World of EUC

it all depends on your storage backend, a lot hyperconverged stuff is all thin provisioned so it doesn’t make any difference at all.
In some instances it can make a difference, as a thin provisioned disk needs to write once to expand the disk and then again to write the data. A thick provisioned disk doesn’t, so it’ll be faster.

I think that could depend on how complex the GPs are for instance, are they applied only to OUs or are there filters based on Groups (users or computers) which would have SIDs applied, etc.  and then the nature of the GPs (referencing UNC paths, etc.)

I done this as well and it depends on what all you bring over that is specific to another domain. But if you were to do it and replace the items that are domain specific it will be fine. 

done it all the time.  Make sure to use migtable.migtable

ditto on what others are saying, never used migtable tho, looks shnazzy.

the group policy migration table looks at the settings in the GPO any anything domain specific such as unc paths it allows you to correct

Maybe I'm misunderstanding the ask, but if you just want the client folder, don't select the name.

Get-BrokerApplication -MaxRecordCount 10000 | select ClientFolder

image.png

That is when you're setting up the hypervisor in host connection? 

The service account you're using have the correct permissions to the hypervisor?  What hypervisor is it? 

Use this link. It's for VMware but hit the hamburger menu on the top left to see the required setup for other hypervisor connections.
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/install-prepare/vmware.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/install-prepare/vmware.html>

they applied those...so it looks like its an undocumented setting

Interesting, I use this most of the time. Let me know what you find 

Oh and just to double check there is shared storage in VCenter as well for each esxi host correct?

At my new place, they have been using the '/masterimage' switch as part of the installation (MCS), but if you check that option in the GUI, it uses a much longer string:

```/mastermcsimage /includeadditional "Citrix Supportability Tools","Machine Identity Service","Citrix Profile Management","Citrix Profile Management WMI Plugin"```
I wonder if the installer sees '/masterimage' and just assumes those other components should automatically be included. They certainly were not specified in the 1912 VDA installation string.

forget the ui it's outdated and buggy as hell, use the offficial doc

I wouldn't use it either. The guy that made it isn't there and from I was told they don't maintenance it no more. I give it to folks to give a command line input to see the idea of it. But them have them update it with the vda cli in the docs. It's not far off but more enough to maybe get some goofy installs. 

I was curious more than anything, as I wanted to see if any command line arguments changed between 1912 and 2203. It appears that it is the same.

Yes most definitely I do the same thing. I use it for a guide and tweak it as well. I don't see a huge change.

If you do the master image /? Or look for example In the help area. Maybe it would give 
More examples?

masterimage is apparently the same as mastermcsimage

I personally think this is dumb and does more harm than good, but that's another story.

In order
• OS
• OS updates
• Language Packs
• VDA prereqs
• VDA
• Apps

Session host role is probably the most important before you install any apps or vda

Vda takes care of the session host role I believe. 

Yea it needs to be able to add computers to AD and manager computer objects ect. They can delegate the same service  account they gave permissions for on the VMware hypervisor connection in studio. That account talks to the hypervisor which needs rights from the hypervisor and the AD side for the same account to manager computer objects/create/read/Write to an delagation of an OU.

<https://support.citrix.com/article/CTX318084/required-permissions-for-citrix-machine-creation-services-and-auditing-information|https://support.citrix.com/article/CTX318084/required-permissions-for-citrix-machine-creation-services-and-auditing-information>

hi ray, someone replied back and said that the host connection account does not need permissions.   i don't think it does. i didn't see it in any of the documentation.

Maybe I am not understanding your question. The host connection is what contacts the Hypervisor and creates machines. It only needs permissions in what is defined from the hypervisor. Now this is the same account that MCS will use to add the machines to AD once it going through the provisioning process during the machine catalog deployment it will need writes to add the machine to the domain and put them In the OU. 

<https://support.citrix.com/article/CTX318084/required-permissions-for-citrix-machine-creation-services-and-auditing-information|https://support.citrix.com/article/CTX318084/required-permissions-for-citrix-machine-creation-services-and-auditing-information>

Unless there is a way to have studio define 2 different service accounts? Which I'm not familiar with. When you go though the Hypervisor setup from citrix studio it will ask for a username and password. Which is for the hypervisor connection. It will ask you for MCS/PVS catalog type. Then ask you about the networks / storage ect. When you get past that point and creat a master image for MCS it will ask you about the AD location and it will use the same account. <@ULJ3D468M>  am I missing something perhaps?

Hosting Connection, let's say VCSA just need e.g. administrator@vpshere.local + Password. When you create Machine Catalogs, an AD user account with proper permissions needs to be selected to be able to add AD accounts in AD

In case you want to automate it <https://github.com/haavarstein/Applications/blob/master/Citrix/XenDesktop/Configure_VCSA_Connection.ps1>

Check virtual channel security default behavior (enabled) has changed

Thanks! Actually Jabber support came back with this. Except for now my DDC are still 1912  as I was hoping to get the VDA upgraded first before doing the Controllers even if Citrix is doing the Controller first. Does anyone know the registry needed on VDA? thanks

I tried with a test 2203 CU1 site with the virtual channel allow list disabled, same issue. Fail at "opening the channel handle" with error 1008.

Hey Nick, when you say 'Select' - you you mean set a client default printer? cheers

Yep, set a default printer - in this example the desired default printer is the client redirected printer

Which i dont think is possible given its a variable printer that wont always be mapped through so the default is not retained - but wanted to confirm with the ofurm

It's been ages since I done anything with printers... have you looked at these settings?

From here: <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/reference/ica-policy-settings/printing-policy-settings/client-printers-policy-settings.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/reference/ica-po[…]printing-policy-settings/client-printers-policy-settings.html>

Fun

<https://twitter.com/gentilkiwi/status/1570525137962930176?s=20&amp;t=1pppJSQCJjbChGO6rhM4FA>

Its more about the actual CRLs and the distribution point for those certs. FAS doesn't need that issuing CA up once it has a certificate from it and that said cert is not expired. BUT whatever you are using for the CRLs and checking those certs all the way up the chain better be available and accessible. Sometimes its good to stagger the FAS servers pulling their auth cert a day apart or something so the expiration isn't on the same day.

Answered in the discussion thread, but copying here:

You get a PRT when using azure ad certificate-based authentication (currently in public preview) but it's only working with Windows 11 Insider Preview Build, at the moment. MS will backport the functionality for Windows 10 and Server OS later this year (no ETA confirmed) see my post about some details <https://www.julianjakob.com/citrix-fas-azure-ad-cba-with-primary-refresh-token-prt/>

The other workaround is to federate your domain with OnPrem ADFS and connect your ADFS to Azure MFA. This is also supported and generates a PRT.

I know, both methods aren't the best, yet...

There is also another method, using local credentials for pushing SSO, but you have to use native Workspace App and the clients have to be domain-joined. See <https://citrixie.wordpress.com/2022/07/04/citrix-workspace-azure-ad-sso-access-to-vda-desktops-and-apps-without-fas/>

Ok, I understand now. For different reasons the customer just ditched ADFS.. I guess we will have to wait for this functionality then. Thanks!

I did us custom account the same as for discovery with adm, so like directorroot for specific director integration. Documentation is lacking but then again I don't think it will be around that long anymore. Citrix ADM Service director integration is still a no go.

you can give feedback on the integration site: <https://docs.citrix.com/en-us/citrix-application-delivery-management-software/current-release/deploy/integrate-netscaler-mas-with-drector.html|Integrate Citrix ADM with Citrix Director | Citrix Application Delivery Management 13.1> just did it myself with the lack of missing requirements.

What rights did you assign to this special account?

Joking or serious ?:face_with_raised_eyebrow:

you could try read-only to be honest haven't looked back into it anymore

read back my notes a bit, and it's regarding a admin view account in adm if i'm not mistaking, haven't tried it with a read-only there. I mixed-up the discovery account for nsroot profiles with the director integration.

my bad for the misleading nsroot :slightly_smiling_face:

At a user's request, I have updated the three XA/XD/CVAD doc scripts to accept multiple items for the -Section parameter. The user had 2000+ applications and wanted every section except for applications. The AD doc script has had this capability for a long time. If you want to test the script, email me, and I will send you the update.

That log is long gone. I actually found my answer - HKLM\Software\Microsoft\Windows\CurrentVersion\Installer. Had to parse through all Citrix installs to validate which components actually appeared.

Another post about lovely Storefront:
2203 CU1. Create Store, Create 2nd Receiver for Web Site in this store, Create Second Store. Delete preciously created Receiver for Web Site, Never open Storefront console again.

Cmdlet name: Get-STFWebReceiverService
Parameters:
System.ArgumentNullException: Value cannot be null.
System.Exception: No Web Receiver Services found within IIS site '-1'. Value cannot be null.

Happy to start again from scratch.

it works on a workstation.. nothing obvious in the group policies, could be a difference between server and client os. have to dig into it deeper

Seems to be a feature on Windows 10 1809 and newer. Not working on Server 2019, will see if it works on Server 2022 :slightly_smiling_face:

We're testing onedrive in published app and after setting the shellbridge registrykey, we could remove the enableadal entry

Yes, but the problem with shellbridge is that it opens up the run key so if the user for example use a desktop sometimes and within that desktop uses Teams, auto started these processes will run in the published app as well. I tried shellbridge to get  Outlook working and it helped but not sure if we will use because of the above.

No, it's not. Not sure for RDS though as it works much better with the railrunonce setup.

RDS definitly not:
<https://learn.microsoft.com/en-us/onedrive/sync-vdi-support>
"The OneDrive sync app is not supported in remote app scenarios."

Ok, was not up to date on this fully. Hasn't this been an issue for a very long time now? More and more customers are going towards OD for the users files and to not be able to use it in published applications is not a good user experience.

Other options here <https://james-rankin.com/articles/managing-onedrive-on-citrix-virtual-apps-and-desktops/|https://james-rankin.com/articles/managing-onedrive-on-citrix-virtual-apps-and-desktops/>

Got the same question yesterday and thought support may change with shellbridge. However i havent used it atm.

<@U023HEDJVH8> Here's the fix. First, don't use EnableADAL or any of the legacy method to get SSO, they are not recommended anymore, modern auth is the way go.

Second, you want to disable OneDrive launch from your default user profile or the current user profile. Since the ADD Broker plugin is broken on Server edition, it must be repaired first and then OneDrive can be launched with SSO.

Third, add this to your login script.

_`# Fix Office 365 SSO on Windows Server 2019 - <https://discussions.citrix.com/topic/403721-office-365-pro-plus-shared-activation-password-screen-not-able-to-select/page/9>`_
_`# <https://docs.microsoft.com/en-us/office365/troubleshoot/authentication/automatic-authentication-fails>`_
`$AADPluginState = (Get-AppxPackage Microsoft.AAD.BrokerPlugin).Status`
`If ($AADPluginState -ne "Ok")`
`{`
    `Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown`
`}`


_`# Launch OneDrive only after Microsoft AAD Broker Plugin is repaired`_
`If ((Test-Path -Path "$env:ProgramFiles\Microsoft OneDrive\OneDrive.exe") -and ($null -eq (Get-Process -Name OneDrive | Get-Process -Name OneDrive -IncludeUserName | Where-Object { $_.UserName -eq "$env:COMPUTERNAME\$env:USERNAME" } )))`
`{`
    `Write-Host -Object  "Starting Microsoft OneDrive..." -ForegroundColor Green`
    `Start-Process -FilePath "$env:ProgramFiles\Microsoft OneDrive\OneDrive.exe" -ArgumentList "/background" -WindowStyle Hidden`
`}`
`Else`
`{`
    `Write-Host -Object "Microsoft OneDrive is already started." -ForegroundColor Green`
`}`

Ah! Thank you very much Jonathan! I'll give this a try!

<@U03TEGF1PJB> den hatte ich noch gesehen! Gruss Thorsten

So that script as a login script worked like a champ, only now the AAD prompt isn't pickng up the user's UPN and passing through, if you type in the username it flows through SSO, anyone seen this? stumped whats left.

I also struggled yesterday at the very first logon.
For me it works when I do the following in a logon ps1:
Start onedrive.exe
wait 10s
Stop onedrive.exe
wait 10s
Start onedrive.exe
After this onedrive is logged on.
(only at the very first logon, new user profile)

Marco, thanks, already doing similar, outlook/onedrive are great but edge and chrome just never pick up the UPN

otherwise all is well, still playing will let this thread know if i figure it out

It's only the instructor led one's that count for the renewal

you would of thought a citrix led citrix instructor on the all access elearning vs a QA/Global knowledge instructor who reads from the book would be better but i suppose its all about the $$$ :joy:

You're confused.   That flag is expecting a string after it to be used as a filter.

so if you wanted to see all brokerapplications associated with user jsmth you'd use that command with jsmith appended and you'd get a result.

So to be clear it's expecting a string to be used a filter, it's not a switch that changes how the output would appear (I'm assuming that's what you are expecting it to mean)

You are using the parameter wrong. 

<https://developer-docs.citrix.com/projects/citrix-virtual-apps-desktops-sdk/en/latest/Broker/Get-BrokerApplication/#detailed-description|https://developer-docs.citrix.com/projects/citrix-virtual-apps-desktops-sdk/en/latest/Broker/Get-BrokerApplication/#detailed-description>

got - <https://www.simonscitrix.com/2019/05/export-list-of-all-xenapp-7x-published.html>

I try this command Get-BrokerApplication -MaxRecordCount 10000 | Select-Object PublishedName,ApplicationName,AdminFolderName,AssociatedUserFullNames | Export-csv -Path C:\Application.csv

yeah, use this in your Select-Object area, just replace AssociatedUserNames with AssociatedUserFullNames

i replace AssociatedUserNames with AssociatedUserFullNames and got the same result

you need to use that whole line in my picture

but instead of associatedusernames, use associateduserfullnames

anyone have the issue before...where it says system.string in the csv or text file but displays correctly when not exporting it to anything

that the only column thats not showing up

is this the correct version of office 365 for Server VDAs?

this document says <https://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/deployment-guide-office-365-for-xenapp-and-xendesktop.pdf> pro plus