World of EUC

image.png

All. The. Time.

Would love to find a solution to it.

does it happen with any type of session <@U012AAZRJ20>? mine seem isolated to HTML5 connections

yes, all the fucking time.  Would also like to find a solution for it

killing winlogon.exe may close it, but i've seen ones that don't die

at minimum make sure you have all the proper AV exclusions for Citrix, and FSlogix (if using)

since a reboot is the only thing to fix it i hafta put the machine in MM (even though there are other sessions on it that are fine) and then reboot after its empty

What OS? I havent had this issue on our 2019 servers since I added the following keys:

I created the Reconnect folder and then added two keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Reconnect

DisableGPCalculation with  a 1
FastReconnect with a 0

already tried the following reg key?

HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Ica\GroupPolicy
Name: EnforceUserPolicyEvaluationSuccess
Type: REG_DWORD
Value: 0 (enables the current fix)


<@U011GTUJ71S> In response to your question, I went back and looked and see at least one that is a Workspace connection. I'll be keeping a closer eye on them as they are brought to my attention.

I hide the session when it happens, at least the user can log back on.

There's one in this article <https://james-rankin.com/articles/creating-a-chocolatey-package-for-the-citrix-virtual-delivery-agent/>

But beware, Citrix have deprecated certain switches in the latest installer (I've noted them in the article too)

For posterity, the command line switches I ended up with are shown below
```/controllers "<http://nameofDDC.mydomain.com|nameofDDC.mydomain.com>" /quiet /noreboot /enable_remote_assistance /virtualmachine /enable_real_time_transport /enable_hdx_ports /components vda /includeadditional "Citrix Profile Management WMI Plugin" /exclude "Citrix WEM Agent","User personalization layer","Citrix Files for Outlook","Citrix Files for Windows","Citrix Supportability Tools","Citrix Personalization for App-V - VDA","Machine Identity Service","Citrix Profile Management","Citrix Universal Print Client","Personal vDisk"```
_Update 21/10/22_ – beware Citrix surreptitiously changing the command-line switches/components available! From 2209, the following component names are deprecated for _/includeadditional_ and _/exclude_
• Citrix WEM Agent
• User personalization layer
• Citrix Files for Outlook
• Citrix Files for Windows
• Personal vDisk
Also, one other has been renamed slightly – _Citrix Profile Management WMI Plugin_ is now _Citrix Profile Management WMI Plug-in_ (added a “-“)

Thanks, Nick. They are running both but for this case it's plain old persistent VDI... couple of hundred machines so no PVS/MCS at play, cheers

Thanks, <@UL5TCSW3D> - know what version that hyphen was added to WMI? These guys have it in their script for 2203 but maybe it should be removed? ta

If your doing it via SCCM - another option is to use the Master Packager app to create a package that SCCM can leverage

Yes, do it in the build script to stop them being able to create subfolders. Hasn't broken anything

did something similar to C:\temp, but apparently it wasn't enough...  Isn't this kind of like chasing wind though?  They'll always have access to download/run things to their profile

Sure, but it cuts off binary planting attacks

Run accesschk from sysinternals and you will be amazed what weak permissions are all over your drive

And besides running anything from %USERPROFILE% should be blocked

like whitelisted, or just in general?  what about Teams or Zoom or software that installs as a user

I don't let Teams install into the user profile, but you can use AppLocker to allow very specific items

Block everything but allow the bits you can't avoid (GTM was a pain for this, as was Bomgar)

The NTFS way stops a "bad app" from installing, say to c:\Apps (which it creates itself with weak perms), and then a user can drop a custom DLL in there with a name that the program uses, and because of PATH searching it loads the malicious DLL when the app launches. Remove the default C: drive permission, and the user can't write to C:\Apps any more - problem solved

yeah it does make sense, i just kept coming back to, the user still will have access to their 'downloads' directory to save/run things

but that doesn't mean the flood gates should be open

Yes, that exact one, although the second one might need to go to

were you using Applocker (or insert another whitelisting software tool) to prevent things from running in %USERPROFILE%?  Or were you doing NTFS stuff there too?

AppLocker, I don't screw with NTFS on user profiles

Check the above reg key on the VDA's and check the event logs on the VDA's. I would also check your FAS Rule to see if there is any Storefront/VDA/User restrictions

Nothing on VDA event logs, registry key on VDA matches the SF box, what's odd is i don't see any outgoing traffic to FAS in the SF windows firewall log, it's like its not even trying to hit FAS

Check the Storefront access permissions in the FAS Rule  make sure the SF server has the assert idenity perms

Check if the SF Store is still FAS enabled.

Looks like MS strikes again with another buggy patch. We had applied the Nov monthly update to half our domain controllers yesterday. Turns out there's a bug in the patch that for whatever reason is expecting RC4 to be enabled for Kerberos authentication <https://twitter.com/SteveSyfuhs/status/1590417822030917632?s=20&amp;t=IFx9d0YDMIQcNoquj_lPDw>
We have RC4 disabled in our environment. I was seeing the following error in the System log on the SF server every time the auth failed.
Client Time:
Server Time: 0:7:15.0000 11/11/2022 Z
Error Code: 0xe KDC_ERR_ETYPE_NOTSUPP
I got with our domain admin and had him apply the following registry keys to the DCs that were updated with the November patch per: <https://www.reddit.com/r/sysadmin/comments/ypbpju/comment/ivu62l7/?utm_source=share&amp;utm_medium=web2x&amp;context=3>
reg add "HKLM\SYSTEM\CurrentControlSet\services\kdc" /v KrbtgtFullPacSignature /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" /v RequireSeal /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\kdc" /v ApplyDefaultDomainPolicy /t REG_DWORD /d 0 /f
I assume what happened was after the patch was applied to certain domain controllers, Kerberos could no longer negotiate a ticket due to RC4 being disabled. So, if the SFs are trying to contact the domain controllers using Kerberos, the process fails there and doesn't even attempt to contact FAS. The generic error message I was seeing on the SF "Could not contact any Federated Authentication Servers" might be technically true but the cause appeared to be a Kerberos issue.
Be careful with the November update on domain controllers + FAS in an environment where RC4 is disabled. Hopefully MS will correct the bug because RC4 isn't something you probably wouldn't want turned on anyway

Can you share a screenshot of the message? Where are you seeing that? 

What is the client platform and workspace app version?

<https://support.google.com/chrome/thread/174381169?visit_id=638037013093981303-719957663&amp;p=chrome_app_deprecation&amp;rd=1>

• June 2022: Chrome Web Store will stop offering Chrome App installations for Windows, Mac, and Linux users.
• July 2022: End support for Chrome Apps on Windows, Mac, and Linux.
• March 2023: Chrome Apps will no longer be launchable on Windows, Mac, and Linux.


Ah, you installed the chrome app.. you can safely remove that and use the native windows client

You need to remove the app from your browser

The reason these are used in the environment mentioned is for users who for whatever reason could not use the native app on mac or win and it was easier for support to get them rolling on chrome

You can use our HTML5 workspace app for that

so back to the original question - will Citrix app for Chrome really stop working soon? I cant imagine that its not used by anyone but us

<https://chrome.google.com/webstore/detail/citrix-workspace/haiffjcadagjlijoggckpgfnoeiflnem?hl=en>

looks like some ppl asked in reviews as well

Divya ChandrasekharanOct 27, 2022
Hi Sam, 
The warning is meant to be for this app on Windows and macOS devices. On ChromeOS devices, the Citrix Workspace app for Chrome OS from the Chrome web Store here will continue to be supported.

For these devices you can switch to our HTML5  app

Seems like this should have been communicated by Citrix and not a notice in Chrome :disappointed: I contacted my rep

And html5 client download requires Citrix authentication :man-facepalming:

Yes as a user does not need to install it

You install it on StoreFront. Our workspace service also supports it

<https://docs.citrix.com/en-us/citrix-workspace-app-for-html5/deploy.html|https://docs.citrix.com/en-us/citrix-workspace-app-for-html5/deploy.html>

<https://verticalagetechnologies.com/index.php/2022/11/10/fun-with-citrix-functional-levels>

that information has been in my documentation scripts since day 1

like after you run the powershell scripts? or you have this listed on your site somewhere?

Looks good.  You have a typo on the 2nd PowerShell command.  Should be "Get-BrokerDesktopGroup" instead of "Get-BrokerDeliveryGroup"

*I see where you have this now.  Were you able to script this, or did you have to manually see what is displayed in Studio? <@UL8ACTGSF>* 

Manual process since Citrix refuses to document it

Yeah, very annoying.  Even combed sql tables, couldn't find it.

The info is on some devs computer somewhere. 

Hi

Take a look at this KB
<https://support.citrix.com/article/CTX267071/password-field-not-displayed-when-publishing-any-office-365-application-such-as-excel-or-word-on-server-2019-or-windows-10|https://support.citrix.com/article/CTX267071/password-field-not-displayed-when-publishing-any-office-365-application-such-as-excel-or-word-on-server-2019-or-windows-10>

There "Fix" is to disable modern auth, which you can't do anymore with the changes that MS is making

Would love to know if Shellbridge actually fixes it

<https://support.citrix.com/article/CTX267071/password-field-not-displayed-when-publishing-any-office-365-application-such-as-excel-or-word-on-server-2019-or-windows-10|https://support.citrix.com/article/CTX267071/password-field-not-displayed-when-publish[…]lication-such-as-excel-or-word-on-server-2019-or-windows-10>

wow...i had no idea...let me review these articles

my users see the password field, but it doesn prompt them for MFA

Awesome.  I will have to test this as well.  shame it took them until 2203 CU1 to fix it.  wow

i can't figure out how to fix the MFA issue

you will have to try this VDA version and shellbridge

Apparently they 'tested' it lol (yeah I know it's not a guarantee all issued will be discovered etc)

<https://support.citrix.com/article/CTX474882/microsoft-security-update-validation-report-november-2022>

I wonder if Citrix will have an update to resolve this since rc4 is a vulnerable encryption algorithm and the work around is to enable it.

<https://www.bleepingcomputer.com/news/microsoft/windows-kerberos-authentication-breaks-after-november-updates/amp/|https://www.bleepingcomputer.com/news/microsoft/windows-kerberos-authentication-breaks-after-november-updates/amp/>

The article has been update with an other workaround
DAAS - VDAs not registering with Cloud Connectors after applying Microsoft Update KB5019966 (<http://citrix.com|citrix.com><https://support.citrix.com/article/CTX474888/daas-vdas-not-registering-with-cloud-connectors-after-applying-microsoft-update-kb5019966|)>

There are many known issues with <https://support.microsoft.com/en-gb/topic/november-8-2022-kb5019966-os-build-17763-3650-b09dad62-5cd7-47cd-992f-b7d01f2956c1|KB5019966>

It would appear they've released an out-of-band for this:

<https://support.microsoft.com/en-gb/topic/november-17-2022-kb5021655-os-build-17763-3653-out-of-band-8e0c94f1-0a7d-4602-a47b-1f086434bb16>

Looks like is a new feature on the 2209 release <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/machine-catalogs-manage.html#change-the-network-setting-for-an-existing-provisioning-scheme|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/machine-catalogs-manage.html#change-the-network-[…]-provisioning-scheme>

If the CVAD servers and the back-end Linux server are on the same subnet or VLAN, this should not be a problem as all ports are typically open for nodes on the same subnet or VLAN. If that traffic is having to go through a router, network teams might block uncommon ports for security reasons. To be fair, they could also block them at the switch level, but that's a lot more work, but I've seen it done .  Also make sure you set the ports for return traffic, too. Most times it's the same port or the FW rules will automatically allow a response, but applications respond over different ports than the traffic went over

was booked on the Citrix CWS 415 course at QA to renew my expiring CCE-V on December 5th-9th but they have cancelled it on short notice. The only other course running in December is at Arrow but they are not setup as one of our prefered training providers !! Have i got any other options ?

this may be the same thing but does this affect the Citrix Workspace for ChromeOS? (the one thats installed via the Chrome Webstore (or pushed via Google Admin page like we do)

Not yet. Google is discontinuing apps for Windows and Mac next month. I think ChromeOS will still support them for a while

ok cool.....we still have a larger batch of Chromebooks in our environment that people rely on that app

The prob is we have been using Chrome plugin on older Mac's and problematic BYO devices

interesting.....i see they ended support for chrome apps on chrome os for all customers june 2022 as well

I haven't seen anything official from Citrix on this, but maybe I missed the announcement?

so HTML5 is the only officially supported connection method from a chromebook/ChromeOS?

ChromeOS app will continue to work for a while. The issue is with Chrome WIndows and Mac installs

Just my 2 cents on optimizations.  There are some 'generic' optimizations that should be applied, but really, you should do an evaluation based on the applications and user requirements.  Think about Lockdown profiles (Security),  You might make a system completely secure, but wind up breaking some functionality that the users or applications need.  The same can be said for performance optimizations.  Setting a registry or disabling a service might be a generic recommendation to improve performance, but if it breaks some function, then it doesn't really improve user experience.  That's why the Citrix optimizer uses templates, but allows and recommends that you review each setting and what it does so that you can decide which ones work best for you particular use cases.
Too many times do I see people just apply a template and not review the settings before implementing

By deleting any reboot schedules attached to the DG in PowerShell

This is a Windows Task Manager bug incorrectly reporting the memory consumption

<https://learn.microsoft.com/en-us/troubleshoot/windows-client/performance/gpu-process-memory-counters-report-wrong-value|https://learn.microsoft.com/en-us/troubleshoot/windows-client/performance/gpu-process-memory-counters-report-wrong-value>

You can easily verify it when you go to the performance tab and select the gpu. You can see the correct utilization there. 
I think process explorer also shows it correctly

./masterimage and /mastermcsimage are the same thing. IMO, I would never use /optimize, and old switches that are <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/2203-ltsr/install-configure/install-command.html#command-line-options-for-installing-core-components|no longer valid> should be excluded.

cool unless i'm reading wrong, /optimize , enable_framehawk_port and Personal vDisk is old and not needed anymore

i know /masterimage worked fine in the past so maybe i just use that again here

I tested with /masterimage, and it worked fine for our MCS stuff.

why would they even break it out to have both /masterimage and /mastermcsimage if they do the same thing

damn that was supposed to be a gif. i guess that doesnt work here :slightly_smiling_face:

Use the /giphy switch :slightly_smiling_face:

from 20 users 2 user will face this issue

Yes, I got that, but those 2 users are they unable to logon? Or are the logged on after clicking OK

Are there multiple servers available? If so does this happen on all servers for the same 2 users?

not supported is usually a smartcard logon / fas issue in conjunction with kerberos

maybe something wrong in the flow of those accounts

take a look at your event logs with the user accounts and the vda

see numerous kb articles around that, take a note of those eventid and validate the normal winlogons as well, regarding security logon etc.

that would be strange, not supported entries should be there, als no other sessions open like RDP etc? then you can also get this message

That is a Citrix FAS / cert error i have seen in past

<https://support.citrix.com/article/CTX218941/fas-request-not-supported-while-launching-a-published-desktop-with-fas>

Was it working before? Did anything change?

This is typically a Kerberos issue. Make sure their AD account is all okay. Even though you have 7.18 DDCs, what VDA version are you running?

Patched domain controllers recently?

<https://learn.microsoft.com/en-us/windows/release-health/status-windows-8.1-and-windows-server-2012-r2#2953msgdesc>

Yeah, I wonder if the 7.18 VDA has the kerberos challenges that the 7.15CU5 and earlier had? I found that changing the allowNtlm="false" to true in the BrokerAgent.exe.config file helped address some of these issues. Unsure if it's the same thing though. I have a post install script I use that's here if you want to take a look
<https://www.jhouseconsulting.com/2019/07/18/citrix-virtual-delivery-agent-vda-post-install-script-2015>

and on a different side node try to upgrade to the 1912 release, is 7.18 even supported anymore?

You read through this?
<https://docs.citrix.com/en-us/tech-zone/design/design-decisions/single-server-scalability.html>

yes, i saw that but it didn't answer my question.

are you saying there should be a 2:1 ratio?

should it be 2 cores with a total of 3 sockets

This might give you a bit more clarification.
<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1658236234444539>

<https://worldofeuc.slack.com/archives/CK6RVLZ8S/p1593952186297700>

For me I follow the Techzone doc for the Ring vs mesh CPU arch. Then I follow the sizing 2:1. For the Socket and cores. I do 1 socket and x amout of cores. I have not went above 1 socket and 6 cores that I can remember. <@UM04QUUSJ> Might be able to give you a better idea. Or anyone that has some spot on formula lol.

i suck at calculating this stuff...i've gotten lucky so far.

does it really impact performance if i leave on 1 core per socket?  it sounds like that feature was created to assist with licensing.

<https://communities.vmware.com/t5/VMware-vSphere-Discussions/VM-Performance-and-CPU-Cores-per-Socket-and-Sockets/td-p/517243>

Just a question, not meant to be taken wrong.

Have you read about the Numa terminology by chance?

All this can be tricky and it plays a role in cpu cores and amount of ram.

<https://blogs.vmware.com/performance/2017/03/virtual-machine-vcpu-and-vnuma-rightsizing-rules-of-thumb.html>
Check out this. Al though it’s not citrix but give a breakdown on vmuma and cores /sockets.
Now intel updated the newer chips that use a mesh connection in the chip. It’s supposed to be more efficient in terms of Numa not so much being an issue. Now that’s my understanding of it and I could be wrong.

Now  I understand this may not be the case for RDSH/XA/XD machines. I would test out  1 socket and 6 cores.

Last time I looked into it on ESX there wasn't any performance difference anymore, but the controls are still there because some licensing is based on cores/sockets.

i never adjust sockets, just doesn't really make sense to me.  And i try to stick with NUMA sizes.  However, most modern hypervisors don't have an issue with adjusting cores or sockets.

zNUMA was pretty important at one point and a lot of architects took that into consideration when designing systems.  But, the impact that it had varied depending on the applications and how made use of multiple cores (think threads here and processor queue length.)

Although I haven't kept up with it recently the new processors are not supposed to be NUMA bound and that, of course, will change that consideration.

So, unfortuanately, <@UM2G5G8E5> there's not a one-size fits all answer.  A few factors you may have to consider (ie. applications running, processor family (architecture, etc.)

As the typical consulting answer... "IT depends"

Best advice.  TEST, TEST, TEST

or was that v and I am reading into it to much lol

I think he just meant NUMA he added the z for me :slightly_smiling_face:

NUMA used to matter more as there were memory boundaries but these days a NUMA node is always a single physical processor.  So for Citrix VDAs we like to align with the number of cores in the VDA being a divisor of the cores in the processor to make scheduling easier on the hypervisor.  so if you processor has 18 cores and your doing largish servers you might use 9 cores.  Luckily processors are susually more like 24 cores which gives more options like 2,4,6,8, or 12

Probably works as intended but maybe someone could confirm this behavior, if an user start his published desktop with Teams on iOS (unoptimized) and then roam the same session on his laptop, he has to restart Teams 2 to 3 times to get optimization back

<https://discussions.citrix.com/topic/414460-html-5-receiver-not-waiting-for-desktop-app-to-start-and-be-in-registered-state/>

I always just chalked that up to the html5 receiver being less fully featured compared to the client

This issue occurs both via cloud and on prem 1912

works fine with Chrome App. :thinking_face:

True but I think the chrome app while basically html5 based has features baked on top of it. I may be wrong there though... Just been my take on it

this is a major limitation :smile: you would think it would be documented

Oh for sure! I'm not saying this is what is going or if it's acceptable. Just saying what I've noticed

You can send an email to Citrix Education Support Team

Good Luck with that. I been trying to get their help for a week now.

Thanks i have just logged a call with them see what they say

I am trying to buy this course
CXD-251
Citrix Virtual Apps and Desktops Workloads on Microsoft Azure

so I take this CC-VAD-MA
They respond with we don't know why you can buy it yet. We are looking into it.

Sorry  John lol, it triggered me with Citrix Education lol

yeah thats the one i done its a bit old and outdated tbh but a cert is a cert

i got the all access elearning plan through work so get all the training

Actually I think its now CWS-251. I remember it popping up on the page saying this is the new course.

yeah could be one i did was cxd-251 with the cc-vad-ca cert

Indeed, the cxd is replaced with cws which finally has been updated with names and Azure specifications. 

Normally classroom support is quick and helpfull

I just need to get the cert before February and Citrix education is slow :)

Dont know how the normal way of getting eLearning is.

Or become a CCI and get all access eLearning;)

took about 4 days before my exam was available when I renewed it about a month ago. I pretty much sent them a mail everyday until it was fixed

Yes. Its painfully slow when compared to something like on prem VMWare.

You will also need to manage your older images yourself if you want to be able to rollback. Copy them somewhere. Not like on prem VMWare, where you can just keep previous snapshots you can revert to.

DISCLAIMER - Been a while since I did this, so may not still be true!

I think it’s fine. What kind of work loads?

w2k19, published desktop hosting financial apps

Yea that’s fine. As always test. But I don’t see it being an issue to be honest. I ram 8 FPS before for some long distance users and it was ok.

yes, thats what i advised the client.  Thanks Ray! i really appreciate your feedback.

I wonder if it was added back into the code when they released 2203 and the whole private cloud support model they took away and re-added? 

You could be correct. Looking at the doco for 2112, no cloud resources are listed:

...but they are back again in the the 2203 doco:

Looks like to use it I would need to swap my existing permanent licenses for subscription "Hybrid Rights" licenses.

Correct if you add hybrid rights you can leverage cloud locations with on prem controllers

Yea, they removed the access with the exception of gov accounts, and then added it back a couple releases later for everyone.. when it was removed, it took us about 4 months to find anyone who knew there was an exception for gov accounts.. good times..

You need hybrid rights licensing for cloud to show starting with 2203 

I can’t recall if 1912 MCS uses “on demand provisioning” - as in, when the machines are off in Citrix studio, do they exist in azure? Or are they created only when they are powered on? It’s been a long time I’m since I’ve done azure without Citrix Cloud in the mix - depending on the answer, you will have different options 

Yeah the Virtual Machine object is 'gone' and i think it takes the OS Disk with it.....the prov scheme is also lacking in details for the disk provisioning....Onprem is easier in this regard :slightly_smiling_face:

Or is the alternative to rebuild the catalog with a larger instance size that has the faster / larger disk offering?

yeah so with on-demand provisioning the OS disk is killed and recreated at the time of machine creation (based on the source). So you can't change this guy easily.

With the Citrix Cloud, you can make changes to the provisioning spec post catalog creation via PowerShell, and you can also flag to persist the OS disk so you can make changes that persist - but I don't believe either of these options are available for on-prem

Your best bet will be a new catalog with the larger disk I would think

Yeah i am starting to think the same......outside of a rebuild there arent many options - the only options in the prov process is the instance type and thats it...theres no disk reference in the scheme so that settles that then......... :slightly_smiling_face:

Yeah, bit different in cloud - hard to keep up with what has what. Won't take long to create a new catalog

Discussed with a customer - performance, performance, performance 

There’s a blog out there about performance testing in past. 

It was convo. Need to see if that went anywhere. Let me find link.

<https://medium.com/salesforce-architects/optimizing-lightning-performance-on-citrix-virtual-apps-and-desktops-850c8c965736|https://medium.com/salesforce-architects/optimizing-lightning-performance-on-citrix-virtual-apps-and-desktops-850c8c965736>

<https://developer.salesforce.com/blogs/2020/05/improving-lightning-performance-on-virtual-desktops|https://developer.salesforce.com/blogs/2020/05/improving-lightning-performance-on-virtual-desktops>

Citrix education sent me this they believe as long as i attend the CWS-415 course before the end of December 2022 my CCE-V will renew if though it expires on 20th December 2022 <https://www.citrix.com/blogs/2022/09/29/deadline-extended-to-upgrade-citrix-professional-certification/>

I can't recall if there's a policy in Edge to allow/disable extensions in other stores, but do you have the Google store path in the policy for that extension? That worked fine for us in Edge:

hdppkjifljbdpckfajcmlblbchhledln;<https://clients2.google.com/service/update2/crx>

Check ControlDefaultStateOfAllowExtensionFromOtherStoresSettingEnabled in the Policy reference: <https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#extensions|https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#extensions>



Yes Nick, we use this google setting, but stopped working

Thanks Martin, i will give a try tomorrow

 <https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#extensions|https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#extensions> regkey worked, but addon still doesn’t install automatically. Software\Policies\\Google\Chrome\ExtensionInstallForcelist
10
hdppkjifljbdpckfajcmlblbchhledln;<https://clients2.google.com/service/update2/crx|https://clients2.google.com/service/update2/crx>
 Is created by policy. Tried to manuelly install the addon, to exclude nothing gets blocked and it worked :man-shrugging:

I haven't seen any official group policy baseline from either Citrix nor  Microsoft for many years.

The last official group policy baseline I know of, is for Windows Server 2003/2008.

Yea, <@ULL6F7DRA> is right, The last time I seen this was 6.5

I have a GPO I used in my Session Host setups. It has been tested on 2012, 2016, 2019 and 2022.

However seeing that it is a baseline it's not the universal truth when it comes to group policy settings, you will have to know stuff about your own environment and applications and add whatever additional configuration needed.

I'll just do an export from my test-lab and add the files here.

Session Host Lockdown - TEMPLATE-22-11-22.zip

All settings touched, have comments with an explanation or a reason for why it is configured

Can I have a couple NVME drives while your at it LOL.

haha...I don't have NVME in my lab unfortunately

this client is pretty nit picky...they usually want documentation from citrix or microsoft to backup anything we implement.

some client are like that and some of my client are like "whatevet you think is best"