World of EUC

Anyone using Amazon WorkDocs Drive in CVAD?

I run it Ubuntu and is a forwarder from AD

For WEM you have the memory optimizations set? What is the polling interval? 

Its set at the default for that. value is 120 minutes

Which means i need to set my page file way bigger then. My VA servers are 20GB of Ram. That would be a huge page file.

Do u follow the 1 times the amount of ram page file rule?

I had to go back and read this "When the user restores Internet Explorer from the Task Bar, it will initially run in its optimized state but can still go on to consume additional RAM as needed.
When considering how this affects multiple processes over multiple user sessions, the result is that all of that RAM freed up is available for other processes and will increase user density by supporting a greater amount of users on the same server." So it will use page file while its doing nothing or no interaction, then once they use ot it will go back to ram?

Sorry for all the questions, just trying to gather my thoughts

Not sure I follow a ratio rule. I just set a page file and monitor with ControlUp. If I needed more PF I grew it

Yea, i could do that. So basically your (wem)taking the wasted ram dumping it to page file (temporary) then when the user starts the process again assuming its in the same session it will go back into ram? Assuming u adjusted the polling as well?

120 polling is fine. Otherwise you can really increase IO. Yes that’s how that all works. More RAM at the expense of IO

Ok thanks man. I appreciate the guidance.

Yep don’t go too low on polling. Will definitely impact IO if you do.

Disable hardware acceleration, use offloading to the client, block ads

uBlock Origin did a terrific job for us in testing. We have the option of using WEM, but likely won't go there because you're just offloading the burdon to another area. I've got Chrome's "tab freeze" setting configured in our GPO, as well.

Isn't The Great Suspender basically the same as Chrome's new tab freeze?

Probably, i'm not familiar with the new tab freeze.   TGS will just suspend an idle tab after 1 hour.  works great, we have it all over the place.  Force install it with a GPO

Are you changing any of the default settings? If so, how are you applying them?

Looks good <https://chrome.google.com/webstore/detail/the-great-suspender/klbibkeccnjlkjkiokjodocebajanakg>

<https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm>

<http://www.gallier.us/pics/ChromeRAM2.png>

Ryan, Do you push this extension out with GPO?

Curious on if there is a config file to set the settings for all users. I can use this along with WEM. I should be golden

The config is apparently in a local DB. Found an old thread on this topic that included <@UK6S90JDR>: <https://github.com/deanoemcke/thegreatsuspender/issues/97>

With uBlock Origin, you can apply settings via registry, which is what I'm doing with Chrome.

I need to read on uBlock Origin more. I didnt relize it helps with Ram perfomance

I just relized what I said, If you block ads ect, it will help with Ram managment... DOH!

Blocking ads helps with RAM, CPU, and security....here's an article I wrote on it for IE <https://www.htguk.com/improving-citrix-xenapp-session/|https://www.htguk.com/improving-citrix-xenapp-session/>

<@ULLH5JGFR> Yes, i push out the extension with the Chrome GPOs

Something like "Force installed extensions"

SuperHelpfull...<https://dennisspan.com/deploying-google-chrome-extensions-using-group-policy/>

Extensions are easy, it’s the custom settings that can be a PITA.

Yea, I am seeing that. dang, but better than nothing.

kinda makes me think if the new edge has the same options

for firefox <https://www.winsysadminblog.com/2019/03/deploy-firefox-in-the-enterprise-with-ublock-origin-https-everywhere-and-privacy-badger-using-group-policy/>

You can use all Chrome extensions in the new Edge, as well.

I have to say, I'm a big fan of Pi-Hole for add blocking. Very efficient and all effort in filtering is offloaded. Also sights that detect add blocking don't know about it. I'd recommend checking it out. <https://pi-hole.net/|https://pi-hole.net/>

Load balance two of these small VMs with a NetScaler and you have company wide add blocking on all devices that is fast and resilient.

I've got an update to ad-blocking I wanted to do, so I will see if I can tie Chrome optimization in as part of that

<@ULKDZHKFY> do you have real-life experience with Pi-Hole in an enterprise setup?

I have it at a couple of clients yes SME size. Not large enterprise size but I think I'd be pretty confident in sizing a solution and placing it into production.

We're talking 1000 users of less for SME btw.

No worries. I'll try and factor in some discussions on sizing in my blogs. It should be quite easy to generate some numbers and monitor performance at the same time.

also a huge fan of Pi-Hole.  I run it at the house.

Has anyone successfully managed to get CVAD and NetScaler Gateway working with Citrix FAS and Azure MFA, in an IMPRIVATA setup? I've configured CVAD, StoreFront, NetScaler, AAD enterprise application etc. Everything works perfect, except for my XenApp servers where we use Imprivata OneSign. Imprivata hooks in to the Credential providers and I suspect that it does not accept the Smartcard certificate somehow.

Done a bit of work on appv and certain avaya apps on my current project mate. What you seeing?

Just curious as far as any special Citrix polices for audio. I read through the docs, they really dont mention it from a avaya side. Looks like I install a VDI communicator on the client, and X-one in the VDA, then go from there, I assume

Depends on the system and the age. You may be depending on generic usb redirection. For the IP phones I have we're using that for a limited number of clients. Realtime audio too. UDP based transport really makes all the difference. Be aware of the constraints of a machine or user setting when considering.

I see. Generic USB.. hmmm ok. I can make that work. Kinda looks straight forward to be honest.

I rather use Teams and be done with it, But you know Citrix is not thought of first at times. :disappointed:

;-) good luck man. I see you got the reference lol its beer o clock on the uk

Which software Ray? We are looking at Avaya for a new PBX and this is on my mind too

So its like pulling teath with our Telcom folks. VDI communicator is now called  Avaya Equinox® VDI. This piece runs on the Clients. Then Avay X-One Communicator is the softphone that runs in the xendesktop/xenapp machines/Published app.

This link <https://support.avaya.com/products/P0994/vdi-communicator/> will foward you to this link <https://support.avaya.com/products/P1706/avaya-equinox-vdi>

Steve I am still collecting all the information.

Oh and this ...<https://support.citrix.com/article/CTX133024>

image.png

Good idea. He was on a surface laptop and probably went to a desktop or vise vesa. Let me check.

User states they frequently see it when remoting from laptop to desktop via RDP. Then open an ICA session inside RDP. However, apparently they see it when the laptop and RDP is not involved.

Hhhmmm interesting , definitely looks like dpi scaling. May be worth change client receiver behaviour to match server DPI.

<https://support.citrix.com/article/CTX230017>

Give it a try and see what you see. To be honest I think DPI scaling is a bit of a mess. Is scaling is default but I think in your case maybe the single hop/double hop scenario or maybe not. It's worth working through the combinations in this article though.

Leee is right on, We have this issue all the time.

DPI scaling and Citrix workspace Client side issues fix.docx

I fought this so much I gave my helpdesk this

I could set it with a Workspace GPO, But its really for vendors

No prob. You guys help me out alot. Atleast i can do.

Have you guys ever noticed they give 3 option on PVS in the 1912 docs? Kinda bugging me.
If you choose the second option and are using Citrix Provisioning to provision the machines, you can configure how user changes to the desktop are handled:
•	Save user changes to the desktop on a separate Personal vDisk. (Personal vDisk is deprecated.)
•	Save user changes to the desktop on the local disk.
•	Discard user changes and clear the virtual desktop when the user logs off. Select this option if you are using user personalization layer.

In studio they only list 2 option under PVS.
Connect to random desktops  = pool and user data is disregarded
Connect to static desktops each time they login  = OLD personal Vdisk
Where is the 3 option coming from?  Save changes on local disk? Huh?  Are They talking about physical PC boot up PVS images? And where are they getting Same desktop each login from a PVS option?

In your guys option what is a good ICA RTT time. In my environment its from 6ms to 150ms. On my low end dsl its 500ms. Little slower, but still can work remotely. Trying to set alerts and perhaps you guys have some opinions on what is a good ICA RTT ?

I’d say anything under 100ms is good... 100 - 200ms is acceptable... starts to become noticeable 300ms plus and would start to really hamper user XP... my personal thoughts... 

From memory monitoring tools such as Systrack will start to degrade the user XP at 150ms plus ... 

Ica RTT is one of those deals where so many factors are in play. Appreciate the Input

That said, I’ve worked with remote sites where it averaged 400ms and they were fine with it... very subjective though... 

John's a cracking fella Ray, I'd echo his statements here.

I have tried every .exe i can think of as an FTA, and they all ask to "configure online plug-in, where is ICAWrapper.msi"

Wow never seen that from chrome. Just a thought have tried a couple Verisons back?

Or maybe 1906 or later? Just taking a stab.

I can test this as well and report back to u.

I have not tried a couple versions back.  Ugh, it's so annoying

It's not just Chrome.. It's any situation where you try to launch an .ica file.  For example, if I take my sites out of trusted sites, IE downloads and ICA file, and it fails that way too

Oh, ok. I tried Version 79.0.3945.130 (Official Build) (64-bit) and it was ok.

the only difference is I am not on Server 2019. Dang I wish I could help u.

You mean the popup to lanche with WorkSpace app launcher? Yes, annoying

I mean, it's asking me for a file, and bombs, and won't launch the app

If anyone cares, removing `/rcu` from the CLI install above fixes the issue.  Not sure if anyone from Citrix wants to know this <@ULGKFDUVD>

<@UMMRWU8CC> Any idea who handles CWA installer? :arrow_up:

I think that switch was deprecated (although it should still work): <https://docs.citrix.com/en-us/citrix-workspace-app-for-windows.html#deprecation>

I thought /RCU was deprecated. Sorry @ Ryan Galier just seen that update

maybe it should bomb, and not actually install and do bad things.  :smile:

Counterpoint: Teams being down meant that I didn’t have to use its awful interface for a few hours.

I am in the process of upgrading. I didnt see this in my test site.

We want to move as well to WS19 but had to roll down due to Outlook Search / FSlogix not working. So 2 issues which prevents full scale roll out....

How can you tell the Search isn't working ? Perhaps mine isn't as well.  :slightly_smiling_face:

I am scheduling upgrade so - *watching :face_with_monocle:

1 items indexed, indexing complete,  but nothing in item's indexed.. ?

There are issue with the "new" user based search index in WS2019, have a look here:
<https://social.msdn.microsoft.com/Forums/en-US/a9b5000d-e2a8-442b-9cbf-48e05136f732/support-for-server-2019-and-office-2019-search-roaming?forum=FSLogix>

There was supposed to be a patch to fix it.

I have done some tests in my lab, and even with a local profile, the search index builds just fine during first logon, any subsequent logons, the search index is corrupt and you have to restart the WIndows Search service, to get the indexing up again

Yeah, the patch doesn't really fix anything, at least that's what I have seen in my lab

What I don't understand is that this issue is more than 6 months old, what's going on in Redmond?

I had a meeting with the fslogix manager yesterday. He was a super nice guy, but the are limited on support right now. They are expanding, but its taking longer

From my point of view this doesn't have anything to do with FSLogix. People are reporting the issue with User Profile Disk in RDS and as mentioned I see the issue with local profiles as well

Actually MS change the FSLogix documentation stating that FSLogix should no longer handle Search Index roaming in WS2019. I am trying to find the amended documentation

From here:
<https://docs.microsoft.com/en-us/fslogix/profile-container-configuration-reference>

So it needs to be 0 for "NOTE: Windows Server 2019 and Windows 10 Entperprise multi-session support per user search. RoamSearch should not be enabled in these environments"?

Damn Kasper how the heck did u find this. Awesome bro :+1::ok_hand::ok_hand::muscle::muscle::muscle:

<@ULLH5JGFR> someone on Twitter mentioned it

<@ULHA2NPPX> configuring it to 0 prevents FSLogix from roaming the search index. It still doesn't work

My index says Microsoft Outlook in included locations... it's still not actually working?

now that i actually started the search service...

Have a look in the Event Viewer in the application log. You should see ESENT generate a few errors

at least that's what I see at the second logon of a user

I see a lot of ESENT, but no errors.  301/302/105/326/637/325

<@ULL6F7DRA> I see nothing here that tells me it's broken

RoamSearch 0 does not work with latest version, so still no go.

So, wtf does mine show Microsoft Outlook as an Indexed location, and I haev no errors

In terms of freeze, Citrix have heard no reports so far, so might be FSLogix.....

if it's working, someone needs to look at it... haha

Are the search icons in the ribbon grayed out?

If it is working, you need to share your config :smile:

I think a guide for how to check if working is needed, was walking in blinds for weeks

If you rename your profiie to .old and try again. When you start outllok it should show high index status counting down to 0

just the profile?  I'm saving search in o365 container

if you want to remote in here and look, i'm fine with that too

Could you click "Search Tools" and then Indexing Status?

<https://twitter.com/michelhelderman/status/1224719004226478081?s=21|https://twitter.com/michelhelderman/status/1224719004226478081?s=21>

and there might be the indicator that it's not working.  :slightly_smiling_face:

Yes, if it just sits there with the "Loading" message, the search index is toast

You will see that in WS2016 as well if something is wrong

Oh well I was hoping you had the right config <@ULHA2NPPX> :slightly_smiling_face:

My users don't even notice.  Outlook still searches nearly instantly

Yes, I actually see that too and I don't get how it's possible

I've searched for stuff in my mailbox that I know I have never searched for and it just pops up instantly

Well, I'm off to bed, it's getting late here in the small kingdom of Denmark :slightly_smiling_face:

hey guys, just saw this and wanted to post my issue with this. I found it to be related to an older Citrix WEM agent. Once I upgraded to a new version of WEM (1911 or 1912) the issue went away

Sorry Eric, we totally hijacked your message...

No worries, I think it might be related....

Anyone here played with deploying CVAD on Azure Stack?

I have seen this before. The VDA never recognises the second device that acts like a keyboard or some sort of interface. Installed Skype on the windows thin client and ran a local app. It's not great but was the only solution for it to work well.

I’ve been able to get users connecting to a desktop session from a particular delivery group.  I haven’t been able to get it to a specific desktop.  Had a case where we had 3 different desktop display names against a delivery group.  Tried to figure out if they were all in use.  Couldn’t get it figured at the time and ultimately we bagged it because other things took priority.

this is the current SQL query i have working to give me the list of Desktop connections per DG... but I would like it per pub Desktop
```Select  [connection].clientname,   
    [User].UserName,
	[connection].ClientAddress,
	[connection].ClientPlatform,
	[Connection].ClientVersion,
    DATEADD(mi, DATEDIFF(mi, GETUTCDATE(), GETDATE()), [Session].StartDate) as StartDate_LocalTime,
    DATEADD(mi, DATEDIFF(mi, GETUTCDATE(), GETDATE()), [Session].EndDate) as EndDate_LocalTime, 
    [DesktopGroup].Name as DesktopGroup
from (((([MonitorData].[Session]     
inner join [MonitorData].[User] On [MonitorData].[User].ID = [MonitorData].[Session].UserID)
inner join [MonitorData].[Connection] on [MonitorData].[Session].Sessionkey = [MonitorData].[Connection].Sessionkey)
inner join [MonitorData].[Machine] on [MonitorData].[Session].MachineID = [MonitorData].[Machine].ID)
inner join [MonitorData].[DesktopGroup] on [MonitorData].[Machine].DesktopGroupID = [MonitorData].[DesktopGroup].ID)
where ([Session].SessionType = '0') and ([connection].clientversion &lt;&gt; ' ') and [session].StartDate &gt;= dateadd(day,-7,GetUTCDate()) order by username```

It should choose everything through ICA in last 7 days

Yep plenty of methods. Pick your poison. MDT seems to be the popular method but if you have other automation tool then use that.

app layering is popular, i prefer MDT even if you spit that into layering for any reason
[5:24 PM]
we prefer to stay 2016 vs 2019 since it scales better but either way i'd say MDT/choco kinda of install if you have that you can leverage that solution into othe rproducts if you decide to.

Speaking of App Layering make sure to check this out - <https://www.citrix.com/blogs/2020/02/04/citrix-tips-whats-new-in-citrix-app-layering/|https://www.citrix.com/blogs/2020/02/04/citrix-tips-whats-new-in-citrix-app-layering/>

I suppose I should clarify, and likely cause some people to cringe/twitch. I mean we simply layer our changes on over time. Same static base image, years old, with tons of changes. We do log them.

then we use MCS w/snaps and spit out our catalog.

That’s fine as long as you track what changes. Try to incorporate automation though.

One thing you’ll have to worry about is image bloat and possible rot.

Yea nothing wrong with what you are doing George. Most are like that or came from that. The automation route is the next evolution. Build it in code, store in version control is the next after that. Environment creation is the usual first constraint. Then testing is next. Not seeing many do automated unit testing to ensure the image works as expected. Most just do a UAT type thing.  The tools are getting better for us though. Only a matter of time. 

<@UK6S90JDR> <@UKHUMQ2H2> Would you gents happen to have some articles regarding the 2016 v 2019 scaling?

<@URV4HE1LL> GO-EUC has some good stuff - <https://www.go-euc.com/performance-comparison-windows-2016-vs-windows-2019-rdsh/>

<@UK6S90JDR> is that link working for you? I'm now wondering if our filters are messing with it

I actually found that a few minutes ago and it seemed dead

no articles, but i can say from our testing 2019 got about 10-20% fewer people than our 2016 implementation.  So since we didn't NEED 2019 we went 2016

Going to be promoted on Monday :slightly_smiling_face: How did you find out?

Any reason for running WSUS on non-persistent desktops? That sounds a bit counter productive?

well maybe thats a better way to approach this. so with our non persistent/app layering setup we obviously only want updates to be deployed to the base image right (or OS layer in our case).  I have local policies in the image set to disable automatic updates) and disabled the windows update service but windows 10 keeps finding ways to turn it back on  so our first thought was ok lets throw all the non persistent desktops in a WSUS group that has no approved updates so even if it TRIES to look it wont get anything and we're good.  but like i said it seems to ignore that and look out to the internet too.  is there something we're missing for really ensuring these mcs desktops dont do that? (we use user layer too so really dont want those updates pulling down )

in windows 7 i'd just do the update in my os layer, and then disable/stop windows update service and we were good. doesnt work so well w/ 10 unfortunately but i'm open to any suggestions here

Check the "Windows Update Medic Service", I have it disabled, it likes to re-enable the windows update service.  Once I disabled that my machines stopped updating.

alright so it looks like that set to manual startup type (currently stopped). so do you set the windows update service to disabled in your image (even though it will try and turn it back on ) and also that update media service to disabled and thats all you did?

That's what finally fixed it for me, disabling the medic service.

I also disable the windows update service as well.

damn dude if that fixes it you are my hero! haha

so one last question.....we are told that we need to get the Microsoft Whiteboard app available to users. as far as i can see the only way to get that is for users to install it manually from the windows store (no msi ).  i THINK the windows update service has to be on in order to use the store, right? maybe an issue w/ this?

Possibly, we don't use the MS store, so I'm not sure what effect it has on that.

i'll have to test a bit here but thank you for chiming in! if that fixes my update issue i'll be thrilled!   friggin microsoft and that whiteboard app limitations.....promote it as a huge Teams addition but dont let admins centrally push it out

so if i try and disable that media service i'm getting access denied

damn so it looks like that medic service is just a watchdog service for the windows update service so JUST disabling that (if i could somehow) wont help w/ windows updates unless i also disabled windows updates (which appears to break the windows store. damn

That's right, I had to do it via registry. I'll find the key.

i think i just found that one too here but thank you! so you disabled both services and for you they have stayed stopped/disabled on non persistent desktops?  i guess that would solve one of my problems but introduces the next w/ the damn Store

well damn isnt this some irony.....been trying to get update service to stay disabled/block updates on these machines for months and may have the solution and one blasted store app that i'm told is "essential"  means i can't even implement it

Can you get the MSI for this app from the systems folder and deploy it that way?

well i know this app is ONLY  available via the Store app so would this be possible? do store app save a msi after install??

Alright so i was able to find a round about way to capture the .Appx offline install of the Whiteboard app and now we can install that w/ just that and don't need the Windows Store thankfully (i like this method better anyways).   So as for the Windows Update Service I have the Medic service disabled per your help but the blasted Windows Update Service keeps changing itself from Disabled to "manual (triggered)" .

Has anyone managed to get Win 10 VDI (no GPU) night light working in Citrix?

Slack buddy Tim found this 
<https://support.citrix.com/article/CTX265011|https://support.citrix.com/article/CTX265011>

Citrix WEM docs simply state *Microsoft SQL Server 2008 R2 or later* so I'm assuming 2019 is okay here

Works perfectly in my lab for both Site &amp; WEM databases

If not listed means they probably haven’t tested/qualified yet.

<@UK6S90JDR> running in production or lab?

i swore i read somewhere that like 5ms and under was "best practice", but i can't seem to find the reference

You're better off looking at this from a hypervisor POV to be honest. Anything above 5ms is going to be impacting though. I'd say you have a good steer.

I went back on some notes I made. Spikes of 20ms can be seen on mechanical storage and was only (back in the day), 3-4ms spikes with flash. This should not be constant though.

thanks Ryan for posting this. Guys I was asking Ryan about this because we run all of our customer file servers on Nutanix with FSLogix and consistently seeing 10-25ms on reads. writes are never much more than 5ms. trying to determine if thats a major issue in our environment

<@ULJH9ED53> you need the man that can. Where are these metrics coming from? The VM? With Nutanix I understand the replication piece and how its displaying files around but I cannot comment on what is good or bad from a HCI standpoint.

Absolutely. He's always really helpful, a pretty nice guy too ;-)

or, he's at the pub.  probably need to wait until tomorrow for him to chime in

Aka the thread wipper lol , as he always tells me off for not using threads ;-)

Sorry guys, I was actually doing work related stuff :slightly_smiling_face:

Ok.. But is it the read access of the FileServer VM (FSVM) to the VG or is it the read access of the User VM (UVM) to the FSVM?

i.e. if you go to prism and you look at the UVM, do you see read latency there or do you see the latency on the FSVMs?

work related stuff?  isn't it like 9pm where you are?

in prism, I can see the high read latency. like currently I can see a point in time metric of 69.22ms on this particular virtual disk where the VHDs live

9:25PM, running CDF traces to show Citrix they’re doing different power management calls to AHV if you compare StoreFront to Studio

I think thats where LogicMonitor pulls its data, so obviously this is a point in time metric, but the LogicMonitor average is around 15-20ms

Ah that’s read latency from the FSVM, I  don’t think  this is worrying. It’s a VG construct so slightly different from the typical VM vDisk.

ah ok...it does seem that especially on Monday mornings for logins, it feels that we have some tiering issues, where the VMs, even in guest, are slow to respond. Once we get some good activity on that machine, it starts running properly. I dont have any definitive data to say thats whats happening, but we did have that issue in the past. had Nutanix support adjust some gflags a few times, but I think most of those have been reverted to default with some of the later updates

Are you doing a-sync replication at any point? Cerebro might be causing spikes during diff scanning?

<https://portal.nutanix.com/#/page/kbs/details?targetId=kA00e000000CrUKCA0> that’s another potential cause and is inline with your comments on monday

ok, looks like that link is no good for me, but Ill send it to a coworker that may have more access in the nutanix portal. Also, talking with him, it sounds like Logicmonitor polls in-guest numbers. looking at Prism historical, the numbers are definitely higher in prism, but the LogicMonitor numbers are still in the 15-20+ms range