World of EUC

You could try this setting…should also work for PubApps.
<https://support.citrix.com/article/CTX221222/published-desktop-is-launched-in-background-of-local-applications|https://support.citrix.com/article/CTX221222/published-desktop-is-launched-in-background-of-local-applications>

just tried. did not work. There is a browser that is supposed to pop up during office registration and it does not.

Maybe you run into this one: <https://support.citrix.com/article/CTX267071/password-field-not-displayed-when-publishing-any-office-365-application-such-as-excel-or-word-on-server-2019-or-windows-10|https://support.citrix.com/article/CTX267071/password-field-not-displayed-when-publish[…]lication-such-as-excel-or-word-on-server-2019-or-windows-10>

I know <@ULC9J5XPB> does :slightly_smiling_face:

Yep, had all of that configured at my old place.

<https://support.citrix.com/article/CTX474990/hdx-microsoft-teams-optimization-crash-or-video-freeze-on-newer-intelbased-clients>
TAM just sent this over to us. Thought I'd share.

I know I can just use *| Select -Unique* to get around this, but I'm curious if there's a better way.

One for AG and one for direct. Select the AllowedConnections value and you should see the difference 

Let me clarify, because I think we're talking about different things...

image.png

I think AllowedConnections is the AccessPolicy

hrmm I am intrigued - what's your specific flow to get the duplicate results?

I think the reason is this: AllowedConnections               : ViaAG

there are two policies one for each method

This will grab the unique users:
```(Get-BrokerAccessPolicyRule -AdminAddress $Broker -DesktopGroupName $DG | Select -ExpandProperty IncludedUsers).Name | Select -Unique```

I found posts on Citrix's forum that all showed the same - that cmdlet has returned duplicate results for like 5+ years now, lol

Hi, has anyone had experience of VSAN policies with Citrix MCS?  I'm looking into how we can assign a different policies to basedisks, vs VM's on the same datastore.  Obviously they aren't VMs, but just VMDKs.

yess. Known Issue. just a sec, I'm looking for the KB

got it. <https://support.citrix.com/article/CTX473065/hdx-browser-content-redirection-broken-with-google-chrome-browser-version-105-or-higher|https://support.citrix.com/article/CTX473065/hdx-browser-content-redirection-broken-with-google-chrome-browser-version-105-or-higher>

sure thing. be aware that there's another issue with teams + intel driver right now: <https://support.citrix.com/article/CTX474990/hdx-microsoft-teams-optimization-crash-or-video-freeze-on-newer-intelbased-clients>

:+1:. The KB mentioning the Browser Content Redirection fixed it for two of our customers.

<@U01GWFT2BDJ> Is this the Teams fat client that is crashing, or the web client?

<@U015MJK0XBM> When I load up the Chrome GPO ADMX files, I do not see the setting for "Determined whether the Chrome Root store....".  Is there a trick to it?

have you updated your policies with the new Chrome package?

<@ULJM98FME> It is the fat client. Make sure to look under computer configuration

<@ULJM98FME>. make sure you have updated your Chrome ADMX Files. I've imported them into my NB and it's the following setting;

Yup!  That was it.  I was rocking some old ADMX files!

Did you perform an in-place upgrade or a fresh install?

Have had this issue as well in my environment.  Historically have always done uninstalls &gt;vda removal tool &gt; new installer for upgrades.    We only saw this start happening with 2203.  

When we’ve seen this in most cases rerunning that update process fixes it but for some it hasn’t.  No one’s made a big deal about it so we’ve not looked too deeply. 

The upgrade from Win10 to Win11 was an in-place upgrade. The VDA version haven't changed since the os update. I already tried to reinstall the VDA, running cleanup utility first but the issue still persists.

Can you test with a clean W11 image as well?

Sorry I completely forgot to share the test results... I was able to reproduce the same issue with a clean W11 image as well. Today I found the cause of this issue by reading the Citrix documentation, it seems to be a known issue which should get fixed with 2203 CU2.   <@UNBRPVD4G> thanks for your help!

OK, I will download that.  I thought maybe they were available separately.

They don't seem to be part of the ISO either.

ADMX for VDA? I am only aware of ADMX for UPM, WEM, FAS and CWA?

Well, what I am trying to do is update the List Of DDCs on the VDA

I know there is a GPO for that, but I cannot find the right ADMX

You need the GroupPolicyExtension for that or a GPP

Any chance you know where the Citrix GroupPolicyExtension can be downloaded from?

It is inside the ISO called CitrixGroupPolicyManagement_x64.msi

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/vda-registration.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/vda-registration.html>

You can also edit the list of DDCs on the VDA, then delay the Desktop service with BISF, so that when the keys update the service is not running. But GPO sounds faster if you use the GPO console for Citrix. I tend to stick with studio.

Happy Thanksgiving to you and Citrix Community members :)

Yes, I had the same error at a customer. I did the DBA stuff, disabling a couple of pagelocks on indexes in the chb_state_workers like the article mentions but this did not solve the error in the site check. The article notes "For smaller sites or light user load we won’t see any issues (except the site test failure)" and "if the site is large and/or under load then we might start".  It's so not us with 90 max concurrent users for that customer, so we decided to go ahead with the upgrade and worry about it when we actually see those problems mentioned. The upgrade went fine and we didn't have the problems mentioned in the article afterward. YMMV of course  :slightly_smiling_face: .

Hey Dale, take a look on this overview: <https://developer-docs.citrix.com/projects/monitor-service-odata-api/en/latest/Session_and_Application_usage.pdf>

You can use this powershell function to receive the data:
function Export-Odata {
    [CmdletBinding()]
    param(
        [string]$URI,
        $Params)

    $data = @()
    $NextLink = $URI
    write-host $URI
    write-host 'Fetching :'$URI.split('?')[0].split('/')[4] -ForegroundColor Yellow
    $APItimer.Restart()
    While ($Null -ne $NextLink) {
        $tmp = Invoke-WebRequest -Uri  $NextLink @Params | ConvertFrom-Json
        $tmp.Value | ForEach-Object { $data += $_ }
        $NextLink = $tmp.'@odata.NextLink'
    }
    [String]$seconds = "[" + ($APItimer.elapsed.seconds).ToString() + "sec]"
    write-host $seconds -ForegroundColor Red
    return $data

}

Let me know if you need anything else.

Sounds like a feature request for <@UR9T47CRM>

yeah i know...i work at something like this at the moment...

Something like the Custom folders feature in BIS-F where you can put your own Scripts and they get run automatically would be nice.

I try something like a folder to put your own exe and/or Msi. And neverred installed it with the standard parameter. Additional maybe put a txt file in it with the same name and there are the parameter to install. So if a txt file exist, use this parameter and not the standard parameter. 

But at the moment I work on the report mode :sweat_smile:

do a manual uprade and check if sqlcmd is enabled

i prefer manual uprades, especially on older versions

I had tried both the automatic site upgrade in studio and manual upgrade scripts in sqlcmd mode both failed with the same error. I managed to get hold of our DBA who had to remove some custom indexes which was causing a lock once he did that the script executed fine altho i had to restore the site DB and re run the script as it had partially updated the DB when it errored out the first time

Or collapsed drunk on the keyboard :beers:

i have a client who added zoom to the list but now Teams doesn't work

Not for teams. Unless it changed, and I am unaware.

they have a ticket open with citrix but they haven't been much help.

Create a test policy and disable the virtual channel security feature and apply it to a user or whoever you can test with. Then give teams a go. This way you can rule it out. Also look in the event logs on the vda.

Event log section
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/secure/virtual-channel-security.html>

Been on PTO for a week.  Forgot my brain.  I know everyone already recommends using VDA cleanup utility, then installing 2203.

There is a switch for removing AppDisk
/remove_appdisk_ack
Authorizes the VDA installer to uninstall the AppDisks VDA plug-in if it’s installed.

and a separate switch for Personal vDisk:
/remove_pvd_ack
Authorizes the VDA installer to uninstall Personal vDisk if it’s installed.

lol, i JUST saw this in the docs when you posted it.  Thank you!

You think they would put that in the CTX article.

Based on past experiences, my guess is that it will be released just before christmas

Hey, that has burned me in the past, so now I know better.

And it has happened so often that it should almost be expected. Bet you can't even guess the last version that didn't get a .1 or a re-release under the same build.

plot twist...Citrix releases 2212.1 on day 1

I don't see that fix in 2210.5 either... i have 2210, it's fucking annoying.

This is why I test shit, personally, before rolling it out to 15k systems. lol

I personally haven't experienced that issue myself

CWA 2210.5 is another feature release, the second of October hence the .5.
It's not because we pulled 2210

We introduced client app management
<https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/about.html#whats-new-in-22105|https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/about.html#whats-new-in-22105>

Is this only with VDA on 22H2 or with a particular endpoint?

I have not tested a new WSA on the client side

and it happened from same client/VDA only upon upgrading from 22H1 to 22H2.  Gathering more info.

Ah, did you perform an in place update with the VDA still installed?

Seems to be isolated to one desktop connecting to it, just still very odd.  did full cleanup/reinstall of VDA 2203... on WDS 2205, so it's not old...

Have a similar issue with Windows 10 Multisession 21H1 and VDA 2203. Try to run the cleanup now and upgrade to VDA 2203 CU2.

Any new features comes in VDA and that is dependent policy to enable and disable. For that u need to upgrade

maybe I've misphrased my question. I mean the functional level, which by default is on 7.9. VDA obviously is newer by far

Newer features that depend on the version 

I don't find anything in the release notes. The newest possible version of a Machine Catalog is 1811. It's clear that it should be on a newer vs. than 7.9 but It seems like this was mainly important at the time before 1811 (CR) or 1912 (LTSR).

one thing you have to careful about is if you have older VDA versions and you raise the functional level of the catalog/DG the older VDA's wont register

Is there anywhere a comparison around that shows which "feature" was introduced with which version related to the Catalog Version?

Citrix docs say only that when "new features" are introduced they may be bound to a specific version of the catalog. But nowhere is mentioned which features they mean.
I mean an "optimized Teams experience" is probably not related to a specific catalog version...

In autoscale for a delivery group theres an option to set "user Logoff Notifications".  If you select "send logoff reminders without logging off user" you can click that without adding anything in the "remind user" text field. If you dont enter anything there, what happens? Do users not get notified and not get logged off? do they get a generic notification?

I would say definitely, but this isn't just specific to Citrix, it's just good practice to segregate different parts of the infrastructure from each other and only allow well defined and necessary traffic flows in between.

Specific to VDAs in most cases users will be the vector for malicious actors to enter the infra, so I always try to maximize segregation of user facing infra.  That includes separate vlans, all outbound traffic going through ips/ids/network firewalls, all inbound traffic restricted by client firewalls, and where possible blocking all intra-vlan traffic so one compromised host can't communicate with any others

You are reading it right.  But the setting is for server and the description highlighted is for vdi. 

It says use server time zone. Not service..

It says: Use server timezone NOT *service*

It's a bit confusing.  I have some users that are on win10 vda, that need the the backend time zone. I thought by reading it "use service time zone" it would.

But it doesn’t say use service time zone….

So, if users are coming in to a VDA in a CST time zone, and they are in EST. The VDA sets it to EST. How do you go about forcing it to to CST?

You may have other policies taking precedence. What happens if you uncheck the default and select use server?

Try to set the Policy „Use local time of client“ to „time zone of the user session“ (server time zone) 

And enable the Allow time zone redirection setting in the GPO (User Configuration &gt; Administrative Templates &gt; Windows Components &gt; Remote Desktop Services &gt; Remote Desktop Session Host &gt; Device and Resource Redirection)

Does that GPO apply in RDSH only? The way it reads I mean. If I set the use local time of client, would it use the time zone they are coming in as  from the local device? For these Windows 10 device, they want them to match the CST time which is where there DC is located.

Well, use server time seem to do the trick. But what does not make sense. It's the same as the Default option lol.

Even though it's not a server. Just throws me off

You highlighted the default in the picture and it is „Use Client Time“ for XenDesktop aka Single Session VDA. But you are right it makes no sense.

Hopefully you can understand the screenshot

Thanks for the tips Guys. Meant to say that

<@ULLAD12P2> and i talk a little bit about it here: <https://worldofeuc.slack.com/archives/CKJADBQM6/p1659633290682279?thread_ts=1659464348.829229&amp;cid=CKJADBQM6>

not sure if it helps, all seemed pretty strange in the testing

It’s broken in the latest versions from what I can tell, you need that reg key to tell it to process policy

Hmmm thanks for sharing that. Yea it’s acting odd for sure. They way I understand it or the way it used to be is you use server time zone for single session vda aka win 10 was if use server time zone it would use the time zone from the source or the datacenter they hit. So for example if the VDA are in a CST time zone the sessions would have CST. If Use client time zone was use the local client time zone where the client os located, the VDA would switch the time zone to the location they are at such as EST or MST. This is in 2203 CU1 as well. What I don’t understand is the use default setting (use server time zone) which is the same setting as the use server time zone option in the drop down. If I set the default it uses the local client time zone. If I set it to use server time zone it seemed to work. Now that was only tested with one login. Chances are the client will hit me up today and say it’s not working again. Based on Mikes results. I read the older post and seems like you guys removed users from the GPO and it uses server times zone but then stopped working again. I’m wondering if this is a bug in 2203cu1 as well? 

I thought 2203 worked but we had a hell of a time with this and I changed jobs before I saw it fully resolved. The reg key to process policy was supposed to fix it though.

we started out on 2203 and had it working, but not CU1

Hi Ryan, where did you get these setting from...are these recommendations from MS or Citrix?  if so, can you send them to me.  I am working on an optimization project now.   I never set these settings, so i want to review some articles and document it to cover my a$$..

These aren't from any documentation.  These were set by me after having a ton of issues with Search/FSLogix/Server2019 (Before they "Fixed" everything)

btw, just saw you client time zone post...i was working on the same issue yesterday

i had to configure a GP to get it to work

yes, you should be loading the drivers into the master image when not doing UPD/UPS

ok, I was 90% positive. Just wanted to double check and make sure I was not off. I got the typical "we did not have to do that for RDSH" hah

+1 on putting the drivers on the image w/ rundll32 PrintUi.dll,PrintUIEntry /s

Perhaps I am missing something, I was under the impression that UPD would only apply if Auto redirection of printers are coming over from the client, or if UPS is used. Can you force it to use UPD if a user actually opens up File Explorer and mapps the printer via \\printerserver\Printer?

No, you cannot.  You are correct in your impression.

Clients lol. They can be challenging at times :slightly_smiling_face:

It's really around when the Citrix API hooks latch to the exe and the process floors the CPU and the application doesn't work. By added the disable part it does hook into the app, there for allow it to work as it would in a non Citrix setup for example.

troubleshooting that leads to this usually is, "App or App behavior works when I RDP but can't launch from Citrix" or "App looks funny/cant be resized/only gives a black screen in specific windows in Citrix"

Yea Jon is spot on. I was trying to explain this. But found the link where <@UKJTJD4KA> explained a scenario. If you do this, Don't do it via GPO. I learned the hard way  many years ago.
<https://support.citrix.com/article/CTX321177/grey-screen-issue-after-changes-were-made-under-ctxuvi-and-ctxhook>
<https://jkindon.com/deploying-brave-and-microsoft-edge-dev-browsers-in-citrix-cvad-environments/>

often see that or protocol handlers, receiver:// workspace://, broken on major chrome/edge updates on WFH/BYO machines.

ohhh... did not think of that. how do you fix?

if it's their own machine, i ask them to reinstall workspace app

i wish i had tools that could manage BYO devices.  actually that almost falls under, "be careful what you wish for" doesn't it ;D

looks like this is not browser issue in my case. they have been fixing it with reset of windows profile so far

you have a case open and they won't give you the private hotfix?

i've been trying but haven't gotten a response since the first initial email

if you call in and get a warm body they should be able to.  Email doesn't always work well.

our error codes are different everytime it crashes (and not the specific one called our in that article) but definitely started w/ that 2203 cu1 agent so hoping its the same thing

it appears i dont have much luck w/ the warm body approach either :slightly_smiling_face: they wont provide me the fix until i send them a full memory dump to analyze first

yup they won't even discuss the possibility of giving us that hotfix until i gather that full memory dump, upload and give them some time to analyze

I was thinking the same thing <@ULJMUV893> said. Tell them to give it to you to test atleast. Geez

Call and tell them you are about to have a stroke and you need it now haha- not really

i tried everything i could on the call .....including telling them i have a very easy way to test it but they wont help....keep saying it would need to be escalated so i said please do that and they said nope, they dont want to risk our environment w/out analyzing first. i totally get that but like you said i can do a quick and simple isolated test and also wait for their analysis before pushing out to production

I love Citrix, but support is like a maze at times. you learn how to navigate it. But it's not just Citrix now a days. From my experience the best support is CU and Nutanix. hands down

yup i agree there......CU and Nutanix are usually rock solid.  Citrix has been nothing but a hassle the past couple of years for us.  its a running joke if i have to open a ticket, its gonna be a good 2-3 weeks of jumping through hoops before we even get someone that is useful

They are probably protecting themselves in case of a CYA.

From what I hear, they are going to get them in line lol.

the funny thing is they said if i upgrade from LTSR to CU the fix is in there and i wont have the issue......soooo why the hesitancy giving me the private fix to test then  since we cant go off ltsr

it was pretty clear the tech was going off the script and whomever he was checking with wasn't budging

Yea, probably them doing CYA. Hopefully they get it sent to Escalation and they are usually so much better.

I try to put myself in their shoes and think of what they have to follow.

they would not send to escalation when i asked.  they said they won't do anything w/ the case until i provide a full 8gb memory dump

oh ya i'm with ya there......i know the tech was just doing what he could.  did not appreciate it not being able to escalate though.  nutanix they even encourage it and give you the option on the user end

There is a button in support case side (in the portal) on the Citrix side and say escalation or grab managers attention

oh is there? damn i missed that! i'll definitely try that. thanks man

But the next problem is.... I bet alot of folks do that for non issues. Just to get faster support.

and most likely all its going to do is get them to bombard me w/ phone calls more often and still not do anything different i'm afraid

i've used it when i have to pivot to 'dude, i'm telling the first guy that picked up the ticket how it works...'

We have it, was pretty random, deployed on production this week, no BSOD so far

So far today my tester has crashed 3 times and each time it's a different crash code but started immediately after the vda upgrade and never before. I'm afraid they are going to look at the crash dump, not see that specific sys file called out in the kb and still not help

Rat farts.  is it worth trying to downgrade or upgrade to the suggested VDA? if not, maybe DM  <@ULNFS3KF0> and see if he can get the hotfix?

I was going to try the downgrade actually to test so good call there. Thanks for the reference...I may reach out to him!

go for 2209. you have to turn on testsigning mode which leaves a watermark for the users. and I'm not sure how stable the fix is as we got 2 different versions

<@U015MJK0XBM> Ask for the safe version of this fix, support send me one without this requirement

I'd imagine the fix is just a replacement dll or sys file maybe? I'm hoping my issue isn't something different side I'm getting different blue screen codes each time

We preferred to upgrade to 2209 and revert to 2203 CU2 when it's released. no ETA for CU2 when I asked the last time. 

Are you using the 2209 VDA with 2203 CU1 controllers?

yes. not supported but sometimes you have to make things work. 

So it's supported to have an older vda than your controllers but not newer?

one version behind is allowed if i recall correctly but you cannot mix CR and LTSR.

Same problem here. We also updated the VDA to 2209 while the environment is still running on 2203 CU1. We hope that this will make our environment more stable, because we have many BSOD every week.

Please be aware of the following known issue on 2209: <https://support.citrix.com/article/CTX472865/cvad-version-2206-2209-gpss-fail-to-apply>

I'm not teasing you but I got the private fix, they also wanted a full dump memory, I replied something back about the fast it impacts production and it's tricky to get a full one with PVS.

I said more or less the same thing and still just waiting on them analyzing the memory dump for the past couple of days . I assume it was after they did that for you they then sent it?

No they sent it without me providing the memory dump.

Not sure if it's still a thing... but there used to be a "politically hot" escalation form.  I wouldn't be surprised if it has been retitled/reworded.

You have to state that the bsods are impacting your users day to day ops so much (and you're getting pressure from leadership) that you need the Hotfix before you can repro on demand/create a dump.

good to keep that magic trick in your back pocket when needed!

<@U011KNA2PRT> could share it with <@URVNXB96C> :slightly_smiling_face:

Indeed and maybe that's what I already did ;)

Support is claiming my issue is an issue with Windows defender and I should disable part of it or contact Microsoft... And also can they not archive the case.....umm nope! The issue only presented itself after the 2203 cu1 agent install (fresh install after using the vda cleanup utility first) and on multiple unique images. As soon as we uninstall that and put 1912 back on we're stable again

Now you can try a vda with CU2. Wack defender for testing and if it happens, then get on the horn with support again unless cu2 fixes it 

nice!  did not know cu2 was coming that quick! good timing!

well no luck w/ CU2 unfortunately.....i've crashed 2 times this morning already so need to upload another crash file to them . but at least it gets me ahead of the curve for when they will probably ask me to update and test.  funny enough the blue screens have a different crash reason every single time......but on the 2 desktops that we've been testing they've been rock solid for 2 years until this update and if i remove it and go back to 1912 its solid again

interesting.....i found this as a known issue in the original 2203 release notes . i'm pretty sure everytime we run into it , its when using Edge in some way (not entirely reproducable). but i cant find reference if it was fixed.

actually that is listed as a FIXED issue .....it would appear thats not the case :slightly_smiling_face:

well Citrix is digging their heels in saying its not their issue and I have to contact Microsoft....even though every crash has a different offending file w/ the blue screen, most of the time something Microsoft and one time it was even our Nutanix network driver (all of which have been in place and rock solid until the 2203 VDA update (and again revert from 2203 to 1912 and everything is stable again).

<@URVNXB96C> Did you have any luck with your case? We have also deployed 2203 CU2, BSOD are happening less frequently but are still there.

So how it was left was the Microsoft ticket/analysis SEEMED to find the picadd.sys from Citrix as the offending file for at least one of my crash files that i submitted .  I sent that info over to Citrix and still waiting to hear back.  On the Citrix end they told me that they won't even try to involve engineering until Microsoft and Microsoft alone can prove it was caused by a Citrix component unfortunately so its taken quite a bit of extra work.    Hoping this gets the ball rolling!   I believe <@ULC9J5XPB> is also dealing w/ a similar issue and has similar tickets open so hopefully between the 3 of us we can get this one figured out (assuming all 3 of us are dealing w/ the same bug of course)

Thanks Andrew. Also not sure if all of us are dealing with the same bug.
These are the latest BSOD:

hard to say w/out a detailed analysis i guess but I know I've gotten similar ones w/ kernel crashes (each one seems to call out a different reason at least with my more basic tools)

Man, I have seen the same exact BSODs here with 2203 CU2.

That's from BluescreenView: <https://www.nirsoft.net/utils/blue_screen_view.html>

yup i've moved to that as well....pretty powerful and simple

I also tried those tools but none of them gave any helpful information.

unless you ask Citrix and in that case it wont help :slightly_smiling_face:

I have tickets open with MS and Citrix, and have provided my crash dumps.

My crashes all seem to be triggered when I join a Webex, or in the middle of one. But I also think there's something going on with the virtual channel. It usually fails and closes at some point, where my Webex is unoptimized.

for us we've seen it when working w/ Chrome or Edge i believe (working w/ a console such as Vmware or Nutanix) but haven't pinned it down as much as Nick.  Pretty random for us (but frequent enough)

But that could be any app, not just Edge at this point.

true so i guess that goes along w/ what we've seen.  At any rate , Citrix claim that "we are the only customer that has reported this" doesn't sound like it holds up :slightly_smiling_face:

"you know what i've been telling you for weeks, Nick would like to add the same sentiment"

<https://www.youtube.com/watch?v=1lRIQGU2RRk>

We archived our case with Citrix after CU2 came out. Citrix was asking to provide a full memory dump but we have physical servers (HP Moonshot) with 128 GB RAM and we don't have the neccessary free disk space for that.

We have automatic memory dumps in our VDAs. Pretty sure that's enforced via policy, too, so it'd be a pain to change.

all good! sounds like we've submitted plenty for that!

Hi guys, i recently upgraded my client infra on CVAD 2203 CU1 (Full OS 2016 / Provisioning 2203 CU1 and Ivanti Workspace Control 10.10)
When i try to launch any published app, Workspace App start to launch, blink in task bar and ... nothing
In eventvwr I've an MetaFrameEvents id 1480 event :
"_Failed to launch application Explorateur CT_1092 with command line '"C:\Program Files (x86)\Ivanti\Workspace Control\pwrgate.exe" 1092 ' on client 'xxx' for domain/user 'domain/username' in session '6'.   Ensure that the application is installed and that the user has permission to launch it._"
Same with app published without Ivanti. Try to upgrade my VDA on 2209 CR and same result.
Thanks for your help i you already see that issue !

don't join the Masterimage and exclude the OU from AAD Sync. It's enough then to enable "Join Azure AD" in the BISF GPO for the VDA's.

Rendezvous is automatically secure because the connection is out to the gateway service. 