World of EUC

Have you followed this? <https://support.citrix.com/article/CTX284738|https://support.citrix.com/article/CTX284738> bis-f handles azure ad bits

Yes but this didn’t mention intune only azure hybrid.  I did try this article but will double check. 

Yeah, if you install the 2015-2019 already on a system you will still then need to go explicitly install 2017 before the CVAD install. MS have an article somewhere I saw about the 2015-2019 package describing that scenario for some apps.

can you have both packages installed?  2017 then the 2015-2019?

I don't believe so as they are all version 14.x of Visual C++. You may just be able to do a reg hack pre-install of CVAD so that the versioning under the following registry key are for what you need for 2017, and then clean it up post install so it's back to 2019. That would make an interesting blog :slightly_smiling_face:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x64
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x86]

It all depends on how the CVAD install detects it. This has worked for me in the past with other apps.

I always install the latest <tel:2015-201|2015-201>9 package and I‘m sure CVAD 2106 is fine with that. 

Unfortunately 2106 is not. Tested and reported to citrix. They acknowledged and are going to release an article.. 2106 will fail to install with only 2015-2019 installed  with no  reg hack to fool it.

Yeah, i tried looking into deploying that exact same app to one of our customers, but ended up telling them to use the web version since it looked like attempt to deploy a modern app just wasn't worth it

I know :smile: But our customer wants to have them anyway. So I'm not even sure if that's possible since there's no store on server OS.

Ok I was able to convice the customer to use the web app. Thx :slightly_smiling_face:

FSLogix doesn't support them for the time being, so that rules it out for us atleast.

curious what you ran into where you had to add it

This explains a lot of it
<https://www.google.com/amp/s/jkindon.com/2019/09/17/deploying-brave-and-microsoft-edge-dev-browsers-in-citrix-cvad-environments/amp/|https://www.google.com/amp/s/jkindon.com/2019/09/17/deploying-brave-and-microsoft-edge-dev-browsers-in-citrix-cvad-environments/amp/>

thanks for that!  we havent run into that white screen issue thankfully but good info to bookmark

I had to add because a vendor that uses Webview2 to auth to azure would hang unless it was placed in that location.

I also read this today 
Microsoft Teams 2.0 will use half the memory, dropping Electron for Edge Webview2

i knew that process sounded familiar......i actually downloaded one of the early releases of 2.0 but can't sign in w/ our corp account to do any testing.  i'm pretty interesting in the performance gains w/ this version and how updates will work (as far as i understand it should be automatic....hopefully)

Wonder if it will improve teams in VDI. They put a lot into it. 

well although i can't log in to do any real testing a cold launch is a lot faster (to get the the login part at least)  so i'm hopeful. i know its more or less a wrapped version of Teams web

I can’t keep up with all MS is doing lately. Citrix and Nutanix has take over my world lately lol

ya i know the feeling! this Teams 2.0 i've tried to keep a watch on as Teams has been a thorn in my side for far too long haha

Nice little read
<https://www.google.com/amp/s/www.windowscentral.com/microsoft-teams-20-way-and-we-just-got-closer-look-it%3famp|https://www.google.com/amp/s/www.windowscentral.com/microsoft-teams-20-way-and-we-just-got-closer-look-it%3famp>

It’s stated what u said can’t sign In lol. I’m sure they will make it better. Like a windows vista to 7 transition lol back in the day

very nice! thanks for sending! i have that open to read later for sure.   and ya i knew it was a super early release so probably wasn't going to be able to do much with. i'm just patient usually :slightly_smiling_face:

I’m always looking up stuff man. 24/7 tech guy here lol

i'm curious since its more or less teams web what feature in the current client are stripped out and will need to wait to come back (i'm fine w/ a simpler approach but im sure theres others in our company that have gotten attached to fluff features

Yea I’m really wondering how it will work in vdi. I’m sure we are a ways off , but it cool 

audio/video / screensharing optimization specifically for me i'm curious on since it took so damn long to even kind of work currently  in VDI

the current client and vdi optimization is so dang picky to work right ....fully moon, need to spin your chair 3 times, jump up and down 3 times before connection....you know the whole deal lol  so hopefully this new way is a more reliable method

It is man. But I’m getting by with it. 

How are you getting by? For us its so inconsistent we have abanded it in VDI.  Last thing we can have is our employees looking bad because theteams meeting they invited a client to has a 30% chance of actually working inside of citirx.

I was talking with the team from my last organization, and they bailed on MS Teams and went to Zoom in their Citrix environment (not VDI, SBC on Server 2016). It seems to work better for them. :man-shrugging:

i tried my best to get to zoom after we proved to our opinion a night and day difference in VDI between that and teams but we got overruled since they had already sold to the business that we were. "microsoft teams shop"

on that note while we were disappointed we were fine with it because it gave us the ability to say 'YUP!" when people complained about teams going forward :slightly_smiling_face: we tried

well ya we actually had tested out using teams w/ the zoom integration....not streamlined by any means but at least the audio/video calls were smoother that way since it utilized zoom

They can do meetings and mostly use chat. The video /audio works most of the time for us. It’s not the best I admit. But we do have zoom and it’s the preferred connection. I use teams daily and it’s doable for me. 

Zoom is the best for vdi. I know some folks frown on zoom due to the security issue they had, but our security team approved it and it’s works great. Teams works as well, but it’s not ideal but again does work ok 

Teams in Citrix has been pretty stable for us for a few months now. Once they abandoned the VP9 encoding, it got much better. We use Dell ThinOS devices, and had many issues before they released 2104 CWA for Linux. We haven't received a ticket for poor audio/video quality since pushing it out. We also received a private fix for ctxteamssvc.dll in April. That service kept crashing in the VDAs. I think that was resolved in 1912 CU3, but not positive. Those 2 items completely changed Teams experience for us. Of course the feature parity is a daily grab bag. MS adds and removes features on a regular basis. Today, users started reporting that the preview windows are  zooming in above their heads. Only on ThinOS connections. No change to ThinOS, or VDAs.

Just me or does anyone else lose there cursor in Cvad on white or black backgrounds? Tried several mouse setting.


Licenses for user/device stay put for 90 days by default so I would assume yes, unless they are disconnected for more than 90 days

That’s what I thought, I’m trying to work out the best way to license a 24/7 call center, so with 3 shifts it looks like concurrent is the way to go, especially as disconnected sessions don’t take up a license

user/device is 1/2 the price but we can get 3x the usage out of concurrent

Yeah typically if you get 3:1 or better concurrent was always the better financial deal, unless prices have changed.  That's why a lot of hospitals/manufacturing stay concurrent because they are 3 shifts typically

Unfortunately in the Cloud aera Citrix doesn’t give lots of love to their CCU customers 

That's we should say no to Cloud .... I do.

<@U011KNA2PRT> Citrix is not happy with you :smile:

Capture d’écran 2021-08-03 à 10.55.10.png

In delivery group’s properties, for Multi-Session OS, maybe limited to publishing applications

Wonder if it's because I'm using Windows 10 Multi user

Documentation says “Multi-Session OS only” but I assume it is not available on Windows 10 Multi Session yet.

You are probably right. It would align with the release of Windows Server 2022 and Windows 11, which will probably be sometime during October 2021

It's telling me "no available workstation". Is that because content can only be published to Multi-Session VDAs?

image.png

Nah, it's just \\fileserver\path. I think it is because I am trying to do it on Win10 Multi-Session

To me it doesn't make sense. Multi Session win10 should be able to do that?

Works on the Win 10 box right? I am sure you tried that

Definitely doesn't work on Windows 10 Multi-User. Hmmm. Smells buggy

If going direct via StoreFront (not ADC Gateway) then yes, VDA needs to be SSL enabled for HTML5 access to work.

hmmm or it could just be enabling WebSockets connections <https://support.citrix.com/article/CTX223503#Allow%20WebSocket%20connections%20on%20XenDesktop%20and%20XenApp%20through%20Policy>

<https://www.citrix.com/blogs/2020/08/06/your-guide-to-implementing-citrix-workspace-app-for-html5/> - seems to cover all the relevant points

We have them on persistent storage for the edification of CISO, who suck them into something along with all other logs

Yah I bisf everything which moves all event logs 

BIS-F is your friend like James K. mentioned. 

Feeling like they’re trying so hard to find a reason to NOT support you that I think they would say you’re not supported even if your issue is not related to it.
Actually, you’ll have to prove them the issue is not related to get support. True story.

Dunno whether this is relevant, but procmon uses a filter driver

In a ransomware situation the main concern is data. Citrix environments can be rebuilt if necessary

I always enable AppLocker, it should take care of most of the know ransomware out there

PVS golden image, with a daily reboot. Rebuild the image monthly (automated). Use AppLocker along with AaronLocker scripts to lock down all user-writable directories. Prevent running any apps on home dirs, user profile, etc., unless necessary, and then by Security Group. Use WEM to modify file type associations for things like .bat, .vbs, .cmd, etc. Configure and implement PowerShell execution policies to prevent script execution (may set to allow signed scripts, up to you). Remove all domain admins from image, including DA group. Use a single local admin account only for building (may also use a single DA account, but I do *NOT* prefer this), and after the image is deployed use LAPS to configure unique local admin passwords on each VM. Turn on UAC and make sure none of your users can install anything. Disable Office Macros (may loosen this a bit and disable for documents downloaded from the internet - just note that if a user saves to their home folder, they can still enable the macro and hose you). Enable all the security logging recommended here (<https://www.malwarearchaeology.com/cheat-sheets>); and set up log forwarding to an external logging tool (I like graylog, use whatever :smile: )

If you want to go beyond the VDAs, then best bet is Backup, SAN Snapshots, and/or hypervisor snapshots.

And get your NTFS permissions right on your data

We also set up Shadow Copies on important data drives, to a secondary drive, with locked down permissions (i.e. not able to be encrypted). That way if a user hosed their own home folder (encrypted it), we could just delete and restore from the last Shadow Copy.

Then, we'd find the server they were on, kick all users and reboot it, and then go check the logs.

Use FSLogix App Masking to mask out apps that shouldn't be available to the user

Thanks for all answers.  Howefer the best solutions will not help if Admins credentials will be compromised.  

I'm more thinking about some kind of disaster resover strategy when “everything will be fully encrypted”.  

I'm thinking about following solution: 
• Automate Citrix farm installation + configuration restore
• Automate image installation. 
• NetScaler re-deploy + configuration restore

Anything else?

Remove domain admin rights from everyone? Lock down security correctly with delegated permissions. Make sure that NO Domain Admins can log on to anything that has internet access. Start there. Then, work on automating the recovery of your environment. For the automation - check out <@ULJ3D468M>’s Automation Framework and MasterClass.

Then make sure you divide rights up correctly, and no one account is a member of every admin group. PAM software should be your first stop

Thank you for all suggestions on how to protect your Citrix infrastructure from threats.  However, my plan is not about prevention.  

My plan is to instantly “restore” the entire Citrix infrastructure. Backups seems to be useless in case of hack or cryptolocker/ransomware attacks as it’s easy to restore vulnerable servers and be in trouble again :confounded:

Paying ransom is not an option - I’m considering something similar to NotPetya (no option to pay to get decryption keys)

But why would you need to restore it? Just rebuild it all, use infrastructure-as-code and you can get it done in under an hour. As you will have wiped them all, and there's no data there, you should be fine, no?

We had a security incident recently and simply tore down the workers and Cloud Connectors and brought up new ones overnight

“Restore” - I mean to make it up and running again for users. 

Time to automate Citrix farm installation. Any good resources to recommend?

Packer/Terraform/Ansible/Puppet/Chef/Chocolatey/WinGet/Eric - many people mash various parts of these together. <@ULJ3D468M> has stuff that can help you - <@ULD1T5RND> has some great resources on using Packer to build Citrix infra - there's loads of resources on GitHub - really interesting stuff

I’m more thinking to do the same as others. Anyone already did farm installation automation including configuration restore?

<@ULHA2PS2H> We're nowhere near those levels of sophistication. We're relying on AV, Tipping Point, logging, and other methods to keep us secure. We moved away from PVS to ELM which you cannot automate. I'm using automation framework by <@ULJ3D468M> to create baseline images and then Citrix infrastructure systems, so we can recover that way. We built out 2 data centers using MDT. We're also beholding to less sophistication with in-house AD, developers and other teams. I need to find the low-hanging fruit and work on that.

It took quite a while to get there - it was not overnight. And we were a small shop - only about 1000 users. I controlled all the areas, which made change control easy - no need to work across different teams. We used the automation framework from <@ULJ3D468M> to start, and built off that over the course of about 5 years. His stuff is WAY more in-depth now. When I look to build my next lab, I'm just going to use that.

We took the same path - found the low hanging fruit, and addressed that first. This was because we had suffered 3 ransom ware attacks in the span of 18 months. First thing we did was modify all file type associations for easily abused file types via WEM. That alone got us about 80% of the way there. Next was Office macros. Then AppLocker. I was pretty confident at this point that we had a much more solid security baseline, and we spent some time removing admin privileges. We filled in the other pieces as we could, and as we found them.

<@ULHA2PS2H> 3 times in 18 months. I'm sorry that happened. You should get on Thivecast with <@ULKDZDN86> and <@US5THT668> and talk about it if your employer allows. You have a lot of experience that the community could learn from.

Former employer. And we definitely learned a lot. The first one was the worst. The last one was pretty easy.

We have moved forward with Sentinal One.  It's low footprint on XenApp, works with MCS, and works very well.

Image from iOS.png

Once in a while it happens to me. I try to remove it from control panel the. Re run vdi cleanup. Try that. Sound stupid I know 

Ok will try that too. I think I must have ran that tool f a few times 

Sometimes, its just the simple stuff that makes are head hurt lol.

Anyone run across a way to disable the "remember logon" when logging in via Storefront website?  I can find something for SF 2.2 but it doesn't work for newer versions. <https://support.citrix.com/article/CTX212369>

did you try running the VDA cleanup utility first <https://support.citrix.com/article/CTX209255>

<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1628197652076200>

I guess we're technically running it via IGEL OS. We've had users runing it in PoC, but haven't reported any issues like the ones you're reporting.

I ran into a weird issue yesterday where characters would disappear and then reappear as I typed....kind of like "rewind" then "fast forward".  Some updates were installed yesterday morning that I presume caused the change in behavior, but I didn't have much luck finding anything based on my search query.  I did find someone complaining of "screen tearing", which I'd gotten on my USB monitor ever since I installed Ubuntu on this laptop.  They switched to "Ubuntu on Wayland" at the login screen, so I gave that a whirl and all my problems seem to have gone away.

This laptop has Intel integrated graphics, and I've noticed my "Connection Quality Indicator" stats in my Citrix session is "excellent" now, whereas before it'd often be orange or red.  Workspace App hasn't crashed on me once, and I'm not getting random fan spinups like I had been previously.

I'm still a Linux n00b but it seems like this did the trick for me, and given the description of what its purpose is I suppose I can see why.

Interesting, definitely bookmarking Ubuntu on Wayland for some reading later.

Citrix and clean uninstall have never been buddies.  A company that ships a separate 'real uninstaller' for any product is to be viewed with suspicion!  And then when they bundle it in 'so you never need the real Workspace App removal tool!' - yeah, right.

Not sure what version of VDA you were cleaning up, but the utility has not been updated for a while and the last version it supports is 1912.
With later versions there is no need to use the VDA clean up utility. If you do an in-place upgrade, the installer actually uninstalls the existing version and does the clean up before installing the new version
Nowadays using the VDA cleanup utility actually makes things worse

It redirects to:
<https://www.citrix.com/products/receiver.html>

For some reasons it does not work all the time. At least for me and ppl who reported - just times out.

I will update my link. Hopefully they wont change URL again. :smile:

Thats interesting too. Though it does not auto detect OS. Users will be confused.

<@UNBRPVD4G> customer want to replaces hosts with m10 GPU. Only Officeworker, think A40 is a lil bit oversized - what u think=?

A40 is not the right one for sure. I would recommend multiple T4s as long as A16 is not yet available

ok, but we have blade systems at the customer. i think t4 its to low from VRAM. what you think about rtx6k/8k?

Because A40 / RTX6000 or 8000 are for high end graphics workload

Those cards only support up to 32 VMs per card, so that's 2x T4 which is a lot cheaper

Always used Published Content to launch resources directly from the desktop shortcut created on user’s desktop by CWA.
I assume the resources should be accessible by the endpoint to actually work but I can be wrong.

Oh so you need to use the full-fat Workspace App?

From a computer that can access your UNC Path I would say.
I consider it like a “create shortcut from GPO” but using Citrix.
But again, I could have misunderstood it.

OK, when run from the full client it tries to launch, which is progress....now I get this though, which may be something completely different

If you enter the UNC Path in your explorer window, are you able to access it?

Trying that now - I think there may be an issue with some of the machines in the test area

Never used it for UNCs, but my Published Content URLs work fine.

It was a path issue - works now, cheers fellas

I do notice that it seems to run "locally" though - so published content will not work if I am trying to publish a remote path that the client cannot access? That seems kind of pointless......

My co-worker is absolutely a fan of Published Content but I cannot tell you why exactly. Maybe it’s eaysier to have your users “Refresh Apps” when published something new rather than “gpupdate /force” but other than that…
In 1912 thought, it seems a published app will act like a published content if it can resolve the path locally (you published Photoshop, it is installed locally on your client device, it will launch the locally installed Photoshop instead of the published one).
But if someone knows the killer feature of Published Content, I might want to know as well.

Apparently it launches locally unless you configure a file type association - but that option only appears for published content such as documents. With a published UNC path, there appears to be no option to have it open "remotely". Which is really stupid

Why don’t you published an explorer.exe with the UNC path as an argument then?

Yeah all my URLs are executed locally.  Of limited use like that.  Also Categories don't apply, kinda annoying.

Because published explorer on Windows 10 disables the "Search" function. I'm trying to find a way to publish an explorer instance and have the Search work. It works on AVD but not via Citrix

So I managed to get this working by publishing powershell to start Control Panel and then send keystrokes to move the Control Panel view back to the root of File Explorer. Which means Search works

Unfortunately the client has blocked PowerShell :disappointed:

we have seen that at times yup.....the usual screen share and "can everyone see my screen?"...." nope not yet".....wait 5-10 seconds "oh wait there it is "  :slightly_smiling_face:

I am watching this side by side on vdi vs desktop and the screen is way behind. Hopefully MS fixes this. 

It happens alot to us as well. It even makes the session lagging as heck even when it in optimized state.

happens to us usually out of vdi even .....my group more or less has abandoned using vdi for teams calls for now

Teams is utter shit, not just on VDI. I regularly see the shared screen freeze over the display. Sometimes it stays even when Teams is terminated

agree'd there!  really hoping the new 2.0 platform helps somewhat w/ performance.  since its more or less teams web w/ a wrapper probably only a matter of time before that gets bloated w/ features until it sucks as well though

And everything we've put in to make Teams work the way we want it will suddenly stop working and we will be back to square one

yup exactly!  on that note i'm really curious how the VDI optimization side is going to work w/ that setup .   the pessimist in me agree's with what you said that its gonna be back to day 1 again

I like the consistency of teams tho, it's terrible in/out of VDI, like <@UL5TCSW3D> said. The MS QA teams are obviously working hard to unify the terrible user experience

I have a set of policies I use, but they are not specifically with optimization in mind, they focus more on the user experience

We may need it soon. Edge is starting to look like Chrome in terms of resource consumption.

This article should cover the basic stuff:
<https://virtualwarlock.net/microsoft-edge-in-citrix-revamped/>

maybe they hate their users? :slightly_smiling_face:

Only done a poc so far. The biggest challenge is having to use only the workspace app to login and not a browser. For us it just complicates getting vendors in a different country to all understand and implement a big change. Otherwise it works well. It can make things like a webex more difficult as you sometimes need to see what users are doing.

Few things can stop a user with a camera or a phone from taking pictures or videos.  Read the Known Limitations. It only works with the full client.

Camera -Watermark? Im my case it’s about hackers, malicious software instead of users stilling data.

App Protection is designed for anti-keylogging and anti-screen-capturing. I don't know how well that protects against malicious software or hackers. AP will not protect against ransomware or many other threats.

I'd say it's not all a technical issue.  Some orgs have large investments and processes around PVS.  Training staff and developing new processes can be time consuming and problematic.  The ease/speed of roll back with PVS is still a big advantage to many.  I agree though on the complexity as more networks become highly secured, it gets harder

Time to re-train is a good point, I had not considered that. Not that it takes long to learn MCS from PVS, it took me about a week, where as PVS was months

Yeah and the time/priority of converting the images.  Most don't have it right now

However, i'd say for NEW implementations, no need for PVS, right?

I wouldn't go full no need, but I would say you'd have to make a convincing argument to not go MCS

PVS with Citrix Cloud is basically the same as on prem. There’s really now integration other than an SDK that brings everything into Citrix Cloud Studio. Everything is still hosted/managed by customer PVS wise.

PVS in Azure is super fast, faster than MCS due to the Azure back plane

<@ULJ3D468M>: I've worked on some Citrix Azure + MCS implementations that weren't great in terms of boot time. <@ULDHJB8BB> can attest. However, got any numbers/metrics to back the above statement up? For me, a hybrid approach is best, on-prem MCS with Citrix Cloud for the bits you don't want to manage: SQL and DDC

Worked for 4 years with PVS and Citrix cloud, there's still alot to be said about the simplicity of robocopying a vhdx across global datacentres. 
Also worth remembering once you install the cloud sdk on pvs servers they cannot be used to provision to on-prem ddc's

Help me scale mcs to 100+ clusters quickly/easily  and across multiple hypervisors and we'll think about but using pvs. It's just too easy at large scale.

Multiple hypervisors more of an issue with PVS than MCS. Common image fun…

Also for MCS depends on hypervisor capabilities. App Layering could be a factor as well for both. Not advocating App Layering. Just an example.

I just mean mcs and a combination of nutanix and legacy 3 tier. The storage hit on mcs can be brutal

Just do Nutanix and put away the 3 tier and get rid of the storage hit (fully admitting I have a bias)

I mean we do make MCS shine...infrastructure matters...

We are moving to nutanix. Already bought 3,000 nodes, but still have about 3,000 xenservers left. Want to donate to a good cause <@UL5TCJ57D>? :stuck_out_tongue_winking_eye:

So you are the guys Citrix refers to as still using XenServer :slightly_smiling_face:

Haha, belive me I think we are the last company using it.  Makes their installed base look good still. We also have 70K VDAs in citrix cloud...for now.

Is moving the profile to something VHD based and getting rid of known folder redirection to the network share an option?