World of EUC

Hi Dennis, there is a big discussion on that topic at Twitter [1] and in <#CKBVDG48H|> channel [2].

[1] <https://twitter.com/pvdnborn/status/1474358258596990981?s=21>

[2] <https://worldofeuc.slack.com/archives/CKBVDG48H/p1640704447358200>

Thanks. I don't generally monitor either of those since I don't use FSLogix, but I think I have confirmed my suspicion that UPM is using some portion of FSLogix under the hood.

That’s really interesting, I don’t think there are a lot of people around here who use UPM with containers. The problems with FSLogix are known according to CU 4 and 2112, but apparently this generally applies to container-based profiles.

I don't think there are either. My suspicion about FSLogix under the hood in UPM comes from the log file, and seeing the setting: FSLogixProfileContainerSupport ... Which upon doing a tiny bit more research I found this:

Before Version 2103: Enable multi‑session write‑back for FSLogix Profile Container
Version 2103 and later: Enable multi‑session write‑back for Profile Containers

In this document: <https://docs.citrix.com/en-us/profile-management/2106/profile-management-2106.pdf>


We use UPM still because we tried FSLogix (several months) before the Microsoft purchase and could not get it to work reliably. Left us with a black eye with our clients, so management has been reluctant to bring it in and try again. UPM containers have been mostly stable, with the exception of Outlook Roaming Search Index, but I blame that on Windows Search more than the container technology. Haven't really had any issues with the Profile containers until CU4, and it didn't really pop up right away, so was somewhat of a shot in the dark about what was going on.

Thanks for the explanation! Will keep an eye on that. 

I found the info on Screen Sharing, still not sure on the Cloud feature

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/reference/ica-policy-settings/graphics-policy-settings.html#screen-sharing>

still, no documentation on how to config with the CLI.

I believe the cloud setting is for this feature in Preview: VDA Upgrade Service (Preview): This cloud-based service is designed to simplify the VDA upgrade process for admins, who can leverage it to update their existing base images easily without the need to perform a manual upgrade or reinstall the VDA. Found here: <https://www.citrix.com/blogs/2021/12/14/whats-new-in-citrix-virtual-apps-and-desktops-december-2021/>

I think the upgrade service is this component.

I think that is part of it, but the additional setting tells the upgrade service whether or not the VM is located in a cloud-based service or on-prem.

it's a guess since the documentation is lacking

image.png

All I can remember when we were testing it, is that only "MRA enabled" accounts could use the JVDI client successfully. So you need to use the Cisco external gateway for it to work, it will not directly channel through Citrix.

<@U01DU4TSUNS> Thanks, as it works on our old servers (2012R2, 7.15) this shouldnt be the issue.

hmm.. changed VDA to 2106 and VXME start working immediately. I set VC Policy to "Disabled", so according to documentation "When disabled, all virtual channels are allowed."

Servers are installed 100% automated, so absolutely no other difference except VDA 2106/2112.

Is it working with VDA 2106 and Workspace App in 2112?

And your Desktop Controller is in 2112 too?

no it isnt. However I used a 2112 policy extension to configure VC policy.

Hi. Assuming you were using powershell then you can probably still use the same health check scripts but will need a few changes. 

You will need to add a Citrix Cloud authentication profile to the beginning of the script. 
It can be a bit tricky to setup but the links below are a good start. 

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops-service/sdk-api.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops-service/sdk-api.html>

<https://hallspalmer.wordpress.com/2019/02/19/manage-citrix-cloud-using-powershell/amp/|https://hallspalmer.wordpress.com/2019/02/19/manage-citrix-cloud-using-powershell/amp/>

Nope every restart, reset the worker to the snapshot. :the_horns::skin-tone-4:

I know definitely in Studio. I don't think outside of Studio works but also could depend on hypervisor.

Same here, Only use Studio I know will do it 100%.

Only studio works if you have a VDA in pending up state (has been a catalog update) if you reboot from the hypervisor it wont pick up the update. It must be done from studio

With xenserver and VMware the same behaviour. Restart in os or with Studio. Fallback to the mcs snapshot. Tested it several times today :the_horns::skin-tone-4:

Ah pending update. Different page :sweat_smile::the_horns::skin-tone-4:

It is with VMware.  We have always kind of abused the OS vs Studio reboot.  Where we could test and reboot if needed via the OS. Then reset with a Studio reboot to reset.  As of this week I was trying to test something and it is resetting either way.  Now I am not sure if the process we were using was "not working" and now it magically "fixed" itself or not.

VMware. MCSIO enabled machine catalogues. Restarting from the OS will not reset the VDA. Restarting from Studio will reset the VDA.

Normal behaviour for me, at least for Vmware hosting connections and LTSR 1912.x

Yep, stick to studio/studio policies. A few years back, a client had that "reboot on log off" FSLogix option set, and it wasn't re-setting the VMs from the linked snapshot, burned a lot of time troubleshooting it

Hmm I would rather say if MCSIO is enabled every reboot will reset the machine no matter how it is triggered. At least if you're using RAM cache.

<@UMCH8SMQB> Thats the point that makes the difference then. I do not use MCSIO (as the storage is fast enough) and the VMs got reverted only if the reboots are triggered through hosting connection/Studio

<@U01GXN065MK> yes, because a studio triggered reboot is a shutdown + start, while at a system reboot the vm keeps powered on all the time so the disk is not wiped.

It depends.
In AWS, MCS is differently implemented.
Reboot/Power Off through OS, changes are maintained (no disk reset).
Reboot/Power Off through Studio, changes are dropped (disk is reset).

is anyone using WebEx on Server 2016/2019 with either GPU optimization OR BCR handoff?

And a second question, is anyone in the health sector dealing with the likes of telehealth on Server 2016 with GPU's in the mix?

SSO Service using what kind of authentication? sounds like a usecase for FAS to get SSO to work all the way to VDA

Yeah you need Citrix FAS then.
So it will request a certificate based on the SAML token UPN and smartcard auth using it.

I am not super familiar with FAS.  I thought the SAML auth was now a standalone supported auth method

It is supported but FAS is required to make the SAML to LDAP mapping work for SSO to the desktop

Understood!  Any reason not to install FAS on the Cloud Connector boxes?

Citrix FAS is a service that integrates with your PKI infrastructure.

So when the SAML token is consumed by the storefront, it will trigger a certificate request using FAS and present the certificate on the VDA, which will be used to SSO all the way.

I have a video on my site which shows the flow and some basic information (more attuned on the ADC side - but Carl got good FAS info)

<https://netscaler.dk/modern-authentication-with-azure-conditional-access/>

FAS is not supported if it's installed on servers with other Citrix components, but it should work :slightly_smiling_face:

What Mads said.  Not supported so I've never done it before

They changed their wording it seems.
Citrix recommends installing FAS on a server that does not contain other Citrix components.

<https://docs.citrix.com/en-us/federated-authentication-service/system-requirements.html>

In terms of HA, I assume two FAS servers are required?

Yes, you add both FAS servers.
I would also recommend creating a new SubCA just for the Citrix environment, because of the amount of certs requested.

And depending on the amount of users it might be an idea to requests certificates for them before a logon storm

This is very interesting.  So <@ULJM98FME> did you decide to do SSO with DUO vs through Citrix Cloud?

Our users hit the DUO SSO portal, complete authentication, then they have their SSO apps which they can click on.  Citrix Cloud is one of those apps.

Treat your FAS as you do with DCs. So strongly recommend to run them on isolated Servers and in isolated VLANs.

I may consider going that way.  With the uncertainty there and some recent frustrations with them, I should probably consider not implementing more and more with them.

Don't let FAS intimidate you either. There are many ways to skin this cat.

Ray, I am all ears.  FAS looks like quite an undertaking.

FAS needs to be treated and secured as a tier 0 service. So we never share with other Citrix services/roles for our designs due to that and other reasons. Thx

Hi, there is a script to delete hypervisor alerts: <https://support.citrix.com/article/CTX269617>

This is perfect! I was looking a while back and could never find it. Thanks!

we are waiting for you to do the articles

Maybe this? <https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/onboarding-and-servicing-non-persistent-vdi-machines-with/ba-p/1360721>

I came across that one today, but I swear I've read that it's not as simple as just onboarding the VMs via startup script. And even then, I'm looking for clarification on implementing "a single entry for each device" and "multiple entries for each device". I don't see why anyone would use the latter, but there has to be a reason for it.

The biggest question mark for me is how you seal your vDisk. Like in Trend, we'd run a utility to remove the GUID and then scan the contents of the image so that when you were in a VM, only new/changed files were scanned. My assumption is that we'd have to run a full Defender scan while in Private mode so that it keeps track of what it actually scanned, and that would function the same. But I can't find anything on that at all. I sure as hell don't want Defender running scheduled scans at boot, or any time during the day.

I've done multiple, defender gets handled (scanning agent) with defender config, and a scan before seal. ATP goes on top and just follow the ms onboarding doco… it is as simple as it looks 

&lt;deleted due to incorrect guidance&gt;

Here are the directory and reg I clear on the master for sense:

"C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber\*”

“HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection" /v senseGuid

So if this is an image that has never had Defender (brand new golden image), you have to actually onboard, then scan it, then run the offboarding script before sealing? That's what's throwing me, because to me it makes sense to not even onboard it at all, unless part of that process remembers what you scanned.

And James, when you say ATP goes on top, what does that mean? I assumed that there was no actual Defender ATP install, and that you'd basically just create some GPOs to handle reporting to the central repository, and your other normal AV policies.

Is my assumption about the single entry/multiple entries sound? That a single entry for each device (so not using the PS script in the onboarding) is the go to for NP VMs?

Thanks in advance, BTW, this is greatly appreciated.

<@ULC9J5XPB> yes, the AV scanning engine is still just defender, so normal defender configurations apply (GPO etc), then ATP is the more advanced protection and reporting - i am pretty sure in the deployments i have done, the Gold Image doesn't have ATP configured, it's just the worker servers that get onboarded via the appropriate scripts etc - the gold image gets a defender scan, but ATP doesn't come into play if my memory serves correctly

My assumption was: Gold image, full scan with Defender, seal image. VM boots up with that image, which now has all related Defender GPOs applied, as well as the onboarding startup script. Boom.

I went and double checked and agree with James and not myself.  I am losing my mind I guess.  Sorry it's been many months since I dealt with this.  So my update :  I was originally onboarding the master but I am not onboarding the master now.  My VDAs run the Microsoft provided onboarding script at startup that I tweaked a bit for our internal logging and whatnot.  Essentially generates a consistent guid based on machine name if I recall correctly.  I have still been running the offboarding script on my master, which is probably pointless, but part of me still wants to do it in case a master was ever accidentally onboarded given it's so simple.  I still think clearing the sense guid / info might be necessary even if the machine wasn't onboarded?

I am going through this now Nick. I have some good article that will break it all down. Let me get them. There is a onboarding script by MS, then there is 2 or 3 blogs that break it all down for non-persistence VDI.

I saw you comment on one article I read, so I figured you might be in a similar boat.

Yea, the one article Carl Posted is what I followed to get me going. For me I had to go undo all the WIndows Defend blocks in the GPO/Image. That was a pain.

1. <https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/onboarding-and-servicing-non-persistent-vdi-machines-with/ba-p/1360721>
2 .<https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/configuring-microsoft-defender-antivirus-for-non-persistent-vdi/ba-p/1489633>

3.<https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-endpoints-vdi?view=o365-worldwide#updating-non-persistent-virtual-desktop-infrastructure-vdi-images|https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-endpoints-vdi?view=o365-worldwide#updating-non-[…]ure-vdi-images>

I expect that we will see more companies moving to Defender + ATP

Number one I posted will break it all down, Number 2 goes into how it works, and 3 is from from MS. Yea <@ULL6F7DRA> I will in time, that is my goal. It's not to bad. It really depends on your InfoSec department and how they are. For me, they don't don't understand non persistence machines and the amount of work that goes into it at times. They are just like "slap it together and go" Then don't have to support it, so it's always easy for someone to say that looking through the glass lol.

A lot of people don't understand non-persistens machines, I can't blame them though. Unless you have some kind of Citrix VAD setup or VMware Horizon setup, I think non-persistent machines aren't that common

Yeah, removing all of my Defender stuff is going to be a pain in the ass. I have them everywhere.

I'm definitely going to be using option 2 in that first article, since my images are compiled with App Layering, so it's brand new each time.

Though it does mention onboarding during the master image build, lol

Hmm, but then I see this in the blog itself: "Remember that you should never onboard the VDI master".

I only have a handful of Defender-related optimizations:

Actually, I may leave them all in. None of them make sense when this will all be controlled via policy.

If that works out, I really just have to remove a line in one of my scripts that disables tamper protection, and then disabled Defender.

I gotta give it to you man, you are like the final frontier of applayering faith. In the end there shall be sand, dust, remnants of humanity and <@ULC9J5XPB>’s app layered images 

I've had some quirks with App Layering, but overall it has been solid for me. I have to fight the good fight to pay back Rob Z. for all of the assistance he has provided over the years, haha.

Nick I'm still there on App Layering with you...year four.  Definitely some quirks and the UI (new one included) really makes things harder than it should be, but overall it's been good for us.  I left the Security Center icon free at first just for my own sanity - learning Defender from scratch and the decentralized management had me all over the place at first.  Also as I pilot with users it's been good leaving the toast notifications, but even then there have been so many times where Defender blocks without any notification so the operational event logs (and/or ASR searches in advanced hunting in security center) is really important.

For the master image, there is a script to run, then before you seal it, there are some action that you take that way it will not onboard it.  When it's shutdown, and the PVS/MCS target get the update version they will onboard. I messed with AppLayering one time, and I didnt like it. I am sure it's good. We bought Liqiudware flexapps, which is pretty good. But it still adds overhead and I suer OCD about login times.

What script do you have to run before you seal it?

Assuming you are using the Offline Servicing tools to do the master image
Under "Updating non-persistent virtual desktop infrastructure (VDI) images" starting at 1 - 4.

1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Defender for Endpoint sensor. For more information, see <https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-endpoints-script?view=o365-worldwide#offboard-devices-using-a-local-script|Offboard devices using a local script>.
Ensure the sensor is stopped by running the command below in a CMD window:
Console


1. sc query sense
2. Service the image as needed.
Run the below commands using PsExec.exe (which can be downloaded from <https://download.sysinternals.com/files/PSTools.zip>) to cleanup the cyber folder contents that the sensor may have accumulated since boot:
Console


PsExec.exe -s cmd.exe
cd "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber"
del *.* /f /s /q
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection" /v senseGuid /f
exit

Hi <@ULC9J5XPB> be aware if you are using nonpersistent VDIs (Win10+FSLogix+O365 and Attack Surface Reduction Rules) that some of the Office apps functionality will be blocked by Defender if you do not disable a specific ASR rule (Block Office applications from creating executable content) even if the antivirus exclusion for FSLogix are in place. As an example of impacted functionalities are: "Share" option from PowerPoint,Word or Present in Teams (option available in PowerPoint).

To find the ASR rule GUID:
<https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide>

Well, things just got more complicated...

Looks like we're just auditing those, per the SCCM config on physical endpoints.

Starting my full Defender scan on this image, and it has about 2 hours left... lol. That's just brutal.

Full Scan, figured that would be the requirement

Yea the first time, if I recall it took a long time.

and now down to 57 minutes, so Microsoft's estimates are about as good as their work on Teams

Question about exclusions. For processes that need to be excluded - _%ProgramFiles%\Citrix\Virtual Desktop Agent\BrokerAgent.exe_, for instance, are you guys adding those paths to *Path Exclusions* or *Process Exclusions*? Path seems like the correct location based on the fact that the actual items in Process will still be scanned.

I have configured process exclude for the BrokerAgent, however based on the description of the Defender policy, that might not be ideal

99% of these processes in my list will be generating files themselves.

Related, my InfoSec team asked me not to configure any exclusions, lol

I think I'll have to do some GPO modifications during the weekend :smile:

Yeah, I'm going the Path route. Process just doesn't make sense. I can always change it if somebody says otherwise.

I do wonder about stuff like spoolsv.exe. That might legitimately be a Process exclusion.

And the Teams stuff. You'd think MS would be a little more descriptive: _To prevent any interference of Teams, add the following items to the "exclusion list" process in the Antivirus Software._

That's not clear if they really mean the process list exclusion.

Isnt the different that when you use process it wouldn't scan any of the files the process opens or is it that it doesnt scan the memory spcace of the process?

Maybe? Really don't know the answer to that.

So here ms says if you exclude a process then any file it opens is excluded. Do it is very different from a file exclusion <https://support.microsoft.com/en-us/topic/how-to-add-a-file-type-or-process-exclusion-to-windows-security-e524cbc2-3975-63c2-f9d1-7c2eb5331e53|https://support.microsoft.com/en-us/topic/how-to-add-a-file-type-or-process-exclusion-to-windows-security-e524cbc2-3975-63c2-f9d1-7c2eb5331e53>

Yeah, and it sounds like we'd still want to go the path/file exclusion route. With regards to Citrix’s AV document, when they list processes to exclude, are they doing so with what MS has written in mind, where the process will not be scanned, but files opened by the process will?

This might be right up <@ULGKFDUVD>’s alley…

I think the reason it says process and not file us exactly for that reason otherwise we would just say file.  

I completely missed this line in Citrix's AV guide: _When process exclusions are recommended, the goal is to prevent scanning of any activity performed by such processes rather than preventing the scanning of the exe file._

So it does seem as though these processes indeed need to be added to Process Exclusions and not Path Exclusions.

Has anyone here actually configured Intelligence Updates via a file share? I've got everything configured according to the <https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus?view=o365-worldwide#set-up-a-dedicated-vdi-file-share|docs>, yet the updates fail when the VM boots. Even granting "Everyone" read NTFS rights, it still fails.

In case anyone comes across it, the MS docs all leave out the fact that *Domain Computers* needs access to that share.

In other news, what kind of performance impact did Defender make in your environment? Compared to Trend, it's certainly utilizing more resources:
*Trend Micro Apex One*

Hmm...from what I have seen Defender should utilize less resources than most other 3. party security products

Trend has always been great for us in terms of resource consumption.

I love Trend. Compared to McAfee and Symantec, Trend is just so easy to work with, easy to setup and configure

Yeah, we're moving away from McAfee, so everyone is excited. Getting Defender working was as easy as those in this thread made it out to be, so far.

This is the only issue I have with it, right now, honestly. May not matter once we're on our new hardware, but this puts a hurt on our old ass CPUs.

<@ULC9J5XPB> did you leave feedback on the MS doc stating that domain computers must be added?

Not yet, but I have a reminder to do so. Trying to finish up some testing first... though I guess I should just do it now since you reminded me.

"Carl says fix your shit, MS, your perms are wrong"

Focusing solely on CPU during a XD session launch, Trend in green, Defender in purple:

Except for those of us who are color blind :slightly_smiling_face:

Well then, higher line is Defender, lower line is Trend

I don't think there are any real optimizations for Defender, outside of removing the related tasks in the image, and doing a full scan before sealing. At least, not that I've found.

Did you get the process exclusions applied?  

It's not awful, and really, it's the logon process that seems to take the biggest hit.

So I'm probably just being a little nitpicky.

I also thought it was a little weird that MS recommended using local GPOs for the Defender settings in your image. Baking in GPOs is something I actively avoid unless necessary (like with some FSLogix settings).

I am in the middle of testing Carbon black, and our testing went from 17 second logins, to 47 seconds. Super unhappy about that right now.

I ran the test a few times, and Trend logs in at 39-47 seconds, Defender 36-42 seconds. Which is kinda ironic.

On the Bake in GPO. I was wondering the same thing, why it was needed. I assume maybe the Local GPO will always be hit vs the Computer Domain GPO

For Carbon Black, I hope you have a case of Excedrin Migraine handy

And FWIW, when I test logons, I'm including the 6 seconds after you launch the desktop while CWA figures out what to do.

Domain GPO has worked just fine for me. All settings are applied, etc.

<@UL8ACTGSF> I agree with you. I am not happy

Good to know Nick on Domain GPO. How did you guys do the Policies ? In GPO? We tried to explore intune, but MS said it will not work well with non-persistent VDI.

Local GPO is applied with and without a domain login

Hi James, yes I‘m doing some filtering based on the endpoint client names to apply BCR policies with IGEL devices. Good to have a corresponding prefix in the naming scheme to do the filtering.

Yeah perfect, I'll force a naming convention on the endpoints 

That's what I do for my IGEL stuff, filter based on client name, as the pattern is consistent.

And if you need to run a bash script to change the name, let me know. I went through that hassle previously to change the default prefix in IGEL to accommodate other workflows, all based around the MAC address.

I like how MS are keeping us at our toes :smile:

They implement a start at logon feature, where they basically come up with yet another location in registry to configure it, instead of using the default/common locations

At least this time I saw that tweet right before I cracked open my image again to update something.

Yeah, and I bet it acts differently if Edge is updated vs. a clean install of Edge

I wondered that, as well. It didn't auto launch when I added this OS layer version, where Edge 97 was installed in the previous one.

I hate it when I am right about stuff like that

do you disable both? on-logon-autolaunch and on-logon-startup-boost

I think I may have Startup Boost disabled via GPO, as well. That's the setting that has Edge running in the background.

Just checked - I do have it disabled via GPO.

<@UL91DJGSE> said in another thread "*Microsoft has a fix ready in Edge version 97.0.1072.62"* 

Got a link to the thread? Also wondering what kind of fix there is given that they're creating this key on purpose, haha

<https://worldofeuc.slack.com/archives/CK6RVLZ8S/p1641923065057600|https://worldofeuc.slack.com/archives/CK6RVLZ8S/p1641923065057600>

Nevermind, found it myself. Did you see the keys removed in the updated build?

I haven't even begin to look yet to be honest 

Gotcha. I have all of this disabled via policy, so it's not really an issue in my environment. Still annoying for anyone who doesn't have those set, though.

I guess the fix has nothing to do with that key, then.

I suspect, when they say Edge is auto launching at login. It launching where the user can see it or it calling edge process at login showing in details or task manager?

According to this, if you disable the MicrosoftEdgeUpdateTaskMachineCore” related scheduled task is one workaround, Which a lot of folks do in none-persistent setups I would think.

Any experiences running VDAs as shielded VMs on hyper-v? Does it work?

Google Drive on XenApp (GoogleDriveFS)
Any way to disable Offline access on Google Drive (Available offline) in a Citrix session - Alternative limit space to be used.
According to <https://support.google.com/a/answer/7644837>
using reg key "ContentCacheMaxKbytes" - does not apply to files made available offline.

My understanding is it runs the vda cleanup tool first and then does a clean install

Interesting, that would account for the time. I don't recall seeing any status text stating that, which would be helpful.

That's interesting. Does it do the VDACleanupTool restarts or is it all in one somehow?

"needs to restart to complete"
restarts
"still installing"
YOU SON OF A

"When upgrading to version 1912, you had to uninstall the current VDA and then install the new VDA. In this version, (Webster: 2112) you’re asked if you want Citrix to remove the component and then continue the upgrade."

VDACleanup usually takes 3 restarts for my servers, so, yeah...sounds about right.

felt like Steven Toast when Clem Fandango kept asking if he could hear him

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/upgrade-migrate/upgrade.html#vdas-that-have-pvd-or-appdisks-components>

Assumes the appdisks and/or PvD stuff might have been installed, even if not specified, in earlier VDA versions

I actually saw that note today for something else. This is an App Layering image, never had either component installed.

Even if YOU never specifically installed either component, I have seen the bits get silently installed

If you look at the old docs for PvD, it specifically states that PvD cannot be run on a server OS (Server VDI or XenApp) BUT the PvD stuff WAS installed and the services running on server OS VDA installs

I am rolling back my VDAs 2112 to 2109, been running 2112 since before christmas. MacOS users gets disconnected all the time, its started after update of VDA.

Be careful with 2109 and 2112 vda Multi os. Logonui.exe Stuck still exists 

<@U015G4SG5LY> Logonui.exe stuck at logoff or?

<@U015G4SG5LY> Okay, haven't seen that yet, 2112 was unusable for us, pretty much all MacOS client, didnt matter what hw and Workspace App they used, got kicked out every 5-15min.
EDT disabled in Policy, and UDP 443 closed in firewall, and default.ica had it if off, so it was not EDT. After downgrade to 2109, zero issue, no issue before upgrade to 2112 either.

I have did some this in the past to get newer features from the VDA side. I can't remember the LTSR rules of hand though. But for example when Teams HDX optimizations came out we did it on the VDA side first, and I set the registry keys to trigger what studio would have did. But it's been a while. 

Yeah, Teams is a big one, as Citrix keeps requiring VDA upgrades in order to take newer features. Makes me wonder why the hell we have LTSR anymore, because at this point it is a hinderance.

I want to say that Citrix won't support the config, which means I likely wouldn't get approval to go that route. My other options are to see how quickly we could get access to Citrix cloud (Azure VMs with GPUs), or change our hardware strategy from blades to racks with GPUs and hope that it would be sufficient to disable optimization.

They won’t. I’ve tried it. It broke webcam redirection with Webex and they told me to rollback, they wouldn’t troubleshoot it.

Wow I didn't know they stopped allowing this. 

Kinda what I figured. I just can't believe that this one issue is going to tank the entire project. Works fine from a Windows endpoint, but Linux simply won't redirect the webcam in Edge.

BlueJeans, too, which I thought was odd. It's either all or nothing - if every app has an optimized channel, works fine. If it doesn't, can't use the webcam at all. But if you use USB Redirection, you lose all optimization.

Linux webcam redirection is limited by the version of receiver  too, we ran into it with ancient wyse terms

they won’t work with 64bit apps so we had to publish an image with 32bit chrome just for them

<https://support.citrix.com/article/CTX132764>

So I've got the latest CWA (2112) for them, and 64-bit webcam redirection works in Teams abs WebEx. Doesn't work in Edge (32 or 64 bit). Tried the last 3 clients for Edge x86, no go.

it’s a real crapshoot with the later versions, I had it work in teams and chrome and webex was totally broken

it’s like every version some thing else breaks

Yeah, this entire ordeal has taken years off my life. Win one battle, lose two. It bothers me that visual quality is noticeably lower on Linux thin clients, too.

And as much as I think it's backwards, I was ready to replace Edge x64 with x86 of it made this work (until we could move back). But nope, doesn't work there, either.

<@ULC9J5XPB>:
To first comment on the LTSR thing:
"as Citrix keeps requiring VDA upgrades in order to take newer features. Makes me wonder why the hell we have LTSR anymore"

That's exactly what is the difference between LTSR and CR, LTSR is a version which get's only bugfixes and security fixes. There is no new functionality introduced.
If you want the newest functionality, for example for Teams, that you need to go the CR route or wait for the next LTSR.

<@ULLAD12P2>: Can you DM me about the Webcam issues? Want to hear more about it

Yeah, it's definitely a conversation we're going to have to have internally, about whether or not to stick with LTSR.

<@UNBRPVD4G>: Any chance you know if Linux clients can have HDX webcam redirection in Edge/Chrome before VDA 2106? I'm honestly finding no information on that being not possible.

Let me check, I'll come back to you on that

And now it's working on my current image. Didn't work yesterday. I don't even know what to say.

Maybe they need to do a LTCR and a CR. Long term with support but introducing some new features that are needed like HDX related features that make up all what we all use to help our users experience with long term support added. Then CR with the newest enhancements that are more around we just made this new feature and it's never been seen before kind of mind set