World of EUC

I configure page file, x 1.5 of memory. if I let Windows manage it, Users had Citrix WEM popup complaining about low memory.
I am 100% in Azure, so not really any cost for me to configure page file either so

How is Azure treating you?  Is it the official  Citrix in Azure  offering or are you just managing citrix boxes in Azure manually?

Citrix Cloud, just using the backplane, self manage Storefront, ADC and VDA.
Been running it for 4-5 years now, no big issues, moved to Citrix Cloud last year, before that everything self managed

so this <https://www.citrix.com/products/citrix-cloud/>

and not this  <https://azure.microsoft.com/en-us/services/virtual-desktop/citrix-virtual-apps-desktops-for-azure/>

I still configure the page file size to a static value.

We have some really wide 2019 session hosts (HSD). So we have 64GB of RAM on these, we can not do 1.5x memory realistically, but Windows certainly wasn't setting it appropriately, because the writable disk size was causing the equation to make a smaller size page file. After about a week (we were keeping sessions a week long on purpose to test this), the virtual memory was exhausted and it spiraled out of control :slightly_smiling_face:

We ended up landing on 16-32GB for a 64GB system. We watched the perfmon counter for commited virtual memory I think and we never pushed too high, I think when windows handled it, it was setting it to like 5-10GB

Yeah the writable volume was making windows cap it at 5GB actually

I think that its the same product, its just Citrix weird sales teams, that try to ride on the Microsoft AVD/WVD train.
They are saying that they add more features to AVD, but they are not really doing that, they add to Windows 10/11 Multi users, but not for AVD.

So they way we are using Citrix Cloud, instead of Citrix Studio, we use the Citrix Cloud portal, Citrix manage SQL and licensing.
Rest is managed by us.

For me I set it as well.  It all ties into these technologies 
1. For WEM memory management if used. 
2. PVS/MCS and write cache. 
3. Standard machine, point to D but I don't give it all its space it wants. I also do memory dumps space. 

Every time I set it to automatic it would sit at 4gb and never expand so I got sick of it and set them all to 20gb static. Expanding the page file is a huge drain on resources too so static is best

They aren't registering to a VIP are they?

No proxy in the way?

I know that the traffic to DDC is bidirectional, not sure if that matters.

Nope, the list is in registry - they are going directly to controllers

I would think throw wireshark on the VDA and make sure you aren't getting a reset packet from anywhere else, but that doesn't make much sense. I mean you only changed the GPO for windows firewall. Maybe make sure the NIC has the correct profile on it (domain or Private)

ok I retested and looks like the policy does break netconnection on 80 and 443. So perhaps the fw policy is not correctly structured. I was under impression that you could do allow and then deny all in that order but that is not working

Its been a minute on Windows Firewall for me, I would think so too, I know thats how a firewall appliance is gonna work, first rule it hits goes. Glad you found it!

not going to bother with GPO. Blocked with Azure nsg instead

Yea allow on top then deny on bottom I thought 

My bets are on next week or before end of March. 

<@ULL6F7DRA> :wink: :+1: :money_with_wings:

But hey, you now get to upgrade your infrastructure a bit earlier than expected :D

You think they are going to release a CR and LTSR with the same version?

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/whats-new.html>

I swear they have referred to the next LTSR as 2203

Someone messed up the release name :smile:

FFS, it's also listed under Current Release, lol

If I know anything, our Citrix rep will be e-mailing us letting us know the next LTSR is available (by way of a new Citrix blog), so I'll give it a day or two.

I'm more annoyed with WEM. Just built my new Platform layer today with WEM 2112. Gonna now scrap it to include 2203 in the next image.

I'm the unofficial beta Prod tester for WEM and App Layering...

Maybe, but it's what I use in my lab because of the dedup feature

I'm only messing around. I can't really talk, anyway, as we run XenServer, haha

I also like the native Powershell support, makes automation a whole lot easier

The What's New section of the 2203 docs is way too short to be LTSR, IMO. I think that title is wrong, and it's CR.

If it was LTSR, that page would be a mile long.

But Citrix has never released a CR and LTSR with the same version

If it is the new LTSR, they are missing a lot of feature updates. I thought when LTSR came out they listed all the enhancements from the CR stacks. I may be wrong.

I asked out Citrix rep to confirm if this is CR or LTSR, so if I hear back I'll post here.

And yeah, if this is LTSR, it should be equal to the most recent CR. Every single feature included.

Our TAM is solid. Our sales/account rep? Bit of a dick.

I miss the priory support to. Is was better than first line. 

Our Citrix rep confirmed that 2203 is, in fact, LTSR. And magically, the downloads page now reflects that.

Also FWIW, Citrix confirmed that you can upgrade to 2203 LTSR from *any* 1912 LTSR build. No need to be on CU5. This blog has been updated, mentioning this: <https://www.citrix.com/blogs/2022/03/02/get-ready-for-the-upcoming-citrix-virtual-apps-and-desktops-ltsr/>

That is not what I see in that article.

This means that you can upgrade to the new 2203 LTSR from the following LTSR editions:
• XenApp/XenDesktop 7.15 CU7
• XenApp/XenDesktop 7.15 CU8
• Citrix Virtual Apps and Desktops 1912 CU4
• Citrix Virtual Apps and Desktops 1912 CU5


<@UL8ACTGSF>: Give it time to update, looks like it was just changed. What you see is what I see from my box at work, but I see the updated content from my home machine.

Honestly not sure why they didn't include that info in the blog about 2203 LTSR from this morning, rather than editing a blog from 3 weeks ago.

It must be cached in Chrome. When I open the link in Firefox, the updated info is there.

Webster can make some calls and Citrix will jump. Lol. He just tells them it's Webster the legend I need this changed 

That is far from the truth! Except for maybe two or three people, it is painful and laborious for me to get any help or info from anyone at Citrix. My former contacts who got me whatever I wanted are long gone. The replacements and new people have no idea and don't care about who I am.

Dang man, Sorry about that. But we know who you are for sure

image.png

Did you installed the Certificate in Computer Account or Current User? and in which more Trust Certificate Authority?

The cert is stored on the DB use the powershell command to add the new thumbprint

<@ULCBDDJCR> I can't remove the old cert yet, as there's an existing catalog still in use.  Certs are installed to Computer Account, under 'Trusted People' as per Citrix docs.
<@U019JU6CVQA> I'll check out the Powershell command.

U need to add cert in Trusted Certificate Authority

<https://support.citrix.com/article/CTX224551|https://support.citrix.com/article/CTX224551>

*Certificates&gt;Trusted Root Certification Authority and Trusted People.* 

What version are the DDCs because there's a bug pre CU3 7.15 that won't accept a new cert

It's latest build (2112), and there's only one DDC in this environment.  The new cert installed matches the locations etc of the vCenter that's still working, installed in all the right locations as per Citrix docs.... I don't believe it's an issue with the cert itself or how it's installed.  The weird part is working for 10 mins after restart then stopping!

haven’t seen that before, anything interesting in the logs? any schannel errors?

Has anyone found a solid solution, other than reducing the # of audio devices on the client endpoint for audio devices &gt;6 causing no audio in session?

did you checked this - <https://community.spiceworks.com/topic/2006817-citrix-and-google-drive>

I have see thins, but I don’t have problems with user credentials, it is working as expected.
I am using FsLogix for my profiles….

I would suggest you to test without any Profile Management Solution like Citrix/FSLogix.

If the same issue is observed then GDrive is not Supported on RDSH Env

<https://support.google.com/drive/thread/17070187?hl=en>

Yes - same problem - but as I see it, there is no solution ?

Why don't you add a script to disconnect the F drive at logoff?

It is an enterprise GDirve - But when there is 10 users logged on to the server, they all have a drive connected (F - G - H .....)

I know this probably doesn't help but by Q4 CloudDriveMapper will be able to handle Google Drive as well as OneDrive

Thanks for all replies – after searching forever I think a have found a workaround.
<https://helpcenter.itopia.com/en/articles/4779004-using-google-drive-file-stream-in-a-multi-session-collection|Using Google Drive File Stream in a Multi-session Collection | itopia Help Center>

Nice <@U01405VJR8U>! Sounds like something to share amongst your colleagues ;)

Yes - will do that :slightly_smiling_face:

I had this idea (not hyper-V related, but PVS will work on Hyper-V, too) and blogged about it. Hope this helps <https://www.julianjakob.com/citrix-pvs-deploy-microsoft-remote-desktop-session-hosts-with-citrix-provisioning-services/|https://www.julianjakob.com/citrix-pvs-deploy-microsoft-remote-desktop-session-hosts-with-citrix-provisioning-services/> 

<https://www.citrix.com/content/dam/citrix/en_us/documents/data-sheet/cvad-ltsr-matrix.pdf>

<https://support.citrix.com/article/CTX205549>

Looks like it's not supported with Citrix

Yeah, everything seems to work fine once it is external to Citrix.

From what you described, sound very similar. But technically you by pass the with RDP.
<https://support.citrix.com/article/CTX107825>

Wish me good luck :slightly_smiling_face:

Does this mean we'll be getting both 2203 CR and 2203 LTSR? Not sure that was well thought out, could be a little confusing

Docs say there is a new Studio feature called "License validity checks".
Did anyone understand what this is about? Is it about hypervisor connections or user connections?

After reading CTX270373, i think it is about hosting connections.

No issue so far after 1 day with 2203 on around 20users

Download pages have been updated, LTSR wording has been added, wasn't there yesterday. File hashes of what I've downloaded matches. So question answered

Did check with GetuserFTA that this is the correct fta?
I have seen with Bluebeam that for some reason the FTA is different on some servers..

yeah i used setuserfta.exe get originally and it was set to .pdf AcroExch.Document.DC  but when i ran Setuserfta.exe Acrobat_pro_DC_Config it set it to .pdf Acrobat.Document.DC but when i tried opening a pdf it still opened with Adobe reader. The machine has a file type assoitations xml file being set via group policy so i am not sure if that is overwriting and taking precedence over setuserfta

I have customers using it with success and no complaints - I've seen strange references to fslogix redirections exclusions as well as custom scripts registering the appX packages to mitigate the issue - but I'm not sure on the full use case for those <@ULL6F7DRA> seems to have a good handle on it 

Tested further by ensuring a hybrid join exists but i'm still seeing Wamdefaultset=no when running dsregcmd /status as a published app. Tried the powershell in this to register the AAD package but still no luck. <https://discussions.citrix.com/topic/403721-office-365-pro-plus-shared-activation-password-screen-not-able-to-select/page/9/>

I resolved it by setting the keys as described here (even though they're not recommended by Microsoft)

<https://support.citrix.com/article/CTX267071>

Be aware that in my scenario, i had to set the registry keys on fresh profiles. Modifying/adding these registry keys on already existing profiles didn't help, so i ended up resetting profiles before rolling out these keys.

I had to do it this way because i couldn't get the powershell method to work either

As a follow up, we ended up getting success with the registry keys like the article suggests - fingers crossed no long term issues persist.

If you want to modify existing profiles you need to delete the HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity, we did this when adding those keys from the CTX article and it worked.
This is anecdotal and I've not been able to confirm for sure, but we found it seemed to affect users with MFA enabled and not those without MFA.

The visual effects in the VDAs performance options are set to custom with only "smooth edges of screen fonts" selected

can't see anything related to this in here
<https://docs.citrix.com/en-us/federated-authentication-service/1912/install-configure.html#event-logs>

(not laughing at you... just an obvious thing the logs should show...)

It might be there, but i haven't found it.
And it would be easy to trigger a script to renew the certificate based on an event.
I've just asked same question in CTP, so maybe someone knows there

that's a great idea... launch a script, drop an email notification "please issue new fas authz cert"

Or just trigger the process of renewing, there are PS for it, the only issue is that someone has to issue it on the CA

Dave Brett has some stuff here that would help with automating it <https://github.com/dbretty/bretty.lab/blob/master/PowerShell/Citrix%20Configuration/infrastructure/fas/01_server_build/02_configure_fas.ps1|https://github.com/dbretty/bretty.lab/blob/master/PowerShell/Citrix%20Configuration/infrastructure/fas/01_server_build/02_configure_fas.ps1>

Does anyone else have a problem with cvad 2112 and servers that are suddenly unregistered. I see the wfshell crashes and then the party goes off. Some users can continue to work and some get kicked out.

Plenty. That is why I wrote this script.

<https://carlwebster.com/downloads/download-info/get-service-account-name/>

If you know the account name used by the service, find every computer that has a service using that account.

There is also this script that finds all services that use domain accounts. Useful for AD migrations.

<https://carlwebster.com/downloads/download-info/get-serviceaccounts/>

Had a customer do this and they had MAJOR issues.  

Any hints as to where the major issues were caused? Customer here has been breached so every single password needs to change, no discussion

Most people don't know what computers use which accounts for what services. That is why I wrote the two scripts.

If you know the service name, use the first script. If you want to find every service using domain creds on every computer, use the second script

Those two scripts and the get/set-dnsinfo scripts are my four favorite scripts for prepping for AD remediation and migration projects

For them backups failed and streaming glitches and inability to failover 

We have to change service account passwords regularly.  Its a somewhat lengthy set of steps I follow, but it's done with zero downtime.  I suppose some of the complexity depends on how spread out your service accounts (meaning how many different accounts you use).

From which version did you do the upgrade? 

There has been a requirement since 1912 CU2 for Ciphers:
To resolve this issue, the cipher suite order list on Citrix ADC must include only the TLS_ECDHE_* cipher suites. Assign a delivery controller server as STA Server in Citrix ADC or StoreFront outside your site. Also ensure that the cipher suite order list on StoreFront includes the cipher suites. These cipher suites must precede any other cipher suites.

<https://docs.citrix.com/en-us/storefront/current-release/whats-new/known-issues.html|https://docs.citrix.com/en-us/storefront/current-release/whats-new/known-issues.html>

Don't know if that's configured in your lab?

StoreFront was 1912 CU3 and is on same Server 2022 box as controller so no ADC LB used for that.

No issues here. Brand new installed SF 2203 on WS2022, load-balanced via NS13.1.4.43.

I have just logged on remotely via Azure AD auth to my on-prem lab-setup

Reading through this again made me double check the cipher group on the SF LB, I have not configured any cipher groups here, so I am using the default group, I guess that's why I don't see the issue?

Have posted in the Citrix discussion but the following Reg has allowed my StoreFront to talk TLS to XML/Gateway again  using system TLS rather than .Net 4.5 defaults.
```[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions" = dword:00000001
"SchUseStrongCrypto" = dword:00000001```

There is a solution for this issue:
<https://support.citrix.com/article/CTX399424>

I can confirm this is working although the registry fix is way easier :slightly_smiling_face:

You can force SSL settings with this handy ADMX template
<https://github.com/Crosse/SchannelGroupPolicy>

I would recommend the change described in the article as it only targets StoreFront. If there is anything else ( any service running) relying on .NET and those settings in the registry it might mess something up.

Yes, healthy  :slightly_smiling_face: . We have a bunch of machines that haven't been used in ages (failover DC) and these work fine when booted (they have been shut down for months). Also if I rename a machine from within PVS it succesfully registers again. Just recreating the machine account solve the domain trust relationship but the machine is still showing up as unregistered. The VDA health check says it's registered however

Are the DDCs on the VDA configuration the correct ones?  <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/vda-registration.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/vda-registration.html>

Solved with Citrix support, the SIDs on the DDC did not match the SIDs in the AD. Recreating the machine accounts,  removing VDA's from Delivery Groups and Machine Catalogs and then adding them again solves our issue. Still a DST issue since it originated when the servers were rebooted after the DST change this weekend. Now I know why it says that the DST issue has been solved in most of the cases in the Citrix KB article  :slightly_smiling_face:

You should always disable scheduled reboots so your PVS targets dont reboot when there is a DST change. Then on Monday create a new Vdisk version and run w32tm /resync before sealing and shutting down and promoting to prod and then rebooting your targets

<@U01HF0W27DG> If SID of DDC didnt match then how come VDA Health Check Tool was showing everything Healthy for you? :wink::thinking_face:

How many DDCs do you have configured on that VDA Machine?

what is the best practice in Daylight Saving Time for non persistent pvs mcs vm? :face_with_rolling_eyes:

This caught us by surprise since this customer did not have any problems with DST previously. The customer team supporting this customer also found the bios time in VMWare gets set to the current time after shutdown so they think this also is contributing to a loop. Just making a new image with DST and resetting machine accounts did not solve it (or maybe because the VDAs already rebooted).

  According to Citrix support the health check tool only checks on the VDA if the registration succeeded. So the VDA finds a DDC and reports it registered successfully but afterwards the DDC realizes that the SID does not match and does not report this back to the VDA (that's how I understood it). We have all the VDAs configured to connect to both DDCs).

 Disabling the reboot script and rebooting the VDAs only when there is a new image with DST changes (w32tm /resync) should have worked. Last couple of years and this year for all our customers (except this one) we did nothing special for DST.

I assume you mean restore on failure when upgrading the VDA? If so, it's mentioned here:
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/install-command.html#command-line-options-for-installing-a-vda>

Great, thank you :slightly_smiling_face: I must have missed that part

hmmm that is a lot of bandwidth for a printer to be honest. I never seen that before. Do you have any tools that can give you the virtual channel metrics? I know if I copy a picture for example from my ctx session to a computer and if it's large it will hang the session up. I would think, the Ctx session would be laggy as heck if that was the case.

200 GB for a single user? Yes this is a lot. If I remember well you can enable the spooler logs and it would be source "Print" and EventID "10" and you will see the file name, file type and size.
Usually if you redirect a printer, the spool process is done in two passes, the high level spooling, done on the server, and low level spooling, done on the client, to process the print job and send it to the printer. In between, Citrix should compress the job via the ICA channel. For best compression use the Universal Print Driver, the EMF format, in the benchmarks I have done a couple of years ago would get the best compression level on print jobs.

This also appears to work more than OK without issues

Old thread revival - does PolicyPak Cloud work with Non-persistent Citrix VDI (PVS Win10)?

There seems to be some issues with the cloud version and a nonpersistent VM.

We got it working combined with some bisf seal scripts… BUT we had major issues with it fighting (we think) with windows defender and completely rooting servers, mcs and non mcs so it was removed. <https://github.com/JamesKindon/Citrix/tree/master/Sealing/PolicyPak|https://github.com/JamesKindon/Citrix/tree/master/Sealing/PolicyPak>

Note in the prep script there is two options, prep commands - the doco says to use the hashed out value but we ran the non hashed command (default) - all the unique side of things was fine but yeah, bigger issues 

I use it on standard servers without any issues. I know it's not MCS though.

It works fine FYI, no issues when provisioned

The new LTSR release 2203 has a massive problem with SSL communication! XML and STA no longer work with SSL!!! Storefront isn’t working anymore! I can reproduce this issue in my testlab and at one customer. <https://discussions.citrix.com/topic/415885-gateway-callback-fails-after-upgrade-to-storefront-2203/page/2/>

I have only TLS1.2 and 1.3 enabled on the NS LB for SF

I plan on upgrading my lab soon and will post back what I see.

It's about the Gateway vServer you use for Storefront and the callback URL. This doesn't work anymore without enabling TLS 1.0 and the Default ciphers. Second thing is the XML service, doesn't work either with SSL. 

It's working here :slightly_smiling_face:

With default ciphers and TLS1.2 and TLS1.3

Hang on, you may have a point. I have been looking a my SF LB VIP, not my Gateway vServer

Same issus in my site upgrade to 2203. But NS 12.1

Disabled TLS1.0 and now I get a "Cannot complete your request" during logon

<@UMB4XQE79> <@U01BENZAP5Z> do either of you have a support case open by any chance?

We have all our GW vServers configured for A+ on SSLLabs. That's unacceptable from Citrix to enable TLS 1.0. 

<@UMB4XQE79> it shouldn't require TLS1.0. Quite the opposite, actually. It shouldn't work with TLS1.0

Something is definitely not right, so need to get this looked at

Only with TLS 1.0 ENABLED on the vServer it works. 

Otherwise you get a Cannot complete your request error. 

Once one of you guys opens a case, if you don't mind, please share the case number. I'll reach out to the engineering team to help analyze the issue

Thats kind of funny. Some weeks ago i recommended my customer to bind the SSL profile for A+ everywhere but not on the Callback VIP for compatibility reasons. There have been similar problems before some years ago where Windows Server Updates caused the TLS handshake to fail (It was on LDAPs when i remember correctly)

Have posted in the Citrix discussion but the following Reg has allowed my StoreFront to talk TLS to XML/Gateway again using system TLS rather than .Net 4.5 defaults.
```[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions" = dword:00000001
"SchUseStrongCrypto" = dword:00000001```

Great work <@U01HATXSH2R> I'll test the registry changes in my lab setup ASAP

Yea, for sure. I had to do this with other products (non Citrix) but never with Citrix related. But good to know for sure.

But why is it needed now with 2203? It wasn't a requirement with earlier versions of StoreFront

Yea I agree, something changed in the .net code

I have only tested on WS2022, but as I understand it it's also an issue on WS2019?

I will test this immediately with my customer!

<@U01HATXSH2R> are you using WS2019 or WS2022?

WS2019 english as well. I will also test it soon.

GREAT!!! It works with the mentioned registry change, XML and STA with SSL &gt; no problem! THANK YOU <@U01HATXSH2R>

<https://support.citrix.com/article/CTX399424|https://support.citrix.com/article/CTX399424>

Looks like the web.config workaround from Citrix effectively tells StoreFront to use .Net 4.7 which itself already uses the system TLS defaults, so the reg fix I used just tells .Net 4.5 to do the same thing globally as per MS best practise in <https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls>
That being said the web.config fix is probably best as with a new StoreFront 2203 deployment the web.config is explicitly set to 4.7 already, and it looks like a StoreFront upgrade just neglects to make this change from 4.5 to 4.7 in the existing web.config files.

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops-service/manage-deployment/adaptive-access-based-on-users-network-location.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops-service/manage-deployment/adaptive-access-based-on-users-network-location.html>

Yes. It should be visible next to system clock or other place but permanently visible.

Those are all stored in HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify in a crazy binary key, so I'm not sure that you can actually hack it.

wonder if you try dragging it to be visable, take note of the binary key, then move it to hidden and note again.  maybe the placement i the tray (ie. right next to the clock) the binary would stay the same

Yes that's been gone a while, it is no longer maintained. For now, you can grab it here <https://jamesrankin-my.sharepoint.com/:u:/g/personal/james_jamesrankin_onmicrosoft_com/EdnoCAI23ClOmQJVS6T383ABYuqi81yxB2EraDr21OZ4Rw?e=BaM1Yr>

Not Sure, why Citrix is removing such useful tools