World of EUC

No, the order in which you upgrade these two shouldn't matter afaik

Nope. Make sure to update first the PVS Infra servers and then your golden master.

<@U015MJK0XBM>  - i am asking if there is a particular order when installing the VDA and and PVS target device software.  i don't think there is anymore.

<@UM2G5G8E5> what's the reason for not picking 2203 LTSR?

That’s correct.  They will probably work but all versions below 7 are end of general support by VMware, so makes sense that Citrix wouldn’t support running on something VMware won’t.

Correct. VMware 6.7 is EOL since Oct 15 2022

WHAT?!? You mean that everyone hasn't updated to v8 yet?  OMG!

All your veggies in one drink, or something Mad Max would be proud of Carl?

image.png

I ran into this during our vSphere 7 migration.  Had to go through this process to find orphaned tasks

<https://support.citrix.com/article/CTX138318/unable-to-delete-resources-there-is-currently-an-active-background-action>

Sorry if that's what you meant by "I checked for running tasks etc via get-provscheme but nothing seems to be in progress"

Thanks, Jon. Ive told the customer to attempt to remove using the PoSH commands.. there doesnt appear to be anything orphaned from a jobs/tasks perspective, cheers

you sure there isn't some form of delegation against that catalog there? Says you don't have access to the Catalog

Thanks JK - waiting on feedback, the clients named admin and the svc account have FULL access to all things Citrix and the VMware/storage platform... cheers

Just got feedback, removing via PoSH did the trick, cheers

Hmm I was going through this as well with a client.
What I did was use the 7.15 handbook and the The TechZone 5 and 10 SSS. Also, I looks up what CPU is runnign on the Hypervisor for ring vs mesh. Which changes how vNuma is approached.
<https://docs.citrix.com/en-us/tech-zone/design/design-decisions/single-server-scalability.html>

Cheers, Ray... I just send some feedback to the hardware procurement partner based on that article... found it earlier whilst trawling :slightly_smiling_face:

The only really good way is to do a pilot with real images/apps limited to a single host to monitor load and responsiveness.  Everything else is just guessing including what Nick talks sbout eith 5 and 10. 

Vmware Horizon has one that I use at time to help me get a good idea. Not fool proof, but it helps.

Typically any decent vendor would have a sizer where you can punch in numbers to get a very generic idea, otherwise it’s what <@UM04QUUSJ> said

what I’m seeing is that no matter how much resources you throw at server OS published desktop, you’re not likely to get more than 15 users on it before the experience becomes awful, especially if they are using chrome

Published apps you can get higher before people complain, but if you’re trying to push 40 users to a single server you’re probably going to have a bad time

Last time I achieved 40 users was on 2012R2 running a light weight app. Since then, I have experienced the same results you have mentioned.

Single session VDI depends on what you’re doing but the bare minimum is 3vcpu and 16 gig of ram, if you go lower on the CPU or RAM the performance suffers a lot, mainly due to chrome again

if you don’t run a browser at all then you might get away with less

If you even open chrome/edge it starts at almost 700MBish +. Crazy how much resources it needs. Even if you slap WEM on it and limit what it can use, then users will get crap results.

Thanks, lads. Ive shared some estimates and links and stressed if they want something accurate they will need to load test etc, cheers

What is the Linux CWA version you are using?

Hi Rody,

It's 2212 at the moment.  I've tested again this morning and audio wasn't too bad... Currently using EDT with fairly stock audio (no UDP).

I'll test some more and see if I can draw any solid conclusions

i have a client asking me how severe this is from a scale from 1 to 10....i would says its like an 9 since it involved accounts.  however, i am not sure

10...its marked high...and i didn't even see that until after i sent the question out...:smirk:

i have a client asking me how severe this is from a scale from 1 to 10....i would says its like an 9 since it involved accounts. however, i am not sure

Is the CWA vuln the one that went wild on Twitter a few months back?

Nope, that was CTX464106

At some point prereqs .NET changed from 4.7.2 to 4.8, so that may be why the customer needed to install prereqs.

Same with Visual C++ Runtimes, they may also change between CVAD versions

thats a self extracting .exe the prereqs are in there.   they shouldn't need to install them first.

Yes, but both .NET and the runtimes might trigger a reboot which usually means that the VDA setup will fail until a reboot has been completed

i removed the /no resume and /noreboot switch

X problem.  Duo asked me to whitelist the credential provider so Duo trusts it and my passthrough auth from Duo will work

i've tried what I think is all of them, and it's not clicking.

*HKEY_LOCAL_MACHINE\SOFTWARE\Duo Security\DuoCredProv\*ProvidersWhitelist

Yes. This is the what I had to whitelist for our solution:
{1D7BE727-4560-4adf-9ED8-5EEC78C6ECFF}

And

{81C8E4DC-B376-4D88-BCCD-BD0DD65BEE2B}

Holy shit <@U012AAZRJ20> you rock!  How did you find these?  I swear I tried ALL of them in the list?

well, to be fair, i tried them ALL, i isoloated it to those 2, and it's working now.   you freaking rock

I don't remember exactly how I found them. I think I tried them all until I narrowed it down to a working solution. I just know where they are stored in the registry for our solution now so provided them.

I just find it odd that it didn't work when I had the huge list in there, that included those 2.

I will update Duo, and perhaps they can make a damn KB for this now

7 in the newer versions just denotes it’s an on prem release

I think you need to trawl through all the release notes and the What’s New section for the tables for each version

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/2203-ltsr/whats-new/cumulative-update-2.html#2203-ltsr-cu2-baseline-components>

I can’t find a single table with all of them, but I get that would be useful

Thanks yeah eg. 2212 and 7.36.0.14, which is also different from what is in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Citrix Virtual Desktop Agent

if you figure them all out, make a github page for them :stuck_out_tongue:

Maybe <@UL8ACTGSF> has a magic jelly bean?

Mike, Boozer is going to kill you for not suggesting I blog it :hocho:

<https://github.com/MikeStreetz/CitrixVersions/blob/main/Studio2ProductVersionNumber>

Lol, that works. <@UL8ACTGSF> thank you sir as well

My scripts only need the major.minor, so I never kept up with major.minor.x.y or CU levels 

Anyone should be able to add them into that page if they feel up to it

I put receiver versions in too because I’m always looking this up

<https://github.com/MikeStreetz/CitrixVersions/blob/main/reciever%20versions%20-%20Windows.prn>

Hi Mike this link does not work. Although the other one further up works and one can get the receiver version via this. Thanks a lot always looking this up.:+1:

I know a solution you should be looking at for Citrix Workloads - it works very well.....

I might know what <@UKJTJD4KA> is talking about..

An impartial rec I hope :stuck_out_tongue:

Don't waste your money on other products. Don't waste your/clients money on 3 tier Infrastructure. That ship has sailed. Seriously. I been there, and it adds much complexity. All the back and fourth with these vendor,  Dell, EMC, Cisco and such. Total BS if you ask me. Such a hassle. I done them all. Nutanix is the way to go. You want a good experience and simplest ease of upgrade, hardware, support. Well Nutanix is it. This is from experience. Support alone is the best in the market. One click upgrade from LCM, sit back and relax while your Citrix Workloads are not impacted. I upgraded clusters with my feet on my desk puffing my vape while using a VDI and NTX FIles on the same cluster the workloads were on. No Issues at all.

I vote <@ULLH5JGFR> to be in the next NTNX marketing video with that visual.  Sitting feet up on the desk vaping away

I thought about it for quite some time and yea what Ray said...

Not gonna lie, you need to do a CUGC webinar and be on cam like that

HAHA, I would do that if they allowed it.

Well to put up at least one other opinion, we went vSAN all the way as an MSP, and are happy. But i'm not the architect, I just consume it for my CSP MCS workloads.

silly question, on a Worker does Qfarm /load work?

xenapp 6.5 servers had session hosts and session controllers so make sure your running discovery against a session controller

Have you tried Appcenter from different workers? I've experienced that if you don't set primary Zone Controller, and the election changes, I had to find the Zone Controller and open Appcenter from there, and do a discovery.

Have tried all the servers (it's a two-server farm with both session hosts configured as controllers as well, different apps on each, what a dog's dinner)

Only thing I can think of but it was pretty rare to see SSL with 6.5.

Might not be so much of an issue - I need to disable the apps for a migration - however I have simply put fake names onto the discovery servers for the web interface, so I think that should effectively remove all of the apps from being available

Not as good as disabling them all individually but net effect is probably the same :slightly_smiling_face:

If anyone asks for them to be reinstated I think I will just tell them to get stuffed

I haven't touched a 6.5 Farm for years... The fun you have mate.

Just shut all the servers down and problem is solved

Haha, dsmaint recreatelhc paggered the IMA service, now failing to start with a db connect error - let's just hope they don't need them back :slightly_smiling_face:

SQL server looks good?  And creds being used to connect to SQL are good? <https://support.citrix.com/article/CTX105257/how-to-determine-where-the-ima-data-store-database-is-located>

i always recreate the radecache when recreating LHC too

i may or may not have done it recently :slightly_smiling_face:

I remember when I did my first 4.5. Man I though I was a bad ass and was ready to take on the world. Little did I know back then haha

I even recall using access as the database in a 4.0 lab setup. So long ago. I was so green

i still prefer appcenter over studio, that thing zips

just waiting for the "ok boomer" replies from the youngins'

Had a company come to me last week with a similar 6.5 farm issue. Citrix DB was somehow corrupted and needed a restore and the zdc's bounced to get things right.

we personally use a task sequence with PDQ Deploy but a similar one can be done w/ SCCM but basically yes, we run the VDA Cleanup Utility first (has 3 reboots in total i believe) and then the new VDA install after that

i'm not 100% if the cleanup utility is totally needed but i always like to be cautious to make sure i'm installing clean

I use Chocolatey to deploy the VDA so a chocolatey uninstall then reinstall seems to work fine

Although I must admit I much prefer to redeploy completely

<@UL5TCSW3D> awesome idea! just found your blog post on that method. so that way just installs over the top then or no?

Chocolatey kinda manages the whole install itself, so you do a "choco uninstall citrixvda" which removes all of it, and then a "choco install citrixvda" which puts it back. Reboot might be needed in between sadly

If you accidentally uninstall it through "standard" means though, it will go a bit skew-iff

<@URVNXB96C> Thanks, so you run the cleanup utility and it removes the old sw as part of its process?

<@U01BLNEMDFU> right, in the task sequence i run the VDA Uninstall Utility w/ command line like this:  c:\windows\temp\VDACleanupUtility.exe /unattended    3 times with a reboot inbetween each pass (reboots after it see's a success code of 0)  and after the 3 passes the old VDA is completely removed and then run the silent install of the new VDA

thanks man, it's been so long since i've upgraded our VDAs lol

Would just note that the VDA cleanup utility didn't really really work for the 2203 CUs.  It left the installs in a really weird state that was painful to recover from.
We found running the new CU2 installer with the same switches we used on CU1 was enough to have a reliable VDA upgrade

Good to know.  Maybe they improved the installer from the older versions.  We're still running 1912.  I'm just trying to find the path of least resistance to address the security vulnerability.

<https://xenappblog.com/2022/master-images-patch-or-die/|https://xenappblog.com/2022/master-images-patch-or-die/>

Totally understand.  If you are running 1912 on your VDAs still the VDA cleanup utility is definitely the right way to go.  Upgrades on 1912 without it were error prone.

I don't use the ISO, i use the standalone installer.  its a self extracting .exe that contains all the prerequisites and much smalled then the ISO.   i usually upgrade unless the client is really behind on their vda updates.

<@UM2G5G8E5> is there a standalone download for the vda installer?

definitely is......i forget exactly the menu to go into but theres a section for the main CVAD version for something like "other components available on their own " or something like that

Yeah you can get the Multiuser and Singleuser VDAs as separate downloads

need to log in first though. They really should have them publicly accessible so I can call them directly from my repositories

<@U01BLNEMDFU> - did you find the download?

When I first touched it - I thought it would be easy.
Ended with 20 steps Task sequence (Well, 9 of them are reboots)
Most of the things run twice as most of the times neither VDA cleanup nor VDA installer are unable to run and finish all the steps successfully on first attempt and require additional reboot.

interesting.....why do you run the cleanup utility 2 runs?  i also didnt know you could run  the 2nd pass of it w/out a reboot in the earlier steps.  thatd be nice to try

Normally, you would run the cleanup utility in GUI mode. It performs uninstall activities and adds a “run once” registry key to continue after the reboot. After the reboot, it finishes the cleanup, which is the ideal scenario.
However, in real life, some PCs may be in a pending reboot state, which can be fixed by adding “restart computer” as the first step. Another issue that may arise is that the cleanup utility sometimes runs but cannot uninstall everything it needs and throws an error. In this case, your only choice is to reboot and repeat the process.
So TS steps for VDA cleanup utility in my case are like this:
1. Reboot
2. cmd /c VDACleanupUtility.exe /silent /noreboot
3. cmd.exe /c REG DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /v CitrixVdaCleanup /f
4. Reboot
5. cmd /c VDACleanupUtility.exe /silent /noreboot
6. Reboot
7. cmd /c VDACleanupUtility.exe /silent /noreboot
8. cmd.exe /c REG DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /v CitrixVdaCleanup /f
9. Reboot
10. cmd /c VDACleanupUtility.exe /silent /noreboot
11. Reboot

Then there is the VDA install part
Using /noresume so it wouldn’t run after reboot and we will call it from TS instead
12.VDAWorkstationSetup_1912.exe /quiet /noreboot /noresume /enable_hdx_ports /enable_framehawk_port /enable_hdx_udp_ports /Enable_REAL_TIME_TRANSPORT /optimize /remotepc /enable_remote_assistance /components VDA /virtualmachine /controllers “<http://sy4ctxdcp01.corp.ad|sy4ctxdcp01.corp.ad> <http://sy4ctxdcp02.corp.ad|sy4ctxdcp02.corp.ad> <http://nrdctxdcp01.corp.ad|nrdctxdcp01.corp.ad> <http://nrdctxdcp02.corp.ad|nrdctxdcp02.corp.ad>” /Exclude “Citrix Telemetry Service”
13. Reboot	
14. Repeating step 12 as sometimes it unpacks the content of .exe file and then dies or tries to install and dies half way.

Run this step only if both of the conditions are false
Check if folder C:\ProgramData\Citrix\XenDesktopSetup exists
Check if file C:\Program Files\Citrix\Virtual Desktop Agent\BrokerAgent.exe exists with file version 7.24.3000.9 (that was for 1912 CU3)
15. Reboot
16. Continue install using the unpacked installer
cmd /c continue.bat
Run this step only if this condition is false
Check if file C:\Program Files\Citrix\Virtual Desktop Agent\BrokerAgent.exe exists with file version 7.24.3000.9 (that was for 1912 CU3)
==conttinue.bat==
“C:\ProgramData\Citrix\XenDesktopSetup\XenDesktopVdaSetup.exe” /quiet /noreboot /enable_hdx_ports /enable_framehawk_port /enable_hdx_udp_ports /Enable_REAL_TIME_TRANSPORT /optimize /remotepc /enable_remote_assistance /components VDA /virtualmachine /controllers “<http://sy4ctxdcp01.corp.ad|sy4ctxdcp01.corp.ad> <http://sy4ctxdcp02.corp.ad|sy4ctxdcp02.corp.ad> <http://nrdctxdcp01.corp.ad|nrdctxdcp01.corp.ad> <http://nrdctxdcp02.corp.ad|nrdctxdcp02.corp.ad>” /Exclude “Citrix Telemetry Service”
=============

17. Reboot
18. Repeat step 16
cmd /c continue.bat
Run this step only if this condition is false
Check if file C:\Program Files\Citrix\Virtual Desktop Agent\BrokerAgent.exe exists with file version 7.24.3000.9 (that was for 1912 CU3)
==conttinue.bat==
“C:\ProgramData\Citrix\XenDesktopSetup\XenDesktopVdaSetup.exe” /quiet /noreboot /enable_hdx_ports /enable_framehawk_port /enable_hdx_udp_ports /Enable_REAL_TIME_TRANSPORT /optimize /remotepc /enable_remote_assistance /components VDA /virtualmachine /controllers “<http://sy4ctxdcp01.corp.ad|sy4ctxdcp01.corp.ad> <http://sy4ctxdcp02.corp.ad|sy4ctxdcp02.corp.ad> <http://nrdctxdcp01.corp.ad|nrdctxdcp01.corp.ad> <http://nrdctxdcp02.corp.ad|nrdctxdcp02.corp.ad>” /Exclude “Citrix Telemetry Service”
=============

19. Install Workspace app
Workspace app installer returns some crazy error codes so I just set it “continue on error”
“CitrixWorkspaceApp.exe” /AllowAddStore=N /AutoUpdateCheck=disabled /noreboot /silent /includeSSON /EnableCEIP=false

20. cmd /c “gpupdate /force&amp;shutdown /r”

Our CM guy is having a hell of a time getting a TS going for 2212 VDA upgrades going on our persistent images...  Unfortunately I'm lost when it comes to SCCM TS's.  His working TS from previous versions doesn't work... I assume it's because of switches that are changed

you should go via manual install first to see where it breaks and automate later. We have no issues installing VDA while building our Windows 10 Virtual machines. But updating is a pain. One of the previous versions had additional issue - black screening after the install. The only way to deal with that was to login each machine after the update and if blacksreens - uninstall/reinstall VDA again.

Last I spoke with him, I was installing manually and suspected it was disparate VC++ versions in his TS vs what is packaged in the VDAWorkststion.exe

This was Friday

did they still have support when CU6 was released? If so, yes.  If not, then i dont believe they are entitled to it.

It depends; what is the subscription advantage date on their licensing...if that's before CU6, then they can't. If it's after, then they can.

thats also assuming the latest license was added to reflect the latest sub advantage date

I wanted to get your feedback on an issue i've been having. I was working on a client site that has existing DDCs running windows 2012 R2 on CVAD 1912 CU5.  I added two new Windows 2019 servers as delivery controllers to the site.   I turned off the W2k12 Delivery controllers, and I could not see any of the servers vda in Citrix Studio. I closed out of studio and tried to re-open but it wouldn't. Have you ever seen this issue?  I've done this process before and this has never happened to me.   As a workaround I created a secondary zone and added the W2k12.   I am concerned when i remove the Windows 2012 ddc servers nothing will work. I tried the following so far:

Checked and confirmed all the citrix services are running on the W2k19 DDCs
Checked DB server for new controller user accounts and confirmed the permissions are correct.
Checked HKLM\SOFTWARE\Citrix\Xdservices\ConfigLoggingSiteSchema\DataStore\Connections
Ran Get-ConfigDBConnection on all of the DDC and confirmed the output is the same.

I am running process mon next....any suggestions on what else i can try?

following.  from what i've heard from other over the years, agents in the vm.  wasn't phd virtual the last backup solution for xenserver and they got bought out by someone...

I've not used it, but I did find this. <https://www.unitrends.com/solutions/citrix-xenserver-backup-and-recovery>

ah yes, unitrends bought them!  good ol spiceworks days

CommVault used to be able to do backups of XS VMs, but haven't looked at it in about 2 years

OK, so I am not crazy - very few of the major players deal with XS.

<https://xen-orchestra.com/#!/xo-features/backup>

<https://citrixready.citrix.com/quadric-software/alike.html>

I use Fungusware xackup for years to backup my 40+ management servers, it's cheap and efficient and responsive support, I recommend.
<https://www.xenserver-backup.com/|https://www.xenserver-backup.com/>

Is this process still required to enable smart card for Edge on 1912CU6/2016 Server?  I ask because i deploy the sfrhook via GPO.  When I updated one of my dev boxes from 1912 CU3 to CU6, I was getting a gray screen on launch with a 1005 CtxUvi error in the event log.  A subquent reboot allowed the desktop to launch normally.  I'm assuming the gray screen was due to the sfrhook key being written to the registry after the VDA was upgraded.  <https://support.citrix.com/article/CTX296999/unable-to-use-smartcard-in-microsoft-edge-chromium-on-server-2016>

2212 has a known issue with multi-domain authentication CVADHELP-20832

2212 also finally fixes the &gt;6 audio devices on a client device breaking in session audio. <@U03JF4T98JZ>

~Is that in 2212 on the VDA side or the Workspace app side (or both)?~   (Edit: N/m, saw the thread context was about VDA.  Thanks for the heads up, our audio team and helpdesk will really appreciate that one!)

Love those sneaky fixes that aren't in the fixed issues; I'll get the VDAs on some machines updated for testing ASAP! :-)

Hmmm does this happen with other office  products? Seems to be something with office token perhaps. You reset the profile then it pull down an updated token in the profile. Guessing here but delete these locations and see what happens.

*AppData\Local\Microsoft\IdentityCache* 

*AppData\Local\Microsoft\TokenBroker\cache.*



I was thinking the same, ill run that past the customer - ill make sure their not syncing these paths back to their FSL profiles

I didnt have much time to look into it and had a mind blank as to the paths M365 uses to store tokens

Same here but I found it in another thread

Generic USB redirection might be enabled on the endpoint side. Disable it and make sure the headset gets detected and is working on the endpoint itself.

Hi Rene,

Headset seems responsive and sounds well when audio played direct through the endpoint.

I've disabled Generic USB, rebooted and retried.  Pretty much the same.    I lost the "devices" tab in CWA so couldn't really see how it was handling the device when I did this.

Really wish all my endpoints had windows on them :slightly_smiling_face:

Im going to reach out to their support and see what they come up with.

maybe worth to check with them and see if there is a newer firmware available

Guessing based on google 

<https://discussions.citrix.com/topic/413582-3dconnexion-spacemouse-space-pilot-keys-ctrl-alt-esc-are-not-working-in-a-citrix-virtual-apps-and-desktops-19091912-ltsr/|https://discussions.citrix.com/topic/413582-3dconnexion-spacemouse-space-pilot-keys-ctrl-alt-esc-are-not-working-in-a-citrix-virtual-apps-and-desktops-19091912-ltsr/>


<https://support.citrix.com/article/CTX318804/3dconnexions-spacemouse-enterprise-display-not-working|https://support.citrix.com/article/CTX318804/3dconnexions-spacemouse-enterprise-display-not-working>


<https://www.reddit.com/r/Citrix/comments/g6in62/3d_connexion_space_mouse_on_citrix_remote_pc/|https://www.reddit.com/r/Citrix/comments/g6in62/3d_connexion_space_mouse_on_citrix_remote_pc/>

Thank you Ray, but that's about what I found myself. The mouse is redirected correctly otherwise I believe. Do you know if you have to fiddle with VID and PID's and so on?

I would definitely pass the vid and pid through. Especially if it’s being a pain. 

I suspect it’s using the generic USB approach as well?

If you by generic mean no driver so no, the 3DXware drivers are installed in the image. I believe that this specific mouse is not supported fully. :disappointed:

Look on the devices and see if it says generic or optimized.

<@U020YAVGU4Q> Knows about stuff like that I guess.

Does it give you an option to switch to optimized on the right? Just curious if it will change the behavior of how the device works within the ctx session.

I think the challenge here is for BYODs ... the biz machines are managed via intune etc

Only thing I can think of would be adaptive access. But it’s tech preview and Citrix has to enable it for use. Which from what I here they are slow to do. Direct access with workspace locations might help. I’m dealing with the same thing. Although my client has traditional Netscaler gateway, so EPA is available for me. Maybe <@ULEEXJUD8>  has some trick? He seems to have a lot of little gold nuggets:)

don't know if this might help, <https://docs.citrix.com/en-us/citrix-workspace/experience/workspace-app-settings.html|Customize Citrix Workspace app settings | Citrix Workspace>

otherwise a on-premises gateway and then some EPA

<https://docs.citrix.com/en-us/adaptive-authentication.html>

<@UR99U4W0Y> that's indeed a situation where we can help. deviceTRUST is fully byod capable and is actually used by several customers for that particular use case. Happy to talk and show you around!

Thanks, Sven... I will run some options by the client.. they are in the process of moving off of Citrix and its rarley used so I dont think they will be up for spending on it.. I have heard great things about DevieTRUST from a few folks :slightly_smiling_face:

<@UR99U4W0Y>, the new capability (tech preview) of Compliance checking/device posture check  (which uses the Secure Access Endpoint Analysis) is now a direct integration capability with Workspace. We are just now testing it a bit for some compliance checks. But on this, a reg key check might do the trick for a CWA check.  However, also, With Workspace, there is the Global App Configuration Service and Client App Management feature built-in there where you can dictate a min and max version of CWA that endpoints must have (and this is managed at the tenant level so doesn't matter if managed or not). I have just started messing with that also. This here says SPA, but it is Workspace in general as well for when it does the check. Our testing was specific to SPA first for a customer scenario <https://docs.citrix.com/en-us/citrix-secure-private-access/device-posture.html> and <https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/configure.html#client-app-management>

<@ULEEXJUD8> Isn’t the global app configuration service only capable to manage the plugins but not CWA itself (regarding min allowed versions)?

<@UL5TD2QM9> no, what's interesting with it now, is the "client app management" piece where now with latest builds, we can deploy the CWA, SCA, and even EPA agent with it and (cli only) determine min and max versions. I hope they get the min and max builds in GACS gui at some point soon.

you have to be at one of the latest Windows CWA builds first to start using it

I think Windows is only one at the moment perhaps

ah ok, did not check the CLI possibilities, thx

Yea, I like where they are going with this. They need to clean up GACS a bit more and get some more stuff over from the developer portal (CLI) to the GUI, but at least they are getting stuff done here to give us something to talk about

See, I knew <@ULEEXJUD8> would have the deep information :slightly_smiling_face:

Isn't the risk with workspace app on the endpoint side? I didn't think the CVE for workspace app allowed SYSTEM access to the VDA, just the machine running workspace app. If its a BYOD device, then the user should be an admin on their own machine. If it's a vendor machine, they should be responsible for their own endpoints.

Yea, but if they get system access who knows what a hacker could do through the ica channels 

Hey <@UR99U4W0Y>! Did you find a solution for this request?#

Anyone using 1912LTSR CU4 farm with VDA 2203 CU2 (RDSH hosts) ? I'm curious if everything is working properly

I went from CU3 to CU6 on my multisession dev environment, not seeing any deregistration issues on it, did you run the cleanup utility before you upgraded?

That will likely be your issue, clean uninstall + cleanup utility then start fresh

Think I do but not in the office right now...

I used <@UR9T47CRM> script
<https://github.com/Deyda/Microsoft/tree/master/Teams>

Number 4 in this blog if you would like to see how I run it.
<https://blogs.mycugc.org/2023/02/10/cvad-guide-ms-teams/>

<@ULLH5JGFR>  - you use the Teams - UserBaseCleanUP.ps1 script, correct?

i tried it and it didn't work.  the script w/o any errors but it didn't remove anything. so i just did a manual uninstall of MS teams and the teams wide installed.   Then i deteled the Teams folders in the user profiles.

uninstall-teams.bat

uninstall-teams.ps1

i've heard of a private one that recently is being looked at (asking a tech about it w/ a long running blue screen crash issue we're battling and waiting to hear back)

Any additional details? What model crashed?

i dont know much other than it had something to do w/ picadd.  You should be able to ask Citrix about it w/ this:  CVADHELP-21885    for my issue they are telling me its unrelated unfortunately even though picadd is what Microsoft tells us is the issue

UPS ? As far as I remember it’s really buggy product :confused: 

UPS all the way. We had trouble in the past, but that was many years ago.

We don't have print drivers on 90% of our VDAs (I work with <@UMNFGC0Q7>)

Update for anyone who may encounter the same issues:
• The problem occurs in all 2203 LTSR, 2212 CR versions and in 1912 CU6 LTSR
• The problem does not occur in 1912 CU3 LTSR
• The UPS version on the print server does not matter
• The problem does not occur on any version if the printer drivers are installed on the VDA

Did you report this issue to Citrix Support ?

Did you try printing without UPS ? (Just for testing)

No, we didn't report it (yet). We are a bit hesitent to open a case because we cannot reproduce the problem reliably.

Printing with the printer drivers on the VDA installed works like a charm, yes.

So source of issue seems to be UPS - speak with Citrix Support- as it seems to be another BUG :man-shrugging::skin-tone-2: 

Citrix support is a PITA if you can't reproduce an issue on purpose.

This might to the trick... the driver is MFA so its doesnt technically need to be a published Citrix App: <https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy>

Still have the domain/SSO issue thought... trying to find out if theres a quick short-term band aid to achieve SSO while the internal team either sync those domain IDs using AD Connect or migrate their site data / identities to the primary domain ... backend server is Sharepoint btw..