World of EUC

image.png

This all depends. Mcs or pvs? Citrix optimizer, Bisf, pooled or static?.

I have not seen that error, but I can find this on the Citrix support site:
<https://support.citrix.com/article/CTX207868>

Upgrading StoreFront is unfortunately a lottery, it either works or it doesn't

Thanks <@ULL6F7DRA> already checked and test it... unfortunatly did not help... 

VMware? Maybe you run into the following issue? --&gt;  "On Virtual Machine's (hosted on vSphere) with VMWare tools (10.3.2.x or above) installed, a failure may be seen with standalone installation of Storefront or while upgrading Storefront part of Virtual Apps and Desktops 7 1906 OR 1909. An error ‘An error occurred with the operation for Storefront’ may be seen.
[WSP-4895]

AH yes, the "vmware bug"I should have remembered that :slightly_smiling_face:

VMware...  hmmm... thanks <@ULJUX26GG>  need to check, but then i then should i had on test as well.. but nothing:smirk:  everthinh looks the same

Failure may be seen -&gt; Sounds like lottery

From my experience: Dont lose too much time try fixing a broken StoreFront group. It is faster to do a rebuild. Of course it depends if you are using a lot of PA and need to migrate subscriptions etc.

Agree with <@ULJUX26GG> I more than often find my self installing new StoreFront servers, rather than upgrading existing servers. There has been way too many errors with StoreFront upgrades

It looks like:see_no_evil: angry!!!! But thanks guys... will see...  

<@UPF2NEW13> what was the initial version?

Hi <@ULMBQFUQN>  it was 7.15 CU5.

I got it, believe it or not, it was shitty typo within the web.config from a store .. line xxxxxx it was ture instead of true !!!
No clue how, nevere touched.. at least not this time. 
So strange, from CU4&gt;CU5 worked then from CU5&gt;1912 failed!!!!! Because of this

Thanks so much guys, for that fast reaction:pray::pray::pray:...

I have found that I need to manually stop the Citrix Telemetry Service many times for the update to complete.  It is a bit of a game as it has to be running for the installer to start.  I usually try to time it for when the StoreFront serverices are removed.

For the last 2 upgrades I started by shutting down VM, snapshot, start &amp; run upgrade. Works every time, even during production for various customers :-)

Thanks <@ULJ3D468M>  for you input. After some issue also  with an SQL DB move to AOC, we are now life  on 1912 LTSR runs now with roughly 1000 session..  all good so far .. :+1: as i always like to say, we never stop learing an we never should stop.

Hi <@ULL56GQG0> no, never used or even heard about this tool

I read few blogs, White Papers from Citrix, they are recommending to use Office 365 E3 License when planning for CVAD user's.
What if the customer is having Office 365 Business Essentials License.

A Very Important Patch Tuesday &gt; National Security Agency | Central Security Service &gt; Article View
<https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/2056772/a-very-important-patch-tuesday/>

Yes. I can plug in a couple of different Plantronics headsets. They show as Optimised, Policy Restricted. Is that a clue?

So By default Citrix will pass them through and try to optimize it. But it appear based on policy restricted you have something disabling it?

You need to enable the USB policy it sounds like.

<https://support.citrix.com/article/CTX203592>

Also check this <https://support.citrix.com/article/CTX234916>

The USB deal in Citrix can be confusing. At times it gets me confused. But once you figure it out, its really simple

The registry settings are the same as we have in our win7 environment where I’m able to change the default playback device. Makes me think it’s a Server2016 thing.

Its apart of the 1912 VDA and CWA now. Just install the Citrix Verions of Teams ( if using teams) and enable the Policy.

Okay. I was going through the Tech Zone article on AV exclusions, since I wanted to make sure I was up to date in preparation for 1912, and there are a few HDX-related directories that I didn't think should be there. At the very least, they should be noted as pre-1912, IMO.

Source: <https://docs.citrix.com/en-us/tech-zone/build/tech-papers/antivirus-best-practices.html>

<@ULGKFDUVD> maybe he can update the to reflect in time?

Thanks, I'll definitely look into it after Summit :+1:

Heya! So seems that's the case for Teams optimization, not for HDX RTOP

Yep, talked to PM few minutes ago (CC <@U01067Q2QUV> :arrow_up: )

I see Teams (HdxTeams.exe) as part of my CWA, but not RTOP

At this point, the RTOP is really only necessary for Skype, no?

Throwing <@U01067Q2QUV> to lions (he just joined few minutes ago) to answer that :smile:

fresh meat
Posted using /giphy | GIF by <https://giphy.com/kimsconvenience/|Kim's Convenience>

Hey guys. Yes, RTOP still requires separate installations on both VDA side (connector) and client side (media engine). RTOP is just for Skype for Business optimization.

In the case of Teams Optimization, that is a completely separate solution. The client side component is bundled with CWA and the VDA side component is bundled with the VDA

I'll just use this as an excuse to move on from Skype.

...not that I haven't been looking to do that anyway.

<https://www.go-euc.com/citrix-virtual-apps-and-desktops-1912-long-term-servicing-release/>

I have integrated it into the base image script framework, check out <Https://eucweb.com|Https://eucweb.com> 

Please grab the content from my github developer branch, and copy it over the 7.1912.0 installation. Patch 7.1912.1 will be available next week 

Thats basically it. You turn off the VMs, restore the DBs and then rollback to the snapshots and you are good to go for powering them on

This is why you should (ideally) test recovery where possible, same way you should always test failover (and failback)

Thanks, and yep, this is why I'm asking. Definitely plan on testing this in our QA environment just to see how it all goes. In Production, we have two separate Sites, so something bombing on one of them wouldn't entirely cripple us.

I don't suppose there's an actual order for restore? DB first, obviously, and the Controllers next?

Restore with live DDCs is significantly easier than restore without DDCs.

Most typical problems that I've seen in the past is related to restoring trust / connectivity to all FMA services back to the central configuration service. I would typically recommend to NOT do copy &amp; paste from articles / blogs, but instead use 'Get-Command' first to check which services are used in your environment.

Johnny Ma is correct. I done it twice now. Shutdown VM, Restore DB, Revert snapshot, Power on DDC's. Your good!

There used to be an education course CXD-302 that covered DB recovery (both with and without DDCs), but unfortunately I don't think it's available anymore

Feel free to post the course documentation here if it's no longer offered... :wink:

Not sure If this is the right channel, please move.  Using UPL works great without an existing UPM profile. I get a lot of os freezing and end tasks. 

Get started with the new Microsoft Edge browser in CVAD
<http://virtualwarlock.net/microsoft-edge-in-citrix/>

Some apps prevent “idle time”, even if the user is idle

seeing the same results with no apps running.

I've used this in the past for one-to-one VDIs which are essentially Console sessions so the idle timer never increments <https://gallery.technet.microsoft.com/SetIdleTimeToLock-Lock-e34a4207/view/Discussions>

A client logged a ticket with Citrix about this, was apparently fixed in 1912

<@ULNLQFMB8> So this is a Director bug? or does 1912 fix a logoff issue?

So for the first release, this still applies <http://virtualwarlock.net/microsoft-edge-in-citrix/>

and the Next verison based on your screen shot, I assume we should not need the API hooks?

<@ULLH5JGFR> Does Microsoft Edge needs any KB to be installed on Server-OS before installation?

in WS2016 and WS2012R2 I faced issues in first launch

I know if u add the hooks it will work. Api hooks

I wish windows 10 multy session was on prem. That would solve all our server application compatibility issues.

<http://virtualwarlock.net/microsoft-edge-in-citrix/|http://virtualwarlock.net/microsoft-edge-in-citrix/> its here bud

You have to update the SSL thumbprint if it is an internally issued cert.  I have a document on how to do it.  Just had it happen earlier this week

CTX has an internal only document.  I 'asked' them to make it public

<https://discussions.citrix.com/topic/375659-cannont-connect-to-vcenter-server-due-to-a-certificate-error/>

about half way down has the information that Benjamin sent and it also specifies the thumbprint of the cert has to be in all CAPS

now to fix PVS. Have 1 remaining image on there

This happened to us before - Tier 1 support had no clue, finally got it escalated to "on call" support, and he had a script he ran and fixed it in 10 minutes after battling with frontline support for 5 hours.

we decided not to fix PVS as the one remaining image on it won't have any additional VMs added to it.  If something breaks, then we'll figure something out at that time.  Just decided it wasn't worth the time to look at it.

The stupid app ties to the machine name. Which then tieds to a mainframe id instance. If the user has the id of the app tied to a machine name. The ID from the mainframe doesn't understand different domain machines registration. Therefore it thinks the app is in use. App is called atlas, its a financial app

I can do static desktops. Juat have to calculate the storage and IO for the amount of luns needed.

Its a pain, but this app is the money maker. So im at their will

What is it though that makes the app not work. Do you know?

500 users, the app thinks its already in uses if..... The user is not on the same machine, the app does a machine check with the user name if both match the id on thr mainframe is ok. That's all i know for now. Its windows 10

Im doing a pilot with this group. To move them off physical computers

Do you know how it looks up the machine name? Is it a regkey, file or WMI type lookup?

Or look the software on a environment variable 

Server might yea... Didn't think of that. Doh. Not 100% on what key it's looking for. Ill find out.

Yes. Ok i need to do more digging to understand it more. Thanks for thr help. Once i get that ill let u guys know

If it's registry / file related you could use FSLogix redirection to point that file/regkey to another value. The software won't know. You can set all users to a single machine. That's a real pain though mate. Alternatively, maybe package it so that all machines have the same value. Depends how it looks it up though. Procmon will definitely help.

Ok so its machine related. So one machine tied to a miser ID (miser) being a mainframe ID. One machine per id. No multiple machine to one ID. Its a pain app. Users cant have shared machines because the app wont allow it in the mainframe id. So I guess its staic desktop with mcs. Kinda sucks but better than physical.

Okay, so it's a mapping between the machine name and a user id? So.... How does the client software query the machine to get the machine name??

Its frustrating. Trying to get a vendor to explain it to me. They seem like they dont know. Im still twisting their arm to try to get as much details.

lol the classic. Software is so old that those who know it are retired.

Whats worse is its web base. So the application server is queries the mainframe somehow. That's what im trying figure out. Yea old technology. That has a face lift. So irritating.

Im trying to deploy xendesktop to local bank branches, but they keep wanting to buy 2000$ machine for basic users. So im trying to show them the value of Citrix xendesktop fir that user case.

They buy all the citrix software and use it. But not efficient, that's where i come in to close that gap. But its really hard to change old school thinking

I need to go back to just doing citrix inky and help companies who want it and see the value in it.

U guys consultant or work for a company? Just curious how you deal with companies that dont want to change

I am a consultant and therefore it is my daily struggle.

Ahh so u deal with it as well. I dont understand why companies look to do Cisco vpn instead of virtual desktops. Its a struggle with them. Citrix cvad is way better.

classic is also manual installation of servers for a few users, as if it were a local client. no use of mcs or pvs. just hide the old thinking a little with citrix. 

I had a user show me and said see how fast my docs ooen and start meue opens. I said yea because the devices are physically here. Try to copy a file back and forth. Super slow. Then i demonstrated a vdi desktop and showed them its just as fast if not faster. Copying data was instant. I explained to them u will still have delays where VPN will not actually show you, where citrix will. Lol

Image from iOS.jpg

Check this - <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/multimedia/opt-ms-teams.html>

&gt; *Optimization for Microsoft Teams requires a minimum of Microsoft Teams version 1.2.00.31357.*


Thanks very much  <@ULCBDDJCR>, Actually i follow exactly those docu. I was hoping that there is something like the old RTOP a state within the systemtray „optimized or unoptimized)

Sounds like the applications have created shortcuts in the Public Desktop?

No, shortcuts are created by Citrix Workspace App after SSO is complete. So it is not public desktop as the shortcuts are user specific. 

Experience was good :+1: - Graphic Workstation through Remote PC

Yeah, same.  When it's good it's good. However, when it goes bad and the VDA has to be reinstalled or drivers updated it can be a bit heavy to manage.

Last 2Years, deployed for a customer. No issues reported

We use it internally, mostly successfully.

I have a couple of customers use it, for both graphics workstations and regular desktops, works well.

I also wanted to know about that experience. Good to know. Definitely better than vpn

the best feedback of any technology i get to put in is Remote PC based engagements - simplest form of a win you can get is to put it in - just be wary of the licencing impact. Dev's and Power users absolutely love it based on my experience :slightly_smiling_face:

How does everyone manage the access? I assume you automate the install but how about the user access? I assume your not having a one-to-one ratio. What do you do when people leave?

Remote PC auto assigns the first user that logs onto the box as the primary owner of that machine (and handles the assignment process the whole way through). I've got customers that may need multiple access (job share, or shared power users on beast machines etc) and they simply add additional users to the assignment, and make them manage their own schedules for usage - when people leave, they reassign the machine to the new user

We limit assignment to the first person who logs in by implementing this following
<https://www.carlstalhood.com/remote-pc/#multipleusers>
I believe without that, anyone who logs into the endpoint will be assigned and see the RemotePC in Workspace app

oh interesting - i was always under the impression it was hard locked to the first user - weirdly that's how it had been functioning for a while at least.....good to know :slightly_smiling_face:

Well I guess Citrix cloud users are out of luck. Maybe a support ticket to turn it on 

There are tables that list the controllers in the site so what you are saying will stop it from interacting with the database, but it won't clean it out of the database

Ahh ok. I need to find that table. Ill search for that. Thx.

Looks promising 
<http://citxen.co.uk/2017/02/02/removing-problematic-delivery-controller/|http://citxen.co.uk/2017/02/02/removing-problematic-delivery-controller/>

Wouldn't hurt to run it past CTX support.  Simply because I don't know how it ties some of the service instances to the controller

Yea, makes sense. Ill do that to be safe. Thanks man

If removing the DDC from studio/powershell fails there is a DDC evict powershell script from citrix you can run which generates a file that you run on sql to tidy up the database done it loads of times

<https://support.citrix.com/article/CTX139505>

That article states if its remove from ad first.

I found the problem. Now the Default.ica used by Workspace App is located C:\Program Files\Citrix\Receiver StoreFront\Features\DazzleResources\template\App_Data

always good seeing the data. thanks for your ongoing efforts!

You mean testing, like, just to see if the webcam is seen?  I've been using webcamoid-portable.

are you using WEM - there’s the fast logoff setting 

No, not WEM, but Liquidware ProfileUnity but they’ve said it’s not them controlling that behaviour..

I’ve been advised that the Citrix vda overlooks the gpo that’s set to show logoff scripts so I’m guessing this is back to Citrix to investigate!

you dont use controlup by chance, do you?  i've used that to monitor a session that does this to see what processes are stuck.  i know you're more wanting it to keep showing what is stuck before it disconnects but if you wanted to see what its doing you could open a console window on your hypervisor for the vm then after you log off the ICA session watch that console and it should show you where its stuck

sure sounds like Fast Logoff. Quite a few vendors had that setting

This is interesting. My W10 1809 VDAs on 7.15 LTSR CU2 logoff quickly (Fast Logoff is disabled in WEM), but on my new 1912 LTSR VDAs, logging off is slow, where the user sees the logoff screen for a solid 5-6 seconds.

Odd right! For our logoffs, we want to deliberately provide an informative status otherwise when the session disconnects, users just assume they can go ahead and launch a new desktop, but in reality the profile sync may still he happening or dropping disks. If they logon again too quickly, the last session may still have a disk locked or a profile sync in progress so it affects the success of their next logon. Checked the following : HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableStatusMessages which would normally ensure messages aren’t shown, but that’s not set! I’ve reviewed the VMware UEM forums and found that the splash screens on logon and logoff also don’t work so it seems to be a common issue from Windows 8 onwards regardless of brokering platform. Citrix or VMware.. 

I enabled Fast Logoff in QA, and now it hangs at logoff for up to 20 seconds. Good start to Friday.

More digging suggests that logoff progess visibility broke when the shutdown process was changed in 1703 (Windows 10)

The logoff process has been consistent for us in 1709 and 1809 on 7.15 LTSR. 1912 is where I'm seeing a change, unfortunately.

Ok, sounds like we have different challenges! We’re still only on 1906 VDAz

Well, maybe... 1906 and 1912 are much more similar, IMO. I'm pretty sure that 1912's development started with the 1906 source.

My issue may actually be FSLogix. If I disable Profile containers, logoff is 2-3 seconds max. Down the rabbit hole I go...

Let me double check, just to make sure I am not shooting my foot off.

Recordings look like this :disappointed: Strange

As much as I dont want to, might have to log a case. I am weak at this product line.

Can u share the screenshot from this key HKLM\SOFTWARE\Citrix\Ica\Thinwire\

<https://support.citrix.com/article/CTX214009>

Its missing, but not sure if that CTX article applies. But I can try it.

Yes it doesnt applied here....I was looking for the same article

After moving to VDA 1912, I didn't see any such error for MSRA from Director

well damn haha  so we are a 7.15.2000 back end setup, updating to 1912 vda to start (prepping to go to 1912 for the back soon) and app layering environment.  I just redid my platform layer w/ ONLY the VDA install and still getting this error and also get this pop up with it  too

we're all fixed up with this.  we had to do the following in our image

i am able to open remote assistance seperately fine but its just when it initiates from Director that we see the issue

<https://support.citrix.com/article/CTX131239|https://support.citrix.com/article/CTX131239> unless you’d write your own provisioning plugin for CS/KVM I don’t think you can run MCS on top

(Nutanix’ AHV came from KVM and Nutanix had to write a plugin with the Citrix provisioning SDK)

Thanks <@ULJH9ED53>! Same applies to OpenStack, correct?

I don't understand why our own tools we write with Powershell can return queries, execute tasks etc so much faster than Studio

There have been some under the hood focus for some changes that haven’t been released yet.  I was hoping to see it in 1912 so I share your disappointment.

Have you seen the baseline GPOs from MS? There are Defender GPOs that may help. <https://www.microsoft.com/en-us/download/details.aspx?id=55319|https://www.microsoft.com/en-us/download/details.aspx?id=55319>

One of my customers does, using recommended settings for VDI - we also have a scheduled task to download defs and a machine startup task to install the updates at startup.

Yes we use it... will check it a soon i am back in the office, keep you post it

Thanks David, will Check the GPOs from MS. 

<@ULNLQFMB8> : Is there a documentation about recommended settings for VDI?

<@UPF2NEW13> : Thanks, can‘t wait to take a look at your settings :ok_hand::skin-tone-3:

<@ULCBD9AJD> I used this MS article plus the usual Citrix best practice guide on TechZone.  We are downloading the defs to a network share using a script (A Windows port of wget or similar I think - I need to take another look at the environment to refresh my memory) and then a machine startup script to install those defs silently. <https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus>

Hi <@ULCBD9AJD>, my apologies, I thought we use some default setting over GPO, but in reality we only activate windows defender over GPO but the whole management goes over SCCM. Sorry for the misleading statement.

Also, it's good to note that Citrix Optimizer  get rid of the scheduled tasks for Windows Defender. We are currently in the process of migrating 2000 users from Win7 to Win10 and our Windows Server 2019 file clusters got super slow yesterday. It was caused by Windows Defender being unoptimized. It's critical that Defender is optimized adequately otherwise it will kill you're storage performance. Also the latest Windows 2019 updates (Jan 23) resolved some important performance issue with ReFS. I suggest you patch asap.

Also we found out that Windows 10 automatic maintenance reenabled the Defender scheduled scans....so we got rid of it as well. I don't think automatic maintenance is a good idea on non-persistent images.
<https://winaero.com/blog/how-to-disable-automatic-maintenance-in-windows-10/>

Thanks Jonathan for your detailed Infos and experiences! Will doing some tests in the near future. 