World of EUC

Any familiar with Desktop Lock?  I have users with 2 assigned desktops in storefront (one dr) and am looking to find a way to deterministically launch the primary desktop.  I originally assumed the favorited desktop in storefront would be launched but in wider testing that isn't the case and the desktop launched seems to be picked at random.   

I'm going to try Enable/Disable maint. mode of a host connection. Hoping that is similar to reset

I've seen it with standard printers, not label printers

One time fixed it by changing the type of driver for the UPD

You mean the UPD Driver Preference policy?

Do you recall the order you specified and why that particular order?

No as it's been some time.  PrintLogic has been my answer since then.  PCL5 keeps coming to mind though

looks like disabling 'Enable Bidirectional Support' on the printer queue has resolved the issue.

We are moving more users into our RDSH environment. We are using Server 2019, 2112 VDA and Office M365. We have had some issues where users are having spreadsheets they are working on from a network drive become locked by their own account. Not sure why this is happening here and not in the Windows 10 desktop space. Any thoughts?

Interesting.  How is this different from IE mode with Edge?

we are removing with the powershell command and then addressing each company individually that might need it

and, can you fully uninstall IE11 with this program?

IE mode doesnt work in edge after you run uninstall IE

via the "Disable Internet Explorer 11 as a standalone browser" policy

<@ULC9J5XPB> like, just dissalow run to iexplore.exe ?

<@UTT4BTR1S> So, ietab, works with IE11 uninstalled

I asked about extended support past june and here was their response

what powershell did you use to uninstall?  I have the DISM commands

```dism /online /Remove-Capability /CapabilityName:Browser.InternetExplorer~~~~0.0.11.0 /norestart
dism /online /Disable-Feature /FeatureName:Internet-Explorer-Optional-amd64 /norestart```

ah, you said powershell and that threw me off. :slightly_smiling_face:

Looks like the policy does apply to S19, too: <https://docs.microsoft.com/en-us/troubleshoot/developer/browsers/installation/disable-internet-explorer-windows>

And FWIW, IE Mode works fine with that policy set, when using Edge.

when microsoft releases the patch to disable IE, will they do the restrict method like you are using <@ULC9J5XPB> or are they going to run the DISM?

sorry just reading some of these documents and seeing that they won't forcibly remove IE on server OS with any patching, and IE mode will be continually supported until 2029 on server 2019

so that seems like the better way to go and much cheaper

Dunno, we're waiting to see how that plays out, as well. We only have one or two sites that really has to load in IE right now, and are pushing for them to evolve or go away. IE can burn.

I'm doing this on W10 single session VDAs, FWIW.

I laugh, but we were literally forced to move off of 2008 R2 2 years ago...

I couldn't believe how many boxes we had running it.

The GPO seems a great fit, thank you for that

Thanks for the thread. You all are so lucky you can actually disable and remove IE. You'd be surprised how many web-based apps in the financial vertical still have this as a requirement to work. IE Mode has helped most sites, but we have a couple that are PITAs.

Nothing says “trust me with your finances” like requiring IE…

i may have misunderstood but aren't the June patches going to do essentially the same thing as setting that GPO to disable it ? (and then fall back to IE mode in Edge if you have that setup)

I'm not sure if they'll do the same thing, but I swear the patches are only going to apply to W10 and not any of the Server OS builds.

yup that sounds right...Win10 20h2 and higher

well i just got the june updates and IE is still working like it always did so we may need to do the group policy method unfortunately.  friggin microsoft

image.png

Anyone seen this before, MCS machine tries to register in DNS with the name of the template / gold image, rather than the host name of the VM?

<https://github.com/leeej84/-DEPRECATED---PowerScale> by <@ULKDZHKFY> and this one <https://github.com/StevenNoel/Citrix-IntelliScale>, by me.  Any reason why you are not using the citrix native toolset, autoscale?

On a side note, PowerScale works fine, I just don't want to develop it any further as there are other products and services providing similar functionality. It's a little overkill for a restart script though.

(I wasn't awake reading this question).. thought, why does he want a reboot script for the cloud? We got Microsoft handling that.. Azure is rebooted enough lately :wink:

New Citrix ADM CVEs: <https://support.citrix.com/article/CTX460016/citrix-application-delivery-management-security-bulletin-for-cve202227511-and-cve202227512>

If you enable Kerberos logging are you getting any Kerberos errors on the vdas? Any FAs errors on storefront or fas severs?

No error's on FAS servers or Storefront servers will enable the kerberos logging to see if i see anything

<https://support.citrix.com/article/CTX217150/unable-to-login-using-the-fas-authentication-getting-stuck-on-please-wait-for-local-session-manager>

Probably not the above issue, but could be a network change restricting access to something (like that CRL)?

you checked for a gpo or lgpo?  <https://support.citrix.com/article/CTX286762/application-launch-is-stuck-at-please-wait-for-the-local-session-manager-and-disappears>

Hey Shane yeah already tried that one without joy. <@U012AAZRJ20> thanks for that will take a look at it

This will depend on your version of CVAD. I got hit with this when using 2203 and specifying a parameter which appears to be cloud only - mine was “StartDate”

Oh I can see it - your WeekInMonth params aren't accepted inputs - you can't do multi value there 

Ok I also tried to configure only one value for WeekInMonth. But I still get the same error.

I found splatting it helped with troubleshooting which param it was <https://github.com/JamesKindon/Citrix/blob/5ac98d3332b4b457e26d8036688a353f7b774dae/WeeklyRebootSchedulesByTag.ps1|https://github.com/JamesKindon/Citrix/blob/5ac98d3332b4b457e26d8036688a353f7b774dae/WeeklyRebootSchedulesByTag.ps1>

Not really a script (just an outline of settings) and drain mode is handled by Citrix natively 

Cool, thanks <@UKJTJD4KA>. I'll check that out

FYI: I opened a Citrix case and support confirmed, that this feature (monthly reboot schedules) is not supported for on-prem but only for cloud.
They will now also update the documentation.

Title: Users were unable to make calls using the Virtual Desktop Infrastructure (VDI) optimization in Microsoft Teams

User Impact: Users were unable to make calls using the VDI optimization in Microsoft Teams.

Final status: We've deployed the fix to all of the affected environments and can confirm after monitoring service telemetry that the impact has been resolved.

Start time: Monday, June 6, 2022, at 12:00 AM UTC

End time: Tuesday, June 14, 2022, at 3:00 PM UTC

Root cause: A recent standard service update inadvertently introduced a misconfiguration, which resulted in impact.

We have not. We moved to Defender on everything from W10 20H2 to S12 R2/S16 in our Citrix environment - infrastructure included - and it has been smooth. All exceptions from Citrix's guide are included.

good. Not sure by what this is caused right now, getting errors like "Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed. - This may be due to low resource conditions". CPU is on 100% and msmpeng.exe using most of the resources. After a Defender Update CPU is not anymore on 100%, but some services are still crashing and brokeragent.exe fails.

Are you using FSL? We had servers going unresponsive fairly frequently and the latest FSL agent almost completely resolved it. We saw the same error messages that you are, but other services we're displaying the same resource utilization error.

Yes we are, version should be minimum 2201, not sure if the Hotfix has been applied. I'll let you know tomorrow.

<@UTPLY4YLU> FSL 2201 HF01 - 2.9.8171.14983 is installed. That's the latest FSL agent

Adding the other notable changes were new Cloud connectors and SF LB on the ADC... but they all look healthy, cheers

Finding lots of tdica / ssl handshare errors in the VDA logs that seem to have started since the change...

Did you install the 2203.1 Storefront that fixes a TLS issue? <https://support.citrix.com/article/CTX457757/hotfix-receiver-storefront-3231-for-citrix-virtual-apps-and-desktops-2203-english>

ohhh very interesting... let me check this out. I dont believe it was installed, cheers

Can't personally speak to you issue, but i was going to mention what <@U01HATXSH2R>  stated. If you are seeing ssl error in the logs I would bet some money taking a shot at 2203.1 on SF. Again just a outside looking it. 

Thanks <@ULLH5JGFR> - I have patched 1 of 2 and have all connections now going to the patched instance. I will report back with findings - cheers bud

Lads, connection timouts / failure rates are down to pretty much normal level since applying the patch and enabling socket pooling. There's still a ton of calls to the SD with folks not being able to launch pub apps and apparently a simple WSA / Receiver reset sorts it. Im going to try get a hold of client logs and go through the client / SSO settings with Citrix support, cheers

Just an FYI, you can force a refresh by either modifying the workspace app shortcut to include -showAppPicker -poll in the arguments.

Whiteboard does work via Teams in Citrix (just tested now!)

Good news because I've just heard we're rolling it next week :joy:

That's not normal. Not sure what's going on there but upm containers are lightening fast

not sure either, got it down to about 30 sec now

Funny. But really whats the point of API hooks?  If i disable it what features are you lossing?

Personally I never seen any loss. Other than the application doesn't render until it's added in the hooks. 

Workaround for now is to install an older version and block the following addresses to prevent auto update:
<http://oneclient.sfx.ms|oneclient.sfx.ms>
<http://g.live.com|g.live.com>

Screen Shot 2022-06-21 at 2.22.22 PM.png

Screen Shot 2022-06-21 at 2.16.48 PM.png

Screen Shot 2022-06-21 at 2.17.45 PM.png

if I remember correctly this should be fixed in 2206/2203 CU1. 

VDAs might experience a fatal exception when using certain third-party applications, and display a blue screen with bug check codes IRQL_NOT_LESS_OR_EQUAL (a) and MEMORY_MANAGEMENT (1a). [CVADHELP- 19654]

pretty sure they're not talking about IMA vs FMA, but rather Server OS vs Client OS. So if your master image is Win10/11 than the latter, but if it is Server 2019/2022 the XA installer will probably be needed

In my example the target OS would be 2019.

I think in their language that would be XenApp, and not XenDesktop

which is pretty lame for an ex-Citrix product :slightly_smiling_face:

So I see I'm not alone with the confusion. You also seem not be be sure what they mean,

no I'm pretty sure I know what they mean, just that it is really outdated to talk like that

Its clearly not about the architecture of CTX, but more about the capabilities of a Server OS terminal server vs client OS VDI that would be the limiting factor of their installer:

*Note:* Audio and recording features are supported with GoTo Meeting installed in XenDesktop environments, but they are not supported in XenApp environments.

Which is basically saying: we can't do this on a multi-user server OS

We are licensed under the desktop version but... we are heading into our renewal.

Now is a perfect opportunity to get out before Broadcom burns you!

We are hoping that we won't get caught on this renewal. We are reviewing our exit strategy options. 

I can say that you should absolutely explore Nutanix and AHV. We have 4,000+ nodes and it really is a game changer.

In my opinion, AHV is the best on-premises option.

A quick pivot to a cloud option would be a challenge for my legacy organization to embrace. 

Yeah, we're 95% on-prem, but we have 3 large data centers so there's already the sunk costs from that we benefit from, and we have opex pressure which pushes us towards capex and buying outright instead of cloud.

I'm right there with you. Are you in a regulated industry?  I'm in US electric. Capex is king. 

Telecom, so not really regulated, just promises to shareholders to cut opex, lol.

it should be automatically on the clipboard, so I _think_ it would be a PNG, maybe?

Thanks, James. The only thing I can see in the allowed formats that relates to basic images is CF_BITMAP... fired that into UAT and see what happens... PS Used your blog a while back for allowing text so cheers! :slightly_smiling_face:

Hmmm, would be interesting one to test. Not sure if it is stored in a specific format though, because it seems to save the clipboard contents in whatever the native format is for the app doing the saving. It might just be raw data - probably need someone cleverer than me to figure that one out

Yeah, my thinking is its just ones n zeros and maybe gets converted to something on paste/write..

ok, my foot is down, it's officially time for Citrix to put the domain field for director in the 'application' section of IIS.  Thank you for listening.

I had this happen with standard UPM on 1809, but it was 2 years ago. I can try to dig up my case and send you some notes to see if it helps?

it might, I just turned off everything other than the container telling it to capture everything, I’m going to reboot and try again. UPM profile container is driving me mental but the customer doesn’t want to use fslogix.

Arent pinned taskbar items stored outside the profile in programdata

are they? I thought theyre were in appdata roaming

I get outlook tool tips every time I start up outlook too, even though it clearly finds my outlook profile.

the only thing I can get to stay pinned is Edge…

Should be here I thought "%APPDATA%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar"

Seems you are right but I remember working on a comparison of full user layers verses fslogix and seeing that pinned uwp apps would only work dith gull user layers because  ms storred parts if the pinning in programdata jnder the username. 

If it were that easy :disappointed: I try to disable the virtual channel allow list and see what’s happen.

I’ve had some fun with that in the past with applications like Dragon and Bighand.

It’s seems that the Siemens COMOS Enterprise Server will use this virtual channel. Normally, German companies don’t have that much humor with their names.

There have been posts that say it is no longer required. I personally have not removed it from there in my environment.

No it's not needed anymore and result in problems meanwhile. Or <@U015G4SG5LY> 

No longer needed and causes problems with smartcards in Edge 

And thx to <@U015G4SG5LY> in the new pre prod version of evergreen script it's cleared out of the registry :the_horns::skin-tone-4:

Perfect. Thanks <@UR9T47CRM>. Fast as always :hugging_face:

nonP we have on boot randomize the password via posh script as well as disable local account.  Have not found a need to ever know the local password on a nonP system

Thanks <@UK89L1Q02>, yeah that's what I also thought. I don't see any need for a local admin account.

If you go the scripting way you can find some scripts in ControlUp GitHub repo <https://github.com/controlup/script-library/tree/master/LAPS%20-%20Reset%20Account%20Password|https://github.com/controlup/script-library/tree/master/LAPS%20-%20Reset%20Account%20Password>

And if you're using ControlUp with Automated actions you can use a Scheduled Trigger to reset them every once in a while :)

We use laps on non-persistent, it works great. It's handy to provide the local pwd for some teams that need admin right for troubleshooting. Our script runs at boot time.

I use BISF to trigger the password update at boot time. 

Something I wrote eons ago on how to be et LAPS deployed with MCS.  <https://mybrokencomputer.net/t/citrix-machine-creation-services-mcs-and-laps-local-admin-password-solution/43|https://mybrokencomputer.net/t/citrix-machine-creation-services-mcs-and-laps-local-admin-password-solution/43>

• I mean I understand what they mean, but what is actually setting each value? WindowsConnectionSetting (Citrix.Broker.Admin.SDK.WindowsConnectionSetting?) The logon mode reported by Windows itself (multi-session machines only). For single-session machines the value is always hardwired to LogonEnabled. Possible values are: LogonEnabled, Draining, DrainingUntilRestart and LogonDisabled.


ie, why would windows report draining but citrix not?  the only way i can see this is in controlup or powershell. in cloud studio the machine looks like it is taking connections but really isnt

Still fighting with restart schedules then...

bob.jpg

the autoscale is actually working.  It is logging off disconnected sessions after 15 minutes. I dont think this is the intended purpose of autoscale but nobody @ citrix will give me an answer. So..Im going to just use this to control idle and disconnected session until citrix kills it and says it was never supported.

i wish they would figure out what they are doing so we wouldnt have to continue to have to macgyver everything

Screen Shot 2022-06-27 at 9.38.53 AM.png

I oftern day dream about just enabling Autoscale, flipping this switch and calling it a day.

Is autoscale replacing schedule reboots? I see it supposedly supports multi-session OS and has options to disconnect idle session and log of disconnected sessions.  Does this actually work with server OS?

thought it was a fluke but yes, it has happened to be alot lately