World of EUC

feel like automatic could mean different things to different people.  Maybe some people want the good quality but don't want the bandwidth hit.  Guessing Citrix will do a better job at setting the default in the Cloud, since they can see what settings everyone is using.  On prem, a little tougher.

The idea is as follows: The automatic settings for audio work like this - We have a weaker connection quality: we automatically change to Medium or Low, the connection is very good: we automatically jump to High. Seems to be easy and will improve user experience without any effort from Citrix admin. :man-shrugging::skin-tone-2:

i bet High already does a good job of this, worth testing.  Agree though, just set to automatic and we'll adjust if we need something different

“Adaptive audio” is coming soon :fire:

Maintenance mode prevents the reboot of the VM

Perfect. Thanks Steven. That was my assumption, but wanted to confirm.

If I remove the VM from maint. mode and the terminate policy has been exceeded, will it automatically reboot, or does the timer begin again?

I think the terminate policy still takes effect.

But it would depend on how your configured your action at logoff and “ShutdownAfterUse” delivery group’s property

There is a setting for conflicts where you can specify behavior

Is it worth deleting at logoff as well as logon? Seems like it just increases logoff times 

if it's a persistent VDA, i use delprof with a scheduled startup task.

Its non persistent server 2019 and only reboots on weekends, plus the timeouts are so low they might have to log in 5 times a day 

Delete local profile on logoff. You have to pick a winner and it might as well be the one you have more control over. To answer your question - <https://docs.citrix.com/en-us/profile-management/current-release/configure/stream-profiles.html>

FSLogix is a must, and WS2019 is also a must

Nope, not a must <https://james-rankin.com/articles/managing-onedrive-on-citrix-virtual-apps-and-desktops/>

In RDSH environments, I find CloudDriveMapper is a cracking solution - YMMV

ZeeDrive or CloudDriveMapper.  Native OneDrive utility is a trainwreck, and does NOT handle over 100k files...

CDM is supposed to be releasing an "API Version" whatever that means. Which will not use WebDav, and they claim large performance increases.

Yeah the connection will be native, and it won't choke when MS disable another bunch of ciphers

yeah, WebDAV is a travesty, and I hate it.  Really not much choice though.  We have a TON of XenApp and OneDrive/SharePoint, and the native tool just DOESN'T WORK

ZeeDrive works, and works consistently, it's just expensive

image.png

 Check the federation cert on exchange to make sure hasent expired. 

I don't have VDI, but we use set-brokersession to hide stuck sessions. <https://citrix.github.io/delivery-controller-sdk/Broker/Set-BrokerSession/#:~:text=The%20Set-BrokerSession%20cmdlet%20sets%20properties%20on%20a%20session,using%20the%20-InputObject%20parameter.%20Related%20Commands.%20Get-BrokerSession%3B%20Parameters|https://citrix.github.io/delivery-controller-sdk/Broker/Set-BrokerSession/#:~:text=The%20Set-BrokerSession%20c[…]20Get-BrokerSession%3B%20Parameters>
Example: get-brokersession -username domain\username | set-brokersession -hidden $true

Hmm - i will do some testing with that - not sure if it works with VDIs

Interesting - the documentation states "A session may be hidden automatically by the system when an attempt is made to reconnect to a session that is unreachable due to, for example, the failure of a VM's hypervisor."

We haven't seen that to be the case. Might have to open a case with Citrix

does citrix see that the hypervisor has failed? Is the power state unknown for example?

Literally had this happen the other day.  Hid the sessions and the users were able to get back in.  If using fslogix profiles you may have to release the disk locks on the share so the hung profiles can be opened in RW mode which is needed if you are using outlook with .ost's (like we are)

Also <@U01258VQW56> I've have never seen that to be the case either

If you're not going through a netscaler then I believe that is indeed a prerequisite

You have to allow Websocket connections via Citrix policy: <https://support.citrix.com/article/CTX223503|https://support.citrix.com/article/CTX223503>

I think there are no other ways, or enable ssl on vda or browser modification or use gateway for internal connection. <https://support.citrix.com/article/CTX134123>

Looks like this is what I needed to read.
<https://support.citrix.com/article/CTX226174>

The snapshot comes after the shutdown actually.
Version 1 -&gt; start the VM -&gt; Do your update(s) (aka install an app) -&gt; Seal -&gt; Shutdown -&gt; Snapshot to get version 2.
From the studio, target your new version with the “update catalog” wizard. You’re good to go.

it always throws me how different snapshots are in hyperv compared to vmware

You can’t snapshot a vm in azure :-) it’s all disk based. You either select the OS disk of the master image VM, or you manually take a snapshot of the OS disk. I always use the latter, that way I can name it the way I want it and have a nice easy way of managing it - I have a script somewhere I’ll dig up 

Here you go <https://github.com/JamesKindon/Citrix/blob/master/Azure/CreateOSSnapshot.ps1|https://github.com/JamesKindon/Citrix/blob/master/Azure/CreateOSSnapshot.ps1>

Oh, I didnt know that. I see the Snapshot option I needed to setup in Azure. But I wasnt 100% on it.

<@UKJTJD4KA> you have a guide on setting up Citrix Cloud with Azure?

<https://docs.citrix.com/en-us/tech-zone/design/reference-architectures/virtual-apps-and-desktops-azure.html|https://docs.citrix.com/en-us/tech-zone/design/reference-architectures/virtual-apps-and-desktops-azure.html> not sure how up to date this is 

Oh man, I should have did a better job looking. Thanks James.

Citrix hooks is the first thing to check, there are two places to do it these days, if I remember correctly

I excluded the process by adding it to "Ctxuviprocessexcludes" or whatever the key is called and checked to see that the citrix DLL's were no longer injected and they weren't, so it should be properly excluded from all citrix api hooks i think. Is there anything more i should check?

Does it still use ExcludedImageNames as well? Or is that just for older versions?

ctxuviprocessexcludes is for 7.9+ and newer i think.

Running 1912 LTSR CU2 in this environment

The old one still plays a part in my experience - the key James referenced above 

Yes, i've still used ExcludedImageNames on 1912 versions of VDA, successfully.

Check the twi settings as well. There used to be a twi checker that would allow you to do a lot

<https://support.citrix.com/article/CTX222592|https://support.citrix.com/article/CTX222592>

Adding it to Excludedimagenames didn't help either. I've been fiddling a bit with CAX - haven't used the tool too much, but i verified with CAX that all Citrix Hooks are indeed disabled for the processess.

I tried out Per Window Class Seamless Flags as well to change the classes of the specific window that is crashing the application but i haven't had any success so far.

According to event viewer,  there's a .NET crash when we attempt the operation.

.. Stupid badly written application that is far too popular in Scandinavia :sweat_smile:

Did you try to run via powershell or cmd prompt? Publish cmd and run the app via command line 

It still crashes when running app via CMD :disappointed:

Is it an app that calls up another rdp app?

It works on RDP, and what about running it in a published desktop?

When you say crash, it opens up then closes or throws a error?

There are many settings for this type of situation, I can get almost any application to work in a seamless state. I just want more details to help you

Published explorer first, then call the application after in the aurgments.

If it’s an rdp app it will not work as a published app

Hey guys, sorry about the slow response.

So, just to provide some more detail:
Running W2016, PVS.

This is a application that is started through a UNC shortcut, when completing the action in the app it causes the application to completely freeze with no obvious error messages. If we take a look in Event Viewer we can see that this crashes the .NET Runtime, see picture.

After doing some more troubleshooting, i've found the following:

The first time we attempt this operation through ICA, it works just fine. However, if we close and open the application and try again, it's stopped working and we get the error message in event viewer. Signing out of the session, and signing in, does not help. Resetting the profile (We use UPM) does not help either. It looks like it starts working after the terminal server is booted again - which happens every night.

If i sign on with the exact same user through RDP, it works every single time.

What's interesting is that if i'm in an ICA session and use "Run as another user" and run the app with my domain admin user, the exact same happens. It works fine the first time we use the function, but after closing the application and re-opening, it doesn't work anymore. But if i switch to RDP it's no rpoblem.

My first thought is that something is up with the profile, but resetting the profile does not solve the issue.  And since it's only happening through ICA it must be citrix related.. really strange.

I will try to call it through published explorer to see if it makes any difference.

Running it as a published app, both pointing directly to the .exe or through explorer.exe does not resolve the issue.

So - it looks like if one user triggers this error, it stops working for all users on that terminal server - when terminal server is restarted, it is working again, but stops working for all users yet once again when a user triggers this issue..

And when it stops working, it only stops working through ICA. Really weird.

I cant find anything in event logs about citrix components crashing.

I found this one in system just now tho, it looks like this error is also generated at the same time as the one in the picture i attached earlier

Also tested running it as an inital app through rdp <https://support.citrix.com/article/CTX218256>

And it works just fine, so definitely some weird citrix issue..

So try this, on the sever that the application is on. Publish cmd. Open CMD and put this in.

runonce.exe /AlternateShellStartup 
Then open the application from cmd



Have you by chance see this?
<https://support.citrix.com/article/CTX127874|https://support.citrix.com/article/CTX127874>

I was thinking this maybe something around active setup not injecting something correctly. This article states IE but ignore that I just give it a try 
<https://docs.microsoft.com/en-us/archive/blogs/askie/things-to-do-when-troubleshooting-internet-explorer-terminal-server-and-profiles-issues|https://docs.microsoft.com/en-us/archive/blogs/askie/things-to-do-when-troubleshooting-internet-explorer-terminal-server-and-profiles-issues>



Sorry, didn't see these messages until now. Thank you for the suggestions. I finally found the culprit! It turns out that this application only crashes if policy "Automatic keyboard display" citrix policy is turned on. After setting it to Prohibited, issue no longer occurs!

Good find. I guess it was environmental being its disabled by default.

<https://support.citrix.com/article/CTX312452> describes the behavior we are seeing.

Not in this combination. but check this: <https://support.citrix.com/article/CTX312452>

Might not be relevant in your case but we experienced the grey screen issue recently and it was caused by a 'missing/changed’ PATH variable. 
I’m posting as it really was a nightmare for a few days. 
<https://www.vcloudinfo.com/2020/05/citrix-grey-screen-issue-solved.html|https://www.vcloudinfo.com/2020/05/citrix-grey-screen-issue-solved.html>

Just an update to this - we may have found the issue.  The faulting module is the "CtxUvi.sys" file cited in the system event 1005 events (referenced above in CTX312452).  As it turns out, Citrix slipped that file into the tech zone AV best practices/exclusions article on 8/24.  Coincidentally, I copied and pasted all the listed exclusions in that article and emailed them to colleagues on 8/24 but before the article was updated.  We've added that file to our exclusions and am hoping that it does the trick.  <https://docs.citrix.com/en-us/tech-zone/build/tech-papers/antivirus-best-practices.html>

That file is also missing from the 8/13 version of this article on the Wayback Machine archive:

<https://web.archive.org/web/20210813115801/https://docs.citrix.com/en-us/tech-zone/build/tech-papers/antivirus-best-practices.html>

The "document history" lists the last update as August 12, clearly that's not actually the case.  Doesn't list the 8/24 to the AV best practices article at all....kind of concerning.

<https://docs.citrix.com/en-us/tech-zone/document-history.html>

Anyone have any more insight on known issue 14 listed in <https://support.citrix.com/article/CTX255870|this CTX Article?>
New build of 21H1 seeing the exact same - workaround says to uninstall / re-install the VDA.....but this is a brand new image.

It doesn't appear to do anything useful at all

Yes we have seen something similar, and also people in this thread <https://discussions.citrix.com/topic/403721-office-365-pro-plus-shared-activation-password-screen-not-able-to-select/>

You need to turn off ADAL to make it work as a published app, which MS would prefer you not to do.

<https://support.citrix.com/article/CTX267071> that has the reg keys

thanks for this guys, you actually don't have to turn of ADAL you just need to register the WAM plugin in the session, looks like the plugin only loads in a full desktop environment so a logon script with a bit powershell in it to install and/or register the plugin makes it work

Would be interested to know what bit of Powershell you are using to make it work. Is it the code from the Citrix discussions that does Add-AppxPackage?

Hey, yeah its just this bit

if (-not (Get-AppxPackage Microsoft.AAD.BrokerPlugin)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown } Get-AppxPackage Microsoft.AAD.BrokerPlugin

save as a Powershell script, run as a logon script from a GPO, works every time

Hi together,
Has anyone had experience with YubiKey FIPS (4 Series) or the case that a Windows client (latest Workspace App) needs to pass it into a Citrix session (CVAD 2106) to sign e.g. Word documents?

We used to create scheduled tasks on the worker, putting itself in maintenance mode to drain users and then, just before restarting (in another task), turning off the maintenance mode.

Thanks for workaround. However we need native solution from Citrix something similar to options for MS “change logon” but a little bit more advanced - feature request will be produced.

We use Ansible tower to run powershell scripts to do this.  The tech who needs/wants to put the machine in MM just goes and fills out a small form to tell the system how long to leave it in maintenance mode before removing.  It doesn't have an option to do on reboot, only time based.

Oooo good question, never tried that.  Following this

All my environments use "ctxlicense" for RDS licensing and Citrix licensing, which just points to X... so, can always just move around licensing and update DNS...

Our XA guys were wondering. I haven't had to touch licensing in so long that I wasn't sure anymore.

I generally just use an A record, but CNAME also works

Using a cname for RDS licensing for many years now, no issues.

Hi Rob you have idle and disconnection timers in citrix polices which apply to desktop OS you would disable both of these and apply to DG or TAG ect

make sure you have no power management settings set on the DG either look at the peak/offpeak buffer percent and disconnect actions. It is still quite difficult even with above set as you have things like SCCM patching and rebooting persistent VDI's  overnight

Ah, great, thanks <@ULM6WD9LY>. I think we have one of those set, but not the other

<@U0125D243RN>  <https://jkindon.com/2021/08/09/citrix-session-management-policies/|https://jkindon.com/2021/08/09/citrix-session-management-policies/> a refresher 

Cheers <@UKJTJD4KA>, some nice bedtime reading!

We do it and yes it possible. What everyone said is correct 

<@UKJTJD4KA>’s article will give you all you need to know. We have similar use cases, where users need to leave a session active overnight, and in a disconnected state (still processing) for days. We still set timeouts, so don't remove them altogether, or sessions can linger for a long, long time, which is not great, especially for the Ops Team.

Great, thanks <@ULLH5JGFR> and <@U011Z7F6733>

FSLogix Rule or better use FSLogix profiles rather than UPM :grin:

that’s what I’d like to do, bit of reluctance to put it in place

bah FSLogix is not better than UPM. Its serves a different purpose

<@ULLAD12P2> you would need to configure a variable in your user paths (an AD attrib) and then change that attrib based on requirements

Mike as per what James said this is what you are looking for:
<https://docs.citrix.com/en-us/profile-management/current-release/configure/specify-user-store-path.html>

I've got that part configured, just trying to send my test user to the new file share when it logs into prod to make sure permissions are all good. It works in the poc environment but that's not a mirror of prod so...

Hopefully it works OK for you... I've used it a few times, eg in an education environment to send staff and students to different profile servers

<@ULLAD12P2> yeah i feel your pain - whack a single server into a sub OU and override the profile pathing :slightly_smiling_face: proof in the pudding, only one broken server :slightly_smiling_face:

A little late to the party after being out on PTO to go watch a taping of Battlebots in Las Vegas, but will say that 100% UPM works with the variable configured. We have it pointed at an extension attribute and and all clients use their own profile server, but the configuration for UPM comes from a single policy for all clients.

Going back to this for a second, if I want to set an attribute to UAT, PRD, or POC, what’s a good attribute to pick, or should I create a new one?

I tend to pick a standard one that's not in use/unlikely to be used in the forseeable future rather than add new attributes.  If you don't use any of the fields on the Organisation tab then Department is a good candidate, or there's carLicense, or good old userParameters if you aren't using ADC native OTP

<https://www.ferroquesystems.com/resource/issue-citrix-workspace-app-authentication-service-could-not-be-contacted/>

Thanks <@ULCBDDJCR> already seen, did not help:smirk:

yes i add the trusted domain and beacons are correct, other GW with same setup works.
Completely strange stuff....:laughing:

Do you have a seperate session policy/profile for Receiver on the Netscaler? check and make sure it is configured correctly

You also have a beacon checker on workspace app advanced prefs / beacon checker so i would check that also.  Pretty much all the time i have seen issues like this where using Receiver doesnt work and RFW is fine its a beacon issue or issues with the configuration of the Receiver session policy/profile

Hi  <@ULM6WD9LY> thanks for your feedback.  Session Police are correct, since the same session police i have tested binding it to another GW which works out good.. i have checked the beacon as well and did not found any miss configuration.

found it.....Shift+click restart takes you to the startup repair

Scheduled task (microsoftedgeupdate*) is disabled ? Install edge with evergreen script :stuck_out_tongue_winking_eye: and the script disable it all for u :joy:

Even though it says it failed, the run time matches the folder creation time.

Whoever created that at MS deserves a swift kick to the groin, and I'd like to deliver it personally.

I disable the services and tasks on the image and deploy the domain policy otherwise edge tries to run the updates as admin ans the users see an error 

It's happening on my packaging VM, so no policies are applied at the time. I just now have to find the last OS layer where it's still on the version I installed, delete the newer ones, and recreate it with the damn task disabled.

They must have changed the task names, because my install script does have two tasks listed in there to disable.

Guess I'm going to just wildcard it for when they change it again.

Yes they changed it to often. I use a wildcard in my script

This really bit me in the ass. I created 3 layers after this OS version layer, and now have to redo all of them, because they all installed Edge v93 on them. One of those times where I hate App Layering.

I have not seen that issue. However I usually implement the "disable auto update" registry value instead

New-ItemProperty -Path HKLM:SOFTWARE\Policies\Microsoft\EdgeUpdate -Name UpdateDefault -Value 0 -PropertyType DWORD

I updated my install script, but I may add that just for the hell of it.

Not the Kindergarten method? Or Twins method? :smile:

It's Microsoft so they do everything in their power to force updates. Just for windows updates we even change the account the windows update service uses to guest so it can't run

Weird one but i'm seeing a similar behaviour on Windows server 2019, edge update services disabled, scheduled task disabled and still i get prompted for updates in the session, have checked and <@ULL6F7DRA> suggestion is also set to 0 but still we get the prompts

Well, I'm now seeing an issue with Edge 93 and opening O365 docs (defaulting to attempting to open in the thick apps and not web). Still testing to make sure it's not the build of O365 I'm on, but this is reason enough to be cautious with Edge updates. If my testing holds up, 93 will be removed from my image and I'll be going back to 92.

<@ULC9J5XPB> did you check the release notes for Edge v93?

I found this, and it might be related to what you see

<https://docs.microsoft.com/en-us/deployedge/microsoft-edge-relnote-stable-channel>

I did, and have been playing around with those. One of them resolves the prompt for downloading a file, but nothing seems to address the fact that the online editor is not the default action when you click on one of your OneDrive docs in that feed.

Yep, to open with Word installed on the VDA,e tc.

In Edge 92, default action is to open in the browser using Word online, etc.

The weird thing is that this new behavior only happens in your Feed in Edge. If I go to <http://office.com|office.com>, sharepoint, or onedrive online, files open in the browser by default just fine.

So I could use one of the new policies to simply automatically allow Office doc file extensions to open. Will probably do that in the end so that I'm not stuck on Edge 92.

Let me know what you find out, I might come across the same issue at some point

99% chance I just add Office file extensions to the AutoOpenFileTypes GPO.

Consensus is that we don't care that it opens in the Office apps by default, especially if it's just from the feed.

Figured out why. *?web=1* is not appended to the end of the URL in links in Edge 93's feed. It is in Edge 92's feed.

I have done backwards before but there is an occasional hiccup. If you are prepping to upgrade I’d keep using the specific version for that broker so that nothing causes issues with the upgrade

mainly wanting to update my VDA's and the studio on them in 1 shot, prior to updating the DDC

Yeah if you are doing it on the app server shouldn’t be an issue. Where I’ve seen issues is when management servers get updated and doing daily management of the environment

Not that i am aware of have you got the recommended Anti virus exclusions in place ?

It is not in my management but we have always recommended this.

<https://docs.citrix.com/en-us/tech-zone/build/tech-papers/antivirus-best-practices.html> i would defiantly check them

I asked for further verification of this exclusion

The problem was caused by Chrome 93.x bugs. I revert to chrome 92.x and all fixed.

Has anyone used ECC certificates with FAS for windows logon?  <https://admx.help/?Category=Windows_10_2016&amp;Policy=Microsoft.Policies.SmartCard::EnumerateECCCerts> seems relevant

<@ULL6F7DRA>: Another item for you to test.

After the browser opens, your account is logged in in the background, and your settings change dynamically.

Also worth noting that if you want to enforce the user staying logged in, you also have to disable the *Enable guest mode* policy setting.

Slow down with the stuff to test, I am still trying to regain access my Azure tenant :smile:

MS wanted me to provide Company Registration Report for <http://virtualwarlock.net|virtualwarlock.net>, today I had to explain that is not possible as <http://virtualwarlock.net|virtualwarlock.net> is not a company but just a website/blog

and I totally understand that they have to ask for that info

The whole edge deal is messing me up with workspace on different user names.

We've been running Trend Micro Apex One (previously OfficeScan XG) for a long time now, and have had good success. That said, we're moving to Defender next year for two reasons: Trend pricing skyrocketed, and the physical devices are all moving to Defender, too.

<@ULC9J5XPB> Hopefully MS doesn't false positive brokerservice.exe again :rolling_on_the_floor_laughing:. All joking aside, as an O365 shop I wish that is the direction we would move.

haha, while I'm excited about the move, I'm also nervous, given the two major incidents that they had with Citrix over the last year or so. I don't know if it was definition updates, but I want to be able to delay certain updates for at least a few weeks so that I don't get bit in the ass like some did.

We were hit by the brokerservice.exe issue (it was missed in the exclusion config) and several months to a year before that, it caused issues mounting .vhdx's for the FSLogix profiles.  Both began occurring immediately after a definition update....which I really wouldn't want to delay the install on anyhow.

For some reason, I thought the other issue was a VDA one, but if it was BrokerService.exe, that's obviously controller.

Yeah, been a while but 95% sure that was the case.  Let me see if I can dig up the email on the FSLogix thing, that was almost a couple years ago now.  Maybe there was a VDA issue too, but our most recent issue with Defender was it quarantining the brokerservice.exe file which unsurprisingly, made our controllers stop brokering new sessions.

Here is the ctx article from the brokerservice FP. <https://support.citrix.com/article/CTX279897>

As much as its easy to blame MS in that event, if you have properly defined your exclusions that specific issue would not have happened.

my last email on the VHDX thing was that Microsoft released a Defender definition the day after the widespread issues occurred to address the issue, so I'm thinking it was a definition update that broke FSLogix

I check the exclusions occasionally, but if they sneak one in, I could see it being easy to miss. It's one of those things that I don't recall ever seeing included in one of the many broadcast e-mails I receive from Citrix.

Yeah Citrix updated their AV exclusion recommendation "tech zone" article on Aug 24th and added a new file to exclude.  They didn't include the change in their change log so even subscribing to it with RSS wouldn't have notified us of a change.  That file was one that was causing us login issues the previous week.  We're probably going to use some 3rd party service to scan their AV doc and notify us of changes so this doesn't happen again.

That's exactly what I just made a note of. If you come up with a decent solution for monitoring that page, feel free to share it. I was thinking of just having a PS script scan it for the date and see when it changes, but that's pretty crude.

I kind of just loosely follow that doc anyway.  Instead of excluding the specific processes I generally just exclude the entire folder/subfolder structure.  For instance exclude all of c:\program files\Citrix, etc

That's what I've done for certain items, as well.

Gotta be careful doing that though, that's how Kaseya customers got pwned

<@ULC9J5XPB> <http://visualping.io|visualping.io> is the service I was leaning towards

Interesting. I may test it on one of the MS docs pages that I know changes frequently.

what I liked about it is that it does more than just notify you a change occurred, it actually highlights what was added and removed...kind of like an examdiff for webpages

so in the case of this CtxUvi.sys file, it'd have been quite obvious Citrix slipped that change in as opposed to just trying to manually parse the page and compare that to my existing exclusions to figure out what I need to change

Sorry about the thread derail.  I posted a week or two ago about the possibility of using AMP in Citrix since that's being rolled out to physical endpoints, sounds like you have to disable enough things that set it apart from Defender that it might not be as beneficial at that point.

Something like App Locker (or similar) + a more basic AV probably offers pretty good protection as well.

Glad this topic came up, as I'm missing a few new entries.

I think I'm inclined to leave C:\Program Files (x86)\Citrix\ICA Client\ in the excluded directories rather than excluding the half dozen processes within.

We've been using crowdstrike for a few years now. I belive now they have exclusions but originally there weren't any, and we don't have any set.  Only had one issue with pvs machines since we switched to it. I'll take it over trend any day.

+1 on Crowdstrike.  No exclusions set, and no issues.  Will have to check with our security team if they now allow exclusions.

Our prior solution was Mcafee...Dear lord....I still have flashbacks.

Our physical clients all run McAfee. We refused to even meet with InfoSec when they asked to install it in Citrix, haha.

I’ve had crowdstrike kill and old win7 image with pvd, and it also failed to pick up ransomware. Their updates have no release notes and oftentimes just don’t work. On top of that, their support is abysmal. I would not recommend.

I should have added YMMV i guess.
I'm happy that the 25% total CPU overhead per VM that Mcafee added was wiped away overnight. Never used PVD, since it was a crock..

PVD was rubbish, as evidenced by the fact that adding AV could totally kill it

I hated every minute I spent having to support it

Bitdefender Gravityzone is a great solution as well.  We have had it deployed for several years now and works VERY well with little to no impact on throughput!

Screen Shot 2021-08-27 at 9.13.59 AM.png

No. You just get a message saying its not currently supported.

Thanks Paul that's what I was thinking but a Citrix employee has said to my customer that it will be possible in Q3 2021 (that's not the case for the moment :grin:)

I sure hope so.  We need to add a few teams to view director.

this is definitely either soon or very close roadmap item. Honestly, I thought it would be there by now. So soon

Think it is currently in Tech Preview and you can request to have the functionality enabled on your subscription

The preview only works if using azure ad tho doesn't it?