World of EUC

I think this link will solved your problem
<https://dennisspan.com/solving-keyboard-layout-issues-in-an-ica-or-rdp-session/|https://dennisspan.com/solving-keyboard-layout-issues-in-an-ica-or-rdp-session/>

This registry helps me in the past
First of all, IgnoreRemoteKeyboardLayout is a registry value that you set on the Citrix worker (the VDA):

Key: HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout
Name: IgnoreRemoteKeyboardLayout
Value: 1
Type: DWORD

I will give it a try Julien. Thank you for quick response.

<@UNV79FH32> have you looked at this?
<https://docs.citrix.com/en-us/citrix-workspace-app-for-mac/configure.html#keyboard-layout-synchronization>
This is for CWA 2210 and higher though, but might help you

Rody, That is exactly what I want to try on the user's macbooks. Change keyboard layout to auto sync and test.

When talking baseline, I think of the unfiltered policy that applies to everything unless over-ridden. This policy I mix user and computer policies. Otherwise, I don't mix computer and user policies, but that's usually because they often apply differently to different sets of users or computers and it makes more sense in our environment to do things this way.

I prefer to keep them separated when and where possible. It simplifies troubleshooting.

I think this is architect-specific, there is no real best practice here. For me, i like baselines per function. So I tend to never touch the unfiltered policy except to make sure its last, and then I baseline security, printing, audio, video, connectivity in individual policies, and then from there exempt/alter accordingly -&gt; this may be overkill, but it works and ticks the CCS boxes on engagements (and makes things nice to track to be fair)

really admin preference - big thing for us is baseline and then relaxed policies above the catch all/baseline policy - I don't separate user and computer.

Completely agree with the baseline then relax per use case above that as per <@UKJTJD4KA> and <@ULEEXJUD8> comments. Splitting it out depends on how the org works IMHO. 

Anyone with BYOD run into users with McAfee LiveSafe as A/V?

I'm on the road today and haven't looked myself, but my help desk sent a screenshot of desktop viewer beginning to connect (white screen) followed by desktop viewer closing, Director shows connection timeout/Client connection failure.

I'm sure it just needs a allow/whitelist somewhere, I've just never had eyes on that product.  Before I hit the Google machine for docs or join a remote session, anyone familiar with LiveSafe?

Our current printing policy is pretty typical I think, we allow for all client printer redirection, set the client's default printer to the default one in the session, and only use native/universal print driver.

Print driver mapping a compatibility. Find the name of the pdf printer then set block

Yeah, that's the part that I thought might be easy to circumvent by someone motivated.....just use a different printer/driver name.

Yea that works but will log errors. Not sure I understand how it would be circumvented if it’s block to pass though from the client?

Maybe I misunderstood you then.  It seems that blocking passthrough but mapping explicitly what you want to allow would make legit BYOD/print-at-home needs difficult to account for all the different types of printers we'd need to allow.

Yeah I'd just block via *PDF* driver name as Ray mentioned.

<@ULK6H7HAL>  I’ll send you a doc I made in the AM. Basically I grab all the garbage printers that get redirected into a session. I grab the printer driver name. Throw it in studio policy and it will stop them from coming into the session. I don’t remember the exact names. But things like Onenote printer, MS PDF printer. Things like that. 

Printer Driver Mapping.docx

Thanks <@ULLH5JGFR>, that's a little different than the method I found in CTX articles which appeared to kind of be the reverse of what you're doing, in that they blocked everything by default with a catch all and then specifically allowed certain things.  This method may be workable for us.  Appreciate you sharing!

Which article show the block all? or catch all Curious on that one. Because there are times I want to do this. But no problem, sharing is caring :slightly_smiling_face:

<https://support.citrix.com/article/CTX312296/how-to-prevent-redirection-software-printer-such-as-print-to-pdf-to-prevent-saving-files-on-the-client>

"Even after restricting client drive mapping in HDX sessions user can save files on their client through redirected client printer such as 'Microsoft Print to PDF' etc. There are hundreds of such printers which cannot be blacklisted through policy as we do not have the list."

The second sentence in that statement is what gave me pause about the effectiveness of blocking specific software printers

But, blocking things like the built in MS one that is native to Windows and keeping it from redirecting would at least eliminate confusion between the one on the Windows VM their Citrix session is hosted on, and the identically named (but also appended by "on %endpoint PC name%) that gets redirected into the session so they dont inadvertently print to the MS PDF printer on their home computer and save a file there by mistake.

The event that brought this up was that - user accessed Citrix from their home PC on the weekend, home PC had no actual printers defined, just the native Windows PDF printer, which got redirected into their session and set as default per the printing policy, then when they attempted to print to the PDF printer on the Citrix server itself, they inadvertently chose the "default" one on their home computer and got concerned when that file showed up on the desktop of the home computer.

try restarting the citrix desktop service, something must be funky with how it's reporting to the delivery controllers.

Have a client with a ticket open with Citrix at the moment for similar. Citrix advised to reboot VDAs but problem sessions persisted. No answer to why it's happening but next suggestion is apparently just to reboot controllers as well to see if that clears the record in the db.

Do you see the user in Task Manager with some processes left? Which version of FSLogix do you use?

Cheers all i was being stupid there was a orphaned session for the affected user on that VDA. I had to add sessionid to task manager and i seen a session with only 3 processes running winlogon.exe / CSRSS.exe / logonui.exe (These run under the system context hence why i didnt notice before) the session ID didnt match up with any sessions listed under Quser so i killed the processes and that then ended the session for the affected user in Director under trends (Studio /Powershell never showed a session)

we have seen kind of similar things, Server 2019. In our setup, this is related to Windows Search issues. We are awaiting a hotfix from Microsoft February for Server 2019, March Server 2016.

Why would you do that? I still don't have BCR in prod as last time I checked I couldn't have different conf (direct, fetch via server,etc) per URL. 

It doesn't seem to work so well for us. What about you guys?

I guess is to eliminate the policy need for all the URLS that would redirect the content and reduce the overall resources? maybe

Doesn’t make much sense to me. BCR should be used to reduce load generated by multi media heavy websites - so usually you want it to kick in for those sites only in my opinion 

The only thing I can think of is some customer made a bid deal about putting in ACL for the sites(youtube like), and they said fine, do this. haha
:woman-shrugging:


Anyhow why not even if I don't see the use case, hopefully they didn't spend time to develop this haha

I would have some doubts about enabling it as I imagine the problems that would arise with all the sites that require various authentications.

No doubt. I’ll test it in my lab but that’s about it

I'd like to see BCR on by default for environments, I think it's a good feature. Redirect what you can and if you can't fall back

That was my thoughts as well. But I have only used it a handful of times for training video sites and it seemed good for that. A bit of a pain when the link redirects many times

My point is, I have no idea what sites users may be visiting that mangle the CPU - IGN, The Register, news sites, they are millions of them out there

I've had problems with a few specific sites, about a year ago now.
so I can imagine how much trouble could arise by enabling it for everyone

It would be really nice to be able to enable it by default and forget about it :)

Good luck with enabling it globally. The issues start when users want to print or up/download something

<@UL5TD2QM9> can you educate me on how that downloading and printing would be a problem with BCR?  I guess it would be redendering on the client some how and get confused? Not challenging you, but really curious

yeah but what if your printers are only available from within the virtual environment or the need to have access to up/download shares, homedrives whatever. At least my users would get totally confused and helpdesk getting flooded 

I was under the impression that the viewpoint is only redirected. Things like address bars, toobars and such would be returned on the VDA still. But I I don't know. Like I said I only used it for massive training that way the VDAs did not get crushed. My experiences is limited on it. But sounds like others had pain points.

yes that’s correct and exactly because the viewpoint is running on the endpoint the VDA has no knowledge about what’s going on in there, resulting in file transfers originating from the endpoint for example or not printing this content

i've seen the load get whacky before, the onoly reason Citrix would allocate users to that VDA is the load was less than the others.  I ended up having to assign a 'maximum user' count in the policies area.  It doesn't matter what it is, just that i'ts set, that fixed it for us.

The load is greater than the others servers but still distributing session. There is no max user policy.

so the load is higher than the other VDAs in the same DG, but still getting users?  There must be something else, like a tag or something else involved

There is an option to do a "health Checker" it will show VDI

Not sure, Just set it up at a clients enviroment. I will get the version

i think it was b/c i did a few months ago and it wasn't showing up

however, webex confirmed that its was optimized

image.png

The PDF from the WebEx team I recieved 3 weeks ago shows this

Was it installed like this, with the VDI switch?
msiexec /i webexapp.msi /qn ALLUSERS=1 ENABLEVDI=2 AUTOUPGRADEENABLED=0 ROAMINGENABLED=1 /log install.log

they tried both enablevdi=1 and =2 and it did not work

That is how I installed it and it is working.

Did you add the ICA virtual channel in the policy?

why do they say "WebEx meeting VDI Plug-in on all thin client computers?"  can you not install it on windows 10 or 11 OS?

No postive why they say it like that. But yes I do. I also use this link.
<https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cloudCollaboration/wbxt/vdi/wbx-vdi-deployment-guide/wbx-teams-vdi-deployment_chapter_010.html>

Did you add these into the new ICA virtual channel security policy?
Cisco WebEx Meetings:
CSCOMT,C:\Program Files (x86)\Webex\Webex\Meetings\meetingshvdagent.exe

Newer WebEx-Teams
CSCOTM,C:\Program Files\Cisco Spark\dependencies\teamshvdagent.exe

they disabled the policy so all vc are allowed

<@ULC9J5XPB> do you have the VDI option that show it's optimized in your environment?

I am not sure what else to check. I used the VDI switch, then I follow the PDF install layout. I then set the VC channels, so I know when it being used from the event logs.

Maybe they removed it and the PDF is outdated since October 22, 2022. I can do some digging and check on my clients side soon.

Na man, maybe just seen more setups and delt with difficult stuff. So I keep notes(SOP for everything)

1998 is the year i graduated high school.

Roll call <@ULC9J5XPB>, Your needed in the WebEx discussion <@ULC9J5XPB> <@ULC9J5XPB> LMAO

I bet he is. But he will see it and give some feedback. He is another sharp one

We switched from Webex to Bluejeans so it's been a while since I used webex vdi, but you used to be able to hit CTL SHIFT D I think to get stats and it would say VXME enabled.

Also, the screen looked different - the buttons for mute, etc, were below the screen instead of on top of it, I suspect because of the overlay for cam and sharing

Bluejeans….. I remember I helped them beta the vdi side. It was definitely better that WebEx imho

It was pretty easy from what i can remember you have the command line switches for enableVDI. you install the HSD Webex plugin on the VDA and the VDI plugin on the client. You can then run the health checker to see if it is optimized

<@ULM6WD9LY> That is what I remember and just went through as well.

Keep in mind that there are two VDI components now (unified agent my ass). You have the Webex Meetings VDI plugin for meetings and screen sharing, and the Webex VDI plugin for calls.

And yes, starting up an optimized meeting will not only show "VDI" in the titlebar, but the Webex meeting window will be gray and not black.

thanks.  so if that VDI screen is not there then that means its not optimized?

okay, let me try a few things and see if i can get it to work.

Once in a meeting, you can go to Help\Health Checker\Summary, and it will show you the current status:

That's a good status with the VDI plugin enabled and working. If it's not optimized, there will be an error in Health Status mentioning VDI.

The key indicator is in the toolbar, though, where it will state VDI. If you see that, Health Checker doesn't need to be checked.

hmm, I am a bit confused myself now. The white screen I seen, and the screen where it shows VDI and the checks I am used to seeing more. So the question is the black screen that shows VDI with the green check box. Is that now gone? So is White screen is what to check along with "The key indicator is in the toolbar, though, where it will state VDI. If you see that, Health Checker doesn't need to be checked" and "If it's not optimized, there will be an error in Health Status mentioning VDI."

I set this up for a client about 4 weeks ago, and the black screen (health Checker) was there. Makes me wonder if I deployed and older verison. I dislike webex as much as teams

i hate webex...teams is much better than webex.

haha they are both in the running for the worlds crappy apps. <@ULC9J5XPB> I think BlueJeans is better haha.

Now, Zoom by far is the best. But since the security issue a year or so ago. Companies are like ummmmm NOPE.

Ray, two different Health Checkers - the screenshot I posted earlier with the green check is from the Webex app. The second screenshot is from within a meeting.

And as much as I hate how Teams is managed, it was better than all of the others in my old environment.

Teams redirection for us has been great, as long as users have fresh sessions (single session w10).  The reconnect bug is :angry: maddening though.

That's what an optimized meeting should look like when you attempt to create/join.

<@ULC9J5XPB> so you may not see VDI in the health check but you should definitely see it say WebEx-VDI.  Is this statement correct?

is that documented anywhere so i can show the client?

I'm sure Webex mentions this in their admin guide, hold on, let me see if I have a link.

Hey Guys,

Periodically get a "please wait for the user profile service" when logging in to my Server 2016 Sessionhost.   Its not all the time.  FSLogix 50276, Ivanti EM pers for ODFC / UPM solution.

Any ideas where to look?

we have it enabled, it provides the best user experience.  However, i'd rather have it disabled, as it bloats the profile and if your separating user and office VHDX it complicates the timing of restores.  I think Microsoft is working on new programming of office365 to correct the slowness of online mode, which tends to just be slower right now, when clicking on different emails/windows in outlook.

see if you can get away with browser based outlook first :slightly_smiling_face:

so is cache mode recommended for all outlook versions?

recommended for best user experience and is how someone would run it locally...

Yes with Exchange online or exchange server in the cloud (far away) plz use cache mode. No matter if it outlook 2019 or outlook 365

Awful user experience without cache mode when using Exchange Online.

<https://jasonhowe.net/2021/05/28/prevent-outlook-from-creating-offline-ost-cache/>  - do i need this setting if i am using exchange cache?  doesn't it conflict since it blocks from creating an OST or am i misunderstanding... i see this setting at the client site i am working at now.

I starting setting up Cache mode like this now.
"this will ensure that if the container fails to mount, outlook sessions will operate in online mode, and not try to download cache data to an undesirable location. Ensure that no other policies control cached mode"
<https://www.vcloudinfo.com/2021/06/how-to-implement-outlook-cached-mode-with-fslogix-profiles.html>

<@ULLH5JGFR>  so you do set the registry setting?

<https://docs.microsoft.com/en-us/fslogix/office-container-configuration-reference#outlookcachedmode>

weird, i've never set that, just configured the cache mode in the normal outlook GPO

I used to do that. But then I wanted some kind of failback.

Just in case the Container failed to mount.

seems like you would only use that, if you had a mixed user base...and the standard for some userse was online mode, which wouldnl't use fslogix profiles....and hte rest of the users would use fslogix containers and cached mode

yea, I stumbled on it here
Citrix UPM and FSLogix Containers (<http://jkindon.com|jkindon.com><https://jkindon.com/citrix-upm-and-fslogix-containers/|)>
. Then I was like wait what is that. So I found the link above and put it in a test mode for month with a old company, It worked good.

microsoft just needs to fix online mode responsiveness, then we dont have to worry about this OST garbage

True, do you have a link on that? I would like read on that or what they are doing.

i read it somewhere a couple weeks ago, let me try to find it

No worries if not. I can pop in some google searches if needed.

<https://worldofeuc.slack.com/archives/CLSHNTWLW/p1667010441111729?thread_ts=1666981023.924869&amp;cid=CLSHNTWLW>

<https://www.windowslatest.com/2022/05/29/closer-look-at-windows-11s-new-outlook-email-app-with-mica-design-and-more/>

oh so thats only for backup purposes.  okay, i don't have to use that.

it's for some reason if your fslogix profiles don't mount, users dont create an ost in their new temp profile, which will most likely fill up space and could render the VDA useless

Well, not like a normal backup. It will mount the container like normal. But in a event the container can't be mounted. As it happens more with new releases. It will failback to online mode so the user can still use outlook.

Oh yea, that tool. Good point <@ULJMUV893>

highly doubt our users would continue with a temp profile though, not having the profile would be the sky falling

i think i am going to pass on that setting. can't we just clean the VDI up if its running out of space

this setting should be disabled for windows 2019, running office 2019 correct?

Any roam to search isn’t needed with 2019 and above. MS will handle it. I have not validated what I’m about to say but it’s in the notes now. FSlogix is supposed to ignore that now on those Operating systems. 

i am so sorry i keep coming back to this stupid search roaming topic for 2019

and they have it enabled in 3 areas of their GPs.

i am disabling it in all 3, that is correct right?

I surprised it is working. Although the 2201 docs say this. I think it will ignore it, but I have not actually tested that to be honest.

<@ULL6F7DRA> <@UL5TCSW3D> <@UKJTJD4KA> may know of hand

Here is a table that helps me when I forget at times.
<https://learn.microsoft.com/en-us/fslogix/configure-search-roaming-ht#overview>

i just want to know if it should be disabled in the 3 places i mentioned.  it sounds like it should be.

Single domain or otherwise?  I'm having an issue with brokers and VDAs in different domains, on-prem.

Currently just single on prem, though, we are likely to extend provisioning to the Citrix cloud plane in the future.

i had no issues in my test env when i put the brokers/vda in the same domain

No issues on upgrading. 
If you have wem in place you have to go to 2103 first an Update your Database then to 2212 with final upgrading the Database. 
Starting with Citrix Virtual Apps and Desktops 7 2109, virtual channel allow lists are enabled by default. You have to configure this by CTX policy. 

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/reference/ica-policy-settings/virtual-channel-allow-list-policy-settings.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/reference/ica-policy-settings/virtual-channel-allow-list-policy-settings.html>


Sounds like a race condition of the policies landing and Edge wanting to load them before the IE mode settings land

I have the same thought. The thing is if the page times out and I don’t refresh it, but close Edge, the same problem occurs the next time I open the app. You would think all GPOs are applied at that point. I need a successful page load for all future page loads to work. 

We don't publish Edge... but use IE Mode on our single session desktops.  I think our Edge config is on logon, not at app launch due to other race conditions when we tried at launch (Ivanti Workspace Control).

Setup a test user with start page as <edge://policy/> and see what shows there on first load?

It is maddening. I have a LOB app that requires the latest version of Edge running on the latest versions of W10 or Server 2022. We didn’t have Server 2022 deployed at the time so to facilitate the need I created W10 machines and hung Edge as a published app off them. I wanted to blame the problem on that, but Server 2022 does the same thing. 

I’m going to try your idea and publishing my intranet. After the intranet loads, can I paste in the LOB app and have it load. 

could it be any UEM fighting with the policy?  ie. saved setting in edge profile, that is subsequently being updated by GPO?

All new user profiles to the published app W10 machines, yes. 

These are fresh profiles not used with any other desktop or app. 

Not a real solution but a work around. May need to test. 

You could do an application prefetch. Which will load it in the background. Use a startup script. 

start edge.exe or msedge.exe" --
timeout /t 1
taskkill /IM edge.exe or msedge.exe" --
timeout /t 1

Just a work around 


I got this to work. My proxy settings are set via GPP user registry entries. You know, things under HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings. For some strange reason on a new profile, publishing Edge just ignores these keys. Edge has it's own proxy GPOs and I'll need to test if they can replace the classic IE registry entries.

Anyway, my fix was to include ""--proxy-server="<http://proxyaddress:8080>" in the command line arguments for my Edge published app. My goal was to have Edge open and go directly to an external website. Including the proxy parameter in the command arguments allows Edge to find the proxy.

Nice!  Thanks for the follow-up with the fix Matt.

First thing that jumps out to me is no use of EDT, that should help a bit.

Do you have GPU's in the VDAs, would guess not, as the policy you screenshotted wouldn't make use of them.   If you do you should enable them.

Also if your Thin clients have the juice and internet access content redirection could help

If not using browser content redirection to offload the video to the client which would generally give the best result, then changing the video codec compression setting from "do not use" to use "for actively changing regions" has had results for me in the past.

no GPUs on VDAs, we had enabled/disabled EDT a couple of times. enabled - for the actual feature, (it was also only dealing with audio on ThinOS clients but not with video) disabled for some graphic artefacts and vulnerabilities. looks like if playing with audio/video quality and codec  settings doesn’t help we would have to deal with content redirection.

looks like this is VDA related - 2203 CU2. as we see difference in ICA RTT and ICA latency  between vdisks running different VDA versions (1912 CU4 vs 2203 CU2). Not much actual performance difference for most of the users. But looks like affecting sites which already have high latency (40ms + ping) . Citrix suggested to rollback VDA version

graph from Systrack - Average ICA latency Between Client and Host. Graph from 10 random servers (and new vdisk running on 22nd of Jan) I think the difference could be seen.

I think this may be what is needed.  If anyone thinks otherwise or has any other input can you let me know?  I’m going t give this a try:
<https://www.nicolasventre.com/virtualizacion/citrix/citrix-receiver-double-hop-drive-mapping/>

AFAIK it's still needed, at least the last time i tested this some months ago

I tested this and it did the trick.  Funny this hasn’t made it into the Workspace GPO or something.   Thanks <https://kb.blackbaud.com/knowledgebase/Article/100941>

Hi - does anyone know of an MCS equivalent to this?  PVS Server we can force it to create Thick cache disks.

Happy Friday everyone! My google skills are lacking here I think, but in Director is there any good documented pages on what each granular item on the HDX report is. for example searching for a session, opening the HDX Audio  element what does the "Opened" statement at the bottom mean and which is the active audio device when there are several, is it number 1 in the list...? The whole HDX report section doesn't seem to have alot of love in the documentation even though alot of it is obvious.

This is old but these settings are still in my 2019 TS servers <https://wedelit.no/slow-application-on-citrix-rds-tsfairshare/>

When I have WEM installed, I disable tsfairshare

I never touch tsfairshare unless the WEM agent is installed, then I disable it :D

So users click on the pub app icon, but the app never launches?  Sounds like AV or bad install.  Can check director for failed launch reason and enable logging on the endpoint.

no that is not it.  The app launches and works fine, just doesn't appear in the task bar.  you can see a session all of that checks out.  Imagine opening Excel, working on it but you dont see its icon

Guessing here.

<https://discussions.citrix.com/topic/390921-icons-whiteblank-on-the-desktop-for-published-applications/>

<https://discussions.citrix.com/topic/403043-application-icons-in-the-taskbar-not-displaying-as-the-application-icons-instead-of-showing-citrix-receiver-icon/|https://discussions.citrix.com/topic/403043-application-icons-in-the-taskbar-not-display[…]pplication-icons-instead-of-showing-citrix-receiver-icon/>

yeah multi-monitor.  just started happening after upgrding them from 2105 to 2210.  doesn't appear like its receiver icons, from the screen shots they shared, the apps are just not there but i can clearly see it being interactive.

Ok, two things I would try.
Try both of these first. Start with Native, they try Yes for High Res.

Second
Make sure the DPI setting match on all monitors on the client end.

<https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/about.html#fixed-issues-1>

That link is for 2210, not sure why it says 2212

There is a known issue with apps losing focus in 2206 and above :slightly_smiling_face: Citrix released a private hotfix which i got but its now included in 2203 CU2 CWA and 2212

<https://support.citrix.com/article/CTX463924/citrix-published-applications-minimizing-after-cwa-2206>

Thanks John. Any idea what the number is? I can find it on 2212 if needed 

thanks John, guess it was not fixed in 2210 then.

Nope we have 2210 and wasnt fixed in that version.  2212 fixes it or 2203 CU2

still seeing this in 2212 btw.   trying to get the private but thats been a challenge.

<@ULCBD9AJD> has a blog about Azure Certificate Based Authentication with Citrix FAS:
<https://www.julianjakob.com/citrix-fas-azure-ad-cba-with-primary-refresh-token-prt/>

That should enable SSO from AAD computers to your VDAs

We are getting SSO PRT without cert based now. no clue how but its been working for about 2-3 months. We are hybrid though but prior to that time frame could not get the PRT to come through.

I forced an uninstall with  *msiexec /x mps.msi /L*v c:\output.log CTX_MF_FORCE_SUBSYSTEM_UNINSTALL=Yes*

<https://www.citrixirc.com/xenapp-6-5-to-7-x-migration-how-to-move-your-xenapp-workers-for-real/>

the issue is the 7.15 installer still sees it as a 6.5 machine

link at the bottom has the github link with the scripts

your issue is the exact reason I designed this script.

Thanks.  Took some real time to make/test

<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1670005167830609>

As for when to do it. I am not aware of when to do it. I just know if I publish an app, and I get freezing when it is launched and high CPU like really high. I RDP in the box and run it. If it opens, I tend to go down the path of removing the hooks in the link you posted.

But yes, I still do it when I run into troubleshooting seamless apps via XA.

oh man, i keep asking the same questions...sorry

do i need these settings if i have HKLM\SYSTEM\CurrentControlSet\services\CtxUvi\UVIProcessExcludes  setup? - <https://support.citrix.com/article/CTX107825/how-to-disable-citrix-api-hooks-on-a-perapplication-basis> .  the client has CVAD version 1912 CU5

i think the older settings can be removed, what do you guy think

Ideally the Uvi process will handle it now.

I think I had a hand full of apps I put in the old way. Looking to confirm. But I published visual code and I added it to Uvi via GPO. I kept getting grey screens, and I could not figure out why. Then I was passed this, and it made sense why
<https://support.citrix.com/article/CTX321177/grey-screen-issue-after-changes-were-made-under-ctxuvi-and-ctxhook>

well, i will remove the old setting and tell them to test

i'll remove it from the master image and then remove the GP setting like that article recommends

okay, i won't apply it through group policy

Just to give you more context around it. In the link <@U011Z7F6733> has good stuff.
 <https://www.jhouseconsulting.com/2019/07/18/citrix-virtual-delivery-agent-vda-post-install-script-2015>
*"Configure the UviProcessExcludes and hook DLLs (CtxHooks)"*
"VDA 7.9 and above utilises Kernel APC (KAPC) Hooking as a replacement of AppInit_DLLs. The KAPC Hooking DLL Injection Driver (CtxUvi) verifies that the hook DLLs configuration in the registry is not changed at runtime (i.e. HKLM\SOFTWARE\Citrix\CtxHook\AppInit_DLLs\&lt;hook name&gt;). If a change to the configuration is detected, the CtxUvi driver disables itself until the next reboot, resulting in none of the Citrix Hooks being properly loaded. So it is recommended not to use Group Policies to control these registry keys and placing them in the master PVS/MCS image instead."
References:
• <https://support.citrix.com/article/CTX220418>
• <https://support.citrix.com/article/CTX226605>
• <https://support.citrix.com/article/CTX223973>


Thanks for the mention <@ULLH5JGFR>. I think Citrix could do a lot better with the implementation of CtxHooks. It has to be one of the most troublesome parts of the on-going management, especially as it's not easy to roll out given that you have to update the master image. It would be better if the service could refresh from the registry, so you can update it via a GPO.

Anytime man, I actually refer clients a lot to that for guidance. But I agree the master image way really is a damper. You got great material 

Oh, I see. Sorry. For this instance. On-Prem

I used to have one using the SDK that would alert on number of available VDA's... based on registration status... struggling to find it but when I do I'll fire it over, cheers

Thanks John, That works. I had one as well, but I can't find it myself. But I will build it if needed again.

Why not use Director alerts? Cant you alert on available VMs below a certain threshold?

To be honest, I did see thresholds. But I didn’t get a chance to investigate it yet. But now that you mention it. I need to expand on it more. I’m not 100% what all director can do at times .  Sounds silly I know :)I been spoiled by CU in the past 5 years lol