World of EUC

Works great unless you run an .EXE from a Citrix UPM profile container.

Thanks Dennis, yeah no UPM in the mix at the moment

App masking is a nicer experience - can’t click what you can’t see 

Thanks James, we're most interested with preventing any drive by malware as well as enabling PS Constrained Language Mode

Have implemented it at a couple of customers. Even just configuring and running it in audit mode is useful for the logging on what users may have been running from homedrives or profiles that they shouldn't have been. Lately more customers seem to be going with other managed tools like ThreatLocker to provide much the same functionality but with a nicer GUI.

Love Applocker! Doesn't matter if single or multi session OS

Always applocker but I also use Fslogix appmasking.

Have a look at PolicyPak:
<https://www.netwrix.com/endpoint_management_software.html>

Yeah PolicyPak is an awesome piece of kit

I should have phrased it better - it breaks everything - im just curious if that behavior is normal

You’re using the Rule Editor to scan for the Citrix Files client and it’s picking up VDA services?

The Rules Editor can pick up extra items for applications with shared files, services, registry items etc. It’s up to you to validate what it produces and adjust the ruleset accordingly. Don’t blindly trust what it returns in a scan.

That is correct, - its picking up VDA Services....good call out that it shouldnt be trusted blindly

I suppose i put too much faith in the scanner :slightly_smiling_face:

If it's installed with VDA Agent then it will probably take everything into it. If you install separate Citrix Files component then it would be better to do app masking

exclude Network Service and Local System from assignement :v: 

image.png

Known issue
Stated fixed in 2203 CU2, but  it didn't work for me there... [CVADHELP-20164]
Fixed in 2212 VDA, tested and works for me

<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1594240331097000>
<https://worldofeuc.slack.com/archives/CK6TCV3JN/p1594240331097000>

have you tried with the latest workspace app for HTML5? <https://docs.citrix.com/en-us/citrix-workspace-app-for-html5/ear.html|https://docs.citrix.com/en-us/citrix-workspace-app-for-html5/ear.html>

i have not, we're on 23.1.1.4, i can try to test this week

according to the release notes, audio device should not show up with their real name

Most of my resources are still server 2016 but CU2 has been ok for us. Still have some zombie sessions to clean up periodically but nothing like the train wreck we experienced with other releases.  

Have a 2019 based delivery group going live soon so I’m hopeful it too will be ok. It has all the registry fixes in place.  

Only thinkg I have seen so far is some issues if the user has more than 8 audio devices, input and output. That's a known issue, se my post yesterday. The workaround is to disable any non-essential audio devices on the machine.

Anyone seen this?  Users are sometimes not able to reconnect to a disconnected session.

<https://docs.citrix.com/en-us/tech-zone/build/tech-papers/citrix-communication-ports.html>

If you dont mind an indirect reply, all poort requirements are spelled out in this master document: v=<https://docs.citrix.com/en-us/tech-zone/build/tech-papers/citrix-communication-ports.html>

I would check this
<https://docs.citrix.com/en-us/tech-zone/build/tech-papers/citrix-communication-ports.html>

That's funny, we all three put the same link in

Does that qualify as triple fact checking?

Without looking in doc. I would say
135 ,389.636

DDC to AD would just be regular active directory ports, which are like 10000 of them

Well, it is probably industry standard for AD Domain Talk.  Something like this
<https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd772723(v=ws.10)?redirectedfrom=MSDN>

<https://docs.citrix.com/en-us/tech-zone/learn/downloads/diagrams-posters_virtual-apps-and-desktops_poster.png>

Well that is 2008R2, but hopefully you get the point.

wow, not even carl has them listed - <https://www.carlstalhood.com/netscaler-firewall-rules/#xenapp> ...how could that be?

Honestly, It's because most of it is a industry standard now I would say. Most FW have a basic rule set for AD DS in the FW defaults.

if that's all you open, you're going to have a bad time

I would start here. That is me though
<https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts>

firewall between domain members is a nightmare, imo

by the time you open all the ports, it's not secure anyway, so what's the fucking point?

and i just mean, basic SPI... now if you have some Layer7 inspection there, it's better

but if you're just going to do SPI between them, it's pointless.

I suppose its a matter of perspective... Assume the org already opens the necessary ports for a member server to talk to a domain controller, what _additional_ ports would be necessary on a DDC...  As opposed to what are all ports necessary for the member server... In the first case the answer really is nothing additional since 389/636 (at least 636 in hyper secure environments) should be open already

If anyone finds incorrect ports in the document, let me know and we can get them fixed :slightly_smiling_face:

i'm not personally familiar with FAS, but i'd expect with cert chains you'd want the ability to revoke a given sub-ca's certificates in the event of a breach. Personally i would have each sub-CA have its own private key.

Normally on your subordinate CA you have to have your root CA online and then then do an advanced cert request and go to the root and approve the pending request for the subordinate CA. When installing a subordinate CA through server manager you get to choose do you want to use a new private key or an existing one you only typically use an existing private key if you were doing a migration and had backed up the CA database and private key and had built a new server with same name and was restoring the CA using the backed up private key and database. So they should use a new private key for each sub CA

Any information when SQL 2022 will be added to this list?
<https://support.citrix.com/article/CTX114501/supported-databases-for-virtual-apps-and-desktops-xenapp-and-xendesktop-and-provisioning-provisioning-services|https://support.citrix.com/article/CTX114501/supported-databases-for-virtual-apps-and-[…]enapp-and-xendesktop-and-provisioning-provisioning-services>

MicrosoftTeams-image (1).png

<https://support.goliathtechnologies.com/hc/en-us/articles/4808951320983-Why-do-I-see-high-ICA-Network-Latency-and-Low-ICA-RTT-|https://support.goliathtechnologies.com/hc/en-us/articles/4808951320983-Why-do-I-see-high-ICA-Network-Latency-and-Low-ICA-RTT->

Good link <@UM04QUUSJ> 
<@U02H2442WQG>  you can also test these two policies to help improve the rtt metrics times.
ICA round trip calculation interval
ICA round trip calculations for idle connections
<https://www.controlup.com/resources/blog/entry/controlup-automation-user-input-delay-vs-citrix-ica-round-trip-time-rtt/|https://www.controlup.com/resources/blog/entry/controlup-automation-user-input-delay-vs-citrix-ica-round-trip-time-rtt/>

it could be occasionally off but we had ICA Latency consistently higher that ICA RTT  with 2203 CU2 VDA,  rolled back.

Interesting, we'll take a look at that. Thanks.

<@UUJAM6B09> Have you seen it prior to CU2? i’ve seen this multiple times and reported it. it’s almost as if the two metrics are reversed at those times 

I’ve seen it before. If you check these two metrics 10 or more times and once in awhile you will see ICA Latency higher.  But on CU2 it was pretty consistent for most cases - 10 out of 10.

Available on CR Workspace client starting from 2207 if I remember correctly 

Yes I use it in production, you need a minimum version for VDA and CWA.

I think it’s in 2212. But I need to double check

Check this out John.
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/multimedia/opt-ms-teams.html#background-blurring-and-background-effects|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/multimedia/opt-ms-teams.html#background-blurring-and-background-effects>

Should be OK.  Read the first few paragraphs <https://docs.citrix.com/en-us/linux-virtual-delivery-agent/current-release/system-requirements.html|https://docs.citrix.com/en-us/linux-virtual-delivery-agent/current-release/system-requirements.html>

Great, somehow i missed that information. Thank you!

Hey JF! all you need for VDA registration is the ListOfDDCs registry key set, you can deploy it via GPO. Both Cloud Connectors FQDN should be added for redundancy. I hope this helps! <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/vda-registration.html|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/vda-registration.html>

Salut Jonathan, not in that case, it's not working, the configuration for a  VDA and Windows 365 is done automatically by Intune and Citrix Cloud, The VDA is deployed automatically by Citrix on the deployed of the VM. From what I see, the VDA is connecting directly to Citrix Cloud without a cloud connector.

<https://docs.citrix.com/en-us/citrix-hdxplus-w365/citrix-hdx-plus-for-windows-365.pdf>

yeah I have not tried HDX Plus yet but since it's using Rendez Vous Protocol v2 I would ensure all the pre requisites are met. And yes you don't need the ListOfDDcs reg key in that scenario since RendezVous v2 will bypass the cloud connectors.

1. VDA must be installed with the rendez vous protocol v2 switch
2. The GctRegistration reg value must be set to 1
3. Network Location must be set to Citrix Gateway Service
4. DNS Resolution must be disabled
5. VDA machines must reach https://*.*.<http://nssvc.net|nssvc.net> on TCP 443 and UDP 443
<https://docs.citrix.com/en-us/citrix-daas/hdx/rendezvous-protocol/rendezvous-v2.html>

I think we must use this tool for the registration, still working on it to found the right information!!  Please HELP :slightly_smiling_face:

C:\W365CitrixVDA\WebSocketVdaRegistrationTool\WebSocketVdaRegistrationTool&gt;WebSocketVdaRegistrationTool.exe -help
2023-03-09 16:57:16.6843|INFO|Citrix.WebSocketVdaRegistrationTool.Log|Initializing WebsocketVdaRegistrationTool ...

                            Usage: WebSocketVdaRegistrationTool.exe -RegistrationUrl:&lt;url&gt; -RegistrationToken:&lt;token&gt; -MachineId:&lt;machineid&gt; -MachineName:&lt;machinename&gt; -AzureRegionName:&lt;Region&gt; -UserId:&lt;userid&gt; -CustomerId:&lt;customerid&gt;  -SiteAddress:&lt;siteaddress&gt; -VirtualSiteId:&lt;virtualsiteid&gt; [-TransactionId:&lt;transactionid&gt;] [-CorrelationId:&lt;correlationid&gt;]
                            RegistrationUrl - The URL for the Citrix CloudPC Registration Service
                            RegistrationToken - The unique token id identifying the CloudPC user
                            MachineId - The CloudPC Machine's unique Azure AD OID
                            MachineName - The machine-friendly name for the CloudPC
                            AzureRegionName - The Azure Region Code of the CloudPC
                            CustomerId - The customer id as defined in Citrix Cloud
                            UserId - The end user's Azure AD OID
                            SiteAddress - The http/websocket address of the Citrix Site
                            VirtualSiteId - The unique id of the Citrix Site
                            TransactionId (OPTIONAL) - A transactionId in the form of guid for tracing of operations
                            CorrelationId (OPTIONAL) - Should be set to the Client-RequestId value of the DataUploadMessage API call that triggered this CloudPC registration

GPO is probably the best option here, or at least what we prefer for stuff like this.  Google publishes an ADMX and there's a setting to disable it

<https://www.makeuseof.com/disable-chrome-software-reporter-tool/>

That's probably better than we we have going on... We just don't allow it in AppLocker so it just dies when it attempts to run. Going to look at the policy now.

I would start here. There are a good bit of Citrix performance counters and systems counter. It could be a lot of thing going on here. Like disk que, cpu ready and wait times, poor dial I/o and latency. Bad overall network. The list goes on and on. 


<https://jgspiers.com/citrix-performance-monitoring/|https://jgspiers.com/citrix-performance-monitoring/>


<https://support.citrix.com/article/CTX220619/information-xenappxendesktop-performance-counters|https://support.citrix.com/article/CTX220619/information-xenappxendesktop-performance-counters>

Go download a trial of CU and EG and slap that puppy on it. Unless you want the performance monitor way

<@ULHA2J7RT>  has introduced me to  Zabbix. It may help you as well. Not sure yet though.

<https://www.eginnovations.com/blog/ica-rtt-metrics/> and <https://www.eginnovations.com/blog/citrix-latency/> may help

Zabbix can monitor any performance counter out of the box: <https://www.zabbix.com/documentation/current/en/manual/config/items/perfcounters>
The default Windows OS template has the most important already included: <https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/os/windows_agent>
It looks like this:

<@ULHA2J7RT> would you mind seeing if there's anything I could add to my free/oss monitoring tool list? Especially around Zabbix <https://www.eginnovations.com/blog/top-freeware-and-open-source-it-monitoring-tools/>

<@ULLH5JGFR> it's getting there - I feel the links to other sources of info need enhancing - Zabbix especially. There wasn't a huge amount of community help last time I looked.

Here is the link
<https://www.spiceworks.com/free-network-monitoring-management-software/>

<@ULLH5JGFR> I used to see a fair bit of Spiceworks 5-7 years ago but not much recently so has fallen down my consciousness... I'm wondering if it's just I'm working on different things so see less - or if folks are using other things more...

I can agree with that on not seeing it as much. I was not sure if the  "Top Freeware Open source IT tools" was the Top used, or a overall what is free. But makes sense from the "Top" aspect.

<@ULLH5JGFR> "Top" is really - stuff I get asked about or see the most :smile: We get a lot of customers who play with OSS / free whilst figuring out what is needed but get to a stage they need something commercially supported and maintained or need to consolidate 15 different tools across 7 teams who all have their own preferences..... the commercially supported versions of some of these technologies actually get quite pricey. Folks will often suggest bits of Graphana they like in feature requests.

2203? I know some of those switches were deprecated in 2209...have you tried an /exclude switch for it?

plugins is excluded in his command line... but that's completely unnecessary, since it's not a default component.

So I can't see why it tries to install it anyway.

It wouldn't hurt to try adding an exclude for it for testing

Excluding it was a feeble attempt of testing it.

Haven't check the logs for any other VDA versions, so I'm not sure if this is a new thing with 2203 CU2

I have not seen that in 2203 CU2 at all, and I've done my fair share of installations while testing it recently.

What does the actual 'XenDesktop Installation.log' say? The one you posted is an SCCM log.

It shows that it tries to install CWA, allright...
14:49:48.2400       : XenDesktopSetup:About to install Citrix Workspace App with parameters: /noreboot /silent /includeSSON INSTALLDIR="C:\Program Files\Citrix\Online Plugin"

14:49:48.2400       : XenDesktopSetup:Starting synchronous process 'C:\Windows\TEMP\Ctx-2041EAB9-AF32-4896-8660-5E140A013F42\Extract\Image-Full\Citrix Receiver and Plug-ins\Windows\Receiver\CitrixWorkspaceApp.exe' with args '/noreboot /silent /includeSSON INSTALLDIR="C:\Program Files\Citrix\Online Plugin" '

14:49:52.2820       : XenDesktopSetup:Process completed with error code 0x00009C48
14:49:52.2830 $ERR$ : XenDesktopSetup:InstallComponent: Failed to install component 'Citrix Online Plug-in'. 'CitrixWorkspaceApp.exe' component failed to install with error 0x00009C48.
14:49:52.2840 $ERR$ : XenDesktopSetup:Recording installation failure. 'CitrixWorkspaceApp.exe' component failed to install with error 0x00009C48.
14:49:52.2840 PROC  : XenDesktopSetup:InstallComponent: Exit
14:49:52.2840       : XenDesktopSetup:Install tasks for this session have finished.
14:49:52.2840       : XenDesktopSetup:Installation failed

But, it seems like the VDA actually gets installed.

SCCM freaks out of course, since it doesn't get its prettly little "Installation successful" in return. :stuck_out_tongue:

Does running that exact command line manually produce the same results?

Seems like so, yes, but I would have to try again to be sure. Can't see that it would make much difference, it would be the same installer with the same install paramters.

Wait a second, you're missing */components VDA*

I bet if you leave that out, it installs both by default.

I have that in some other scripts that I use to create golden images, but seems like that it wasn't included here... gotta go talk to my man in the apps team here... :stuck_out_tongue:

Turns out the same mistake was also present in a different script here, so it might be that I did some copy/paste errors here. Will teste and let you know.

Thanks guys... /components vda was it, of course. Just completed a test install here now, and there's no mention of workspace app in the xendesktop installation log.

Funny though... the script (InstallVDA.bat) that Citrix includes in the install media that they claim is for "installation and upgrade" of the VDA doesn't really works. It updates some components, but not all it seems. And the version number of the installed VDA is unchanged... but hey, we've discussed silent upgrades of the VDA here before...

I refuse to trust any new installation that comes in the form of a batch file. It's not 1993.

Well... that could be a discussion for a different day. The problem with batch scripts is the lack of log handling. Most of the installvda.bat script consists of log handling and copying... like 98% it seems. :stuck_out_tongue:

And you need access to the complete isntall media for CVAD to use it, not only the vda install file....

Anyways... once more, thanks for the feedback and help. I'll loiter back to my corner now and contemplate my inability to do copy and paste in silence... :stuck_out_tongue:

Citrix would only create that monster batch file if a big-money customer demanded it. Citrix is not one to waste time and money on "silly things" like batch files.

Well, somebody probably paid good money for it.

Do you mind if I post this in the CTP Slack?

<@UL8ACTGSF> the CTPs / CTAs get free licenses if they want to have a play <https://www.eginnovations.com/citrix-champion-program>

Look in C:\Users\%username%AppData\Local\Programs\Cisco Spark

Webex App installs to the following folder by default: `%LocalAppData%\Programs\Cisco Spark`.

I would appear you may have the allusers=1 install and user have it in the profile as well?

Yes. I have dealt with this. What is updating is not Webex App, but Webex Meetings. If you are not installing the packaged Webex App + Webex Meetings installer, Webex Meetings is updating according to your Control Hub. I ran in to this because I was excluding %AppDataLocal%\Webex from UPM write back. Once I removed the exclusion, this is only shown when Webex Meetings updates and not every time a user logs in.

<https://www.webex.com/downloads/teams-vdi.html>

thanks matt, they are using the WebEx Team VDI install.

but i do think that control hub is causing the issue.

Which Webex Teams install is being installed? The one titled "Webex App" on the VDI download page?

the licensing of it is all done on the backend, in office 365.

So no built-in solution to assign the viewer mode to an user on a specific application?

so we include Visio via office 365 install into our golden image, and when a non licensed user opens a VSDX, they do get a login/activation prompt, but you can cancel and still view the document

Yeah, not really an user friendly experience. Will share what I have done.

VISIO_viewermode.fxa

VISIO_viewermode.fxr

Set the following registry for *unlisenced* Visio users :
```[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\common\licensing]
"viewermode"=dword:00000001```
FSLogix rule assignment is set so that WEM can create/delete the registry value.

Have you run the xdping tool to see if there is an issue?

xdlog.txt

Yep, apart from some redundancy warnings because I have only configured 1 DNS &amp; NTP server while testing, everything passes.

Also confirmed I can connect back to the VDA from the delivery controllers on port 80.

I don't think so mate no. Once you've gone through that process the linked template is already copied into each storage location.

Only thing I can think of is possibly rollback issue depending on hypervisor…

Hmmm yes, that would obviously not be possible without the previous image. Maybe will add a note to do it only after new image has been up for a few days

That should still be okay too as the snapshot that's copied to each storage location will still be there too.

But I hear what Jarian is saying and I've never "pressed the buttons in this order" so no guarantee. In theory though, promoting a new image copies a new base clone to each storage location and retains the previous one for rollback. It doesn't rely on the original VM.

it all sounds good enough for my current predicament, so happy days

Just say "Leee said" if it all goes wrong.

I don’t think that’s equal on all hypervisors and how they handle image management.

Yeah, if you're on ESX the snapshot is a flattened copy of the golden image. You'll be fine in a running state but as Jarian said, rollback can become problematic.

I wouldn't take the risk if this is a 'to-be' procedure and keep that image around for X period of time.

Part of the image update process here involves manually cloning the golden image to a second datacenter and I don't want them to get in the habit of leaving stacks of copies of it lying about. But giving it a week or so to bed in should be reasonable enough. Very small customer I am trying to hand over to with zero Citrix skills, so you can imagine the shenanigans

If this is Azure, James has a kickass automation script to handle replication between datacenters and cleanup

nvm, its sounds like its not a requirement for basic setup - <https://docs.citrix.com/en-us/citrix-cloud/citrix-cloud-resource-locations/connector-appliance.html#:~:text=The%20Connector%20Appliance%20is%20a,complex%20networking%20or%20infrastructure%20configuration>.

Secure Private Access and Image Portability Service.
Not required in a basic setup like you said.

Good timing - The guys here answered it, but good timing, nice blog from Citrix today covering this topic: <https://www.citrix.com/blogs/2022/10/27/citrix-cloud-connectors-how-they-work-and-how-to-get-the-most-from-them/?utm_source=linkedin&amp;utm_campaign=citrix%2520organic&amp;utm_medium=social%2520media%2520organic|https://www.citrix.com/blogs/2022/10/27/citrix-cloud-connectors-how-they-work-and-ho[…]gn=citrix%2520organic&amp;utm_medium=social%2520media%2520organic>

Has anyone here tried using a StoreFront website configured with Azure for the SAML iDP as well as put behind an Azure App proxy? Configuring internal StoreFront to just use Azure AD via SAML (with FAS) for auth works well, and configuring Storefront behind an Azure App Proxy but using user/Password or Domain passthrough auth works well. But if you combine the two it seems once the StoreFront SAML auth process is finishing it does a redirect back to an Internal URL (e.g. <https://internalserver.lab.com/Citrix/DemoStoreAuth/SamlForms/WebView>..... ) with a "return url not valid" error and not the App Proxy based URL for the store web site like it should.

Sounds more like a network issue to me, if it were a problem with VDA you'd expect the issue to be prevalent on 1 VDA at a time rather than across the board.
Are all connections via Netscaler?

First I would do is disable EDT. You already did?

When did these issues start? What has changed since when?

There’s an Edge GPO for creating a web site as a PWA: `Configure list of force-installed Web Apps`

There might also be a `msedge.exe` command line

I’ve been reviewing Citrix Cloud stuff all weekend so I can assist a client today. I have so many questions…
Are the below urls are only required on the connector?
<https://docs.citrix.com/en-us/citrix-cloud/overview/requirements/internet-connectivity-requirements.html#cloud-connector-common-service-connectivity-requirements>

https://*.<http://citrixworkspacesapi.net|citrixworkspacesapi.net>
https://*.<http://cloud.com|cloud.com>
https://*.<http://blob.core.windows.net|blob.core.windows.net>
https://*.<http://servicebus.windows.net|servicebus.windows.net>
<https://citrix-cloud-content.customer.pendo.io>

are these the urls the endpoints will need access to?

I removed all the out of thread comments.  The doc looks like both or many different areas from each componet. I was on my phone looking at it.

they said resource location/ cloud connectors so i assuming its more than cloud connectors...like maybe VDAs?