World of EUC

we actually dealt with this exact issue last year and had a Microsoft ticket going on it since we had that set to 7 days but klist was still showing 12 hours i think?  came down to us having to redo our default domain policy so it was clean and ONLY had in the default stuff and just adjusted the values (i think we maybe had added a few additional security items in it before they said was conflicting).  after that the issue went away

went away meaning running klist on a VDA showed 7 days like it should and the disconnects went away

we've actually ditched FAS since but making those changes did help.....i believe FAS was messing up our Onedrive auto account config policy and maybe some other Azure join stuff

sorry i just re-read your info and you actually are showing the 7 days i guess so it LOOKS like the policy is working so this sounds different than what we dealt with (same workaround though to disconnect/reconnect to renew the ticket)

Yea, I am still digging. Something is off somewhere. Thanks for the feedback though.

Ran into the same issue and ultimately found out it was an AAD Dynamic Group with a time bomb (users were temporarily added for AAD join).  Limited the TGT

I tried to work a feature enhancement to at least have FAS notify the user if their ticket is about to expire, but have since struggled to find out if it went anywhere - sent several follow ups and never heard back.

They are in a Dynamic Group. I need to find what you mean by Time Bomb though

I purged the Kerberos Tickets for one user. Had her disconnect and reconnect back in. It hasn't came back. Just doesn't make sense to me.

Sorry by time bomb I meant time-based TTL membership.  i.e. User is in group until X and then automatically removed

Carl Webster Scripts + Visio :slightly_smiling_face:

Webster's scripts are the industry standard documentation method now

cool, thanks for the nice words. for 7.0 thru 2112, -maxdetails -nosessions gives you a very detailed report

Of course <@UL8ACTGSF> scripts! Nothing better out there :+1::skin-tone-3:

Couple options
1. You can use Session Printers or Printer assignments via Studio and Find a Vendor Universal Driver on the Image. Then set that session printer up for that user. 
2. You can setup Universal Print Server with the UPD client on the VDA and do session network printers with UPD
3. Use WEM to install the Printer, which should install the setup in the profile. Not positive how it stores the driver unless its still in the system32 Printer drivers section or not
4. Check into Printer Driver mapping and compatibility setting in studio. It will allow you to select a driver ( that is in the default Windows Printer section)
These are all different ways that I used in my past, Which doesn't really answer your question much for 1 user.

Tried #3, definitely uses the driver on the server. Actually testing #1 right now.

#2 is probably out of the question, since it requires integration with our print servers. Not sure if we'd even get approval for it.

Initial test of 1 and 4, and the printer never mapped, lol.

Hmm, says the requested operation requires elevation, so it doesn't appear as though #4 is working.

Ahh, the driver mapping/compat policy is for auto-created printers only.

That is strange, so It is trying to install the Print driver with you mapp it with a differnt driver?

<https://support.citrix.com/article/CTX200460>

Ah ok, my bad on that, I was thinking of session printers, not auto redirect ones

He says he can't map the printer locally, so auto-created won't be an option.

WEM can do this, but It installs the Driver. I cant remember if it does it at the user side or not. I would have to login and test that. Its been a bit since I look at WEM for printers

Honestly not even sure if he has tried to map it via IP, like I asked him to.

Yeah, WEM attempts to do it as a user, and uses the driver on the print server. Even if that worked, it's only good for that session. We don't retain mapped printers in the profile, and the install would happen each login.

I just figured Citrix would have a way to create a session printer using UPD without having to have the full blown Universal Print Server feature configured.

I think this is my second printing ticket ever in Citrix.

I don't think they do, well I havent seen it.

years ago, I used 100% Citrix Printing. It was a nightmare on XenApp 6.0

We only allow auto-created printers, all using UPD. It has been great for us (hence the 2 tickets ever).

And that second ticket was for Mac printing, so I had to install the HPLJ2800 PS driver for them, and Linux/thin clients.

I'd almost consider installing the driver in our image if we had a standard, but looking through our half dozen print servers, we have at least 10 different Lexmark and Xerox drivers in use.

They just need 1 network prtiner? Or they want many?

the one they need, do the make a vendor universal for it?

Yeah, that printer is using the Xerox Global Print Driver PS driver. I',m just hesitant to add this one, because that could open the floodgates for doing the same with others.

I do have one workaround, but it's kinda dirty.

He can map the printer via IP in the session, and manually select the UPD.

Would have to do it every session, though, since we don't retain the list of printers.

yea, that might work with a custom stuido policy for them? But its one users as well which in my setup is enough to do it.

image.png

An option in here says saved on client device. Which makes me wonder how it saving it on the Client device other than a virtual channel?

He's not mapping anything on his client device.

I gotcha, I was pointing out it says held in client if not in profile. So I confuses me a bit.  I suppose that still applies to redirection?

I need to test this. The client printer retention policy, that makes it sound like the mapped printers aren't retained, but printers mapped from within the sesion may be,.

So it saves it in the user profile for all printers?

My policy clears it entirely, so the next login is clean (nothing previously mapped retained).

What is this actually doing if you map a network printer?

I don't have that policy set, so it's whatever the default is. Isn't that policy just the actual properties of the printer, and not the actual mapping itself?

Yea, it may be. I was thinking it would save the driver on client as well. But the key work is Retention properties

I changed my 'Retain and Restored Client Printers' policy to Allowed, so I'll see if this works.

The last time I mapped it, I sent a test page through. He e-mailed me and said it's printing out a 225 page test page... oh man

Nope, didn't save the printer. I wonder if I have another policy preventing it somehow.

Many years ago this required the UPD Server, But I am reading this and I don't see it yet for this *Printer Assignments –* This policy can be used to assign specific network printers to users or machines with options to select a default printer. The network printers are created within the Citrix session at user logon. Citrix administrators can use this policy as an alternative to other means of network printer configuration such as Microsoft Group Policy or logon scripts.

I tried that earlier, but it acted exactly like session printers - tried installing the Xerox driver, then failed.

I disabled all of my printing policies, and the printer was never retained.

That was after I manually mapped the printer in the session, then printed a test page. Not sure WTF the Citrix UPD was doing there, haha

You can use Printer Detictive by Citrix that will scan a printer driver and tell you if it compatible with the OS and such

<https://support.citrix.com/article/CTX116474>

It's old though, and might now work with newer OS.

Printers and USB devices in any Virtual Environment(CVAD-Horizon-AVD) is always a pain. Citrix has more options than RemoteFX or use to anyways.

I think the issue is that the TCP/IP port created during the initial mapping in session doesn't exist when I logoff and log back on. That's my theory. I wrote a quick 2 liner PS script to do this, but I'm going to talk to this guy before doing anything else.

I would bet the 255 pages is the wrong print language like printing pcl codes with postscript 

Funny you mention that, because the driver installed on the network print server is a PS driver.

StoreFront Example.jpg

This is what I'm after, which the users really like and is from our 7.15 environment.

Let me see what I have in tool kit :slightly_smiling_face:

SFPageTweaksdocx.docx

Check this dude out as well.
<https://www.citrixguru.com/2016/03/08/lab-ultimate-storefront-customization-guide/>

StoreFront Example2.jpg

This is what we don't like and we want to change back to the old view...

I can probably work through the code and work out how to do it, but want to know if anyone has done this before. If you compare the two screen shots, you will see what I mean.

This is why we've stayed on 3.x version for so long.

Yeah, my colleagues were talking about that.

Ok I guess I found something. Going to rebuild the performance counters.

<https://support.citrix.com/article/CTX319744>

Also this week we had the same thing happen, but for us it is only happening in a new image. Part of the LB GPO is not applied, as described in:
<https://support.citrix.com/article/CTX232359>
Manually putting the register value back solves it instantly.

Thanks, I just checked and the reigstry values are present on all VDAs. Did you have to create a new Citrix Policy?

No, since our problem was missing registry setting I just put in another GPO which directly writes the registry values for memory load balancing (so not a Citrix policy). Recreating the policy is set for a later date.

FYI: The issue was resolved after rebuilding the performance counters.

You have the FAS GPO applied to those VDA for the non working users and verified in the registry that the Key is there correct?

I will double check but all of the desktops are in the same OU and therefore should be getting the GPO

ok, same applies to the SF servers as well correct?

This is all Citrix Cloud Windows 10 desktop, but yeah one domain

ok, do you have any user right assignments in a GPO that is applied to the VDA? like access the computer from the Network rules in the computer GPO ?

Check the Rule on the FAS server you might be using a AD group for users and VDA's who can use the FAS Rule

Sorry, late replies time!  It was the UPN not matching their email address.  Resolved now!

Being worked on.. keep an eye out for our security bulletin and KB article. I try to remember to post the outcome here as well

<https://www.citrix.com/downloads/citrix-virtual-apps-and-desktops/components/linux-vda-2112.html>

<https://support.citrix.com/article/CTX335705> now the security bulletin is updated..

i would have a chat with afischera :slightly_smiling_face:

Had that chat already, he created a template from an existing policy and created a new policy from that template without any assignment. What I see in the second screenshot is enough for me to open a citrix support case.

Corruption of policies/missing used be unfortunately be a risk we saw quite a few times in older builds back a bit. Ironically it's one of my talking points about moving to cloud

Geez,  Sure, restore the DB but dang. What about after you restore it, you export it via powersehell, and if it happens again. Keep importing it until you can find the root cause? It keeps happening when the unfiltered one is modified?

<@ULEEXJUD8> Customer is using 1912 CU3.. Customer is unsure if proceeding with the case. Will let you know as I have a call tomorrow with the customer

Maybe something like Schedule task, Log off Script, UEM tool such as wem
taskkill /f /im processname.exe ( or something similar)

I seen in my past, AV will hold it open as well. Just more food for thought

The AV is defender. maybe I need to exclude a few things

<@ULLH5JGFR> adding defender exclusion did not work either. You mentioned something about scheduled and log off script?

Yea, what I would do is fine the PID and do a task kill and see if it ends all the processes. If it does then do a logoff script and test it.

Yea killing google drive in Director ends session. so what would a log off script look like? get-process for the current user and kill it?

and are we talking logoff script via GPO?

it can be yea, or you can use WEM or any other UEM tool you have

should be something like this or very similar
stop-process -id "pidnumber" -force
stop-process -name GoogleDriveFS.exe -force

not working. I think its not even getting to the windows logoff script part.

Does the stop-process work by itself as a simple script?

yea there was a typo which i fixed. still not working. get-process -name GoogleDriveFS |Stop-Process  - works if ran interactively

Here is the action I would take to test it .
Log on and open the application.
Make sure the processes are running
Now open powershell and run the command.
Verify the task stop.
Now start the application again
Create a schedule task to call the poweshell script.
Make sure the schedule task works and the process stops again. 

At this point you know the command works and the schedule task works 

Then Create a schedule task locally and test this On an event that logged when the user logs out. I think it's 4647 event ID.
Then have it call the powershell command.
This should work






If it works then either bake it In your image or GPO 

Like this
<https://qtechbabble.wordpress.com/2019/12/09/trigger-a-windows-scheduled-task-for-logoff/amp/|https://qtechbabble.wordpress.com/2019/12/09/trigger-a-windows-scheduled-task-for-logoff/amp/>

looking into this. the system never generates 4647 because logoff does not work. However Citrix Desktop Service logs 1030. That being said, since there are mutliple users on the system I need to only end the process for the one that is logging off. Will probably need to read the event, get the username and then end task for that user only.

well im an idiot :smile: went through processes again and found the sub process that was causing the hang of Google Drive. Added to reg and all is good.

All I can say is that I have deployed it on local workstations for a case of roaming profiles replacement on desktops, and it worked without configuring any licences....

Interesting, I have always domain joined also.

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/machine-catalogs-create.html#prepare-a-master-image>

Scroll down to Point 5

i have always joined to domain. I was always taught it was a requirement for MCS just like windows activation/NIC set to DHCP

We do, kinda. Applayer best practice guide for platform layer wants to domain join / login as domain user / log back in as local admin.  But the machines it pushes out at the other end we don't spin up. Just point at them as update images in MCS. 

In my opinion joining the master image to the domain makes your life a lot easier, unless you really want a pristine master image to use in different domains.

Depending on what goes into the image, image automation is a lot easier without a domain join.

<@ULD1T5RND> was your ears burning? I was just talking about you and all the DevOps around Packer you do. I was showing it off lol

If you have everything in AD and GPO configured correctly then you can get away with it and yeah, it makes automation easier especially if you have multiple domains, but nobody ever has AD and GPO working correctly so you’re setting yourself up for a bad time troubleshooting why your GPO settings aren’t applying.

we used to do it without domain joining and moved back to having it joined because it was faster if all the GPO was cached locally at least once before pushing it out

to Start
<https://www.citrix.com/blogs/2021/03/30/citrix-duo-all-cloud-all-zero-trust/>

<https://chrisanderson.cloud/Duo-SSO-Citrix-Cloud/>

Thanks <@ULLH5JGFR> I read those.  The first one is more for on prem gateway, and the second option is to leverage Duo SSO, not MFA.

Barry do you mean for admin logons or logons to workspace.  You wont be able to use it yet for Admin logons.  For Workspace you would need to use generic SAML. with DUO

<https://docs.citrix.com/en-us/citrix-cloud/citrix-cloud-management/identity-access-management/saml-identity.html>

Yeah, as <@ULC9J5XPB> mentioned, they CWAd CVAD :smile:

Nah, the new LTSR is supposedly coming early next year after they validate the Windows 11 stuff.

PVS 2112 and WEM 2112 have been released and they are not LTSR

This is CR, LTSR is coming next year as announced earlier. 
<https://www.citrix.com/blogs/2021/10/04/coming-soon-the-next-citrix-virtual-apps-and-desktops-ltsr/|https://www.citrix.com/blogs/2021/10/04/coming-soon-the-next-citrix-virtual-apps-and-desktops-ltsr/>

Download should work now, if not wait an hour or so. No F5-hitting lol

seen that with win10 multi-session but not with serverOS

Never seen it officially documented but noticed it with Excel power users when upgrading to Office 2019 on Server 2019 and trying to work out why their giant sheets took longer to process on teh new environment. Power excel users ended up moving to Win 10 VDI instead.

Office 2016 on Win 2016 - all cores visible.
Office 365 on 2019 - only 2 cores, confirmed on 3 different clients.
Office 365 on Server 2022 - only 2 cores
Office 365 on Win10 20H2 - all cores visible.
I don't have any other combos of Office/Server OS to check at the moment
You can change the setting manually to use more cores, but it only persists while that Excel session is open, once closed it reverts back to 2 cores... will look to see if we can change it programmatically at startup.

so you can actually see the proper core count availabile and its locked to 2, or you can only see 2? with Multi Session windows 10 it ONLY sees two, you can't change anything

Remko wrote an excel add-in for the other scenarios

<https://social.technet.microsoft.com/Forums/itmanagement/zh-CN/c40a5d55-838a-4e13-aeb0-b26d7efd6199/excel-not-registering-full-amount-of-available-coresprocessors-for-formula-calculation?forum=Office2016ITPro|https://social.technet.microsoft.com/Forums/itmanagement/zh-CN/c40a5d55-838a-4e13-aeb0-b26d[…]ocessors-for-formula-calculation?forum=Office2016ITPro>

and then over to <https://remko16.rssing.com/chan-5122181/all_p1.html> - check the Excel 2010 multi-threaded calculation - his core site appears to be unhappy

It defaults to "Use all processors" which shows 2, but you can manually change it to whatever you like.  (Don't know what happens if you set to more cores than available lol)
Good find with Remko's blog, I saw a reference to that too but it's offline atm. I'll get my client to try that out.

ah with multi-session win10, you can't change that sucker at all!

<@U012BA2MKU3> <@UL8GKL4PL> ^---- Check this out

Hi, is anyone familiar with the problem of a maximized window with blank/empty space on top of the screen? We have created a case with Microsoft last year where they told us it's a bug and will be fixed, but can't find any information on this fix. Now a new customer is having the same issue with 5-7 users of 150 users in total.
Does anyone have an idea?

Windows Server 2019 (latest updates)
Citrix VDA 2103/2106/2109
Citrix Hypervisor 8.2 VM tools 9.1.5
Nvidia vGPU Tesla M10 8A profile, Windows driver 453.10.

I'll do an upgrade of my lab later today, I'll let you know if I run into any issues

That would be very interesting. What i have to admit, we are using all roles including PVS and FAS on a single VM. So maybe that is just an impact of this lab-setup. Never saw such behaviour before in a prod environment where roles are separated

I have the roles split out on different machines

What version are you upgrading? I did 2109 to 2112 with no issues.

Also 2109 to 2112. But as i said all roles on one box

Mine has Controller, Director, and StoreFront. No issues.

Have never put PVS on same box as Controller. Wonder if that is the issue.

No issues with in-place upgrade of controller and director on WS2022 Core. Upgraded from 2109 to 2112

No issues with in-place upgrade of PVS on WS2022 GUI. Upgraded from 2109 to 2112

No issues with in-place upgrade of WEM on WS2022 GUI. Upgraded from 2109 to 2112.

No issues for me. Updated a single DDC from 2109 and a PVS vDisk with a server VDA.

Didn't have that folder on my Lab DDC so no issues with the upgrade.

I should have mentioned that this problem existed on a different DDC (when trying to upgrade to 2109), so it is not related to the current build! Must be something related to the roles and/or automation (DDC+all roles are built 100% automated). <@ULJUX26GG> we should try to find the reason for this :slightly_smiling_face: Thanks for your feedback

Are you by any chance using this CLI parameter:

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/install-command.html#command-line-options-for-installing-core-components|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/install-command.html#command-line-options-fo[…]stalling-core-components>

<@ULL6F7DRA> No this parameter is not involved. But anyways this workaround works and if someone else will run into it there is the solution :raised_hands:

As long as you have SSO/Passthrough auzhentication to the Wotkspace I don't see a reason why it would not work

The reason could be: it is not being implemented :smile: Need to test this on a clean environment, we did not have that when we asked this here. And the documentation does not state anything, so maybe you are right, but i doubt it from the first experiences with SAML stores..

Has anyone run into the issue where in a remote desktop\VDA  you lose app focus as noted here in this on going 3 year old problem. (Outlook seems to be the culprit)  <https://answers.microsoft.com/en-us/outlook_com/forum/all/outlook-stuck-on-topforeground-issue-is/221b03a5-c17d-4c46-a8f5-0d01a4f6bf57?page=21>

Multi user is essentially the replacement for RDSH, although I guess if you just "need" Windows 10 then it may make sense to jump single to multi

I'm more worried about an issue with a VDA suddenly affecting however many sessions a multi-user host can accommodate. This being healthcare, this would directly affect patient care.

I haven't used Multi session, but I do use XenApp and the concept is very similar I would say. There are sizing metrics you can use to determine this as well.

I've done a fair bit of moving from win10 SS to win10 MS in azure to gain from fslogix and financial wins - but never from win10 SS on prem to win10 multi on azure, density on win10 MS isn't anywhere near as good as server OS but it plays relatively nicely 

Have plenty of customers still doing win10 SS in azure for a variety of reasons 

If that's your worry Nick, then take the Amazon AppStream approach (one app session, one server)

It's probably an unfounded worry, to be honest. I have no experience with FSLogix on server OS, so I'm trying to think through worst case scenarios. Azure is probably the obvious location for the resources, and I think I'd prefer staying on W10 if possible.

James K: In your moves, I assume you manually copied/moved existing containers to an Azure resource for the change? I definitely wouldn't want them to start fresh.

where possible I use wem or powershell to migrate required data across profiles - but if fslogix, you could use cloud cache to help with the move 

do you have optimal gateway routing configured on the store? I think that throws even local traffic back though the gateway

<https://www.carlstalhood.com/storefront-cr-configuration-for-citrix-gateway/#optimal>

Not trying to pile on more problems.... but WMS is susceptible to the log4j issue.  make sure you have version 3.5.1

<@ULLRRKZ8E> Thank you, I will be patching now.

<@ULLAD12P2> thank you for the link, will see if this is applicable.

<@ULLRRKZ8E> looks like we're on 3.5.1.12 which is good.

<@ULGR78LTW> sounds like something you may or may not have had to play with all week … ish 

You can do a one-time conversion simply by logging in to a v6 machine, IIRC

I always used a tool like VMWare UEM to migrate between profile versions.  Just export the settings for a couple days/weeks, then re-import them with a single command at first login of the new system.

Nice suggestion <@ULHA2NPPX>. I've downloaded the latest version of VMware UEM (now called DEM) and will have a play with that, as we are licensed to use it. I haven't used the FlexEngine for years since this was first developed by Login Consultants. This would be a clean way just to migrate the profile data for the apps the business users care about.

yup, i've had great success with it. Let me know if you need help with it.

we just do a runonce key on login.  `c:\Program Files\Immidio\Flex Profiles\FlexEngine.exe -r \\server\fp\ARC\%username% -i \\server\fp\INI2019 -R -f \\server\fp\LOG\%username%\RunOnceImport2MCS.log -l DEBUG`

Hey <@ULHA2NPPX>, I got this working, but have not had success using a similar command line and method to you, which I believe is considered the legacy path-based import/export methods. I've posted to the forums for some assistance, but would appreciate some guidance if you know how to get this working. The post is here: <https://communities.vmware.com/t5/Dynamic-Environment-Manager/Enabling-legacy-path-based-import-export/td-p/2891256>

The latest version I have this working with is 9.8.  I have not tried anything newer

I was thinking about trying an older version. If I don't get any helpful responses on the forum, I might do that tomorrow and see what happens.

that version works fine with Server 2019.  Not sure about anything newer.  Probably a good idea since it's not apparently "legacy" in that version.  :slightly_smiling_face:

9.11 works like a charm! They seem to have made several undocumented changes for the 10.x release. It did my head in for while. At least now I know how to get both versions working. I will move forward with version 10.4, as I want to be able to plan for this to run on Windows 11/2022 later this year.

Oh yes Oh yes! A new research showcasing the new Citrix improvements in CVAD 2112!

<https://www.go-euc.com/significant-hdx-improvements-with-cvad-2112/>

I also tried add instead of update. No luck. Just keeps telling me a parameter is missing. However, the help doc shows I have all the parameters.

I thought it was this

netsh http add sslcert ipport=0.0.0.0:443 certhash=########

<https://www.ferroquesystems.com/resource/howto-enable-ssl-on-citrix-delivery-controllers-easy-method/>

Does this still work?
*netsh http show sslcert*

Here is the command I used: netsh http update sslcert ipport=&lt;value&gt; appid=&lt;value&gt; certhash=&lt;value&gt;

Basically certhash can't be before the appid

I wonder if something changed with later versions or being its updating instead of "add"?

I know of two environments where they have been implemented in some form

That's good to know. I thought about looking into it more. But I know it may change somethings and I would need to think outside the box more myself if it does.

ive done a ton of work with CIS and CVAD - takes a while to unpick whats required to get all the infra running right but once its done it goes a long way in a PEN test

I was looking for a CIS template around CVAD like STIGS have. It was about a year ago when I looked though. 

there isn't a template that I know of - there are quite a few settings that you have to reverse though depending on your implementation to make it all work right

Just an update on a thread I made here.

<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1639611231111200>

Ended up being that our thin clients didn't like 1.1.1.1 as an alternate DNS setting in our Meraki configs. We made a new VLAN without the 1.1.1.1 DNS settings and the WMS config we've been pushing out worked without issue.

Queue, It's always DNS.

Is there a compatibility matrix of EC2 instance types that we could use for Worker servers for a new Citrix Farm? I couldn't find anything so I'm just going to be testing performance between Compute and Memory optimized servers of current gen.