World of EUC

I think they use basic AG. Which does what you want. I think!

i just don't understand what they mean about the windows clustering part

I think and I am not a SQL guy by all means, The Cluster part that Windows offers maybe

Back in the day, I used SQL cluster that was not AG based, which ran on WIndows cluster services.

image.png

i guess these means you can use the cluster to failover the databases to the secondary node.  You have to do them seperate

have you ever done a multi-subnet configuration with SQL Always on using SQL standard

This is my extent of SQL
<https://blogs.mycugc.org/2022/09/06/how-to-setup-citrix-wem-with-a-sql-dag-netscaler/>

The issue with the BAG on standard is that you have to create one for each DB, monitoring, logging, and site, and they fail over independently. So you might be running off 2 nodes if you’re not careful.

There’s logic you can put in place but none of it is built in

It appeared to be related to a bad CRL repository on the CA's. There was an LDAP based repo and a HTTP repo and the latter was in an "unavailable" state. This was resolved and we have not heard of the issue re-occurring. Kerberos logging was helpful in tracking down root cause and can be enabled via registry.

Sounds similar.  We found the issue to our problems; it seems the old CA server did not have a proper CDP/CRL configuration therefore all the certificates’ issues by it had the CRL pointing to the LDAP location of that server. When that server got decommissioned it caused CRL smart card failures because it couldn’t find the LDAP location of the old server. We end up removing/rea-adding the Citrix Smart Card certificate template, forcing all Citrix users to get the new smart card certificate from the template, renewing the Kerberos Authentication certificate on all our Domain Controllers (so it can have the correct CRL) and rebooting all Citrix Servers and Domain Controllers. This finally corrected the issue.

Hi Aaron. 200% local will be 125% on the VDI Desktop. Forgot to mention in the previous post. At least consistent over all connected screens.

How does this work? I would have thought 200% local is 200% remote.

That is the big question. It should work like that

You’ve also said “Double Hop Session will be 400% DPI.” - I don’t understnad what’s going on there

Going to open a support case. Just wanted to ask if anybody is seeing similar things.

Regarding Double Hop Session -&gt; When you launch a published app (Silo) from the main desktop (Win10) the app will be double as big as the screen DPI value. “EnableDPISupport” is enabled for 1912 VDAs. But it does behave the same with 2203 CU2

Hey Julian, can you create a CDF trace from client and vda while your connecting and share that?

Also, can you share a screenshot of which dpi setting you are using in the workspace app?

HI Rody. I will capture the traces the upcoming week. Thanks for your help

I would love to hear if it was. I gave it a go for a few customers early on years back before that last update and had instability issues mainly with some HP drivers and had to abandon using it. I haven't tried the more recent builds that have overhauled it a bit. Would be great to know if it is working good for any at medium to larger scale.

That's my point too :slightly_smiling_face: , I need to build 2 print server for more than 1500 printer queue

windows print server wouldn't work in this scenario?  i have about 110 printers setup like this on 1 vm, never an issue

Different concept. This solution allowed for only a single universal driver (similar to dynamic printers) in image for all session printers.

I will use it for a customer who have a print server with more than 150 different drivers. I will use Citrix UPD in most case and some native drive for specific printers.
I hope Citrix Universal Print Server has evolve with years !

And it can load balance between print server which is very convenient because Microsoft have stop print server cluster

yeah never install print drivers onto your image, either use Citrix Universal Print Server or some startup scripts that install the drivers at startup but only on the production vms, not the master. That way you will keep the master image pristine.

Consolidate print drivers using universal print drivers on your print server

i have the hp universal driver in there, honestly its the only one i use anywhere

Have you tried associating PDF with another reader?

I had the problem with Acrobat, but I don't think it's just Acrobat...

Other users also have the problem, unfortunately I have no information about which program or file causes Windows File Explorer to close.

So other users opening other file types also makes file explorer crash?

The problem appears in different constellations.
A regularity cannot be determined.

i've used this before - <https://github.com/ryancbutler/XDReplicate> <@ULD1T5RND>

I'm fairly sure that Citrix DaaS is always current release with support for LTSR VDA

Maybe more advanced than a Cr :slightly_smiling_face:

Yea it's CR, but I agree in my opinion tad bit advanced that CR.

Maybe it can be related to the connection path to the vda . If there is a cloud connector far away from vda ? users will go through. So were the vda are registered on ? Directly with rendez vous protocol or with a cloud connector then where the cloud connector is located.

Hi Mathiue, thanks for the feedback.  it works fine when users are using the VDA (cloud) that is connected to the cloud via the connector, but does not when they VDA (Cloud) is connected to on premise delivery controllers.

You have to have in mind the connection path, in cloud user connect to the Citrix cloud "storefront" enumerate then go to the vda using the cloud connector ( as a Citrix gateway) then go to the vda.
I guess you don't have an on premise Citrix gateway. So I think user still going through the cloud connector (in cloud) then take an VPN/express route to the vda located on prem. So. Long trip. It can explain. To solve add a cloud connector on premise

So the site where they are having the issue, the DDC and SF is on-premise but the VDA is in Azure.

The site where they don't have the issue, the VDA is in Azure, and the access layer and control plan are Citrix Cloud services.

In the non working scenario, user access to the on prem storefront?

If it is this scenario, you should investigate about the network route user take to reach the vda

You probably go through a VPN or an express route and maybe the link is too small

in the Non-working scenerio they use on prem storefront

You need to focus your attention around the bandwidth and this express route performance

So two different brokering points. Are the policies different across cloud/on-prem?

anyone know of any issues any of these drivers could cause on Windows 10 VDA in Azure.  I have client complaining that their users sessions freeze when they play videos.

Not sure of a definitive answer but I have stats monitored there on our m10 GPUs

Hmmm okay. Nothing else you needed to enable to get it to show up ?

Nope, it only shows the last minute of data and that sampling only takes place when I have it open.  But I didn't do anything (other than standard hdx3dpro setup /grid driver installs )

Okay, same here and it is missing. Using the A16 cards. I know it is working because I have this to show me

They are 2203CU1, I need to check the know issues now

FWIW this worked on our setup since VDA 2006, and I see it working on our 2203CU1 and CU2 devices

And you settings looks pretty close to what we have (we just don't force build to lossless)

Hmmm, wonder if its because it's a mult session device in my case!

:thinking_face: that could be it, we are single session only here

yea, that may be in this case. I will test with Single session and see soon. Thanks for the quick feedback though.

This?
<https://www.htg.co.uk/blog/redirection-in-citrix-xenapp#|https://www.htg.co.uk/blog/redirection-in-citrix-xenapp#>

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/general-content-redirection/host-to-client-redirection.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/general-content-redirection/host-to-client-redirection.html>

Hmm, interesting.  I wonder if I missed this somehow?

Thanks for the post, will check to see if this will suit the user need.

Not something I use but I ran into by mistake a day ago. 

I wrote that first article, it is pretty old

Have you tried running AnalyzeLogonDuration (<https://www.controlup.com/script-library-posts/Analyze-Logon-Duration/>) yet? That would be my first stop. If you're on FSLogix, I'd also check the container log. At my last place, we ended up having a storage issue that caused similar results to what you're seeing, and it was reflected in that FSL log.

Not sure I can get a script into this environment, but will have a try

You can do it manually... I never use ControlUp for this

Unless you mean you can't run a script (needs to be run as an admin)

It's a locked-down environment, so probably blocked for admins - will see what I can do with my pentesting knowhow though

FWIW, this is what I do:

1. Copy the script locally to the VDA you want to test on
2. Run the following against that VDA:
```Invoke-Command -cn Hostname -scriptblock {auditpol /set /subcategory:"Logon" /success:enable}
Invoke-Command -cn Hostname -scriptblock {auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable}
Invoke-Command -cn Hostname -scriptblock {auditpol /set /subcategory:"Process Termination" /success:enable /failure:enable}```
3. Logon to that VDA with your normal account
4. Run the following to execute the script (elevated):
```powershell -executionpolicy bypass -file ".\AnalyzeLogonDuration.ps1" domain\username```

Does that analyze *all* logons? This is RDSH and I'm interested in a specific user

I've never run it on XA, but I imagine it would since you need to specify the user to query. It's using that user when querying the events to build the logon times.

Sorry, I didn't see the username bit in the command line, cool

Well dammit - the script reports the logon as 38 seconds whereas Director (and the user's own experience) report it as 126 seconds. I'm still 88 seconds missing :disappointed:

Are you actually seeing the logon take that long? Director being right isn't always an easy pill to swallow...

As is usual, the user account I have has no such issues. But when i first came in they were complaining of long logon times (some outliers are 10mins+) and the Director data seems to reflect what they told me

That makes me ask, are the long logon times all happening in a certain  window of time?  Could be something environmental that happens at specific time periods,

If it is time related, are others outside of the RDSH farm seeing similar delats?

Only got a week's worth of data so difficult to say. Also session hosts are experiencing quite a lot of hangs which I am trying to fix. It may be that fixing one issue depends on (or precludes) the other

the other things I was thinking is, how many users are reporting this?  Since the account you ran the script with isn't seeing this issue, maybe it has to do with user config(s).  same RDSH hosts?  The more data the better to try and find patterns  It's never help to just get the anecdotal, "Everyone" says it's "Really" slow....

Example of the discrepancy shown below (196 seconds total but the elapsed time for each logon phase in Director is nowhere near that)

who's hosting an AMA? :slightly_smiling_face:

I thought this wasn't dropping until the 8th?

or is something else dropping on the 8th....

correct, citrix just released a little more information on their blog

so for universal licenses, can i setup multiple on prem Sites and use the Cloud all simultaneously?  And for the Termed licenses, can I run VDAs in the cloud (with or without using a hosting connection)

Can confirm, you need to enable the policy in Studio and either set it to Enabled or Disabled.

Set the policy beforehand and you're all good.

By default, the VDA makes the call, and since by default in 2203 everything is blocked, that'd be the result without telling it to open.

I need to see if the policy even exist in 1912. I have no idea.

You running 1912 anywhere in your enviroment?

Sure am... getting you a screenshot right now

Ahh I see in the 1912 docs "By default, the Virtual channel allow list feature is disabled."

Yeah, everything allowed by default in 1912. Reversed in 2203.

I still think the decision to reverse this by default is dumb.

Until 1912 cu4 it’s open by default. With cu 4 citrix changed this in 1912 and the Virtual Channel are closed by default :sweat: 

Good to know that. I thought they would not make any changes lol oh well.

Is that accurate? I thought the policies were created as of like CU2, but not the functionality change.

<https://www.citrix.com/blogs/2021/10/14/virtual-channel-allow-list-now-enabled-by-default/> says 2006+ by default

Yep I know what u mean. We were all very surprised, because this change was a very little note in the readme of cu 4 :sweat: 

We're on 1912 CU5, don't have this policy configured, but Webex and ControlUp VCs work fine...

Yep 2006 cr and 1912 cu 4. trust me. I had so much customer with this update and they all gone nuts because the third party tools (controlup, Devicetrust and so on) doesn’t work after the update. Nobody had a glue at this time, because we all had in our minds that in ltsr that changes are not allowed :clap: 

Maybe u configured it. If u have it not configured. The default changed from allow to deny. 

<https://kb.devicetrust.com/configuring-citrix-virtual-channel-security|https://kb.devicetrust.com/configuring-citrix-virtual-channel-security>

Oh sry it was 2109 current release and cu 4 1912 ltsr

This was my default article for my customer :joy: 

Interesting. I seen this at another place and they had invanti. I don’t know if that is the issue but I did see that.

Presense status doesnt work in outlook if you exclude SFB i had the same issue and had to include SFB in my configuration.xml

FYI, there may be a private hotfix for this. I've been following this thread since last May: <https://discussions.citrix.com/topic/413111-teams-presence-addin-not-working-in-oulook/page/2/#comment-2097670>

I saw this one, I hope they will share the fix (or case number) :slightly_smiling_face: 

I love those posts. "Hey everyone, MS gave me a fix and it works... seeya!"

Interesting
<https://techcommunity.microsoft.com/t5/microsoft-teams/display-online-status-next-to-name-in-outlook-greyed-out/m-p/730571/page/2>

Came across this on Reddit today, for anyone feeling bold: <https://www.reddit.com/r/Citrix/comments/11r2vnx/teams_presence_missing_in_outlook/jc6hpuj/>

Awesome, I'm adding it to my 365 Apps install script

What I find weird are the tlb files these match those located in "C:\Program Files (x86)\Microsoft\Teams\current\resources\assets\tlb"

yep these files looks identical to me.

I have registered uc.tlb and uc.win32.tlb with REGTLIB.EXE and it changed nothing. What am I doing wrong?

3 hours later...I got it working.

Here's the best install script for Teams VDI :grin:
<https://github.com/JonathanPitre/Apps/blob/master/Microsoft/Teams/Install.ps1>

You're welcome.

Thanks <@ULDHJB8BB>, is the reboot necessary?

nope, just restart Outlook. Teams must also be launched for the presence to be reported.

It doesn't work, maybe I'm doing something wrong...
`Copy-Item "${env:ProgramFiles(x86)}\Microsoft\TeamsPresenceAddin\Uc.tlb" "${env:ProgramFiles(x86)}\Microsoft Office\root\Office16" -Verbose`
`Copy-Item "${env:ProgramFiles(x86)}\Microsoft\TeamsPresenceAddin\Uc.win32.tlb" "${env:ProgramFiles(x86)}\Microsoft Office\root\Office16" -Verbose`
`Start-Process -FilePath 'D:\officedeploymenttool_16026-20170\regtlib\REGTLIB.EXE' -ArgumentList "${env:ProgramFiles(x86)}\Microsoft Office\root\Office16\Uc.tlb" -Wait`
`Start-Process -FilePath 'D:\officedeploymenttool_16026-20170\regtlib\REGTLIB.EXE' -ArgumentList "${env:ProgramFiles(x86)}\Microsoft Office\root\Office16\Uc.win32.tlb" -Wait`

I couldn't make it work using variables with the regtlib.exe command, try with the real path.

yeah that took me hours of testing to figure it out.

I was always on the daily bus unless there was a damn good reason not too - the more frequent, the more stable

I would be on the more frequent bus, but management doesn't like the idea of users not being able to connect at all times, day or night. We have a weekly maintenance window, but aren't allowed to reboot weekly, only can use the maintenance window if there is actually something to change that requires are reboot. Really we end up rebooting about once a month unless a server has issues. If we were to restart more often, the servers would probably have less issues in the middle of the day...

I recommend nightly where possible to my clients, but most go with a Sunday on/after 12 AM schedule

We do every other day.  1/2 one day and 1/2 the other.  Leaving it up for users to connect at all times.   Also drain users for 8 hours before reboot.  On avg we end up kicking 10s of users out of 1000s that connect

The only time my hosts get rebooted is when they are rebuilt at the end of the month. If you don't need to do it, you don't need to do it

I’m sticking with daily, preventative goodness with no downsides if scheduled properly :man-shrugging: to each their own though, whatever works really 

Daily. I've setup 2 groups of servers. One for daytime and one for nighttime using tags. I have scheduled tasks that take the daytime ones out of production so they can rebooted and the nighttime ones are made available overnight. Then around 5 or 6 the maintenance toggles and the daytime ones become available and the nighttime ones go out of production and are booted later in the morning. I've got a PowerShell module to do the maintenance toggle and I "borrowed" <@ULLRRJRHC>’s invoke-RebootXDMaintDevices.ps1 script to handle the user logoff and reboot.

My question to the team is, "Do you find that you NEED to reboot frequently or has it just become a BEST PRACTICE?  I remember, back in the day, that we HAD to reboot frequently because apps had memory leaks and wouldn't release resources when terminated.  And this was exacerbated in an multi-user system since many people ran those processes.  Do you still find that that is the case or are apps behaving better in the 2020s?

My point exactly. This is why I've ended up with my first ever deployment with no reboot scheduled (admittedly we're not doing "tough" applications). Reboot schedule was preventative maintenance that seems to have become mantra

The main reason behind why we do it is keeping the PVS writecache clear. We have a couple of apps that can fill it up like WebEx or Zoom installs and OneNote. I'm going to test moving at least OneNote to a container to see how well that works. I'm not sure you can prevent WebEx always installing to the  user's profile when it launches.

Fair enough when cache is in use. We don't do PVS or MCS

I think there's an increasing tendency to try and avoid "preventative" steps like this if IT teams are being held to external SLAs and audit. We have customers who run synthetic availability testing on services they use from MSPs / or silo'd different teams in their own organizations... for teams running operations where their end users or customers hold them to account for downtime / users kicked off etc... unnecessary maintenance time takes away from the time they have to resolve real issues and still meet SLAs and they can get questions why was big-bob-working-on-his-super-important-powerpoint kicked off at 2am.... because the systems a bit flaky and we turn it off and on because we don't really know why conversations etc... when there's a clear service / user delimitation the customer is more likely to expect always up...

for those that don’t reboot nightly, when are you doing FSLogix compaction?

100% in my experience it’s been warranted across many verticals, particularly health, else you look at a farm and admins are constantly fighting fires with maintenance mode on dead hosts which typically don’t have problems if you bounce them. MCS and PVS

<@ULLAD12P2> didn't know you needed to do a reboot to compact? We run it on a schedule, if anything is in use it is ignored

I wonder if <@U011AT3EESK> has any official/jim best practice advice around FSLogix's needs?

if you don’t have session limits and you don’t reboot, when is it not in use? I’m running into this with a client now

they stay logged in for a month at a time

You gotta get all Mike Streetz on them users!

I’m back in the consulting world, if it were my environment they would get kicked off every night

Don't forget to enable natural reboot, only available through Powershell for some unknown reason. <https://developer-docs.citrix.com/projects/citrix-virtual-apps-desktops-sdk/en/latest/Broker/New-BrokerRebootScheduleV2/|https://developer-docs.citrix.com/projects/citrix-virtual-apps-desktops-sdk/en/latest/Broker/New-BrokerRebootScheduleV2/>

If someone at Citrix is listening this must be added to the GUI.

QQ - I got a new server 2019 image (previously used 2016) so i built a new RDS license server with same OS version (server 2019) which is activated and added to terminal services license server AD group. I installed Windows server 2019 Per user cals via the MS clearing house using the EA number and i plan on changing the RDS licensing GPO to point at the new RDS license server (FW rules are good) is there anything i have do with the old RDS license server / CALS ? do you have to return the old CALS or deactivate the server via the ms clearing house?

At my last place, our 2016 VDAs were all on Defender, registered in MDE.

Thanks, Im gettign conflicting info about them going into intune verse MDE. Do you recall any license issues with users logging into a shared desktop like citrix? (With defender being user based lic and a lic count(

interesting. MS appears to contradict by posting this <https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/how-to-manage-microsoft-defender-on-windows-server-via-intune/ba-p/3713195>

and then this.  <https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/how-to-manage-microsoft-defender-policies-with-intune-on-non/ba-p/3724894>

I never dealt with the licensing side, thankfully.

You can’t enrol Windows Server into Intune, but what you can do is configure Defender policies for devices enrolled into and managed by MDE. This allows you to configure Defender policies in a single location instead of across Intune and MDE

Or you can can use config manager and then apply intune windows Defender/Firewall policies to config manager controlled machines via tenant manager per the first article above. Quite a mess and I’ll think I’ll stay with just MDE for servers. 

Yeah, it was much easier for us (Citrix team) to use a GPO for Defender as opposed to letting the SCCM monkeys tinker with it. We had zero issues with our implementation, whereas they had... a few.

Just build the policy and forget about it.

no, it works also when you restart the machines from studio

Note: it does not work if you restart the machines from the Windows Operating System

I'm so sick of this issue with office, aad and citrix cloud

You could pull out the registry /file inclusions and exclusions from the Windows settings groups in the ivanti template. There is quite a few I seen that I haven't personalized in the past

They copied it from Ivanti Workspace Control AKA the successor of Appsense :rolling_on_the_floor_laughing: 

run this on one of your ddcs.  It should spit out the vm or snapshot used for the image.  Just replace the $CatName variable with yours
asnp cirtix*
$CatName = "W10NDJMCS"
$Cat=Get-brokerCatalog -Name $CatName
$ProvScheemUId = $Cat.ProvisioningSchemeId
$ProvScheme = Get-provScheme -ProvisioningSchemeUid $ProvScheemUId
$ProvSchemeName = $ProvScheme.ProvisioningSchemeName
$Image = $ProvScheme.MasterImageVM
Write-host $Image

If you click on the catalog then look at Details it will lsit the disk image which doesn't tell you exactly but will tell you the top level

that doesn't help me determine the master image name

Otherwise you need to look at the metadata on the provscheme

Do any versions before RHEL 7.7 work with FAS? I’m trying to get it to work on 6.10 and it doesn’t write anything to PAM.d