World of EUC

was it this post here Dan? <https://discussions.citrix.com/topic/403721-office-365-pro-plus-shared-activation-password-screen-not-able-to-select>

That wasn't it, but looks like my issue all the same!  It might have been a tweet that I saw, from memory it talked about a private Citrix fix specific to 1909.

hmmmmm I haven't heard of private on that one

Either way it looks like it's broken for now - thankfully the bulk of users will be using published desktop in this environment, those that needs apps we will have to stand up a 2016 image

i know the new support stance just changed with 2019 and ProPlus so hopefully someone will fix something soon :slightly_smiling_face:

That's right, fingers crossed!  Thanks bud.

Check the cloud cache / container logs in programdata\fslogix.... I've had some amusing delays with CC 

There are tons of fixes in the latest build - good chance it fixes your issue too

I will see if it helps with the latest release, the first test this morning looks good

Have you got exclusions and mirroring configured for UPM for the "old-style" TileDataLayer Start Menu?

You mean mirror or exclude it, which "old-style"? :wink:

image.png

There were normally some mirroring and exclusions for the old-style Start Menu from 2016 and Windows 10 RTM, now superseded, I think this was maybe them

Is this also occurring when you create a fresh profile? Have seen something like this when the AppLocker policies are configured not properly. 
I always mirror the Windows/Cache dir and the vetamodel database file -&gt; no problems 
Maybe this helps: <https://citrixguyblog.com/2017/08/03/xendesktop-windows-10-startmenu-becomes-unresponsive/>

New WSA on IOS 13...  chrome.... how do you make it auto-launch the ICA file

not possible unfortunately, works only from within WSA as far as I know

well that blows.  Without the MFA support in WSA on ios you have to launch from browser...

Comparing times from the application logs and system logs it appears like the crash happens after a time zone adjustment when the user reconnects. ```The system time has changed to ‎2019‎-‎10‎-‎14T18:09:48.853512500Z from ‎2019‎-‎10‎-‎14T18:09:48.853512500Z.

Change Reason: System time adjusted to the new time zone.
Process: '\Device\HarddiskVolume1\Program Files\Citrix\ICAService\PicaShell.exe' (PID 16040).```

You could try disabling the clipboard to see if that helps narrow it down. Looks like an error in vclipbd.dll. The time zone error could just be related to the policies kicking in on reconnect and using client time zone policy.

Would have been patches from September.  Event ID 1000

It's free for the first 100: <https://home.pearsonvue.com/Clients/Citrix.aspx>

Unfortunately I could not find it (anymore)

Citrix 7.15 LTSR CU5 is available now <https://docs.citrix.com/en-us/xenapp-and-xendesktop/7-15-ltsr/whats-new/cumulative-update-5/fixed-issues.html>

Do you mean VDA‘s? Fixed Size of 4096 MB on cache disk. Then configure dedicated memory dump in case of a BSOD, so you get a dump file. If you use WEM memory optimisation it may be different because of pagefile usage. For PVS servers I use the recommended value from the OS as a fixed size on the OS drive. 

same config here, regardless of memory amount of the VM, if you size correctly you won't be paging as long as you don't enable WEM memory opt. Have multiple environments running with around the same specs, thx MS for making licenses so expensive so we go back to bulky VM's :thinking_face:

Are you expecting to see anything good come out from using PVS Accelerator? I haven't seen the use for it for 2 or 4 VM's per host, very curious to know if there's anything I missed about it

For us the usage of PVS accelerator is very disappointing. We have 8 VDA on each host and don’t see much advantages. Dom 0 has 16 GB and PVS accelerator uses 8 GB to cache. Boot time on XenServer is a pain compared to ESX. 2-3 min vs. 30 sec. 

thank you lads, this is great - much appreciated..... no wem memory management in this one (WEM for everything else but no memory management for obvious reasons), was hoping that accelerator will give some benefit....I saw one environment using Cisco UCS with accelerator and the difference was insane, but not sure i will get the same on the kit i am building on - already the speed of XenServer boots is painful compared to ESX

Target devices.... 120 Gb memory per target 

XenServer vm's - big hosts, split into 4 with nice gpu cards 

We do the same thing. 60GB RAM per target, though. Works well for us. Use ControlUp to monitor RAM / CPU / Page File / PVS Cache usage. Also - make sure you size PVS RAM cache correctly. And hook up your XenServer hosts so you can watch IO / latency on the local disks.

No page file, we disabled WEM memory management, it was not worthwhile as we are not RAM constrained.

<https://blog.citrix24.com/how-to-recreate-xendesktop-7-15-local-host-cache/>

Only time I have seen this not create the DBs is when there are SIDs (orphaned or invalid) assigned somewhere to some resource. I have a script on my site that will look in all the known places for SIDs and optionally remove them for you.

<https://carlwebster.com/downloads/download-info/get-broker-invalid-accounts/>

Thanks Carl <@UL8ACTGSF>, almost forgot. Will check that!

unfortunately no orphaned or invalid SIDs reported... Troubleshooting goes on

Check for any unsupported characters on your machine catalogs/DGs i had a customer where the import to the LHC by the Config syncronizer service kept failing event id 505.  I confirmed there was no orphaned SIDs in any resource and i also tried recreating the LHC database with psexec but it turned out to be a unsupported character on the DG name had me stumped for ages!!!!! You can also enable CDF tracing for the CSS

Thanks <@ULM6WD9LY> ! Good point. CSS tracing should be my next step.

We are not tracking assets to which our users connect / or from which they connect (not enough to collate the information at least). We log the user off the session, and that's pretty much the end of it for us. However, we are in the process of updating a bunch of our thin clients, and this problem has seemed to decrease over time.

This isn't related to ctxgfx.exe per chance?

I saw this type of strange behavior with fslogix. Dropped the software and went back to UPM. 

<@ULTGG1KDJ> I’ll check ctxgfx.exe.  <@ULLH59VQF>, no FSLogix in this delivery group, legacy 2008 R2.  Started when we rolled out CU4, and is more prevalent with a specific app.

<@UL5TCKFEF> We get individual sessions appearing to freeze.  Win2016, VDA 1906, FSL, WEM, some with GRID.  Killing the affected user's ctxcfg.exe miraculously unfreezes their session and they can reconnect to it.  Your prob may be different of course but thought i'd mention it :slightly_smiling_face:

<@ULTGG1KDJ> the session isn't disconnected, from both receiver and director it shows connected. I get access to the offending app today to do some troubleshooting.

<@UL5TCKFEF> Sorry yes i used the wrong term - in our case the session would be visually frozen on the client device.  When killing the user's ctxgfx.exe process on the VDA, the session would un-freeze on the client device and the user could carry on working.  You're right, there was no disconnecting or reconnecting going on.

I don't really have anything new to report either.  As we've been phasing in and out workstations lately.  I probably should circle back to the users.

<@ULTGG1KDJ>, yep, killing ctxgfx.exe brings the session back to life.  So, now, what's the real fix?

What graphics policies do you have applied? Might be worth going through those one at a time?

And... You're probably not going to like it :slightly_smiling_face:

But silo some users and enable CDF trace?  Not sure how else you could debug ctxgfx.exe :disappointed:

or just upgrade the next LTSR in 2-3 months

OR...   This might be a crazy idea...  but you can change the graphic policy settings on the fly and ctxgfx will pick them up and apply them in a couple seconds

looks like they started having an issue when we upgraded from CU1 to CU4.

I have access to the app and I can reproduce the issue.

how long does it take for the issue to occur?

like, can you make it repro in a minute or two?

it's odd the app works fine until click a specific button in the app and it appears to freeze.

if it's that specific then you can start the CDF trace right before you click and stop it right after

<@UL5TCKFEF> from memory it was similar here - app worked fine until a particular button was pressed.  Think it was google earth pro for some surveyors.  will find out.  we use Grid vGPU on the affected VDAs, do you?

Even though we're on Windows 2008 R2 we have Optimized for Wan enabled, meaning we're using Thinwire Plus.  We had an issue a couple years back with a build of Adobe Reader DC where they introduced a custom mouse pointer and there was drag with the mouse pointer with Adobe Reader DC in their sessions, I opened a case with Citrix and they suggested changing from Optimized for WAN - Legacy OS (legacy graphics mode).  This resolved that issue, I need to do some testing, but I suspect it's the cause of this issue.

We had a TON of problems when we switched away from Legacy Graphics on 2008 R2. Had to turn it back on. Now that we're on 2016, glad to have that gone!

I need to test, but I think CTX234028 solves my Adobe Reader mouse pointer issue.  I need to verify but I also suspect using legacy graphics fixes this app issue...  trying to build this test out now.

<@UL5TCKFEF> this may be off course but does it happen with different versions of workspace app?  Had a situation not long ago where LTSR receiver worked and no version of WSA would

<@UL5TCJ57D> most everyone is on 4.9.6001, I haven't tested with different version of Receiver.  Yes, Receiver version is something worth investigating.

Gotcha. Our issue didn’t matter what version of ltsr as long as it was so sounds different but who knows

Confirmed, applying "Optimized for WAN - Legacy OS" with legacy graphics resolves this issue.

On PTO today and was following along. Will test this out Monday.

yea so we are on 2012R2 so not sure that would fix our issue

<@ULHA2PS2H> now that you are on 2016 do you see this behavior anymore?

We do not. All we're seeing is FSLogix problems due to crappy SAN firmward :rage:

what it like to still have a SAN? Seems so "legacy". LOL

There _IS_ a problem with Session Recording on 7.15 CU4. No mouse pointer movement tracked on WSA for Windows. Mac is OK. Receiver LTSR is OK.

HEY NOW! :smiley: I'd love to get there. Can't justify the expense at the moment =(

sounds like your UX disruptions have cost more than the investment for Nutanix :slightly_smiling_face:

<@UL5TCJ57D> did I see you are leading a NUG now?

Yeah, well...soft dollars vs. hard dollars. That's not an easy sell here, unfortunately.

Yea so long as they are not turning away patients it's just soft dollars

Hey <@UL6KWR1U2> - complete side note: any update on a web client for CU? =D Even publishing the console on its' own server is painful =( (Sorry Brandon for hijacking your thread)

I think we're going to connect soon-ish.  I can pull back some curtains for your then

So, I've switched my legacy 2008 R2 delivery groups to "Optimized for WAN - Legacy OS" and the mysterious lockup issue is gone.  I "fixed" the Adobe Reader DC mouse issue with the REG key from CTX234028.

<@UKJA0MZN1>, I've be interested when you have a lockup, if you kill ctxgfx.exe for that user if the locked up user session comes to.

So we tried this yesterday with a helpdesk call and we could not terminate it (via director).

it's a system process, there is one for each user, I don't think I saw it in director.  I had to kill it via task manager.

I hadn't really had a chance to follow up with them about it. They just sent me an FYI on internal slack yesterday sometime

If it's the same thing, you'll see a rogue ctxgfx.exe consuming a bunch of CPU.

If it's a system process, and we can't kill it from director, and director doesn't show the PID. How will they know which to kill? Gotta make it easy for the helpdesk otherwise they'll just log the user out and call it good.

at least they are just logging them off, here our help desk loves to reset profiles for everything...  sometimes humorous because we'll get an ticket escalated to us saying settings aren't saving, we've reset the profile 3 times and they still aren't saving.

anyhow, if there isn't a rogue ctxgfx, matching that up to a user session wouldn't be easy.

I think ctxcfg.exe runs in the user's context, so you will see a bunch of ctxcfg.exe's in task manager or equiv, so helpdesk can kill the right one.

Controlup ties them up if that helps, looking under the user's session you can see their ctxcfg.exe with PID, right-click kill.

Yea this particular environment doesn't have control up, but we do have EG so I'll check that.

Anybody using Workspace Hub against a CVAD environment with multifactor?  It takes the config fine, prompts for auth, but then just doesn't do anything after that

&gt; Upgrades directly from 7.15 LTSR are also supported as long as you have stayed current with cumulative updates throughout the rollout.

I assume this means _officially_ supported. We're still on CU2 with no plans of moving to a higher CU until this next major release.

The statement is confusing but seems to me they expect you to upgrade to latest 7.15CU before going to 1912 LTSR

Hi James. I had a same configuration few years ago.  As I remember I had to create one template by host (template was just configured with vCPU, memory, network and no disk). I can check this point in my old documentation if you want.

I have just check my doc. I am wrong there was only one template and one host connection with all storage declared (ie: Local storage on host X, Local storage on host Y...). Your configuration looks correct.

I have no idea what i am missing - will try breaking out all the hosting connections and templates etc

Does your template is configured with a home server ?

you legend - i had skimmed right over it :slightly_smiling_face:

yes, it had a home server - exported and imported the template, changed the home server :slightly_smiling_face:

Thank you - I was going nuts :slightly_smiling_face:

many thanks mate, community is awesome :slightly_smiling_face:

I was going to suggest EXACTLY that as a problem.

Just kidding, had no idea. But love it when problems are solved before I can reply :smile:

Love this thread lol, I was gonna say a template per server. I worked for a small Citrix Specialist for a while and all we used was local storage and XenServer. Its why I have no hair.

i don't mind the architecture of local storage - just a few gotchas that can trip you up if you aren't doing it all the time i guess :slightly_smiling_face:

And there was me thinking that was because of people spelling your name incorrectly <@ULKDZHKFY> :joy:

<@UKJTJD4KA> replication is key for sure. MTU settings too. <@ULKK77J12> I don't mind that bit so much, I feel sorry for everyone else having to spell it ;-)

Hi All, migrating active-passive OnPrem XD sites to CVAD service. Anyone know how to set priority to published desktops between 2 resource locations so that it always launches from active datacenter. OnPrem setup is two XD sites with keywords primary &amp; secondary and StoreFront aggregation. 2 delivery groups with same published desktop in CVAD service show duplicate icons. Thanks.

Thanks <@UL5TCJ57D> Any chance you have documentation on that?

I could bet there's a tooltip somewhere there, waiting for a mouse hover so it can pop-up! :slightly_smiling_face:

Not sure I have documentation on it. I know we were looking at it a lot for capacity planning and noticed a major difference on Monday as usage over weekend is minimal. I’ll see what I can find

Last resort - I opened a ticket with support, and apparently it is undocumented.  Yay!

it's a way for them to get their support response time numbers up.  People open a ticket and get a quick response and quick close. :rolling_on_the_floor_laughing:

<@ULJMUKVMK> You are sounding as cynical towards Citrix support now as I am

Citrix support sure does leave a lot to be desired......

You're not alone there, mate!
...and YES, VPN is not better. It's actually worse!

I'm actually happy I'm not alone. Appreciate the response.

Yes for sure.  A connection goes down, "we can't get into Citrix".  File server (or whatever) goes down, "Citrix is broken", network/qos goes screwy, "Citrix is slow/crap", storage is slow serving vDisks "Citrix is slow/crap".  Anything from Vmware to GPOs - "Citrix is broken/slow/crap".  Very rarely actually the fault of a Citrix product.  Give them a crappy Dell Windows laptop, forever updating, full disk encryption going screwy, AV slowing it down, etc. etc.  These users have short memories!

I'd say 120% 'coz we Citrix folks have turboboost :smile:

Yes I agree same stuff here. I even get tickets sent to me that says Citrix application laggy. I investigate. I reply to the help desk the user isn't using Citrix. They say oh. We seem workspace app and assumed it was Citrix.

Unfortunately I don't think we can Evey change this. We have control up and I can produce reports showing Citrix isn't the issue. Still the same stuff. I understand there will be issues but not like they say. Wish we we change this l.

For us, half of the time it's the user's workflow. We have users who will VPN in using AnyConnect, and then connect to Citrix apps/desktops from there, despite the fact that they should be going directly to our NetScaler in the DMZ. It never fails.

Or you could change the appearance of StoreFront by replacing all Citrix logos with an Apple logo, and they'll gladly accept any and all shortcomings with glee.

That's what I was getting at - I have rebranded Storefront and the Workspace App many times, to the extent it looks a bit crazy when I'm recording videos

Logo.jpg

Feel free to throw this in there at some point to really confuse people...

Your not alone..  they built a vdc in Korea and kept all files here without even asking about vdi.  The users complain it slow... ya think! :exploding_head:

We've been trying for a couple years to remove vendor names.  When we switched to IGEL and XA/XD 7 we termed it as "The New Platform."  So now they are starting to say "The New Platform is ..."

I meant to add this is for workspace app client issues. Very basic stuff for them. Just curious if I'm not providing good guides for them

Thats a never ending story...
I use to do some reccuring kind of hands-on.. at least on one guy then hi can give the learnt stuff over.
The next time choose another one, maybe an overhead i know.
Its kind of difficult, since help desk usally they deal with a lot of other stuff as well, and the “oh sh...t“ i forgott“ rate is quite frequently.
I do some guides as well, but i an not sure if they even read it...

We are running in our XenApp environment. It's great!

With the later versions, no gotchas. On the 4x and early 5x versions, non-persistent didn't work really well. Now it does.

IMO, everyone who hates AV penalties in VDI/SBC should switch to traps. Hardly noticed the impact of the agent and superior protection.

Read the palo edocs carefully. They had so many ways to prep a non-persistent machine. With new versions is quite simple.

That is exactly why we are interested in Traps, low footprint, and it still gets the job done.

<@UKJA0MZN1> before traps, what AV solution were you using?

quite complicated comparatively. Lots of dependencies to get scanning working.

I guess I will say on the VDI stuff with Traps that there is 1 gotcha. You can install the agent and then run an image prep process where it pre-scans all your EXEs and then you can pre-stage the verdicts. This way EXEs on your master image are in effect "whitelisted".

If you make changes to the image you may want to run that process again. It can take an hour or longer to complete

<http://docs.paloaltonetworks.com/traps/6-1/traps-agent-admin/traps-agent-for-windows/install-the-traps-agent-for-windows.html#id17CTFI00QHB|docs.paloaltonetworks.com/traps/6-1/traps-agent-admin/traps-agent-for-windows/install-the-traps-agent-for-windows.html#id17CTFI00QHB>

Read the Configure a Traps Agent in a Non-Persistent VDI section

low footprint benefits aside, just the concept of how they handle malware by trapping for 24 known exploit techniques is way smarter than managing billions of file definitions. This is disruptive endpoint protection IMO.

<@ULLLG3UUV> <@UMVNUT9C6> It would be cool to see a GO-EUC study on the impact of user density with Traps vs "the leading vendor"

I think Steve said it all. Yea, we have been partnering with Palo for quite some time and their Traps product is second to none IMO for all of the reasons Steve mentioned. You can run it with or without Palo Alto Firewalls, however having the whole stack provides added benefits of course.

<@ULRF0Q64E> Good info from Steve/Oz re: Traps vs TrendDS

Can you guys comment on the relative cost of traps vs TrenDS without the PA firewall?

We were subscribing to TMDS for the virtualization environment and trend micro office scan for the windows and points. We have since moved to traps for all Windows devices. My overall costs went up quite a bit. However looking strictly at the virtualization environment I think the costs are cut in half

A lot of it depends on how many devices you need to protect and the quantity you are buying. We license 700 and points which includes server virtualization

And you were using DS with guest introspection, and TRAPS ended up cheaper... hmm.  We may have to take a closer look at it.  We are getting ready to do a Trial and POC of DS, since we already run officescan in our environment.  Seemed easiest to go to DS / Apex .  Do you feel TRAPs does a better job for AV/AM than the DS Solution?

^ OfficeScan's seal process is a pain point as well (TCacheGen being 100% manual)

Part of the reason why it was cheaper is that we bought so many and points in total. Had I just protected my virtualization environment it may have been similar in cost. You know, some of this also boils down to how well you negotiate. We are a nonprofit organization so we can get better discounts sometimes.

Traps is by far the most superior endpoint protection on the planet period. IMO that is. 

Once you learn how it works you will be kicking your self for using a traditional antivirus. It is a game changer

TMDS is very complicated to deploy comparatively. You can return so much capacity back to you or your team by the deploying a simpler solution. We had so many problems getting the introspection servers to remain online all the time.

Those are pretty strong words.  Thanks for the share, we'll definitely take a look.  I'm assuming they have good server os protection as well as desktop?

Same agent. Different command line options depending on your scenario like terminal server or VDI

Not sure if you have a good reseller or not but if not talk to <@ULEEXJUD8>. They work with a incredibly smart Palo Alto integrator called Norlem. They put on boot camps where you can get hands-on with the product and that is where you really see the power of the product

They let you install ransomware on machines and you can see how traps stops it at various different attack chains because usually it takes 3 to 6 successful exploits to take ownership of a machine.

Jup.. as I'm also one of the developers:yum:
Any questions?

Sure, this tool should not be missing in any collection. :+1::skin-tone-3:

I think it needs no guide. You start your remote session and you get exact informations about your protocol. You can change settings on the fly like the video codec. Only thing to keep in mind, start RD Analyzer as Admin. 

:point_up:This! We always want to keep RDANALYZER so straight forward that we don't need to create a guide. <@ULLH5JGFR> you can always reach out to me if you need some help.

Yes! Though my license just expired so need to renew... 

Wow, nice. I've been a light user in the past, but my license doesn't work in the newer versions, so I was trying to see if others still used it. I'll have to get in touch with them to see if they do POs now, since that's the only way we're allowed to actually pay for anything (fun being non-profit).

<@ULC9J5XPB> We only do POs for Company licenses. Personal licenses is PayPal only at the moment

This would be a company PO, but I was told this morning that we basically have to go through our VAR (Connection), so if you don't sell through them, I'm SOL.

We are just a small group so we do only direct sales... But your VAR can purchase it from us under your name and Re-Use the PO for you

This is neat software, how would you go about it for published applications?

When i meant published apps, I mean like changing settings on the fly for example outlook, word ect.  If its possible

I played with SOCKS proxy a few years back with limited success, I use OGR regularly and it’s rock solid - the answer from Citrix would be to leverage OGR 

Hi James. I share your point of view. I ask the question because I am doing a Citrix audit and the customer use proxy shocks. I will recommend OGR but I need some arguments. For the moment I have: SSL, same store for internal and external access, configured by GUI (Storefront Console), possibility to use HTML 5 inside corporate network (Secure Web browser for instance)...But I don't know if I miss regression point.

only other things i could think to add - less complexity, widely consumed and supported model via OGR, more visibility into traffic flow via the gateway vs the CR vServer, no intervention with ICA file edits etc

Not in ESX , in HyperV. ESX is usually pretty good.

I have that before. PVS has device that has the mas already.

<https://kb.vmware.com/s/article/1024025>

yea had that before when creating desktops in the thousands and one of the xendesktop setup wizards fail before it registers the new devices in the last step with the machine catalog. you have to look at the either pvs or vsphere to figure out the last item that was created (can't remember which way round they are created now, probably PVS device first then vSphere VM), grab the mac address and do a search to ensure that the mac address is being used elsewhere. we script ed using citrix snapins and powercli the mass deletion of the vm's as we found it easier just to delete everything in the failed attempt range and start again. If you find one duplicate then it seems likely that there will be others, so the XenDesktop setup wizard would fail again and just make the issue worse.

the script was basically using the following vSphere: "remove-vm -vm %VMName% -deletepermently -confirm" and for citrix pvs snapins: "remove-pvsdevice -name %Targetname%" and remove-pvsdevicefromdomain -name %ADname%"

We ended up tracking this down to another cluster actually made the same MAC randomly

our dumb luck and the fun of having more than a couple clusters