would be any ill effects of pushing this on to my static vdas silent with no reboot and wait to bounce the boxes at a later time?  we don't use the upm anyway but i know director uses it for stats

i got same question regarding 1912 CU1/2 do we have to upgrade to CU3 before applying the hotfix ?

Newer VDA version should be backwards compatible with older Controller version

We're running 1912 CU3 VDA's in a site with 7.15 LTSR installed right now without issue

It does appear that you would need to be on CU3 in order to apply the fix as it doesn't mention about it being applicable to earlier versions

yeah the hotfix only says its for CU3 hence my question if it will work on CU1/CU2 i will test it on my lab as that is CU2

just installed the hotfix onto a 1912 CU1 VDA and it went on fine without any errors

I just got confirmation from a contact in Citrix that the hotfix is all that is required, not updating the VDA.

I opened a support case for the same question

So it looks like the advisory got updated and there's two hotfixes now?

Like the 4th time we’ve had to crack our images open….decided to be proactive and got the first Citrix update installed.  Then Mozilla released a fix for Firefox.  Ok done.  Then Adobe releases an acrobat patch.  And then now Citrix again.  :joy::sob:

How is the UPMVDAPlugin different from ProfilemgtWX64?  I suppose one for UPM and the other for UPM WMI?

Why isn’t there a fix for 2103 as this Version is also in active support cycle?

<@ULCBD9AJD>  already found the answer on the 2103 question?

Just contact Citrixx about version 2103: Citrix is still testing. Recommended to upgrade to 2106 and than install the patch.

Also possible for 2103 is to install the Hotfix for 2106 and if you are using WMI Plugins it's necessary to downloaded 2106 VDA and extract the UPMVDAPlugin. Since the Hotfix for 2106 is only for profile management and not the plugin. 

They also tell that in this situation (2103)  it's necessary to uninstall the fix before upgrading to a higher version

Is anybody else having issues with Outlook after the patch?  I saw this post on the reddit sub where somebody posted about an issue with upmoutlookhook.dll <https://www.reddit.com/r/Citrix/comments/ok23nh/outlook_2016_error_after_installing_citrix_upm/>

I just got a note from our SE on the outlook issue.

```Please note that there is a known issue on Citrix Profile Management 1912 CU3 hotfix caused by signatures: With Citrix Profile Management 1912 CU3 hotfix installed, Outlook is unable to launch. The workaround is to replace following three binaries with ones from a non-patched VDA: UpmOutlookHook.dll, UpmOutlookHook64.dll and UpmSearchSvcHook.dll. As the security fix targets on the installers, replacing these binaries won't break the security fix.```

Thanks for the update.  So that's interesting.  Does this issue only occur if UPM is being used?  I've patched my dev boxes and don't have any issue launching Outlook

Description of the Update says “a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed” Do you have one but not the other?

Had not even finished packaging the hotfix before we have to redo it, so not had chance to test against outlook myself.

I have both installed but we don't use UPM for anything.  I only have it so i get stats from Director.

For those of you experiencing this Outlook issue on 1912 CU3 after installing the hotfixes, are you actually using UPM for profiles?  We use FSLogix and don't appear to have issues opening Outlook.

I'm thinking this would only impact those using UPM for Outlook profiles because the hook files would get loaded in this scenario.  I would think those not using UPM are not impacted which is why we don't see it.

With that said I'd prefer Citrix release updated hotfix installers that would put the proper files in place.  Sure it could be scripted but just cleaner to have it as part of the install process.

One setup we have is : 2012 vda with the fix. NO GO! Get error code 262 with event id 42 and apps just does disappear
Luckily we have release managment inplace (I strongly suggest this to Citrix)

<@ULK6H7HAL>: I didn't see the Outlook issue on my W10 VDAs, and am also an FSLogix user. Still has me nervous about rolling with the patch in my next image.

I have confirmed the Outlook issue after i installed the UPM/UPM WMI plugin hotfixes (This environment uses Citrix UPM) this sucks cant they incorporate something into their hotfix where it backs the dlls up first before copying them back

I’d say, could they test their fixes properly? Not the first time things like that happened.

This is the error if anyone hasn't seen it. having to copy in upmoutlookhook, upmoutlookhook64 and upmsearchsvchook dlls is a pain in ass

What's crazy is clearly they're aware of the issue and they have yet to even update the KB article to reflect the workaround.

Unfortunately you're right, typical, QA/QC is nonexistent

When overwriting the three "non-patched" DLLs does that mean that the vulnerability is still present then?

Looks like they updated the kb articles for the hotfixes themselves to include the following: *Known issues*
With the Citrix Profile Management 1912 CU3 hotfix installed, Outlook is unable to launch. [UPM-3602]
As a workaround, replace the UpmOutlookHook.dll, UpmOutlookHook64.dll and UpmSearchSvcHook.dll binaries with ones from a non-patched VDA.

They appear to have updated the KB again, removing those issues. I haven’t checked, but it looks like there are new patches altogether: <https://support.citrix.com/article/CTX319750|https://support.citrix.com/article/CTX319750>

At least we can confirm that their teams are all on the same patch cycle. Release a patch, wait 24 hours, release an updated patch (a la CWA). :slightly_smiling_face: 

It appears the change to the hotfix ProfilemgtWX64_1912_3002 for 1912 is to address the Outlook thing.

*New Fixes in This Release* With the Citrix Profile Management 1912 CU3 hotfix installed, Outlook is unable to launch. [UPM-3602]

yeah it appears that only the one hotfix was updated, i guess thats the one that drops the hook files

upm.PNG

hi i wanted to install the new hotfixes on a not patched server with 1912cu3. i installed first ProfilemgtWX64_1912_3001 and then UPMVDAPluginWX64_1912_3001 but i get this message. but i'm able to install the older version of the hotfix. is the first hotfix enough or should i use the old UPM patch and overwrite the outlookhook dlls?

Hi Simon,
there's a new "ProfilemgtWX64_1912_3002" (see 3002) available on <https://support.citrix.com/article/CTX319750>.
With 3002 the Outlook bug should be fixed.

But there is a new known issue with Login Data in Director. 

What new issue with login data? It seemed fine to me in my environment.

Known Issue
With the Citrix Profile Management 1912 CU3 hotfix installed, Citrix Director does not display logon duration for Published application sessions. [CVADHELP-18055]

I'll let the XenApp schmucks on my team know the bad news. :smile:

<@U015G4SG5LY> better have Outlook running and a Patched System than Logon Duration Data in Director :)

If I want real login data, I'm running Guy Leech's script anyway.

Haha - I tell my peer mac sucks every time he uses Bluejeans. Kinda irritated I didn't get an early release of 2.28 considering we own it.

You're right, I've noticed recently it doesn't consume anywhere near as much space as before - even with VHDs. Clearly Microsoft are fixing some of the crap, just not telling us

And yes, the AV exclusions are aimed squarely at the "user" version, I think (excluding anything in the user profile from AV scanning gives me nightmares)

Hi, I have a strange issue with MCS, randomly on restart (few cases on hundreds) VDA DNS record disappear, any ideas ?

We used GitLab in non-persistent environment. As long as you clone your remote repository to a persistent storage location (we used home directory), then it stays across reboots. We didn't really use FSLogix for it at all (other than AppMasking to hide the Git options in Explorer).

You can also use a local repository (not synced to a remote repo), and if you do that, also just use your persistent storage, such as your home drive / user drive, or another shared folder (mapped drive, whatever).