World of EUC

No tom foolery required.  Installed with the normal procedure

you need to use shared computer activation when you install

I dont know if that was required, but I always install with SCA when running on a CVAD shared desktop

```&lt;Configuration ID="8db88607-fccd-43bb-be08-2e17ede5be46"&gt;
  &lt;Add OfficeClientEdition="64" Channel="Current" SourcePath="\\lab.local\voa\streamedapps\o365-voa" AllowCdnFallback="TRUE"&gt;
    &lt;Product ID="O365ProPlusRetail"&gt;
      &lt;Language ID="en-us" /&gt;
      &lt;ExcludeApp ID="Access" /&gt;
      &lt;ExcludeApp ID="Groove" /&gt;
      &lt;ExcludeApp ID="Lync" /&gt;
      &lt;ExcludeApp ID="OneDrive" /&gt;
      &lt;ExcludeApp ID="Publisher" /&gt;
      &lt;ExcludeApp ID="Teams" /&gt;
      &lt;ExcludeApp ID="Bing" /&gt;
    &lt;/Product&gt;
  &lt;/Add&gt;
  &lt;Property Name="SharedComputerLicensing" Value="1" /&gt;
  &lt;Property Name="PinIconsToTaskbar" Value="FALSE" /&gt;
  &lt;Property Name="FORCEAPPSHUTDOWN" Value="TRUE" /&gt;
  &lt;Property Name="AUTOACTIVATE" Value="0" /&gt;
  &lt;Property Name="DeviceBasedLicensing" Value="0" /&gt;
  &lt;Property Name="SCLCacheOverride" Value="1" /&gt;
  &lt;Property Name="SCLCacheOverrideDirectory" Value="%appdata%\Microsoft\Office\16.0\Licensing" /&gt;
  &lt;Updates Enabled="TRUE" /&gt;
&lt;/Con```

And you tested it, because it's unsupported, right? Or did I miss something?

Hoping MS will cave.....  Which the community thinks will be true.   Not sure what else to do.

Migrate all our clients to AVD?  That's not gonna happen in 2 years

I don't believe they will change their opinion. But we can all believe what we want. We will know the truth when it happens. 
And is Win2022 Support what the community really wants? Isn't Windows10/11 MultiUser on-premises the real thing we need?

I'd be fine with either of those.  Forcing me into Azure is a crap move

and Azure Stack HCI is even more expensive.

"Windows 10 Enterprise multi-session can't run in on-premises production environments because it's optimized for the Windows Virtual Desktop service for Azure. " (<https://docs.microsoft.com/en-us/azure/virtual-desktop/windows-10-multisession-faq>)

and if that's not the biggest horseshit statement.

if by optimized the mean deliberately coded to not work if it can’t see certain azure resources, then sure

did you tried latest FSL version released with Hot fix

<https://docs.microsoft.com/en-us/fslogix/whats-new|https://docs.microsoft.com/en-us/fslogix/whats-new>

Going to try that -currently on 2.9.8111.53415

Check the fixed issues in above article looks similar your one

Looks like it, alot of fixes in the version we on now - i am updating the agent monday morning and will let you know how it goes

Do you ever updated the VMWare Tools inside the vDisk or always with reverse image or E1000 method?

Happened to me with FSLogix 2201 and ATP. We updated FSLogix to 2201HF01 and removed ATP.

Retries are fine.
VMware Tools have been updated with E1000 Method.

<@U015MJK0XBM> we have FSLogix 2004 and Cortex XDR. How often did it happen to you?

image.png

This is how the Console looks like.. Retries seem to be fine.. We have done every reccomended AV Exclusion (Citrix+FSLogix)

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/2203-ltsr/install-configure/install-command.html#command-line-options-for-installing-a-vda|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/2203-ltsr/install-configure/install-command.html#command-line-optio[…]or-installing-a-vda>

That was a 7.15 thing as BCR was added in a CU to it.

bcr what do you guys do since most monitor are scaled higher than 100

Believe it or not, most of our monitors are scaled to 100, as we generally sell 24" 1080p monitors to our clients

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/vda-registration.html#auto-update|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/vda-registration.html#auto-update> check this - you should be able to disable auto update and override with listofddc keys. Do a reg check (search) for the old DDC value also, have seen it be written via GPP from missed policies etc 

Regularly, for customers in certain sectors (finance, defence)

To be clear, VDA registration is always over port 80 even when you enable TLS.  The TLS settings are for ICA traffic rather than using 1494/2598

You can configure the DDCs to handle connections from VDAs over HTTPS instead of HTTP. 

I assume you're referring to the Secure Browser in Citrix cloud vs the "Workspace Browser". We have used it to deal with a SaS web site that used Google Captcha. Captcha sees all traffic coming from our network as one IP and thus we would get errors or were not able to authenticate to the site. Using secure browser got around this. We have not leveraged it for much else at this point. It does work seamlessly for us. All our implementation is on-prem except for Secure Browser.

The cost of usage needs to be more flexible however. If you have a large organization that uses a certain external web site a lot, it can get costly. You buy "user hours" to use Secure Browser, so it's not an all you can eat license.

<@ULHA2NPPX> afraid so. You buy packs of user hours and when you run out you get more or you can't use it.

"Maximize Shareholder Value" :face_with_rolling_eyes:

I didn't realize there was a SaaS option.  I was looking at the on-prem option.  <https://www.carlstalhood.com/published-applications/#securebrowser|https://www.carlstalhood.com/published-applications/#securebrowser>

<https://docs.citrix.com/en-us/citrix-secure-browser.html>

Not trying to hijack the thread, but what is Workspace Browser?  I thought that was the same as Secure Browser.

Citrix Workspace Browser is a native browser running on the client machine. It enables users to open web or SaaS apps from the Citrix Workspace app in a secure manner. It ensures a consistent user interface while accessing various web or SaaS apps while improving your productivity and giving you a great performance in rendering those apps. <https://docs.citrix.com/en-us/citrix-workspace-browser.html>

„…newly introduced Shellbridge feature…“
Does anyone have more information about that thing? 

I think it's for m365 apps authentication on server 2019

<@U019JU6CVQA> seems to fix much more. I'm curious about the technical details…

Quick question about virtual channel security enforced on 2203, if I want to make some testing on 2203 without upgrading delivering controllers (1912). Do I need to configure the policy ?

<@ULNFS3KF0> the Policy is already there so you can disable it without a hustle :)

2Pac's gonna come back to life and write another Hit 'Em Up, only this time about Citrix.

I'm still laughing at how bad this is, and that multiple people likely had to sign off on it.

Anyone here have contacts at VMware? We need that rap battle to happen.

I couldn't make it past 6 seconds. Yikes. Somebody got drunk and came up with an idea for a new marketing video.

6 seconds? You have to dig down deep and watch it all. It's glorious in how awful it is.

I was disappointed comments were off because I wanted to roast it so bad. I was like growing up in the 80's again when they stuck Rapping into all sorts of inappropriate places. Who paid for this and which marketing team did it. I think they need to be downsized!

I want to know who liked it. I want names.

I watch all of it thinking the beat/words would get better. But it was hard and really cheesy.

<@ULC9J5XPB> it is glorious.. lol now you made me watch the whole thing.   You are a terrible person.

This was right up there with "Grill Skills"

Dig in through powershell and you can see the thumbprint of the cert, see if it matches what you installed in windows.

<https://support.citrix.com/article/CTX224551/delivery-controller-cannot-contact-vcenter-server-after-certificate-update-on-vcenter>

Thanks mate, I actually got it resolved, just posted outside the thread because I wasn't paying attention :slightly_smiling_face:

I think you need to download the appliance "CA" cert and install it in your DDC trusted root cert store. In your browser open the cert for the vcenter appliance.  Go to certificate path and click on the CA, then View Certificate, then details then copy to file

Actually you're right but on the other side - that's what I'd done, I didn't realize there was actually a link on the vSphere site that lets you download a bunch of root certificates, so I hadn't done the obvious bit :slightly_smiling_face: Fixed now - the power of "find the solution as soon as you post to Slack" strikes again

Can you do it via computer login script/PS?

Could do, but GP will just overwrite the damn thing

Unless you add a sleep command in to wait for that to happen first?

is it due to a 'access this computer from network' restriction? is that why local admin is needed?

Here's the Citrix doc - <https://support.citrix.com/article/CTX340030/vda-failing-to-register-with-the-error-stating-the-registration-was-refused-due-to-agentnotcontactable>

has to be another GPO or setting of some kind that was implemented.  Seen a similar situation where you can target delivery controllers via group to override the setting in another GPO

in my case it was 'access this computer from network' that had domain users ripped out of it

Indeed, "access this computer from the network" is Administrators only

yeah, create another GPO that is maybe targeted to an AD group with the delivery controllers in it.  Something like that

That's a helluva catch, I think you've spotted the problem. That's made me go home in a more cheery mode!

Are you getting this kind of authentication prompt? Is the login proceeding if you're waiting for more than 60 seconds?

Yes that kind of logon screen, no it doesn't proceed if I wait

Eventually it powers itself off, even more bizarrely

Had this behaviour with O365 licensed W10 VDI's and blocked ports from that specific VLAN --&gt; <http://device.login.microsoftonline.com|device.login.microsoftonline.com>

Will be tomorrow before I can check, let you know then

another one too for RDSH, they both look pretty similar, but are different paths.

Image from iOS.jpg

Same OU, same GPOs? Usually it's the FAS servers missing or not in the same order as for Storefront

Steve is solving all my problems recently :slightly_smiling_face: It was indeed the GPO for "prompt for password on connection", someone has gone security-crazy over here by the looks of things

lol, well i work in a security crazed environment, so that explains it.

a combination of AppLocker and DisallowRun

mount the NTUSER.DAT of the default Profile and remove the run key

Yeah, I think that's the route I will go.  Cheers

Also a good way is to block the following path with FSLogix AppMasking, if any User is trying to setup the UserInstaller later:
%SystemDriveFolder%\Users\*\AppData\Local\Microsoft\OneDrive

my question would be, is there a elegant way to stop OD4B from trying to upgrade in a nonpersistent RDS setup?
One way we have seen is, to rename updater.exe :man-shrugging:

thx and have all a good start in the new week

Not to my knowledge.  What would be the use case for this versus putting machines from multiple catalogs into the same delivery group?

If i have two types of Delivery Group like Static and Machines created from PVS CVAD Wizard.

No you can have multiple catalogs in the same delivery group if they are of the same type.  You wouldnt want a different image in the same delivery group because users could not then pick which image to launch. 

Rob is correct you wouldn’t be able to do that.  Plus if you have both my question would be why not decommission the static and just use the PVS machines.  Dealing with user experience across different provisioning methods would be challenging

<@UL5TCJ57D> Target is slow remove the Static Machines and Move all users to PVS Target

yeah, I went through this with support recently, they updated the page to remove the part about it not being supported

I use rendezvous on every project unless it's air gapped or the network is configured in a sub optimal way 

Do any of your projects use in session VOIP apps that don't have optimizers available?

<@ULJM98FME>: I would definitely recommend Rendezvous, it removes load from your Cloud Connectors and it removes an additional hop.
If you want to, you can still use TCP with Rendezvous.

<@UKJTJD4KA> How is the user experience after enabling

<@ULJM98FME> Yeah V2 is preferred here. It removes the need for reverse-DNS of the VDA VM.

Some information on V1 and V2 can be found here:
<https://docs.citrix.com/en-us/citrix-daas/hdx/rendezvous-protocol.html>

we're going to be moving from 1912 to 2203 soon here.  what is the logoff issue you are referring to?

With FSLogix and server 2019, if a user logs out, the vhdx Will stay mounted, but then allows the user to login to a new session resulting in a temp profile because of the vhdx being locked. 

I am struggling with this also - which is the last stable release for this one?

<https://discussions.citrix.com/topic/393608-logonuiexe-sessions-disconnected/page/12/> I think the only stable one is 2106

<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1654035681089039|https://worldofeuc.slack.com/archives/CK6TCV3JN/p1654035681089039>

Ahh right I do remember seeing that thread. I knew it sounded familiar! So still an ongoing issue with cu1 but slightly improved?

Forgive me for hijacking this thread for 2203 CU1 issues..anyone seen that logon performance data is not available in director? UPM is functioning and session ready with event ID 1000 is logged. Happening with 2203 CU1 VDA, old version 7.15 CU4 works

<@U01GWFT2BDJ> we just had the same thing happen when we went to 1912.CU5.

Nope. We're thinking about opening a ticket with Citrix.

I did that earlier that day, will keep you updated

Just to circle back, i have opted to go with 2112 VDA with the hotfix thats available - as far as CR is concerned for me its the only stable release

We still had the issue with 2112 and the hotfix, we’ve been able to get away with 2203 for a handful of servers, the rest are on 2106.

Iv had 2112 running for about 4.5 months without issues, 650+ user environment with FSLogix / WEM all the usual bits.....its weird how its a different experience for everyone......frustrating the latest 2 releases haven't been stable

Have you tried this:
PsExec -i -u "NT AUTHORITY\NETWORK SERVICE" cmd

there is a space between network and service

I failed there too…my guess is that recent psexec versions don't work anymore. Two other options to achieve the context switch:
1) Create a simple batch an use a scheduled task with context network service
2) Use nirsoft advancedrun tool


Thanks <@ULD72Q44R> will try that :slightly_smiling_face:

Lol the issue was the space between network and service, so vice versa as <@ULL6F7DRA> said

I don’t think RDSH-based workloads will cause an issue from a storage perspective, any modern storage solution should be able to handle that load. The difference between solutions (specifically for RDSH) is going to be in scalability/manageability/support/costs etc etc (IMHO)

*Disclaimer: I work for Nutanix Engineering.

Yeah have done it plenty of times - nothing to really think about from an MCS perspective 

In Teams? Yes. You need latest Workspace App and a recent VDA

Sorry, yes, in Teams.  Running latest CWA and latest teams client (optimized), but the background and blur options are missing.

have you set the Registry key that enables it?

Well, I must have missed that in my googling.  I did not realize there was a reg key needed.

Sorry, I think you need 2207 Workspace App as well....I was running the EAR in testing

<https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/about.html>

<@ULJM98FME> / <@UL5TCSW3D>:
There are 2 different things here.
1. Background blurring or effects in Optimized MS Teams -&gt; GA in 2207 (Was a Tech Preview in 2206). AFAIK the registry keys that were needed for the TP in 2206 are no longer needed
2. Background blurring on redirected Webcams -&gt; TechPreview in 2207. With this feature, any webcam stream used in the VDA (Unoptimized Teams / Zoom / whatever app uses webcam) now has a blurred background. As this is a Tech Preview you need to enable it via the Registry

Thanks for the clarification, certainly what you can find on the internet is a bit murky and contradictory at present

Now fix my "blue key" problem and I will buy you a gallon of beer :wink:

Can confirm that blurring does work for me in CWA 2207/VDA 2112... on first logon.  Spotty on reconnects though.

Can't seem to get this to work, 2203 VDA and 2207 CWA.....does anyone know if there's any extra reconfiguration required to activate?

For the life of me, I can't get it to work either

Yeah I'm going to spend all day tomorrow battling with this I think

You know... I don't think I've ever tested "in a call" I've only validated in Settings -&gt; Devices.

The very latest version of Teams doesn't seem to have gotten this flag yet. Very annoying and intangible stuff

Odd, are you seeing the same Teams version in the About header inside my screenshot? 1.5.00.21463?

No,. Using 22806 from the exploration ring, so newer

Don't think this is dependent on what you have installed but on MS rolling features out at a user level? <https://techcommunity.microsoft.com/t5/microsoft-teams-blog/microsoft-teams-release-processes-why-do-i-not-see-a-feature-but/ba-p/2110426>

That'll be right, we have to wait for Microsoft to deign to give us it. Great for people with project deadlines :man-shrugging:

Looks like the flag has switched for me - noticed the UI is there today and once I deleted the client side reg key I'd ben using for testing CWA2206 TP it works well (blur / background image).

We've also found this file on the write-cache disk.  Would look in the documented places, remove it and still would not register.  Found it on the wc and boom, magic

Yeah, we know it gets generated on the WC disk, and that's for all of the VMs. But why do some refresh that file, and others do not?

Are you sure you installed cpm  when you installed the vda

I am seeing a similar case here resolved by uninstalling the UPM and then reinstalling the 1912CU5 UPM, it seems you might have not upgraded the upm in the process

Same issue here with a clean install of 2203 CU1

<@U01GWFT2BDJ> are your logon duration more than 3 minutes by chance ? there is a known private fix for that CVADHELP-20107 not included yet in CU1 <https://support.citrix.com/article/CTX459861/logon-duration-is-not-logged-in-director-for-session-logons-taking-more-than-3-minutes-to-complete>

It's less than 3 minutes and Desktop Ready Event ID 1000 is logged

can you try running this on VDA see if there is any error "get-wmiobject -namespace root\citrix\profiles\metrics -class logontimings"

Already tried that and there are no errors shown

I'd collect CDF traces from VDA and DC and Director and open a case with Citrix, seems no one reported anything on this version yet, I'd also try the normal steps in this article <https://intelligentsystemsmonitoring.com/knowledgebase/citrix/average-logon-duration-data-missing-in-citrix-director/>

Case is already opened. Thanks for your feedback <@U03SXFM34R0>

DDC, Storefront and Director is working fine. Only issue I've encountered so far is what I described in this thread

My first thought would be something related to the video codec/settings on that VDA. If you set Edge, etc. to open a blank page, is it still slow switching blank tabs?

Do you have hardware acceleration enabled in Edge and Chrome?

<@ULL6F7DRA> Default settings for Edge/Chrome.  Not sure if that includes hardware acceleration or not.

<@ULC9J5XPB> Will have to test that theory, but I think it is still slow.

If I remember correctly hardware acceleration should be disabled, but it might be worth checking just in case

This is one of those times that RemoteDesktopAnalyzer (paid build) would come in handy, to test out the applied video policies in real time.

it's recommended to disable hardware acceleration if you don't have a GPU available

Hardware acceleration is enabled by default in Edge, FWIW. I disable it via GPO.

Nick, I might just drop the $75 for the pro version!

It certainly comes in handy for troubleshooting, and they've done a great job adding new features over the years.

<@ULL6F7DRA> Any chance you have a link to the Citrix recomendations re: hardware accelerations?

I'm not sure if they actually have it in their documentation for browsers, but they list it for Teams for the same reasons.

I disable it in everything from Edge to Office 365.

I agree. I don't think there are any official recommendations.

Early testing looks positive.  Performance with one user is MUCH better

Sharing is caring :slightly_smiling_face:

I never was a fan of that rule anyway, Moore’s law is an actual thing you know. 

There's was an old Synergy session that went into this, showing another method for figuring out scalability. Citrix removed it from YouTube for some damn reason, but I basically created a spreadsheet using their methodology. Worked fine for us, but I'm not sure how well any of this works short of using something like LoginVSI and actually testing your workloads.

The only way to really know is to pilot with real users.  

It’s difficult to tell but what I’m finding lately is that if you give the users a browser you will hard pressed to get more than 15 on any server configuration, no matter the specs. The magic number seems to be around 10.

Interesting, really interesting. Thanks Mike!

we went up to 16 cores and 56GB of RAM in Azure and couldn’t get more than 14 users on without someone complaining of slowness

That’s a full desktop though, apps are a little different

it basically comes down to if you allow chrome/edge or not, and there’s not many places that don’t allow a browser

if you get super into optimizing edge you can probably fit more on, but if you’re stuck with Chrome, then you’re capped at around that 15 number

I keep trying to throw more resources at it but keep coming back to that number, even with vGPU

yeah, so it’s probably better to scale out. If you can keep 10 users happy with 5 cores and 32GB of RAM just build more VMs

This is why we flipped from Hosted server desktop to Win10 VMs.  All it takes is one user to hose a box for everyone else.

We changed our student lab machines to virtual desktops.
So far only 100 desktops at 16gigs ram/4 processors.  I can push it to 140 (licensed for 150)

When updating these student lab machines, we can handle a boot storm of 20 at a time.

That’s been my experience over the last few years anyway, the days of getting 40 users onto a server OS are long gone

This is all great information. thank you Mike.

<https://virtualblog.nl/2019/12/18/windows-10-vdi-sizing/>

it all depends on where you are hardware constrained and how intensive your workloads are, if it’s CPU keep an eye on CPU ready, anything 5 or over is going to be rough. Same thing for disk and disk queues

disk latency is a killer if you’re doing a vhd profile solution

the sizing calculators from citrix I have not found to be of much use for years, they are wildly optimistic

LOL yes those calculations are.

So far these are only student lab machines with stat software and arcgis (no 3d cards yet).  Staff we will be using liquidware for profile management.

That link is something that will help me immensely

Depends on your workload. If sized correctly, everything will stay in RAM

^This. We have 15GB WC disks and 4GB pagefiles, which work for us, but our W10 desktop is pretty vanilla (O365, Teams, OneDrive, Edge, some minor LOB apps; PVS).

Use a monitoring solutions who can monitor the usage of the ram cache. Start with a catalog with enough cache and see how much users use

I don't really see the point of PageFile anymore, unless you need a dump for MS, or don't have enough Ram. Educate me if I am wrong on my thinking lol.

What do you mean by we can approve? What are you approving and in where?

Ok, that translates to the request is not supported.
And are you saying that after clicking ok and trying again you are able to login without issue?

ok and then you can enter your creds, so no sso

Are you using Federated Authentication Service?

Hmm, that would push me to think SSO issue b/w workspace and storefront, but I haven't see this directly.
Maybe try testing SSON from Workspace.  right-click Workspace app icon in the systray, click Advanced Preferences, click Configuration Checker and run the SSONChecker

Are you certain that both the Webex app version installed in the VDA and the VDI plugin on the endpoint is the same, or only one build off? <https://www.webex.com/downloads/teams-vdi.html>

I ask because I have found that the new unified Webex app is much less tolerant of version differences between the two.

I saw similar issues in my W10 20H2/1912 CU3 environment when the VDI plugin was only one build behind the app.

(Endpoint was 42.6.0.22645, VDA app was 42.8.0.23214)

Virtual Channel Allow List?  <https://www.citrix.com/blogs/2021/10/14/virtual-channel-allow-list-now-enabled-by-default/>

thx <@ULC9J5XPB>! I had sync'd the versions 2 weeks back, but, i'll check again

<@ULHA2NPPX>! We did have to open USB / audio / mic redirection via Citrix policy, but the virt channel allow list is only for 2109 or later, AFIAK

<@ULC9J5XPB>: Anything you had to do windows firewall / appliance firewall wise to make it work? Does your virtual channel show as open / green ? on this sub-page of the WebEx client?
This is my first time doing WebEx on VDI, as it's Citrix, i'm used to things not working as excepted on the 1st attempt :stuck_out_tongue_winking_eye:, i'm thinking I missed something simple ?

I didn't request any firewall changes, though I can't speak for our UC team who owns the app. Perhaps they did, but I'm unaware of it. Before you go into a meeting, this is what I see for Health Checker: