World of EUC

I removed all the out of thread comments. The doc looks like both or many different areas from each componet. I was on my phone looking at it

image.png

I would post the cloud aspect in DaaS . I have never seen this personally.  I assume the Fas Servers are built in the datacenter somwhere and you are trying to setup the micro service in DaaS to connect to them?

hey bud, what do you mean "post the cloud aspect in Daas" .  yes, the FAS server are built in the datacenter somewhere...

shoot..i didn't know there was a citrix-daas chat..nice

No not concurrent. MS explained it to me 3 years ago on an audit :disappointed: if you have domain users listed anywhere in either CVAD or the remote desktop role on the server. Then you need cals to cover the amount of domain users. So based on your example, yes, it sounds right.

Cheers thought that had a conversation with someone who thought they was concurrent

They told me it's a honor system, however they expect you to buy what you need. If audited they will charge the user/client big bucks lol.

yeah lol luckily this place has purchased 2000 per user cals but only installed 1500 to match the citrix concurrency rate. So i will just install the remaining 700 per user cals once i get hold of the EA number from the licensing guy

Hi Everyone, i have to configure Citrix Cloud for Azure Multi-Factor authentication for the first time....Yah! Is this a good article to follow to guide me through the process -
<https://www.citrixguru.com/2018/08/20/lab-part-39-configure-multi-factor-authentication-with-azure-mfa-service-and-citrix-workspace/>
anyone have any better ones?

On the FAS servers you should see events in the event log that show certs being issued for the users behalf.  Are you actually logging in via UPN? If FAS was working and you didnt use a UPN to login after switching the claims on the store in StoreFront it wouldnt work correctly

You should also see certs being issued to the users from your CA if FAS is working correctly

where on the FAS server should i see that...b/c i don't see that on the application logs

On the VDA I get an event ID 106 from source Citrix.Authentication.IdentityAssertion as well.

Have a look on the admx gpo, you will certainly have the option to put the default domain , but if you mean remove the display text , I don't think so , need to check

how would the admx gpo help with non-domain systems?

is there a way to have cloud workspace default to a specific domain like you can on Storefront?

As far as i am aware there isn't a way with Citrix cloud workspace service where you can set the default domain unlike storefront with trusted domains/default domain

You can disable some of the domains in Idenity &amp; access mgmt &gt; Domains if you dont want subscribers from those domains authenticating to workspace service but thats about it

you will be able to launch and login, but you will need to auth a "second time" at the windows login screen.  With FAS enabled, only need to auth when logging into storefront / workspace app / cloud gateway (pick yours)

well, i shut the servers down and it didn't prompt me to login again after clicking on the published application

and before i had FAS enabled it did prompt me to login after clicking on the published application

does the second login only happen when you have two-factor enabled?

Others can correct me, but we use FAS because our auth method to Citrix is AzureAD.  So without FAS running there is no authentication ticket.  If you're still using AD auth generally, then FAS won't really do anything for you.

You only need FAS when using a SAML based Authentication like AzureAD for example.

The secret is in the name.  Federated means that you are using an authentication authority that is not inherently trusted by the default authority, like if you had AD Domain and/or Forests that have trusts in place.  Federated allows access to resources without establishing those trusts

You aren't dumb - FAS and federation and SAML are just a royal pain and a nightmare to deal with. If you do SAML, the credentials are never passed directly to storefront to send to the VDA, hence the FAS generates an auth cert.

Federation keys are also a key target for threat actors.

If FAS is enabled on the storefront store and no FAS servers are available users will not be able to launch resources. They will get an error "Cannot start APP/DESKTOP" and an error is logged on the SF that says "The Federated Authentication Server at: FASERVER generated an exception for method AssertIdentity. The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state."

You can use the "Don't run specified Windows applications" policy:

That's plan B. There's no native Sophos way to disable that crap?

I don't know. I have never come across Sophos. It's note widely used here in Denmark.

or add the process to the "LogoffCheckSysModules" registry entry

LogoffCheckSysModules should fix this, like Dennis mentioned.

It's not since it's a protected process, Citrix cant kill it.

7 years ago, MacAfee did the something, and the LogoffCheckSysModules did not help. I had to open a ticket with them, and if I can remember right, they had to help me do a custom security policy for the CVAD side. This is super old, but may be worth looking into. I know it's not dispalying in the sys tray, but it might be worth testing.
<https://support.citrix.com/article/CTX121599/an-active-session-exists-even-after-logging-off-the-session-when-symantec-endpoint-protection-is-installed-on-a-citrix-xenapp-server|https://support.citrix.com/article/CTX121599/an-active-session-exists-even-after-loggi[…]-endpoint-protection-is-installed-on-a-citrix-xenapp-server>

I think if it's a protected process, Citrix can do anything about it

Never used applocker but, can’t you block that process with it so it simply doesn’t start?

Yes, you should be able to block it for Domain Users, however the users will received a "this app has been blocked" notification everytime they log on

"Don't run specified Windows applications" policy did the trick.

But I haven't check in the AV console if there's a native way to disable it yet.

Thanks <@ULL6F7DRA> for the suggestion.

Oldie but still goodie :slightly_smiling_face:

Never noticed that - but for published apps we go CDM all the way now anyway

TBH I am not sure whats the difference between "OneDrive" and "OneDrive sync app" but the following article states: "The OneDrive sync app is not supported in remote app scenarios."

I understand it that this also counts for Citrix and not just MS RemoteApp!?
Maybe I am wrong :)

<https://learn.microsoft.com/en-us/sharepoint/sync-vdi-support>

The sync app is the client for machines that allows a local cache. OneDrive in general is just "files in MS cloud"

And yes, that's how I read it - Sync App no longer supported for remote published apps (Citrix or MS or anything)

I havent checked the article Leee posted before posting. :smile:
Now I see that Citrix used the very same screenshot :smile:
Sorry for that.

Thanks James for clarification on the difference.

Oh dear, that snuck in quietly. All those customers with published apps all over the show are going to have to move to desktops.

Or buy CDM licenses, or just use the web browser, or hack it with WebDAV - options aplenty

Got a few customers who just use OneDrive in the browser, works reasonably well

Yeah, that is an option for sure. Just a weird decision from MS IMO. They have a service that has published app capability and their own product will not work with it. I just don't understand the reasoning.

Their products should work in their own ecosystem to allow a nice seamless experience. Integration with other office products as an example.

I don't know how much CDM costs, but I can't picture trying to include OneDrive via the sync client in published apps. It just sounds like a nightmare.

Yeah you'd need multiple cache disks if doing concurrent sessions, CDM is cheap. And does other stuff besides just OneDrive (Teams drives and Sharepoint drives and the like)

Back in the day, I tested that other OneDrive PS script that basically mapped drives using WebDAV. Worked well, for free.

But it needs to constantly run in the background

And doesn't need to re-auth either. I think the mapper script now tells users to use CDM instead

Its not really a nightmare no, but its been a bit of a faff for a while. The concurrent access isn't so much of an issue as long as they're all published from the same pool.

WebDav I've used before but it has issues, slow, not fantastic. Annoyingly its been working fine up until the update.

Let's not forget Sharefile and Ivanti can also solve this problem for you, if you have them

Nah, I'm good with forgetting about ShareFile...

CDM didn't do well for us but there are options at least.  Our issue was with vanity URLs that they couldn't support.

Yes, vanity URLs are an issue. Had the same at an insurance client.

Apart from the fact that Microsoft does not support OneDrive as a remote app, has anyone still used it or does it work?
I guess we would still need to configure ShellBridge and a scheduled task: <https://www.jeffriechers.com/wiki/launch-onedrive-with-citrix-published-applications/>

Microsoft has published a new article: <https://learn.microsoft.com/en-us/sharepoint/onedrive-in-citrix-virtual-apps-deployment-guide>

Looks like it's "again" supported?

just log in as a local account and run

Reset-ComputerMachinePassword -Server DomainControllerName -Credential domain\AdminAccount

okay, so that won't impact the MCS clones when i run an update?

Nope.
Top tip... look into disabling automatic password update on the computer account, that is a registry setting which can be set inn the master image.

There are some security concerns involved of course, but you can avoid this issue later if you revert to an older snapshot with an invalid machine account password.
<https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/disable-machine-account-password>

Exactly what <@U032F1660BX> said is what I do at times.  Sometimes I have to do this as well
```Test-ComputerSecureChannel -Repair -Credential corpdsmith```
I use this site to help me when I forget
<https://theitbros.com/fix-trust-relationship-failed-without-domain-rejoining/>

<@ULLH5JGFR> thanks...i guess it won't impact the clones...thanks

What <@ULLH5JGFR> said will work as well when the problem arises. I've done that a few times with persistent VDIs that have lost the trust relationship. However, "my" fix should help you avoid that issue with the master image alltogether.

No <@UM2G5G8E5> the clone have there own identity. But do what <@U032F1660BX> stated with the machine account. If the master image is turned off, as most are while not in use. The Domain trust may continue to get broken. As I believe it is 30 days. It like we do with PVS Golden image.
<https://support.citrix.com/article/CTX231620/disabling-automatic-password-change-for-nonpersistent-desktops>

I tried all these steps but none of them worked.  I checked AD and the computer account was missing.  I've never seen that before.  I thought a computer AD account loses it's trust if it has been shut down for longer than 30 days.

does it automatically get deleted from AD as well?

Do you really have to do this for MCS - <https://support.citrix.com/article/CTX231620/disabling-automatic-password-change-for-nonpersistent-desktops>

All the best. Your site has been an invaluable resource.

All the best, <@UL8ACTGSF>. Thank you for everything you have done for the community.

I would expect it to be released in May, based on the timeframe between CUs. It contains a fix for crashing that we have seen in our environments, so we're also waiting for it.

I had to go to 2203 CU2 VDA due to the recent high sev security vulnerability affecting prior VDA versions

I have nothing to base this on, but since 1912 CU7 (CU6 in November) was just released, I expect 2203 CU3 (CU2 in December) in April, based solely one prior release cycle.

<@ULC9J5XPB> What crashing are you seeing? We have our entire 2016/2019 server environment on CU2 and not seeing anything crash related. UPM issues, for sure.

For us, in 2203 CU2, after booting up a VDA and waiting (no specific timeframe, all random), I'd see picadd entries in the event list stating that virtual channels were being blocked (Webex/ControlUp was attempting to open them). If we launched a Webex meeting after this happened, Webex would launch unoptimized and the VDA would blue screen. I was able to reproduce this every single day, at least once per day. Citrix provided a private hotfix (picadd.sys and PicaSvc2.exe) for CU2 that completely resolved the issue for us, and told us it should be included in CU3. That made sense given that the file version of both was .3000.

<@URVNXB96C> is also having crashing issues in 2203.

We don't, either... I have a policy explicitly allowing all VCs. That's what made this weird.

ya for us we have no idea what it is but definitely can say both 2203 cu1 and cu2 will sporatically (few times a day) blue screen us (mcs persistent) and if we uninstall/reinstall w/ 1912 all is good.  loooooong running ticket w/ both microsoft and citrix in which Microsoft pointed out picadd.sys as the culprit and citrix is being difficult now asking me to start totally over and get more crash files (examples exactly like what i opened the ticket w/ months ago so i'm pushing back)

Had lots of crashing issues with CU1 as well, but mainly on 2016 servers and didn't deploy very widely because of it. Whatever they found for our specific issue they provided a private fix for and included in CU2. There's always something with picadd.sys it seems.

I get random issues when I try to reconnect to an existing session, and end up with the error "Unknown client error 0".

It might be related to changes in display settings on the local client, number of monitors etc. But its hard to pin down. Never had any problems with 2103 which we are currently running in production.
This makes me hesitant to deploy 2203 CU2 into production, even if it is to patch the vulnerability.

I'd wait for CU3, personally, if you're able to. It should be right around the corner, and will have a slew of other fixes in it.

remove the rights to the template and don't issue them on the according subca but only on the ca that you wan to use. The default templates etc. are not security hardened.

yeah understand that my question was how i remove all the pending requests for domain joined endpoints that are trying to auto enroll for a cert from the Citrix_RegistrationAuthority_ManualAuthorization template because the security perms on it had autoenroll enabled

i dont fancy going through thousands and thousdands of invalid pending cert requests and deny them all

Ah I understand then you’ll need to revoke them via cli regarding CA 

certutil -deny seems to work but need the requestid of the pending request

Worth a try, or some looping via powershell perhaps 

once i denied all the pending cert requests will fix the perms on the FAS templates as per <https://carlstalhood.com/citrix-federated-authentication-service-saml/#certificatetemplates>

if it's like certutil -deleterows it will only do 3000 at a time so may look like it's not doing anything, but you just need to rerun things multiple times.

Not sure if it's related, but after 2212 WSA we have user reports of "Num Lock" light indicator is on but it doesn't work on the VDA. It's not a big deal because they toggle it and it works fine. Num Lock is working on the local machine when it is NOT working on the VDA.  Anyone seen this?

Have you deployed the FAS service component on prem and connected it to citrix cloud and deployed and published the FAS templates to your CA and approved the Citrix_RegsitrationAuthority pending request and created a FAS rule ? and applied the FAS gpo to your VDA's and FAS servers ?

Is this new or has it ever worked? Just thinking do you have Domain Controller Authentication certs on your Domain Controllers?

When i have seen the incorrect username or PW error with FAS previously its normally related to the cert on your Domain controller

Its a new FAS server i just configured the other day

what do you mean Cert on the domain controller

Yeah, it'll only really show up if you enable kerberos logging

check your cert on your domain controller in the personal store for local machine

You need to issue certs to your Domain Controllers using the "Domain Controller Authentication" certificate template

It's needed to allow AD to authenticate credentials using smart-cards

i don't see those steps in here <https://docs.citrix.com/en-us/federated-authentication-service/install-configure.html#connect-to-citrix-cloud> at all do  you have the steps?  can  you send them to me?

Trust us its needed :slightly_smiling_face:

can you send me a screenshot of what i should be looking for?

haha mine actully expired in my lab best renew it

and its issued from the domain controller cert template ?

but he had to go so i have to check back with him at 2:30.

<https://support.citrix.com/article/CTX270737/incorrect-username-and-password-error-when-using-fas-to-single-sign-on-with-vda-with-event-id-19>

so the cert on the DC looks fine its issued by the correct certificate authority.

is this right...is this what it should look like

i see this event logs in systems - EventID
The domain controller rejected the client certificate of user , used for smard card logon.  The following error was returned from the certificate validation process:The revocation function was unable to check revocation because the revocation server was offline.

Check this thread <https://worldofeuc.slack.com/archives/CK6TCV3JN/p1677495941288019|https://worldofeuc.slack.com/archives/CK6TCV3JN/p1677495941288019>

it looks like its the certificates on the DC

what is the impact of renewing that certificate to include the smart card properties

i think i basically have to do the fix that is stated in this article

Open PKIview and check your CDP/AIA locations and make sure they are not offline. If you want to publish a new certificate template you go into templates on your CA and manage and duplicate a template eg domain controller authentication (check the extended key usage and make sure it has smart card logon) on the ACL make sure your domain controllers has the enroll perms. You then publish the template "cert template to issue" and select your duplicate template. You can then enroll for the cert using that template via MMC on your domain controllers

thanks john, but i was able to create the correct certificate last night by selecting the kerberos cert template.  so i am good from that end.  I think they have an issue with their PKI. i need to determine what it is.

From the error from the logs you posted sounds like the CDP (CRL) and AIA is unavailable if you run PKIVIEW via CMD will confirm that or not

Yes dtls 1.2 does not work with audio over UDP

Could be related if using CQI,
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/2203-ltsr/whats-new/cumulative-update-1/fixed-issues.html#sessionconnection>
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\icawd
Name: AdaptiveScalingEnabled
Type: DWORD
Value: 0
[CVADHELP-19781]

This fixed the erratic latency measurement. Now to understand what is HDX Adaptive Scaling and why I need to turn off the L7 latency on the NS..

I should have check Slack on Friday..I got messaged to look at a similar situation on my weekend. I was able to duplicate it and then it cleared up on the account I was working with. Difference being we are all persistent and the only users that we saw with issues were a couple of employee (non-client) accounts that had their logon token expire and weren't able to get them to renew. Won't be able to work with the broken accounts, if they are still broken until Monday (tomorrow).

Just looking into this again now. It might be related to a change enabling acceptance of "terms and conditions" that was executed last week her. I just to some exception rules added for the Citrix machines, so I'm just doing some testing to see if that is the issue. If not, then something must have changes elsewhere, either on our side or on Microsofts side.

It is confirmed, they enabled a requirement to accept "terms of use" via Azure Conditional Policy. For some reason that breaks sign-in from Office apps from the VDI. SSO for browsers works as intended.
We are still looking into possible solutions, including verifying trusted sites and intranet sites.

Interesting. I'll be looking at my users in a moment. I don't think we made any changes, but there is potential that one of my co-workers did make changes while I was out. Thanks for the follow up.

Experiencing what sounds like a very similar issue for one of our customers. ADFS which has been working fine suddenly stops working, user i'm talking to first noticed it this modnay. I'll have to check with my azure guys if the terms of use requirement is set up and see if disabling the requirement fixes it

No changes were made here. I have had now a total of 5 instances and a full profile rebuild is the only thing I have been able to do that fixes the issue. I'm missing something and most users won't give me the time to work it either...not that I haven't broken the profiles of the users I was working on trying to fix anyway by "randomly" deleting things that looked like they could be related. Trying to get a more accurate approach to troubleshoot the next one we have, but it's starting to be a trend.

FYI, this issue was eventually tracked down to a Azure Condiational access policy with "terms of use" that is applied to some groups of users. A support case has been opened with MS for this case.

Have you tried Get-BrokerDesktopName, looked at DesktopGroupName and Name, and see if there is name difference? I'm not sure which name Director looks for.
This might be the reason, you are seeing the wrong name in Director.

Yep. On Studio / DB site, everything is fine.

If you don't have to many Citrix Policies and WEM condition/rules pointing at the DG. Remove the VDA's from the DG. Create a new DG and assign the VDAs to that DG and assign the policies for the new DG. Should do the trick.

Not hard at all. I have some notes I can send.

You mean the PVS service in Azure, or just running PVS devices in the Citrix Cloud control plane? The latter is hardly different from the traditional way at all

Yea, good point. So running Citrix PVS on premise but hooking it into DaaS(Citrix cloud) or Setting up PVS in Azure to DaaS? Azure side I have not done yet.

PVS hooking into DaaS pretty straight forward. Integration has also got better recently. 

I can’t speak for Azure native side but there differences between Azure native and non Azure native functionality wise.

PVS-DaaS.docx

I have a doc I made, but it's not finished. I can send it to you to get you going. But remember it's not finished.

<@ULLH5JGFR> it is time for a blog :slightly_smiling_face:

<@ULLH5JGFR> doc has all steps it's just missing you have to change the licensing to Citrix cloud on PVS farm properties as well as install a special license SKU on your on prem license server

I used a script to generate the devices, create the VM‘s and configure DHCP reservations. After that I used the new export wizard in the PVS console to add the devices to a machine catalog. I plan to write a blog about it. 

Hey Guys, sorry for the late response. thank you for all of your feedback! i'll review it over the weekend and also look for other articles! Thanks so much!  i hope i can repay you guys in the future with same type of feedback!

IMG_1737.jpg

Here is the option John referenced “cloud” tick box. I will finish this doc and release a blog soon. No need for a payback man, we are all helping each other out in this space. Like <@UL8ACTGSF> did for us when we were wet behind the ears many years ago. :)


Just as a note it's not "required" to change an existing PVS server licence to a cloud one if you are already licenced with traditional licences. 
But something worth keeping in mind is "if I remember correctly it's been a couple of years", once you install the SDK into PVS you cannot use the xendesktop setup wizard for traditional on prem ddc's. It's cloud or on prem not both.

Install pvs console on another machine to manage on prem vms if not moved to daas yet. Then pvs servers with updates sdk manage daas

Did they change the sdk requirement recently and that’s no longer needed?

why would anyone still do PVS? unless snapshots replication is an issue, I don't see much reasons for PVS.

“I’ve always done it this way” is what I always get or “we tried it in 5.x days and didn’t like it so…”

still a lot of folks that just don't like MCS.

On the client side that I see. PVS is slowly going down, but I still see more PVS vs MCS.

Amazing notes <@ULLH5JGFR>. You're always very disciplined with your doco.

Thanks man. That's because I can remember nothing lmao. But I document things so I have my own little repository 

<@ULDHJB8BB>, that could be the topic for a really cool and fun debate at an in person event.

I will say, I am liking MCS a lot more now. Especially in AHV setups. I have PVS in my lab, and I looked at it this morning, and I was a bit slow doing things. I am liking MCS a lot more now than ever.  I would like to get on on the event <@U011Z7F6733> if you guys decided to do it.

<@U011Z7F6733> definitely

Couples of MCS Advantages on top of my head
-No Sysprep to run
-No Reverse Image to do for VMware tools updates for instance
-No possibility of Windows Updates of breaking the network connectivity
-No Extra SQL BD to manage
-No dependency on licensing server
-No extra agent to maintain
-No extra legacy MMC console to maintain
-Manageable through a web console!
-Same RAM Cache mechanism as PVS as long as you install MCS IO
-etc

No E1000 hack either for VMware Tools  install (quicker that than reverse image)
Reduce Infrastructure footprint (no PVS servers)
No TFTP/BDM and DHCP setup Helpers needed.

Don’t have to worry about networking impacting your images streaming…

It's a lot less faff on, I avoid PVS where possible now

the only pro for PVS I can think of is easy VHDX replication

makes sense when you have no way to replicate snapshots easily with multiple data center

Depending on your environment, that can be easy. Especially with some stuff we are doing with AHV templates.

<@ULDHJB8BB>, aside from...
-No Extra SQL BD to manage
-No dependency on licensing server

...the rest are all minor and irrelevant in my opinion if you've got a good automation tool in place. Have been using MDT for 13 years, so this stuff is just so simple for me. But yes, for those that struggle with the items you list, I take your point...BUT you will never win the debate! :joy:

Just FYI and informational. We had another channel about VDA registration talk. I can confirm this works really good. If anyone was wondering. Only if the current DDC are up and the VDA can register with them. Other wise disable it and update listofDDC and delay the Desktop service.
<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/2203-ltsr/manage-deployment/vda-registration.html#auto-update>

Generally i would do, although you might need to supply domain creds to connect to *stuff

I had done it mostly to keep the size down and not have the Domain Admin accounts profile built into the image.

Also, it helps avoid caching any uwanted user GPO objects in AD. You do have the base image placed in a blocked OU with as few GPO objects as possible, of course? :slightly_smiling_face:

If you want users to only connect to specific vda's, you can use machine tags to achieve that :slightly_smiling_face:

<https://docs.citrix.com/en-us/citrix-daas/manage-deployment/tags.html>

missing a bit of information, what kind of profilesolution are you using?

icon white &gt; right click the app, and in the pop-up right click the app again &gt; Properties. On the Shortcuts tab &gt; Click Change Icon &gt; verify if the file and path presented there is available. Most likely not, but if so (and I'm not quite sure if this applies to both desktop and taskbar), then your iconcache DB might be corrupted, delete it and start a new session.

Citrix UPM.  For one, the taskbar icons dont stay after reboot sometimes.  When they do, the icons are blank. Im thinking i have something exluded I shouldnt?

Do I need to include %localappdata\temp\*.ico ?

Just set different policies for different user groups. Lots of details here <https://james-rankin.com/articles/windows-session-timeouts-on-citrix-a-brief-guide/>

Thanks <@UL5TCSW3D> !
I swear - I've read every single of your articles, but somehow I missed this one :wink:
Somehow it seems that I've also missed that it's possible to set session limits on a user base. Since Server 2008R2 I've always built them on a computer level.

Unfortunately this is what brakes my neck now - the computer baseline policy has session limits implemented and this makes it impossible to use the user settings.
Also the Citrix Policies are ignored if I configure them :disappointed:
Without "reorganizing" the baseline GPO (which isn't an option at the moment) I fear I'm stuck.
Does someone know if the Citrix Session Timers still rely on those "finherit..." reg keys?
My thought is: I could disable the Computer RDSH Session timers, set the needed "finherit" reg keys to enable the counter functionality and then configure some Citrix user session counters.

Good luck with your house renovation!  :+1: (I'm luckily almost done with my house too)

Why are the Citrix policies ignored? Is it because the RDSH Computer policies are in play? Are the Citrix policies actually getting written to the Registry (HKLM\Policies\Citrix\[SESSIONID]?

Of course, you could just tell these users to install Caffeine on their end devices.....works a treat for me :slightly_smiling_face:

I suppose it's because I've to disable the session limits on a lower ranked computer based gpo and then try to re-enable them on a higher ranked user gpo.

I suppose that deactivating them on a computer level takes precedence over "re-activating" them on a user level - even the user gpo is ranked higher.

also bringing in the Citrix policies instead the user rdsh settings doesn't change anything

Yeah I think Computer overrides User if the same settings are configured

Could you not switch the 10 hour timeout to a User setting as well? Technically it shouldn't make any difference.....then the higher User setting should override it

Unless it's specifically mandated as a Computer GPO, which wouldn't surprise me

generally switching over to user: well - that's what I'm thinking about since a couple of hours now. It would cause some effort in testing, change advisory board discussions,... + the risk to damage something for 1,5k users.
On the other hand I'd need the flexibility for 4 users that want to run some SAP reports "in the background" 4 times a month. They are not willing to run the reports on their local computer, because of the CPU consumption and because they can't hibernate their laptops and take them with them when they switch to their home-office.

Or just install Caffeine for those 4 users on their local machines which will make sure the session limits never apply (there may be a security implication however dependent on your stance)

yes - this would be a quick alternative.
will check this out - hope it's still working with workspace app...

thanks a lot for reading all this and all your suggestions!!

it still works, I use it every day. Occasionally it has crashed (not very often) but a reboot usually sorts

Gpo must applied to fas, storefront and worker

interesting...its not in this environment

it is a requirement.  perhaps they used lgpo or simply the registry keys?  easy to check, just look at hklm:\\softwarepolicies\citrix\Authentication\UserCredentialService\Addresses for the fas server names.

Exactly. Maybe they put it directly in the registry

<https://www.deyda.net/index.php/en/2022/08/18/saml-authentication-between-citrix-microsoft-with-azure-mfa/|https://www.deyda.net/index.php/en/2022/08/18/saml-authentication-between-citrix-microsoft-with-azure-mfa/>

TechZone link as well. But yea, GPO or another method of applying it goes to the FAS,SF, and VDA.
<https://docs.citrix.com/en-us/tech-zone/design/reference-architectures/federated-authentication-service.html#active-directory>

You can check this location as well
*HKLM\Software\Policies\Citrix\Authentication\UserCredentialService\Addresses*

Oops looks like <@U014U1UPHDW> already put that on there. Sorry.

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/whats-new.html>

"There have been no fixed issues since Citrix Virtual Apps and Desktops 7 2212"

their products are flawless, what are you trying to suggest?

0 issues fixed? wth I had policies from web studio that refused to be applied for more than 6 months.

Citrix Graphics Status tool that crashes with dotnet error also.