World of EUC

I think this is more a Hypervisor question as you need nested virtualisation support. 
For CVAD it's just an app with a GUI.

Thanks Rody.  Right, I did some reading on "nested Virtualization" this morning... I'm first just trying to find out if Docker Desktop (and WSL) are "officially" supported by Citrix....

I JUST got this working last week. It does work with Win10 multi-session. If you're in azure, make sure you're using a VM that supports nested virtualization

I have done this for developers. It seems to work fine. As long as you enable the nested virtualization part. Although the VDA had to have a bit more resources.

it’s not VDA version specific, we also have some guys running it on 1912 CU3.  2 main issues they encountered - 1 Proxy issues - 2 Performance (it needs more RAM than standard user VDI)

<@U02TDPX0M5G>, by "a VM that supports nested virtualization" you mean specific VM "sizes", right? Like E4s v3? Are there other sizes you might recommend?

Image from iOS.jpg

I can’t really suggest a certain size or series as this will likely be determined by your specific needs but you can look at these series to narrow it down for you. 

Specifically, I'm searching the MS docs to see if "D8s_v5" supports Nested Virtualization... Not finding it yet...

I think I went with a Ddsv4 but would have to check

Have I mentioned lately how badly I despise the way msft names these? 

I'm whipping through these MS sites, trying to find info on that specific Size, which our company has gotten a volume discount for...

image.png

"Carbon Black Cloud Sensor" My condolences...

there has to be a better way...i remember i had this issue years ago and it wasn't this difficult to figure out

It's usually not so difficult. I login with a test user, log off and then as admin I check which process releases the profile. But maybe there are better ways.

can you add winlogon.exe to log off sys reg key?  i thought that was already included to terminate when a user disconnects.  <https://support.citrix.com/article/CTX891671/graceful-logoff-from-a-published-application-renders-the-session-in-active-state>

According to the link you just posted it's hard coded already.

CU2 has fixes for zombie sessions, but in this case it just looks like you need to play whack-a-mole on the processes to find the one holding the session.

yeah, thats what it looks like. i think its the winlogon process.

I talked to <@UKJTJD4KA> about that problem. We are getting started on a DaaS Standard for Azure project, and our ephemeral VMs are soooo slow. The Disk read times are horrible. But this vanishes slowly about an hour after the VM startup. But the first 30 minutes they are terribly slow.

Hopefully you guys can contain yourself....

So this is basically the new version that's been available to consumer use in Win11 but for business right? I haven't used that new personal version too have an opinion to be excited yet or not:grin: I won't if we finally will be able to manage settings easier with GP instead of the stupid JSON file

I haven't used Teams on Win11 at all yet so i'm in the same boat

It SOUNDS good on the surface.... Hell even if it just loads quicker than it takes on CVAD I'll be happy. And the question of teams optimization still working or is that all back to square 1 again

With msft licensing hdx from Citrix now for AVD, surely to god they're going to continue with the optimization sh!t

That's good then... But I just mean hopefully they don't have to start over with redesigning that part. Can't imagine they'd willingly do that though

i'm sure not related but this morning i noticed my Teams did not open for me......when i launch it, i see the update.exe launch (normal) and it goes away and nothing.   i found if i manually go to the teams.exe does open fine and when it did i got this prompt.  once i restarted it like it wanted all opens fine and it SEEMED to open quicker than normal but i may be imaging things.  i did also clear my teams cache so i'd bet that helped w/ the faster launch

mcs persistent.....no profile management outside of Onedrive KFM

Not sure I get how it wouldn’t be legal 

Simple: I bought a perpetual license (expensive) and I pay for maintenance every year. Now my license is “evaporating”(converted to subscription) and I'm forced to switch to subscriptions which will cost more. 

Is it fair? 


In the same time new customer will be able to pay for subscription without initial cost (perpetual license). 

In my opinion, this could be the beginning of the end for Citrix… :man-shrugging::skin-tone-2: 

Fair and legal are two different things.  But in that vain, have you done the cost comparisons of what you paid and what your renewal is versus a net new customer to know that it is a material difference.  Also every software vendor out there either has or is in the process of moving to subscription.  Citrix isn’t doing something new to be fair to them.

It's time to verify the contract documentation. :man-shrugging::skin-tone-2: 

Check the listoffddc and see if it's updating. Or update it reboot and see. 

check the 3 usual suspects? like ray said, listofddcs, gpo, personality.ini?

I updated 2 of the 3 and it still pulls it from somewhere when the desktop service restarts

I didn’t think this was an mcs machine, I’ll have to check now

so auto update is supposed to check if the initial configuration method changed, which it did, and then skip getting the ddcs from the site, but it’s not doing that and it looks like it’s pulling them from the citrix policy and it’s overwriting the listofddcs reg entry

Just for shits and giggles. Update listofddc, run gpupdate and see if it gets put back 

I’ll have to tell them to move this machine to a new OU

local policy edit and forget it's there ftw

You can disable auto update of controllers via Citrix policy - i did this in most deployments and set them via GPP 

I can't remember which is which. I recall studio has a auto update but then I remember if using the GPO Citrix mmc has one. Just can't recall which is which at the moment. 

all the above, and check this path - ram across this a few times in the past - <https://support.citrix.com/article/CTX216883/vda-attempting-to-register-to-an-old-or-decomissioned-ddc-after-upgrade|https://support.citrix.com/article/CTX216883/vda-attempting-to-register-to-an-old-or-decomissioned-ddc-after-upgrade> 

Ive been dealing with this as well. If its an MCS persistent, check the personality.ini in c:\. That will override the policy or registry. If its not MCS, check the savedlistofddcs.xml in c:\programdata\citrix\pvsvmagent\brokeragentinfo (I think thats it).

Ive also found that it can be a pain if you try to use cloud connectors in a different zone/RL than your host connection, so make sure they match.

If its PVS based, the savedlistofddcs.xml could be on the cache drive, so check there too.

path is correct. references in article above. key is editing with ps exec need to be local system. all items in this thread should sort you out though. Good suggestions Brian 

Use the autoupdate policy set to prohibited.  Otherwise the vda uses the cached listofsids and not the listofddcs. 

Do you need to add a delay on the broker service? Or will it register fine after disabling the update policy and enabling list of ddc?

I  you may need to reboot twice to be sure

Yeah the auto update feature is great in theory but I seem to run into stuff like this a lot

I've been bitten before where people have rebuilt DDCs because they got ransomwared and nobody ends up connecting to the new one because that list of sids never gets updated properly 

The feature works fine, it’s a chicken egg scenario a lot of the time and an ordering of what kicks in when. Hence there is the option to turn it off via policy if the need is there, I personally turned it off in pretty much every cloud deployment ever and the same for site migration projects on prem 

I'm trying to do the same thing as Mike but with a on-prem MCS to cloud connector MCS machine. I know delivery controllers were specified during the VDA installation. I created a GPO to set the ListofDDCs registry value and it applies, but the broker service must start faster than the registry value can apply. On boot, the VDA registers with the on-prem delivery controllers. If I restart the broker service, it correctly registers with the cloud connectors. I think I'm going to have to re-configure the VDA to look for the ListOfDDCs instead of specifying them as manual.

Yep to use gpo you want to install with do it later. You could do things like start the desktop service with a script that first does a gpupdate but thats kind of a hack. 

I’ve moved this machine to a whole new OU and it’s STILL pulling policy off the old delivery controllers…

I think you are fighting information ON the VDA rather than FROM somewhere else.

there isn’t one, it’s not an MCS machine

Oh, i thought thats what you meant by a "cloned machine" - so it's essentially a standalone VM with no provisioning mechanism in it?

anything in the PVSVM folder for a savedlistofddcs.xml?

the reg key under policies is recreated every time the desktop broker is restarted, doesn’t this mean it’s getting it from Citrix policy?

interesting, that is one i have not seen before - it recreates the regkey? very odd

yeah, there’s no pvsvm because it’s not an mcs machine

so I’m at a loss as to how it keeps coming back, because it doesn’t show up in gpresult either

it’s totally ignoring the listofDDCs key in the non policy location too

Even after you set the update policy in studio to not update?

how does it know where to get the policy from if I delete the reg keys though?

ok, so I stopped every single citrix service and restarted them and now it’s fine

This is the part I keep going to man. Don't mean to beat a dead horse.
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/1912-ltsr/manage-deployment/vda-registration.html#auto-update>

[HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\VirtualDesktopAgent\State] “RegisteredDdcFqdn”

if you clone a server and don’t clear that out, it keeps going back to that server

<http://www.kylewise.net/citrix/xendesktop/how-to-migrate-a-virtual-machines-to-a-new-xendesktop-site/>

the problem with the citrix pages are they don’t mention those other keys at all

so now it’s not pulling policy from the old farm, but it’s not registering either…

Wow that’s crazy. I would run the VDA cleanup. Then login and just make sure nothing is prestaging those keys.

this is insane, the DDC doesn’t live anywhere in the registry, the group policy cache locations are all cleared, autoupdate is off in citrix policy, the C:\ProgramData\Citrix\PVSAgent\LocallyPersistedData\BrokerAgentInfo folder is gone, it’s not an MCS machine so there’s no personality.ini file and yet IT STILL TALKS TO THE OLD FARM

As much as it may be painful. Procmon time to see wtf is happening 

What version is the old farm? Just curious 

I was thinking before 7.15 maybe there is some crazy setting we missed

I hate procmons. Only because I suck at it

the insane thing there are no citrix policies defined

omg, the vda cleanup tool won’t even run on this

far out, even after running the cleanup utility an re-installing the new VDA, it still connects to the old farm

what if you put a host file entry in for the old controllers pointing to home

Oh my. I see the email from the unsuspecting frontline support agent now. “What have you tried?”

trying the host file now, going to reboot

its not a local policy set on the VDA with the citrix GPO add in added, is it?

that would still show up in the registry, I did a full search of the registry for the address and it doesn’t exist

it wouldn't be stored in the machine.pol file?

it’s the citrix policy engine that’s writing the reg key

it might be, I just deleted the group policy cache too

it doesn’t show the server names at all

there is no citrix policy at all other than turning off auto update

so I just cannot work out where this is coming from

Have you cleared this? C:\ProgramData\CitrixCseCache

I’m having issues as well. Not exactly like yours but similar. The Citrix Docs respectively need a bit of work around the VDA registration part. They do a good job in troubleshooting why it’s not registered in most cases. But really miss when adding more delivery controllers. They talk about it taking 90 minutes to update the cache locations but say nothing about needed to delay the desktop services to enforce registration (unless I missed it)There are so many little hacks folks do to make it work that the doc seem to not have. Am I wrong?

DAssuming MCS did you use the autoupdate prohit settings first so that the listofsids cache is not used.

Of course that assume the VDA was installed wiht do it later.  If not then you need to reinstall the vda wiht do it later

I will get back to you, I need to lab this out. I am going off what I client is saying. First I need to confirm they are following what you said on disabling auto update, then update listofDDCs.
even if that was not done, the VDA cache would get update after 90 minutes from what I am reading with the extra DDCs. is that accurate in your experience Rob?

The VDA was installed with the manual option listing the DDCs.

What are you using for profile management 

are any processes still running under the old user session?  If so, have a look at adding them under the logoffchecksys registry key.  Other option is the filer not releasing the open files for FSLogix, when the second account logs on, does fslogix create a chained container? If it does, that means that the first fslogix container has not been released properly

Do you see the session in Task Manager with some processes? 

<@U023HEDJVH8> when this occurs are you seeing their vhd/vhdx hung as well?

Thanks guys! I will look into you suggestions! <@U02TDPX0M5G> no, they appear to be released.

not seeing this on my Server 2022 Standard 20348.1487

gonna patch my image and re-evaluate after :wink:

I have used it in past you need the Webex VDI plugin on the endpoints and the Webex HSD VDI client on the VDA

We're using it. To be clear, you're using the Webex app and VDI plugin from here? <https://www.webex.com/downloads/teams-vdi.html>

Also, which part is not optimized - Webex calls or meetings? Those require two separate plugins on the endpoint. You need the VDI plugin from the link above - and it must be close to the version of your site - as well as the Webex Meetings Virtual Desktop Plugin from here: <https://help.webex.com/en-us/article/glj57y/Webex-Meetings-Virtual-Desktop-Infrastructure-release-notes#_ff8dd002-55da-4c64-a481-32a465c09fc1>

You can validate both by running Health Checker in the main Webex app, then Health Checker once inside of a meeting (obviously you can see that Webex meeting is gray and says 'Webex - VDI' in the titlebar to verify this, also).

Thanks Nick. Yes that's what I use. So far my testing was for meeting only. Health checker show the virtual channel disconnected. I probably miss the desktop plugin you mentionned, I didn't install it, I'll try this, thanks!

That was the issue, after the desktop VDI install, it worked except I can't connect the audio because the certificate can't be validated (I was using the test webex meeting). I'll do a bit of research, thanks a mill!

Yes. I even start to see this AGAIN on 1912 CU6 or 2203 CU2. :face_with_symbols_on_mouth:

lol.  there's like a thousand page thread in here on that.

This would be the fix:
- Registry value HKLM\SOFTWARE\Citrix\Ica\GroupPolicy EnforceUserPolicyEvaluationSuccess DWORD 0
- Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Reconnect FastReconnect DWORD 0

<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1654035681089039>

i want to stay on 2212 if possible because of the security bulletin they posted last week.

You don't have to change from CR to LTSR. Reg Keys should do the job :)

that is perfect <@U015MJK0XBM>. thank you so much!!

Director will display an error if the license server cannot upload telemetry data. I know because I inherited an environment that always had the error because we use a secure proxy to get out to the Internet. You have the ability to turn off telemetry within the license server preferences, which will make the error go away. With Citrix changing their policy on the telemetry feature, you will want to leave it on. If it fails to upload, Director will tell you.

Thanks for your answer.
This is somehow strange - I'm sure that our license server can't connect to the internet. But director shows no errors in my case.

Does someone know if the newly required telemetry data can be verified online?

Is it required to register the License server at <http://cloud.citrix.com|cloud.citrix.com>?

Go to your Citrix Licensing Manager and sign in. Go to Settings &gt; Usage and Statistics. At a minimum, the second option of "Help improve Citrix..." must be enabled in order to send in telemetry data.

i have articles on my site that shows what changes between each release. you can also download the excel file of all the policy default settings for, iirc, 7.0 to 2212

Hi guys, just a short question: Has anyone been able to run plain RDP (on-prem) mstsc.exe with the dynamic resolution:i:1 property (Resizing mstsc windows changes resoultion inside the rdp session)
No problem on AVD, works just fine - however reading these docs it should also work on-prem?
Smart Sizing (Dynamic Window size scales the rdp session) works, however the resolution is not changed.
With the Store RDP App it also works.

 <https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/rdp-files>

For persistent VDA upgrades? Yeah, it's a bit of a pain if you want to ensure that it completes successfully. In a perfect world, simply running the new VDA installer will handle it all, but that's not always the case. You can give it a try on a small subset of VDAs to see if it'll work for you.

At my place, with our images not exactly being clean, we have to jump through the hoops. Run VDACleanupUtility (4x, reboots in between), run the MS VC++ installer, reboot, run the VDA installer, reboot, validate that the RunOnce entry is gone (if not, run the XendesktopVdaSetup.exe to complete the VDA install), reboot, done. It's... a lot.

Just ran a simple quiet install of 2203 here now, and it does not seem to complete all the way. I see that some services are installed, but the VDA version info is not updated... pain..

Sounds like you'll be boarding SS DoItTheHardWay with the rest of us...

The process works, it's just time consuming. The sheer amount of reboots is insane thanks to the VDACleanupUtility.

Well... I'll have a chat with the apps-team... they have an uncanning way of finding some neat solutions sometimes... not that I think they are that better than anyone else that have tried and failed, but it's worth a try.

<@ULC9J5XPB> I know it works... it just that you have users, then you have demanding users. And then you have... other users, that NEVER want to boot... ever..heck no...

Yeah, just have to schedule those ones for after hours. We use SCCM, so it gives us more leeway on how we upgrade.

Yeah, we can use SCCM as well. The trouble is that these users use the VDIs for simulations and stuff, and they can run for days. They don't react kindly to sysadmins that needs to patch something within a reasonable time frame.

At my last place, we used to let people defer 3 times before it forcibly installed. They can whine all they want, but this was happening.

If they had their way, they would never log off. In fact, in the old days we had users that stayed logged in for months... on Windows 7. I'll never complain about uptime and stability in Windows again. :stuck_out_tongue:

Oh yeah, we had people who used to go nuts over our timeout values. Thankfully I just referred them to InfoSec and went about my day.

Yeah, of course Nick, if they have to suffer a reboot they will. But they will also complain and bicker and cry... :stuck_out_tongue:

I serve a demanding set of users here.. :slightly_smiling_face:

I had a look at automating this in another environment a while back and i ended up just manually upgrading all the servers as trying to make it work using command line just wasn't worth the hassle. So yeah, same experience here

<@U032F1660BX> make sure to install latest VC++ before installing vda automatically.
Microsoft enforces a reboot if you upgrade VC++.

^This. We added that as a step in our SCCM task sequence thanks to the Citrix installer failing to install that prereq consistently.

This is our sequence in a nutshell:

1. Run VDACleanupUtility
2. Reboot
3. Run VDACleanupUtility
4. Reboot
5. Run VDACleanupUtility
6. Reboot
7. Run VDACleanupUtility
8. Reboot
9. Install VC++ 2015-2022
10. Reboot
11. Install VDA
12. Reboot

If it's a recent VDA the cleanup utility should not be needed. But you might need to reboot during the upgrade though

Simply running the upgrade installer natively resulted in something like 50% failure rate in my staging environment. Had to resort to the old faithful cleanup utility.

Would be interesting to get the logs of the failed upgrades to see what's going wrong

I'll give it another go if we move forward with a different CU, but we have BSOD issues in CU2 so we're sticking with 1912 CU6 for the foreseeable future.

<@ULC9J5XPB> We had BSOD issues after a VDA upgrade as well a while ago, turned out to be a conflick of some sorts with the ControlUp agent. Seems like they've sorted that out in the mean time, the issues is gone now.

<@UNBRPVD4G> I'll have a look into VC++ as well, thanks for the tip. Can't remember, does installing VC++ on its own require a reboot?

We force a reboot post-VC++, which I've always found to be necessary.

If you would upgrade VC++ a reboot is definitely required, not so sure about when it's a fresh install. But I would install VC++ x86 &amp; x64 and then reboot.

Request for help.....does anyone have a Windows 10 single-session VDI environment running over Citrix with MSIX apps? If you do, can you tell me, do the MSIX apps launch OK, or do they blue-screen the device? It doesn't always happen on first run (although it does sometimes), but by the fourth or fifth, I always manage to generate a BSOD. I see the same behaviour in my lab as I do at a customer, so just wondering if anyone else can verify that this is a thing, or is it something I've managed to generate via my own configs?

Yea I will DM you some stuff in 10 minutes

<@ULLH5JGFR> would your guide have any tips  on how to eliminate the memory leak acrobat has?

Hi Ray, do you have anything to share that might help me?

CVAD_ Adobe DC pro in a non-Presisten.docx

Here is a doc, that contains great resources for Adobe in Citrix. Tuning aspects, License difference, and contains some of my notes.

I had positive experience with vdi and nul licenses, does anyone have experience with serial licenses or with offline activation on a published app?

If anyone had another other tips, Please share :slightly_smiling_face:

You got some great notes on app configs and app installs in citrix <@ULLH5JGFR>. I used to have my own but lost them a while ago :sob:

Well, you have some great other material that saved me many times :slightly_smiling_face:
Great NS stuff

Short of finding the GUID for every component and manually uninstalling them all, I'd just opt for running the old Receiver cleanup utility: <https://support.citrix.com/article/CTX231094/citrix-receiver-desktop-cleanup-utility>

Might want to uninstall using the product that was used to install it, obviously it was installed using the system account (see install source). Perhaps a simple PSEXEC -SID cmd.exe already does the trick, drop the uninstall string in there and it will run as system.

<@ULC9J5XPB> old receiver cleanup utility didn't work

Or
`"C:\Program Files (x86)\Citrix\Citrix WorkSpace 2302\TrolleyExpress.exe" /uninstall`

Outside of doing that. Sorry, should have noted that.

Tag it and create a new Delivery Group or desktop?

Okay, that was actually what I was thinking of trying next - new DG with a tag on the specific VM. Thank you!

If all you need is a specific desktop, you don’t need a new delivery group. Just another published desktop with tags. 

I wrote a script to get the users and groups assigned to a DG, yes. See if this is what you're looking for (it has some extra info):

```$ErrorActionPreference = 'SilentlyContinue'
Clear-Host

$Log = ".\CTX-GetDGUsers.csv"
$Results = New-Object System.Collections.ArrayList
$Results.Add("Broker,DG,Username,Name,Email") | Out-Null

$Brokers = "CTXBROKER1","CTXBROKER1"

ForEach ($Broker in $Brokers) {
	$DGs = (Get-BrokerDesktopGroup -AdminAddress $Broker | Where {$_.Name -like "*GroupName1*" -and $_.Name -notlike "*UAT*"}).Name
	ForEach ($DG in $DGs) {
		Write-Host "Querying " -NoNewLine; Write-Host "$DG" -ForegroundColor Green -NoNewLine; Write-Host " on " -NoNewLine; Write-Host "$Broker" -ForegroundColor Green
		$Users = (Get-BrokerAccessPolicyRule -AdminAddress $Broker -DesktopGroupName $DG | Select -ExpandProperty IncludedUsers).Name | Select -Unique
		ForEach ($User in $Users) {
			$ADDomain,$ADUsername = $User.Split('\')
			$ADUser = Get-ADUser $ADUsername -Property * -Server $ADDomain
			$DisplayName = $ADUser.DisplayName
			$Email = $ADUser.Mail
			$Results.Add("$Broker,$DG,$User,""$DisplayName"",$Email") | Out-Null
			$ADUser = $Null
		}
		$Users = $Null
	}
	$DGs = $Null
}
$Broker = $Null
$Results | Out-File -Append $Log```

can you please test the script of <@ULJM9DQF2>
<https://github.com/guyrleech/Citrix/blob/master/Get%20Citrix%20OData%20data.ps1>

An other idea here <https://github.com/Mohrpheus78/Citrix/tree/main/Citrix%20Client%20notification|https://github.com/Mohrpheus78/Citrix/tree/main/Citrix%20Client%20notification>

I have disabled the revocation check in a bid to get the going again but its still not grafting... I also see this:

The FAS servers/console looks healthy, IVe tried re-authorising etc, all green... ideas welcome :slightly_smiling_face:

No updates.. by the looks it started happening at 2pm on Friday...

The revok check errors have stopped since I disabled the check... but users still get the logon prompt when launching and app/desktop..

Got this from the VDA... its a revocation issue for sure...

Do you have access to the CA? If yes, check pkiview.msc for errors regarding CRL and CDP publishing

The revocation check is performed in every stage where a certificate is used.
We had the same issue after the server that hosted the CRL was moved and the firewall wasn't updated.

You can open the intermediate cert and find the URL used for CRL check there, and see if there any respons from that server via a web browser or similar.

Awesome... thanks lads will have a look :slightly_smiling_face:

Odd.. I confirmed the revocation http location... I can dl the revoc file/list from the FAS servers and VDAs..

Is that URL using http or https? If https, maybe the certificate has expired?

CRL / AIA / OCSP needs to be golden, you can't just change it and expect it to update, every cert needs to be renewed then for revocation checks to be active. HTTP is the normal standard for this and if it's still default everything gets bloated in ADDS

Also, check the event log on the CA server, that might contain more details.

re-publish your CRL and also do a new pkiview.msc and revoke the CAexchange cert so that it gets an update and will not use the cache

Cool... FAS servers are configured as Subordinate CA... does it need to be the root? I will have a look and see if anything of interest..

no that doesn't make any difference it can be a subordinate or root

is your root still looking at a active CRL as well?

that one also if you do it correctly needs to be turned on again lets say every year for CRL publish (if you have an offline root ca)

ahh ok.. the root is offline and has been since FAS was setup.. and I think it was about a year ago..

I think you need to turn on the root and publish/copy the CRL file to your CRL location

Got it... the root is online but Ive not got access... trying to get someone that does, cheers

but a pkiview.msc should also show you that

the root will have a red thingy cross on it's CRL

Yup.. thats it Henry... I can see it expired on Friday...

yeah.. and it's also a bit yucky with file locations being published as a valid CRL

normally you don't want to see anything in there besides a valid HTTP location

Tip: leave a task for your self in the calendar 11 months from now to update this.. :slightly_smiling_face:

Thanks folks, so in order to fix this I will need access to the Root yeah?

yes correct, they need to turn on the root

publish a new CRL file under the revocation tab

copy that out and put it on the location where it servers the CRL for clients