World of EUC

Yes, exactly. Guess it's related to <https://support.citrix.com/article/CTX253779>

In the past you had to contact Citrix Support to enable the flag for SSO, maybe they turned it on by default.

Yes, this was done for this customer.  So users with a Domain Joined client don't need to authenticate again when starting a published App. Awesome, but sometimes there is the need to disable this on a per client basis or at least make it possible to select another account.

You could use the browser based access for this

Sure, can be done with a browser. But you may know these few but very persistent users how do not accept this as an answer. :wink: Thanks for your help!

$WSA = (Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object {$_.DisplayName -like "*Citrix Workspace*" -and $_.UninstallString -like "*Trolley*"}).DisplayVersion | Sort-Object -Property Version -Descending | Select-Object -First 1
        If (!$WSA) {
            $WSA = (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object {$_.DisplayName -like "*Citrix Workspace*" -and $_.UninstallString -like "*Trolley*"}).DisplayVersion | Sort-Object -Property Version -Descending | Select-Object -First 1
        }

yup, just looking for other methods.  thank you

ah, nice, thank you for that!  :slightly_smiling_face:

Yeah, already ran into this.  There was a thread on this earlier.  Most of us rolled back to CU3...

I literally just ran into this issue this morning... You saved me a headache <@UK6S90JDR>

<@UNBRPVD4G> saved you. I just posted it.

Thanks <@UNBRPVD4G> :slightly_smiling_face:

Your welcome! I couldn't do a ping to everyone so Jarian rang that bell for me haha

<https://discussions.citrix.com/topic/393608-logonuiexe-sessions-disconnected/>

Yes, same one indeed. There were a few threads here as well

Hot fix didn't work, rolling back to CU3...

Did you update your master image or how did you deploy it? It needs an reboot

Updated the master image and pushed to the MCS catalog...

Thanks for making this an alert, that is helpful.

Looks like my problem isn't related to this CU4 issue, rolled back to CU3 and still doesn't work... False alarm from me...

Careful, even with this 2012 still has the Ben Splittgerber noted MAC disconnect issue, as well as the Tpoppelgarrd noted fslogix profile lock issue  that windows KB5007266\1-2022 was suppose to fix but has shown in dif environments to not be fixed.

<@UR9SMNQCQ> or <@UM0G9EB5E>: Is the FSLogix not a Microsoft issue? Or is it only reproducable with 2112?

We build a new environment on Server 2016/2019 with VDA 2112, FSLOGIX 2109, Crowdstrike and WEM Cloud.  Initially it worked okay (limited use and low user load) but as the load increased we saw many failed connections, server lock ups, profile locks, etc...   We made sure the Microsoft patch KB5010196 was applied as well as the Citrix hotfix.   Nothing worked.  We tried Cloud Cache, not cloud cache.   It was a miserable few weeks.  We ended up moving back to 2106 and now the environment is working vey well again.  Not sure but 2112 didn't like something.

That sounds like my story but we are on 1912... We have Windows Server 2016 VDA, we have gone thru a full review with Citrix they made some recommendations including upgrading to CU4... yup and is all kinds of issues. Disconnects, lock ups.. miserable experience for everyone..

I just wanted to add, that 2112 with the public hotfix also still doesn't work for uns. We have two affected environments:
A random user gets disconnected from the farm, for an yet unknown reason.
As he tries to reconnect, he can't reconnect / create a new session, because of the "FSlogix error" disk in use.
*In Studio and Director there is no session for the user.*
By asking the Fileserver, where the VHDX lock comes from, I can find the VDA where the VHDX is still mounted. There I found a disconnected session in the Task Manager. Opposed to the other cases I spectated, it was a "complete" session. By that I mean, that each program was still running. Like Outlook and Edge. Normally I only find like ~6 processes in those sessions. I started a graceful logoff from Task manager and the user could login once again.
Sadly I have no CDF traces, yet, but I will take that ticket as an excuse to implement it.

tl;dr: Random unwanted disconnect, Session still exists, but Citrix doesn't know about it, reconnect impossible, as VHDX is locked.

I think so, it never really worked 100% and the guy looking after it I think has left

Ah shoot! Trying to get the syntax just right with multiple controllers, cloud WEM, etc is proving tricky

I also had to read the manual for my CWA deployment 2112, as the tool would not be officially supporting it. So yes, back to manual reading and trials and errors.

Yea they took it down as nobody internal owned it. We are trying to get somebody to own it so they can control it and update it. They will be doing it for another product so I was suggesting they pick this back up as well. It's a great tool and helped keep things easy. So I'm trying.... We will see

The challenge with it is that the command line arguments had changed quite a bit, so it needs constant update and management to align with the new packages. You would probably need a drop down list of VDA versions, type, etc, and it would need an internal database to know which arguments to expose. A big job to keep constantly updating it. I would personally prefer they focused on getting the documentation accurate, as there is also a lot of trial and error there as Olivier mentioned.

Are trying to monitor disconnections due to bad network?

I don't know about VDA logs but if you're going through a Netscaler it does record session end reason and differentiates between network interrupt and user exit. 

Event ID: 39
Provider Name: Microsoft-Windows-TerminalServices-LocalSessionManager
Description: “Session &lt;X&gt; has been disconnected by session &lt;Y&gt;”
Notes: This indicates that a user has formally disconnected from an RDP session via purposeful Disconnect (e.g., via the Windows Start Menu Disconnect option) versus simply X’ing out of the RDP window. Cases where the Session ID of &lt;X&gt; differs from &lt;Y&gt; may indicate a separate RDP session has disconnected (i.e. kicked off) the given user.

<https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/>

I did a test deployment, so far so good. Only had to mess with reg hacks to get it installed without TPM and secure boot since that isn't supported yet on Nutanix AHV.

Yep! vTPM as per my blog post from a few days back:

<https://getvpro.wordpress.com/2022/02/13/packer-part-3-windows-11-build/>

What kind of information are you trying to grab.   I have a ton of different queries I use to gather info for security teams and for grafana

This is the long list, which may not be available in its entirety, but its the data we are being asked for.

User state tracking - active, idle, or disconnected
User login/logout times
Applications that were accessed and time active in apps, idle time
User IP connecting from
User computer name connecting from
CPU usage for each application and user
Memory usage for each application and user

I do already have SQL queries for all of that except the CPU and memory.  I will pass them along when I get back to my computer

all the SQL queries start with
```use &lt;Citrix Monitoring Database&gt;```

```/*This will get sessions for last 90 days
it will get the following columns
Username, Client IP Address, Client Platform, ClientName, Session Start Date/Time (in local Time), Session End Date/Time (in local time), VDA machine Name, DesktopGroup Name,
*/
Select     
    [User].UserName,
    [connection].ClientAddress,
    [connection].ClientPlatform,
    [connection].clientname,
    DATEADD(mi, DATEDIFF(mi, GETUTCDATE(), GETDATE()), [Session].StartDate) as StartDate_LocalTime,
    DATEADD(mi, DATEDIFF(mi, GETUTCDATE(), GETDATE()), [Session].EndDate) as EndDate_LocalTime, 
    [Machine].HostedMachineName,
    [DesktopGroup].Name
from (((([MonitorData].[Session]     
inner join [MonitorData].[User] On [MonitorData].[User].ID = [MonitorData].[Session].UserID)
inner join [MonitorData].[Connection] on [MonitorData].[Session].Sessionkey = [MonitorData].[Connection].Sessionkey)
inner join [MonitorData].[Machine] on [MonitorData].[Session].MachineID = [MonitorData].[Machine].ID)
inner join [MonitorData].[DesktopGroup] on [MonitorData].[Machine].DesktopGroupID = [MonitorData].[DesktopGroup].ID)
where StartDate &gt;= dateadd(day,-90,GetUTCDate()) order by StartDate```

basically the same thing, but add published apps into the mix and checks last 7 months
```/*******  Script for listing all launches of pub apps ********/
Select  [connection].clientname,   
    [User].UserName,
	[connection].ClientAddress,
	[connection].ClientPlatform,
	[Connection].ClientVersion,
	[Application].PublishedName,
    DATEADD(mi, DATEDIFF(mi, GETUTCDATE(), GETDATE()), [Session].StartDate) as StartDate_LocalTime,
    DATEADD(mi, DATEDIFF(mi, GETUTCDATE(), GETDATE()), [Session].EndDate) as EndDate_LocalTime, 
    [DesktopGroup].Name as DesktopGroup
from (((((([MonitorData].[Session]     
inner join [MonitorData].[User] On [MonitorData].[User].ID = [MonitorData].[Session].UserID)
inner join [MonitorData].[Connection] on [MonitorData].[Session].Sessionkey = [MonitorData].[Connection].Sessionkey)
inner join [MonitorData].[ApplicationInstance] on [MonitorData].[Session].[SessionKey] = [MonitorData].[ApplicationInstance].[SessionKey])
inner join [MonitorData].[Application] on [MonitorData].[ApplicationInstance].[ApplicationId] = [MonitorData].[Application].[id])
inner join [MonitorData].[Machine] on [MonitorData].[Session].MachineID = [MonitorData].[Machine].ID)
inner join [MonitorData].[DesktopGroup] on [MonitorData].[Machine].DesktopGroupID = [MonitorData].[DesktopGroup].ID)
where ([connection].clientversion &lt;&gt; ' ') and [session].StartDate &gt;= dateadd(month,-7,GetUTCDate()) order by PublishedName```

does that cover basically what you are looking for?

this is for pub desktops, not pub apps
```/*******  Script for listing all launches of pub Desktops ********/
Select  [connection].clientname,   
    [User].UserName,
	[connection].ClientAddress,
	[connection].ClientPlatform,
	[Connection].ClientVersion,
    DATEADD(mi, DATEDIFF(mi, GETUTCDATE(), GETDATE()), [Session].StartDate) as StartDate_LocalTime,
    DATEADD(mi, DATEDIFF(mi, GETUTCDATE(), GETDATE()), [Session].EndDate) as EndDate_LocalTime, 
    [DesktopGroup].Name as DesktopGroup
from (((([MonitorData].[Session]     
inner join [MonitorData].[User] On [MonitorData].[User].ID = [MonitorData].[Session].UserID)
inner join [MonitorData].[Connection] on [MonitorData].[Session].Sessionkey = [MonitorData].[Connection].Sessionkey)
inner join [MonitorData].[Machine] on [MonitorData].[Session].MachineID = [MonitorData].[Machine].ID)
inner join [MonitorData].[DesktopGroup] on [MonitorData].[Machine].DesktopGroupID = [MonitorData].[DesktopGroup].ID)
where ([Session].SessionType = '0') and ([connection].clientversion &lt;&gt; ' ') and [session].StartDate &gt;= dateadd(day,-7,GetUTCDate()) order by username```

all the data in the monitoring db can be mapped out using the [session] table as the main focus point and branching out from there

I'd also recommend sending all your netsclaer syslogs to elastic and do some clean up but its a good way to get both activity via the brokers plus any netscaler connectivity

Hi <@UK89L1Q02>, thanks for those queries. Do you have any more interesting queries that you could share?

will look through my queries to see what else I have

I see this for 1912CU4
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/1912-ltsr/secure/virtual-channel-security.html>
By default, the Virtual channel allow list feature is disabled. When enabled, only Citrix virtual channels are allowed to open in virtual apps and desktops sessions. If there is a need to use custom virtual channels, whether homegrown or from a third party, these need to be explicitly added to the allow list.

In my lab 1914CU is disabled, and VC are allowed.

if you use Citrix WEM then the tray icon will give you that info if you hover over it.  I think you're looking more for a graphical output but this is something that works i know

image.png

Not off the top of my head, but I use a modified version of <@UMB4XQE79>'s BGInfo script in my environment. Always comes in handy.

<https://github.com/Mohrpheus78/Citrix/tree/main/BGInfo|https://github.com/Mohrpheus78/Citrix/tree/main/BGInfo>

You can change the name of "This PC" to the hostname of the device quite easily

Drop me a dM tomorrow <@UKHUMQ2H2> can give you some pointers

i'd figure there would be more blog reading on it but its all around installation only it seems

I need to do a FAS install in azure soon so if you want to share I can do a writeup after I get it all working

Yeah it's pretty scarce. Had a couple of tests done on it and seems to pass :+1::skin-tone-2: will put something together. 

We have an ongoing analysis with Citrix support regarding VDA going unregistered when an admin RDP reconnect to a VDA. IPv6 was already disabled (prefer IPv4 over IPv6) and upgrading to CU4 has changed nothing. Next step is to capture network traces. 

CU4 is a confirmed dumpster fire.   You should not be using it

I didnt face any such issues with 1912CU3

Great post, lots of great detail. Thank you for putting this together.

Nice Post - Full on Security Options discussed with WEM

For Citrix Cloud? Yeah, it's pretty much not possible unless you use RPA I think

never tried it with an on-premises license server

HELPFUL LINK - <https://discussions.citrix.com/topic/362712-script-to-delete-user-and-device-licenses/>

<@UL5TCSW3D> I have raised a case with Citrix, Lets see how it helps. will keep posted here.

<@ULJM9DQF2> <@ULKDZHKFY> any suggestions?

I asked a couple of PMs and never received a response

I think Citrix should work on this <@UL8ACTGSF> and Citrix Management Console with detailed information of the license usage.

It will probably never happen as I don't believe Citrix wants you releasing licenses before that 30-day limit

What if the user left the organization on the 10th day of the license renewed and that license will of no use then admin has to wait for 20 more days for Citrix License Server to release the License

If you are talking Citrix Cloud, open a support case and see if they will release the license for you

I have create one Excel File in that we just need to enter disabled and inactive usernames in Disabled-Usernames (C Column) and command is ready to execute

<https://docs.citrix.com/en-us/licensing/current-release/license-administration-commands.html>

Mass releases of licenses, before the automatic 90-day lease period, outside of the reasons highlighted earlier might violate the Citrix EULA. Before doing so, contact Citrix.

You can release a license for a user only when:
• The employee is no longer associated with the company.
• The employee is on an extended leave of absence.
You can release licenses for devices only when the devices are out of service.

True, I have this case, The employee is no longer associated with the company.

Then use the link above for the udadmin command to release/delete a license

I have used the delete command in the attached Excel Sheet

to create a delete command in bulk and just copy paste the command in CLI and DONE

What happens when you run one of the commands? Show us so we can help you

Open a command prompt on your license server
Run one of your commands
Show us what happens when the command attempts to delete the license

No Problem here...I was looking for an script that will help us to automate this process weekly or in 15days or monthly

Easy. PowerShell script to loop thru the contents.

running this for a customer, let me see if i can clean it and put it on github

just looking at my code here makes me cringe.  you'll have to adjust some values.  Licensing Server, Install path, Smpt server and Email addresses (if needed), possible OU keyword, value of licenses to email if lower than, and fileserver.

<https://github.com/StevenNoel/Citrix/blob/master/License/CitrixLicense-DailyUsage.ps1>

I will try this <@ULJMUV893>. do you have any sample screenshot?

Yes, I have seen that in a customer setup

We didn't solve the issue, but we noticed the issue with VDA 2009 and later, not older so I suspect something has happened with the changes to the Virtual Channel allow list:
<https://www.citrix.com/blogs/2021/10/14/virtual-channel-allow-list-now-enabled-by-default/>

The customer had 10 webcams and didn't need the 4K resolution, so they acquired other webcams

Depending on my research the issue startet for some guys since CVAD 2103.
But so far no solution known.

I also do not need 4k.
But this cam is now is in use. Would be a shame when I have to buy a new cam.

Thanks for the heads up Hal. We're a big SEP house, so this is great info to know. You've got to wonder who they consult to make such silly decisions.

been chasing this for a few months and ran across that article while dealing with a new issue on 14.3 RU4 that will take a full core on any OS.

will let you know what was found on that when we actually find anything besides "It shouldn't do that" from Broadcom

We been having an issue with sep 14.3 RU4 that causes the OS to refresh GPOs on a constant loop…

Hi <@USUGWH9V4>, do you use BISF to help seal the image?

Negative. Using Citrix App layering which quite honestly I am starting to dislike with passion.. I need to take a look at BIS-F. I do use the clone prep tool to seal.

I believe it is. It's not mentioned among the deprecations and it's still a part of the 2112 documentation

Yes, but the documentation is just copy + paste „Windows 7, Server 2012, Windows 8, blah“
Is anyone using this?
It such an unreliable unfinished feature for me..


I have a use case for LAA, but haven't tested it yet.

I don't know anyone who use that feature I have only set it up in my lab, never in a production environment.

Got a couple of customers using it to "drop into" locally installed apps from a seamless published desktop, but not a common thing

I tested Local App Access with URL Redirection (not BCR) a few weeks ago. While LAA seems to work fine the URL redirection part works not so great. Then I had a call with Citrix Support where they (more or less) admitted that the documentation is outdated and no one feels called to update it.

Apparently, "Citrix Cloud" was confusing (their words).

Makes sense. I've had a few customers asking me what a VM costs in Citrix Cloud or what kind of hypervisor they are running.

Well, it can manage on-premises stuff I guess

They continue to push harder to get us to move stuff to the cloud. I'm open to looking at moving our XD workload to the cloud, but XA will probably remain on-prem.

Their elimination of perpetual licenses will probably affect a lot.

Some customers I talk to will not be be able to have workloads in the cloud for a long time, usually because of client-server apps that are very latency intensive.

During the last couple of years I have also been talking to multiple customers considering going with Microsoft 365/Modern Management instead of Citrix, or with a very limited set of app in Citrix

If they can't go to Citrix because of latency, why on earth would they then choose MS?

Microsoft has been pushing us hard to try and use MS Managed Desktops.

Well, the ones "stuck" with latency sensitive apps will probably not only go with MS, they will need Citrix as well

I dunno. Even though I have no personal experience with MS's cloud virtual solutions, I have never heard great things about their offering when compared to Citrix.

I am not talking AVD here, plain old physical laptops managed with Intune/Endpoint Management

We're probably headed in that direction for our physical fleet, anyway, but that's completely separate from Citrix.

When they presented Managed Desktops to us (virtual), it didn't sound like it was a good use case for us. I repeatedly asked them about video optimization, and they were like yeah, we optimize! Never answered my question about optimization _outside_ of Teams, because I'm 99% sure that's _all_ they can optimize.

Even in their own docs, that's all that's listed.

AVD doesn't provide much when it comes to optimization and user experience

We have some leaders here who are all in on the MS train. Not because it's the best solution, but because they know the name Microsoft. Us Citrix guys have been trying to show them that Citrix can do the same shit that they want, and all integrated into the same single access point, which we don't have now. It's been a struggle.

They're everywhere, the MS cheerleaders. They're not leaders, they're followers

We have a new CIO here who seems like he wants to buck that trend and start making better decisions in IS, so I'm hopeful that it happens.

Here it's mostly about license costs, nothing else. Because it's almost free some are willing to sacrifice user experience, image management, non-persistence and years of know how, to save on license costs

That's part of it, too. We have E5 licenses here, so naturally they want to milk everything they can.

That said, we also have unlimited licenses in Citrix with our current contract, which goes another 2-3 years.

Do you guys have to deal with "what does Gartner say about this product?" with every decision? I swear, if we want to do anything, we have to see what they say first.

I refuse to deal with any industry recommendations or even vendor recommendations. I just tell them "let's do it this way because this works best". Fortunately I have people who listen to me......for now

That's pretty much how we feel. You pay us, let us make the best decision for our own use cases.

Holy crap.  Another rebranding.  WTF are they doing...

Citrix Desktop as a Service... also for your published application needs

For those of you that don't like MS, what do you like? We've been stuck in Gsuite hell for a long time and while the grass is always greener, at least MS is designed around the enterprise

Well, I do like the Microsoft 365 platform I am actually going for the MS101 exam next week and I already have the MS100.

There is a lot of features in M365 that is possible to use in a session host based or VDI based setup

<https://xenappblog.com/2022/hybrid-azure-ad-joined-virtual-machines-and-intune-the-right-way/|https://xenappblog.com/2022/hybrid-azure-ad-joined-virtual-machines-and-intune-the-right-way/>

And Intune is going to be what O365/M365 became for Exchange, at least for &lt; 1000 users.

I've read that, good read. However in my environments the capability of that sort of use case is a very long way off currently

Yeah more than 1k users becomes more complicated.

Hopefully I will be retired by the time it scales up to bigger estates ;-)

Bigger $env will be stuck with Citrix or VMware

And don’t put all your money on MSIX, that will take time as well.

Yeah, agree. I'm more sold on nupkg currently as a packaging standard.

Currently migrating 1250 SCCM apps to Intune for 8000 devices.

Now the Citrix teams needs to figure what to do when we’re all migrated to Intune and decom SCCM. The server team is also looking into other solutions. Great times

I have stacks of SCCM that I'm trying to get into a Nexus repo short term and then across to InTune longer term

Interesting times :slightly_smiling_face:

We're still very firmly in the App-V packaging world, published in Citrix. I'd love App Attach/MSIX, but it's taking forever, and what I've read so far isn't inspiring.

Get AppVentix and just convert everything to MSIX

That's on my list if we move forward with this app virtualization project.

AppVentix is practically free software. Also does deployment of certificates and FSLogix rules. Totally sold on it as the "halfway house" between App-V infra and InTune

I use your favorite Citrix app for deployment of FSL rules, so we're good there, but you've mentioned AppVentiX to me in the past, which is why I looked into it and liked what I saw. I think the struggle will be convincing everyone to shift away from App-V to something else. We have over 100 App-V packages currently, with another possible 40-50 as part of this project, so I guess the time is now if we were going to make that switch. MS ditching App-V certainly helps my case for getting away from it.

At the end of the day, we still probably want to publish all of these apps in XenApp, though.

I can't recall off the top of my head, but can you convert other app types to MSIX, or just App-V packages?

Wait, let me confirm that. 2023 is EOL, but I still think there's more in support.

I don't want to wait until the last hour to make a move, though.

Let's see if others feel the same way. :smile:

Looks like their Lab edition is free, so I can definitely get this running in our QA environment to demo it.

Yeah, Appventix has a free edition with support for 5 or 10 software packages

I don't think we meet the App Attach requirements currently in XenApp, though, so that'd require a shift to Server 2019+ if we went the MSIX route.

I honestly don't know. I actually thought it was only available in AVD right now, but I swear I was told otherwise recently.

I do still think that's the case, AVD only, unless somebody proves me wrong.

Which means staying on App-V is more likely.

MSIX and App Attach is definitely available in 2019 and later

MSIX works better on 2022, that's for sure, but it is available in 2019

I think we'd probably go straight to 2022 if we made a move. That makes the most sense to me.

If bot using AppVentix you will have to come up with some powershell scripts for the App Attach part though

Funny, your blog (which I just recalled you writing about this topic) is one of the few that actually mentions this.

Yeah, and while I can, I'm not doing that. I'd rather we just purchased a utility to handle all of this for us.

Again, a smart decision, you are on a roll :P

So you plan on taking some not so smart decisions?

BBQ for lunch, which my wife will say is a not so smart decision...

Maybe I'll also ask MS for an update on my FSLogix ticket. That's never smart.

<@UL5TCSW3D>: Any chance you know the ballpark cost for AppVentiX?

One thing you’ve got to keep in mind with all the MS cheerleaders is that MS has a LOT of money to throw around to keep people cheering for them. I was at a company where they ditched Citrix and sent everyone an intune managed Autopilot provisioned Surface. Can only imagine the incentives MS provided there…

Yeah, I loved that one, "replace all of your devices with these $2700 Surface Pros!"

They're decent, but replacing devices with them just to access W365/etc? lol

I heard of a customer here in DK with 10K users where MS had told them that an RDS setup was perfectly capable of handling that amount of users. After a few months of PoC, Citrix was brought in :)

Btw. If you go above 500 objects in Server Manager with RDS, you have to use PowerShell for managing user sessions

PS is great and all, but sometimes I just want to click on shit with my mouse.

Anyone have the issue where the session name "services" runs hot, high CPU. shows as a disconnected session with no user in controlup.  Session name is "Services". trying to isolate what is causing such high cpu

Hi Chris, the "services" session is a OS based session where you usually find the processes from the services.
So you will usually find all svchost.exe, WmiPrvSE,  etc. inside this session...

If you double click the "services" session you can drill down into that specific session to see which process is causing the issue...

If svchost.exe is going nuts you can give "Display SvcHost processes" script action a chance to identify which service went wild:
<https://www.controlup.com/script-library-posts/display-svchost-processes/>

Honestly have never tried animation tablets - they're kinda just a mouse, so I would assume it's possible with USB redirection

yes, other devices from wacom working fine, just this new one do not want.

No probs, glad someone found it useful. Click on an advertisement when you're finished reading :wink:

I thought that was how it worked unless you also select load balance across contreollers

Yea I think you're right.  I had to read up on it. Found it on Carls site. But citrix Site i haven't looked yet. I believe this is it!?

“If you configured farm aggregation without load balancing, then use the up and down arrow buttons to put the active site/farm for this group of users on top. The lower priority sites will only be accessed if the primary site is down. You can run this wizard multiple times to specify different active sites for different users.”
“If farm aggregation is configured for load balancing, then there are no arrows to prioritize the farms.”


<https://www.carlstalhood.com/storefront-cr-configuration-for-citrix-gateway/#gslb|https://www.carlstalhood.com/storefront-cr-configuration-for-citrix-gateway/#gslb>


That sounds right, I haven't done aggregation in months now

But I remember scenarios where I was wondering why traffic never hit the other server and then saw that load balancing wasn't checked 

Yea, that makes sense now. Thanks for the help.

Hello all, a weird strange thing happend. I'm starting a publish word application and when I want to write a "F" the shoft+f combinaison  (unable to make uppercase F) when I do that that move the cursor to the left…..Office version 365 16.0.14701.20290
VDA version 2112.0.032068
OS version 21H2 build 20348.524
Have you ever seen this ? and that works very well with excel and in word all except f works in uppercase

Storefront should tell you what's going on in events. 

It appears from what you said, those vda have the FAS GPO? Are the persistent machines aware of the FAS server? 

yes, and it has been working for  months. Just this week we have seen the iss

yup, we can launch it internally with no issues, but that store isnt setup for FAS. We only use it for external to skip the double log in

On the vda does it show a list of messages for the deny?

I guess that depends on how many months it’s been working for, if the answer is 24 then…

On the VDA It shows an S104 Identity Assertion Logon Failed. Failed to connect to the FAS Usercredentialservice Error:access denied

The oddest part to me is that it is only not working for a handful of machines

any time i have seen the access denied error it has been an issue with the certificate on the domain controller or the user / VDA isnt allowed permissions on the FAS default_rule

have a look at this blog is good for basic FAS troubleshooting <https://www.citrix.com/blogs/2019/04/24/troubleshooting-the-federated-authentication-service/https://www.citrix.com/blogs/2019/04/24/troubleshooting-the-federated-authentication-service/>

yea, pretty sure I have that article memorized at this point, lol

I have verified that Domain Users and Domain Computers are both set to allow on the default rule.

checked the FAS GPO has applied to the VDA and the FAS servers are in the correct order ?