World of EUC

<http://go-euc.com|go-euc.com> has an article from 2021 which benchmarks 2016, 2019 and 2022
<https://www.go-euc.com/windows-server-2022-performance-testing/>

Thanks, did just find that and its came to 30% less users per session host. So thats some :slightly_smiling_face:

Some difference! Does anyone have a similar article on how Win 10 multisession stacks up against 2016? I have a coulpe of customers running in Azure and they have their eye on Window 10 MS in place of a server OS, cheers

Newer OSes always perform worse. it's a constant

<@UR99U4W0Y> I know go-euc has done some performance testing with W10 multi-session, but I don't know if they are comparing server OS to W10/W11 multi-session OS

Nice one - thanks, lads :slightly_smiling_face:

I think a W10 MS vs Server OS comparison would be really beneficial to a lot of people.

Check! I'll add it to our backlog! Thanks

<@UR99U4W0Y> the original link from this post shoes win10 multisession gets 25% less sessions than server 2016. 

Don't think so. I simply install with the Print Spooler running then as part of the post-install script move to an OU where the Print Spooler is disabled. The Bakery OU is heavily segregated.

Not sure because of the Citrix Universal print driver. Perhaps try to exclude driver installation and perhaps the setup will not check Spooler service

afaik the seamless sso is just kerberos expanded to aad, with PH/PTA - <https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso|Azure AD Connect: Seamless Single Sign-On - Microsoft Entra | Microsoft Learn> and FAS is needed if you don't use a username/password alignment because SAML is there from a NetScaler perspective. I must admit if SAML in play and then no FAS and seamless SSO is working then this sounds like a nice setup without the FAS hassle for the customer.

Seamless SSO and PRT are different things so just be aware of that. FAS is using Certificate based Auth with only a username and the cert is your password essential. Kerberos tickets are granted based on that Auth passing. Seamless SSO allows Kerberos tickets obtained to be provided for sso on office products. The dsregcmd command should give you your current state on the machine. Also you will want to look at the Azure Active Directory blade on Azure and see you AD Connect status and what's enabled. Those two things should help you see how it is configured right now.

Thanks Leee, I'm aware of these things but exactly that's the reason why I'm this confused within the mentioned citrix article, I think it's just a bad description

Yeah, I don't think it makes sense. It's not clarifying what you are signing into too and is a little vague.

Btw, in secure environments where levels of Kerberos encryption are enforced on your vda machines Seamless SSO will fail out of the box due to the way AD Sync creates the AZUREADSSOACC object in AD. I may have spent a while troubleshooting this issue :wink:

Oh just wait for that AES hardening phase 5 from MS, so many customers that don’t know what the impact will be

image.png

If you set that to 2106 or higher, you can't include any VDA on a lower build in that catalog. You simply won't even be able to see them when you go to add them.

That selection also just makes those features available to you, should you want to use them.

Ahh ok, that make sense. I was curious if It had to do with any updated featrues as well. I have a client that did a 2203 CU1 install, and they select "7.9" and I am not sure why you would do that, unless you wanted an older of VDA version

I was typing this, while you gave me the second answer

Yeah, that's the only reason, IMO - to support old VDAs in that catalog.

Citrix is also renaming that selection in Cloud soon, if it hasn't already happened.

OH this
<https://updates.cloud.com/details/renamed-some-actions-to-better-align-with-their-actual-meanings-stud21803>

Sigh, they are so eager to close a case vs. resolve an issue.

Sounds familiar. I gave up on Citrix support years ago, it's way to time consuming and rarely produces a solution.

Luckily for me I had coworkers with more patience with Citrix support than I had.

it's unbelievable.  I take at least 15 minutes to put detailed notes in the case, and they just come back with a blanket form of "please tell me about your environment".  It's SUPER frustrating.

I put in maybe a case or two a year when I get stuck.  I have zero idea how to fix this FAS issue, so here I am.

My favorite is when you list email as the preferred contact method, and they still call.

absolutely useless they are. I cant access our new cloud DAAS tenancy cloud studio doesnt open they put it down to the Azure issues yesterday but it still doesnt work now everything is back green on <http://status.cloud.com|status.cloud.com>. Good job its a empty site atm (trying to migrate from on prem to it) or i would be raging lol

This echos exactly why i hate opening cases with Citrix Support.  You waste so much time going over the basic info before they get on the right track.  It has progressively gotten worse over the years. 

My favorite is when they wait to email or call after you specified your working hours and then close the case when you don't respond.

Lol - perfect example: they just reached out to close a case as duplicate to another just because they are both about the same component. But the basic case details are completely different. Unbelievable. 

Yeah my first response is almost always, please check all the notes I entered into "the accelerator" as well as logs/traces I have uploaded ahead of time.

Did they send it 1 min before close of business in your time zone to minimize the opportunity for you to reply and maximize the opportunity to close as customer failed to respond resetting the clock? :smile:

Support has definitely taken a turn for the worse in the last 5 or so years. I especially like the canned “please tell me about your env and all the software versions” replies when i explicitly state “all Citrix cloud”. 

Its scary with the adoption of Citrix cloud we are entrusting them and rely on them for support alot more than we used to with on prem Citrix infrastructures

I cringe everytime somebody asks me if I've contacted Citrix Support... I might as well open a case and close it my self...after describing the problem at least twice of course.

And, as usual, I figured out the issue before anyone contacted me with any useful information.  Half of me just wants to keep this ticket open for a year now

It's not just frontline either, I've had a ticket open, which was escalated to someone I've worked with in the past.  I've thought I was on the road to a resolution...only to get a private hotfix that didn't work either... now it's been 5 days since that hotfix and no movement

I'm sorry to hear that.  Cheers to you as well buddy.

Dang so close. I know that feeling. Citrix is like a massive video game. 

Everytime I open a case about DaaS I get questions like: What does the eventlog on the Delivery Controller look like? It so sad.

I feel like they should just have a Cloud/DaaS specific number that hits the right triage team. The current system is hilariously broken. And don’t get me started on a ticketing system that doesn’t show the attachments you put in it.  

I always try to put myself in their shoes. Handling many cases with all different issues can't be easy.  not making excuses for them, but they have alot going on I am sure.

<@ULLH5JGFR> i get that, but when you fill out a detailed description of the error and highlight in all the correct places that it is cloud only, provide detailed screenshots showing its cloud only, and they send a canned 10 point email asking about PVS servers, Delivery controllers, Netscalers etc;  its......frustrating.

Yea, I get that. I know how you feel. It happens to me as well.

i think for 2023, we should all just put tickets in with the description "it's broke".   That will save everyone a lot of time..  You can then have your detailed information ready to send to them after they send that canned email.  :smile:

I am a wicked lady! Hey ChatGPT - can you write a response as if you were a L1 Citrix frontline support staff member explaining that you need more details of the Delivery Controllers in their Citrix Cloud installation


Sure! Here is a sample response:
Hi there,
Thank you for reaching out to Citrix Support. I'm here to help you with your issue. However, in order to better assist you, I would like to request additional information about your Citrix Cloud installation. Specifically, could you please provide details about your Delivery Controllers? This information will help me understand the configuration of your environment and will ensure a quicker resolution to your issue.
Looking forward to your reply.
Best regards,
[Your Name]
Citrix Support

<@ULLH5JGFR> that's a very good point that the staff in many vendors have to cover a ridiculously broad portfolio and if they haven't been trained to do so, or workflows to route tickets to subject experts aren't effective it's ultimately a vendor's fault. Although it's extremely frustrating for customers we can can be kind - even if a support operator seems like an idiot / incompetent their manager put them into a role they aren't able to do and are ultimately responsible. #bekind

I often work with another vendor that removed their IVR and tossed all support calls into a general pool...so that you 'always get a skilled human voice as your first contact'.

That lasted about 9 months before they went back to Press X for this team, Press Y for that team.

I can empathize with staff that once were rockstar SMEs on their slice of the product, having to try to troubleshoot an issue that was completely foreign to them...

Just called to open a case for Citrix Cloud. First question, "what version of CVAD site is it?" Umm.....

Hey ChatGPT - Write a Citrix bug report in the style of Enid Blyton


Dear Citrix Support Team,
I hope this letter finds you well. I am writing to report a bug that I encountered while using your software. It was a most peculiar thing, and I must say that it has caused me quite a bit of inconvenience.
You see, I was using Citrix to access my work files from my home, just like I do every day. But suddenly, my screen went blank and I was unable to access my files. I tried everything I could think of, but nothing seemed to work.
I felt like I was lost in the middle of the Enchanted Wood, with no map to guide me. I was most concerned, as I had important work that needed to be done.
But then, I remembered that I could reach out to your wonderful support team for help. And just like Noddy and Big-Ears always find a way to solve a problem, I was confident that you would be able to help me too.
So, I humbly request your assistance in resolving this bug. I am eager to get back to my work, and I am confident that with your help, I will be able to do so in no time.
Thank you for your time and support. I look forward to hearing from you soon.
Yours sincerely,
A Citrix User

Yeah, came across this a few days ago. Surprisingly doesn't affect Edge, though, which is ironic given that BCR is a Chrome extension, haha.

yea, surprising not Edge. nice. Another reason to stick with Edge.

For DaaS customers with GaaS, UDP out of band audio won't ever be a thing so now they are doing a lossy audio feature to replace that I think. So as many moved over for me, that didn't matter anymore. So its only for NetScaler customers for that and doing out of band UDP audio - for us just contact centers mainly focused on that

Hey Oz, got a quick link for that? Just curious about the lossy with GaaS.

Hey man, I honestly am not sure where that is.  Yea, that was big point of contention for us for call centers. GaaS there was no UDP out of band audio and it wasn't ever going to be there in that form (where you can go out of band on those ports and ultimately the very best audio). The answer to that for GaaS was providing audio through "EDT Lossy". I'll tell you what though Adaptive Audio by itself was dang good as an optimized in band virtual channel for audio. The old audio stunk and wasn't even possible for calls that way, but adaptive audio was very good.  We used Adaptive Audio for some POCs.  But yea, the next level if I remember right with GaaS was framed as UDP audio embedded as part of EDT Lossy. Just can't find it now for the documentation on it....

Not a problem man. I was asking because 7 months ago I was reading about adaptive a audio here. But it looks like you can’t use normal EDT with adaptive audio. You have to go back to standard TCP and then use adaptive audio. Or use EDT with its UPD to tailback to tcp functions which has udp audio as well but not adaptive audio. It’s a little confusing for me. So I’m trying to understand it more lol.
<https://www.citrix.com/blogs/2022/03/23/next-gen-hdx-multimedia-audio-redirection-a-difference-you-can-hear/#respond|https://www.citrix.com/blogs/2022/03/23/next-gen-hdx-multimedia-audio-redirection-a-difference-you-can-hear/#respond>

Sorry <@ULC9J5XPB>  didn’t mean to hijack your thread 

yea, its confusing, but UDP audio 'real-time, aka UDP out of band audio is the highest clarity as it goes around virtual channels all together (out of band) and uses those other ports. That one UDP only (not EDT) out of band and is only something we can do with NetScalers in the mix. There are a bunch of other things as well like source natting and other networking things that can break it. Very sensitive to that stuff. You can use regular/Default Adaptive Audio (in band optimized  channel for audio that is now improved) over either TCP or EDT.  UDP (aka out of band audio) will always be the highest/most preferred where voice quality (like call centers) is required, but also the most difficult to get working and anything networking side can break it in an instant.

Been 100 miles deep in this rabbit hole. ha

No worries Ray, I already got my answer. :)

<@ULLH5JGFR> looping back to this, here is the EDT Lossy I was talking about for GaaS <https://www.citrix.com/blogs/2023/03/13/preview-edt-lossy-on-citrix-gateway-service/>

Thank you for updating me. Going to go read this. 

Guys, I'm helping a customer transition an internally built (and built very well) Citrix / Azure build to their BAU/Ops team... before I got recreating the wheel does anyone know of good link/resource for troubleshooting runbooks for common issues and where to start on the hunt for an issue such as performance/slowness, connection failures, outages etc, granted this could be a needle in a haystack but im looking to craft some common process/runbook on how and what to rule out, cheers

2209. I have the fix for GPO policies not applying enabled.

seems just the Citrix cloud policy isnt applying

Are you using double negative? i.e. prohibit clipboard redirection and then in the client IP assignment you *deny* the policy from applying to your internal IP subnets?

I've been having issues getting Citrix Policies applied properly for months, multiple cases open and still no solution. In the meantime you can use Citrix Active Directory policies.

yea i was hoping to move on from active directory policies since we are migrating to Cloud. I figure no sense keeping those policies in a GPO and always updating the ADMX files with the latest releases.

<@ULNKUS8F8> no double negative either :confused:

It should be double negative. The way I have it done is like this: prohibit clipboard for everyone and deny applying this policy to the users you wish to allow clipboard for. 

I want it to work how our on prem policy works. On prem is configured if you log in through netscaler you cannot redirect clipboard but if you connect internally you can. I cant seem to get this config on the cloud working

When I reboot a machine manually using Studio, the origin is Admin

You might want to check the "Logging" tab in Studio to find out who's rebooting your VDAs

I've run them together a lot. Config-wise, Ivanti is way ahead of WEM

Application Control and Performance Manager are way better as well than the equivalent WEM parts

But FSLogix is only comparable to the Personalization Server aspect of Ivanti EM. There's a helluva lot more power in the Ivanti tooling and it depends how much they are leveraging it

Unpicking an EM implementation and replacing what they've done with it *can* be challenging

Thanks <@UL5TCSW3D> great insight :) I have a session tomorrow to get a better understanding of what they’re actually doing with it outside of the obvious :) 

Shout if you want help understanding any of it

Nice one, James. Quick Q actually... how does the profile piece handle replication/redundancy between sites and an active/active scenario? Ta

It's an SQL backend, so your options are SQL-related - AlwaysOn, mirroring, replication, etc.

The connection to the database is brokered through a web server, so you may want to consider resilience and/or load balancing in the web server aspect of it too

Got it - does it work pretty well in comparison to the likes of Cloud cache? Granted totally separate tech...

From highlevel it looks like they have done a good job of it..

Are the actual profiles on a share or in a file based SQL DB?

Cloud Cache works on a profile level. The Ivanti Personalization database copies down "bits" of your profile as required. Mainly the components of your profile are in the SQL db, but you _can_ call out to file shares as well for redirection, to copy in specific files, etc.

I would hope they've already got a robust design in place to handle resilience for the two web services and the two databases. The Personalization Server web service and database is the most crucial as this contains your profiles and personalization, so if this is offline users will get blank profiles. However the other database and web service (the Management Server) is not as crucial - generally if this goes down all you will lose is the ability to deploy any updates, see events, etc.

Awesome... very helpful, Rankin. I'll grab you a beer at the next CUGC :wink:

In the middle of an Ivanti project so happy to help while it is fresh in my mind :slightly_smiling_face:

think their personalization replication feature is called GeoSync replication, got close to using it, but never did.

Love me some EM, everything you ever wanted in Group Policy Management, and more.

For Server-OS you have to use a RDS GPO, see

I can't say i have proven yet one way or another, but with the new multi session timers in DaaS  or latest CVAD policies having the ability to dictate that now, I was happy as that trumps the Microsoft GPO. Before we never had that as a possible selection for multisession for disconnect timer like that.  But now it is in there so if not working, I assume you VDA is up to a recent level that would take/understand the new policy capability there? Cause yea, previously we ALWAYS needed the RDS side policy for that, but now from what I know we shouldn't require the RDS side one if everything is recent

<@ULCBD9AJD> That changed with VDA 2212, there are new Studio policys, hence the question.

Yes, that's how I understand it.  1912 (latest CU) first, then 2203.  Watch your OS and Database versions as they aren't all compatible with each iteration.

Further info on this with relevant links:
7.18 is not mentioned as a direct upgrade path for 2203 <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/2203-ltsr/upgrade-migrate.html#versions-you-can-upgrade|here> (7.18 is EOL and not considered a support CR). 1912 however, is listed as a direct upgrade path.

7.18 is listed as an upgrade path for 1912 <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/1912-ltsr/upgrade-migrate.html#versions-you-can-upgrade|here>.

TLDR; 7.18 -&gt; 1912 -&gt; 2203

I used this process - <https://support.citrix.com/article/CTX216295/how-to-export-and-import-storefront-subscription-database-on-storefront-36>

<https://docs.citrix.com/en-us/storefront/1912-ltsr/configure-manage-stores/store-subscription-data-in-sql-server.html>

Another option if you can use a SQL Server to store the Subscription Store. It's been working much better over all for my environment. Also gives additional options for managing subscriptions without having to export and import the entire DB.

<@ULHA2NPPX> - that will migrate user's favorites to the new SF server?

it doesn't matter if its different OS versions?

i did from a 2019 server to a 2022 server.  Though, same version of SF.

do i replace this entire phrase  "/Citrix/Store" with the store name or just the /store part?

yeah, just tested in my lab...its "Citrix/Storename"

so if the storename is  Ryan...the command would be $OriginalStore = Get-STFStoreService /citrix/ryan

Haven't come across that, but on the subject, I recently saw something that promised the end of countless VDA upgrades to support Teams functions and a possibility of feature parity from "desktop" to "VDI" - there is light at the end of the tunnel....

Nice. Feature parity nirvana would be fantastic

We have updated some VDIs  (win 10) and servers  (win 2016) with 2203 CU2. It shows “optimized” when logging on to VDI. But  a number of times when I tried to log on XenApp server  banner was missing and usb camera not working. I looked though Teams logs and there was something like “vdi mode not detected” or similar So I though something is wrong with either Teams or new VDA. But at least one user managed to logon and get “Citrix HDX optimized”. I have just retested  and it worked from a WIndows laptop  Teams 1.5.00.3362. VDA 2203 CU2.  Looks like we also have latency issues with this new VDA.

Did you install with the correct switches?

Thank you, Vadim.

Always something with these VDA's...

I may try 2212 and see how I get on.  I want a solid, stable VDA that enables latest Teams goodies.

Hi James,

Typical  ALLUSER=1 ALLUSERS=1

I can see Websockets running, menus have their typical HDX appearance (i.e no Zoom, secondary ringer, etc. )

Ill have a look through the logs.

Little fed-up with Teams at the moment...

wasn’t me installing Teams this time. But we use the same bat file, just replacing msi file (machine wide 64 bit msi). only these switches are bing used (ALLUSER=1 ALLUSERS=1) no other modifications. And it works but not always. For the last couple of days we were testing it it was not working more often than working. (I mean optimised mode)

It seems to show "Citrix HDX Optimized" in the about banner for my admin account that I'd installed Teams with.   Not for any other of my test accounts, though, as said above, it LOOKS to still be HDX'ing despite not displaying the banner.

UPDATE:

This could be related to a preview shim that MS recently applied to allow some specific previewing of Teams HDX features.  We are having it rolled back to the standard.  Will see if this helps.

<@UUJAM6B09> "Looks like we also have latency issues with this new VDA" - are you seeing issues where latency actually 'looks' good but you notice tons of delays within the session? I didn't see this until we started piloting CU2.

ica-latency.ps1

OK, so we tried to go scientifically and put some stats. As it’s hard to rely on users feedback.
I decided use PS script on the server to grab the stats instead of collecting info from Director or Systrack
So ICA latency raises dramatically for the users running on new VDA.
I tested with the same test user, the same endpoint watching YouTube video on servers running old and new VDA
You could run the script attached on your test server and compare the results -it also dumps all samples and averaged values to csv files

My test case was:
launch session.
Wait till Teams fully launches.
Open Chrome
Open YouTube video set it to 1080
Start collecting stats with a script.

Thanks Vadim,

I think im going to pull the plug on the 2203.2 VDA upgrade.    Im just not happy with the stability and what I've seen from other adopters (Who are rolling back..)

<@UUJAM6B09>

Curious,  do you still see the ICA Latency issues if you run straight through Storefront as opposed to traversing any Netscalers?

I seem to get triple figure ICA latency only when going through NS.  its fine direct through SF.    This also applied to internal NS.

• When you run Connection Quality Indicator on VDA version 2112, incorrect Round Trip Time (RTT) and latency values might be reported.
• This fix allows you to use the legacy NetScaler L7 latency measurement when the HDX Adaptive Scaling feature is disabled. The NetScaler L7 latency and VDA HDX Adaptive Scaling features cannot be enabled simultaneously.
• For the functionality in the fix to take effect, you must disable the HDX Adaptive Scaling feature in the VDA registry as follows:
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\icawd
• Name: AdaptiveScalingEnabled
• Type: DWORD
• Value: 0
• [CVADHELP-19781]


Seems to fix the (erroneous?) ICA Latency values for me.    Even through NS,  ICA latency is now back to typical response.

Citrix support suggested to test going directly via Storefrorent after  asking to update receiver on our Thin Clients. Receiver version is really old 14.x but that’s the last available for this hardware (Thin OS 8.6 on Dell Wyse 5060). We haven’t tried this reg fix. And we have just sealed our Feb vdisk with downgraded VDA. so we start focusing on upgrading the rest of components to 2203 first and then try VDA update again

I've worked in environments where you:

a) Have redundant everything in the same Citrix site, and use SQL clustering for the DBs; or
b) Have completely separate Citrix sites, both identical, and presented to the user via SF using site aggregation. Same as (a), but more flexible - especially for upgrades and outages

Pros and cons to both, but I'd choose option B every single time if given the choice.

What if the site where the storefront is in, is crashed? Disaster recovery 

For option B, we'd have SF servers in both sites. Option A... if you're running multiple SF servers, shouldn't be a problem unless the entire site went down.

Option A obviously has outage time associated with it, but if it's something like a DB restore, how long are we talking? Under an hour?

Typically mirror but also depends what’s being used for DR. For example might be a VPX vs physical NetScalers. Also separate sites vs single site. Which control plane is being used. 

Yep also in site availability. No single component failure in production.

Rabbit hole of a conversation <https://docs.citrix.com/en-us/tech-zone/design/design-decisions/cvad-disaster-recovery.html|https://docs.citrix.com/en-us/tech-zone/design/design-decisions/cvad-disaster-recovery.html>

Import-Module ServerManager
    Add-WindowsFeature Web-ASP-NET45, NET-WCF-TCP-PortSharing45, Web-Static-Content, Web-Default-Doc, Web-Http-Errors, Web-Http-Redirect, Web-Http-Logging, Web-Mgmt-Console, Web-Scripting-Tools, Web-Windows-Auth, Web-Basic-Auth, Web-AppInit, Web-Http-Redirect, Web-Http-Logging, Web-Filtering, Web-Windows-Auth

powershell to install all the prereqs for storefront.

so the ISO doesn't install the prereqs?  and i've been installing it wrong for years, now?

heh, honestly, i've been doing it like this for so long, i don't know.  Was just giving some code I use to make sure it's all installed

it does(ISO Does), but I like the powershell way myself.

1912 but 2203 is the same
<https://docs.citrix.com/en-us/storefront/1912-ltsr/secure.html#configure-group-memberships>

Yes - watch out for customers who override local Administrators group memberships with GPO as you will need to ensure these accounts are still added :wink:

Yea definitely looks like the child object or chain part was deleted from the data store. Which the snapshot want be aware and therefore shows this.

Thank you guys.  One of our other staff members is going to call Citrix support shortly, and see if it can be fixed.
In 12 years, I have not seen something like this.  It could be one of our update procedures which caused the issue, or our vcenter upgrade/update

I would personally start at the VMware level to be honet. Look in vCenter and see if the snapshot chain is intacted first. Make sure the VMware stuff is good.

I rolled out VDA 2202 CU2 (previous was 2203 CU1) and got some very slow logon (profile and interactive session). I had to roll back. Anyone saw that? I use Windows Server 2016.

You say "Making sure that “Restrict each user to a single session” is set", that would be your issue then I guess. With that configured, your resulting configuration is the opposite of what you desire to have.

My mistake. Lagging a bit :slightly_smiling_face: making sure that it ISN'T set

Could use tagging
• Tags: Desktop1, Desktop2, Desktop3...
• Desktop defined on delivery Group: Desktop1 -&gt; Restricted to Tag1, Desktop2 -&gt; Restricted to Tag2, Desktop3 -&gt; restricted to Tag3 etc
• Assign tags to sub pools of VM's in your DG

That require users to press five different desktops, right? Or am I missing something.
It may be okay, but the optimal scenario would be to press the same published desktop five times and then start five desktops.

Oh my! The customer agreed to five different published desktops. So big thanks <@UKJTJD4KA>! This is the solution!

In Windows computer management you can see who has a session and which files they have open. Just connect to the share from computer management and close all the sessions

If you have PSREmoting enabled you could write a few lines of powershell and close processes that way

Sorry for the late reply. As suggested we wrote a PowerShell script that runs on the Fileserver, which closes all open files for this specific share. It's a bit drastic, but works.
Too bad that Citrix feature is lost with current Citrix versions.

When enrolling shared machines (RDSH\citrix shred desktops)  into defender should it be installed as device mode instead of user?

Get-LogHighLevelOperation -MaxRecordCount 3000 | Select-Object User,AdminMachineIP,Text,StartTime,EndTime,Source

<https://support.citrix.com/article/CTX138132/viewing-configuration-logging-data-not-shown-in-citrix-studio>

This?
<https://support.citrix.com/article/CTX473039/how-to-configure-browser-content-redirectionbcr-for-all-the-websites>

Do I need to be a CTA/CTP ? :stuck_out_tongue:

I don't think so. I wants me to login, 2 weeks ago it was public.

Yeah... Im almost certain Ive reviewed when announced a few weeks back..

Unless they pulled it because it had issues?

This is why I need to export all CTX links to PDFs. Massive job, but helps me keep the content.

Wow I think I put a feature request in for that many moons ago

I posted it here originally to get some feedback on it.
<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1674055945912959>

I think you can set these on the ica file for testing... or the client.. Im sure Ive done this before, maybe this will help? <https://blog.sachathomet.ch/category/troubleshooting/>

Yes. Possible on the Ica file or by GPO apply to the workspace app

Yep, can do it ad-hoc as they mention above which we have to do sometimes for certain small branches/offices and we can't break it out via policy even.

Or use a dedicated VDA with a Citrix policy based on a tag. A dedicated SF store for specific clients is also an option. I think you can disable EDT in the default.ica. 

I've opted for a quick and dirty reg edit to turn off. Cheers for the advice guys :relaxed:

Are wild card certs costly than SAN certs? Are there any more benefits in using wildcard instead of SAN?

However, i highly recommend <@UL9CZ4TA7> script for letsencrypt on the SF/NetScalers.  <https://github.com/j81blog/GenLeCertForNS/tree/dev>

I was all wildcard until I migrated to LE with the help of this script

Are there any cost differences between wild card vs san certs?

i do not know, i'm sure all vendors are slightly different, but even if there was, it's not going to be enough for you to care, i'd think

ok.. I ll discuss it with my team to see if we can implement it.

<https://www.cloudflare.com/learning/ssl/types-of-ssl-certificates/|https://www.cloudflare.com/learning/ssl/types-of-ssl-certificates/>

Last one in the article Multi Domain is nothing but SAN Certificate

It's best security practice to not use a wildcard on all your machines services. If that's compromised then it's all compromised. Better to stand-up an internal CA or split the cert for different services. I know we all know it's pretty rare but when it does happen.....

This issue has been around forever, this is a little more thorough.  <https://jkindon.com/windows-search-in-server-2019-and-multi-session-windows-10/>

I first encountered the search index issue in december 2019, so this is a very old issue. Also the workaround described in that article is not supported by MS when using FSLogix, however it is supported with CPM.

Yea that is what I use for user/device
*udadmin -list -a &gt; C:\lic.txt*

udadmin can see ony default license without sessions with other licenses 

You want to see which session are consuming differnt licensing type?

I’m using User / device as default and concurrent on few delivery groups. I would like to check what’s license in use for specific user

Unfortunately I can see only U/D without concurrent :-( 

udadmin (aka UserDeviceadmin.exe) allows you only to see User/Device licenses. 

Wouldn’t be nice to see Concurrent licenses… any idea ?

CTX Director, License Server or this little tool (never used it): <https://xenthusiast.com/monitoring-citrix-licenses-usage-graphs-using-wmi-powershell-and-rrdtool/|https://xenthusiast.com/monitoring-citrix-licenses-usage-graphs-using-wmi-powershell-and-rrdtool/>

Yea that is nifty. <@ULL7R5KT6> Do you not have something like this?

Heck I don't know if that will give you any valuable info. I am just throwing things out to try to help lol