World of EUC

image.png

It's my session and it's 100% disconnected, thats the confusing part. Here also saying console is active, but it isn't. Fast user switching isn't enabled.

And do you have fast user switching enabled?

It switches to Disconnected but the Connection type is Console, too. I think as soon as the type is Console, the session idle limit will never hit?

The GUI can and will lie to you.  I never trust what it tells me, I go look at the raw data from the machine itself, vs. the GUI which just tells you what the database thinks is going on.

Not yet Andrew but I think that might be coming.  Its a microsite thing but i think what is required isd in tech preview.

Thanks Rob! So I guess that means we'd be kind of out of luck if we're staying on the LTSR channel, right? And that's assuming if we'll ever get help with her 2203 VDA blue screening issue :slightly_smiling_face:

Understandable! At the rate our Blue screen issue ticket is going, thehe next LTSR will be out before we can finish that anyways haha

On a physical machine where you have the device attached you can get the settings <https://support.citrix.com/article/CTX129558/how-to-redirect-usb-devices-in-xendesktop>

If you have trouble tracking it down in DevManager, i like to use USBDeview, then sort by event time, plug in the device, and the device will be on the top   <http://www.nirsoft.net/utils/usb_devices_view.html>

There’s a ps script that will show pid/vid of everything connected and export it. I’ve ran the script with and without the device plugged in and then compare output of each

Only the same user can re-connect. Any ideas why the broker isn't registering the session correctly as HDX - disconnected instead of Console?

Maybe this will help.  <https://learn.microsoft.com/en-us/answers/questions/61473/rds-licensing-servers-ha>

I just use 1 rds server at each data center and user based licensing. Don't load any licenses. True up every year.

I have it in once place where they did the 100 as well. “But RDS license HA was usually classified as less meaningful mostly.” “If the license server fails, the server starts the "licensing grace period" and you have several days to recover the license-server.”  [<https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-client-access-license>](<https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-client-access-license>)

That screen name drunkmonkey cracks me up haha

<@ULLH5JGFR>  - this is 120 grace period is only when the RDS server is first brought online.   It doesn't mean that if the RDS license server goes down you have 120 days until it stops denying connections..

Yea I’m aware. But if it goes down it goes in a 120 day ordeal on the vdas. I deal with this a lot with clients. If the server vda can’t talk to it. The RDS part that the VDA installs go into a 120 days countdown. 

If you setup a server vda for example for no RDS it is 120 by default. If the RDS license server goes down the vda resumes the 120 or whatever the time is next.

From my experience yes. But do what you think is best. I could be wrong man.

last week i noticed that when i moved a vda out of the OU i started getting RDS licensing errors, and it would not let users on.  so thats why i don't think there is a grace period.   if a user doesn't have a license assigned or its expired then you are out of luck.

Funny you say that, last week I deployed 2203CU2 Server VDA. The clients asked me why am I getting a popup saying I have 120 days. I explained they need an RDS Licensing server.

Yea it was. So that may be the difference. But when I do move something out, I reset the timer. But it's only for testing, as it goes again MS EULA.

yes, so for new servers you have a 120 grace period not for existing

so really the only way to make RDS license HA is to have to rds license servers and have the same number on both.

<https://social.technet.microsoft.com/Forums/windowsserver/en-US/e3e65366-ef08-4692-b2e4-8a6a7df46a1a/rds-license-server-high-availability>

Build 2, and split the licenses. Then in the GPO(Use the specific Remote Desktop license servers) or whatever method you use. But both the RDS lic Severs in the area for the VDA to contact. I never done it, but I don't see why it would work.

just reset the grace period reg key and reboot lol

not 100% what you're asking for, but you could extrapolate the data from this list: <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/policies-default-settings.html>

I'm not aware personally of a list like you're asking

Thanks Quentin. Your link is about policies by VDA version, that's not what I am looking for.
I want to know what feature by catalog functionnal level.
IE: Level 7.9 give you the MCSIO (as I remember)

I checked with someone who has source code access and they came back empty, but are still looking 

Hm, I started to suggest "For GPO managed machines, it helps to have the protocol handlers whitelisted with URLWhiteList workspace:\\ reciever:\\"

But when looking for the Google KB to reference it... I found that setting was removed Chrome &gt;84...

I found this gets it done. Sort of annoying an approach. <https://chromeenterprise.google/policies/#AutoOpenFileTypes>

```Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Policies\Google\Chrome\AutoOpenFileTypes]
"1"="ica"```

Good to know. Wonder if we can do it for edge

Thanks Steve!  Yes Matt, looks like it's in Edge policy documentation as well.  <https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#autoopenallowedforurls>

I have seen the same result at a customer running with the configuration/versions as you. I havent spend much time looking in to it as it only happens randomly. But we are currently trying the three keys mentioned here, to see if they help: <https://discussions.citrix.com/topic/416254-2203-ltsr-issues/page/7/considering> (FastReconnect doesnt apply to 2016 though)

Interesting.... what would you be looking for John?

Hey Leee, one of the engineers asked me the Q. I shared this matric from Citrix docs: <https://www.citrix.com/content/dam/citrix/en_us/documents/data-sheet/cvad-ltsr-matrix.pdf>

ITs decent but I recall seeing a Go EUC one from years back with CPU/Mem/Network comparisons between 7.x and 1912 that was very useful, cheers

I'm currently working for Automai (Load Testing, Continuous Monitoring, Application Testing) and I may be able to organise something like this but not very quickly.

Nice one.. thats cool man. I think the link I sent will do for now but anything you share down the track will be off great value :slightly_smiling_face:

I can test the latest 1912 LTSR against the 2203 LTSR and see what happens :wink:

This was the article I was talking about mate... I used to reference it in HCs etc: <https://www.go-euc.com/citrix-virtual-apps-and-desktops-1912-long-term-servicing-release/>

back up the citrix databases and restore them on the mirror using restore with no recovery. Run the database mirroring security wizard on primary and connect to principal/mirror/witness and select service account and then start mirrroring. Once that is done you need to null out all the FMA service DB strings and then configure them with the new DB string for mirroring eg “Server=<http://FQDN.com|FQDN.com>; Initial Catalog=XDDatabase; Trusted_Connection=True; Failover partner=<http://MirrorFQDN.com|MirrorFQDN.com>”

There is powershell scripts i have used in past or you can do it manually <https://docs.citrix.com/en-us/advanced-concepts/implementation-guides/database-connection-strings.html>

Hey John, it's a new site, creating empty databases on the principal SQL server of an already mirrored SQL server.

From what I can tell, it's supposed to detect it's mirrored during the creation phase, but it doesn't.

oh ok thought you wanted to migrate to a mirroring setup. Did you create empty databases (Site/logging/monitoring) and configuring mirroring prior to the Citrix site setup ?

Yes. The SQL and its mirror are up and running (and already hosting the old 1912CU6 databases)

That's the thing, I haven't let it create the databases yet, because the installation summary is showing me I don't have high availability on my database:

you will need to create empty databases and setup mirroring on the empty database, When you then configurure the DB connection during the site setup it will detect the mirroring setup

That was quite the undertaking, for somebody not at all familiar with SQL, but here we go. Thanks man, you're my hero :slightly_smiling_face:

I would take a look at that specific user instead. Why is that user making tls1.1 calls, when everyone else is using tls1.2/1.3.

Thats 7.15 LTSR version. By default does that version use tls v1.1?

Works well, it's not a hack but a feature :wink:

<@UM2G5G8E5> This feature is a replacement for the current reducer, but we want to get customer feedback before we switch defaults in the future. This is not something a customer normally should configure, hence why there is no policy.
As it is not a policy, backend versions etc doesn't matter. Just VDA / CWA for Windows versions that have a minimum req.

Let me know if you have any questions.

<@UNBRPVD4G> the article says to upgrade Netscaler.  What is the recommended version of netscaler for this feature?

The article mentions that HDX Insight will be disabled if you have v4 reducer enabled. In the future, when we will switch v3 to v4 by default, we will mention which ADC build you need to support HDX Insight. But currently there is no support for that.

okay, great so all my team has to do is deploy that registry setting and it should start reducing the bandwidth?

Yes, it should reduce it more than the current one

i just wanted to make sure i have all the info

Feel free to send me an KBs you might have.

The blog contains all the details needed, also explains what the reducer does

<@UNBRPVD4G> I tried to comment that blog post two times, but my comments just vanish.
How can we tell this is active, any indicator, like for example in ctxsession.exe?
Maybe it worked now, seems like commenting from smartphones didn't work so well.
Aaaaannd the comment is gone, again.

You mean Citrix gateway service + workspace service? I've not done deployments for 5k users, but have done dozens with the above components without much hassle. The biggest win, is taking away regular Netscaler firmware updates. Normal caveats of 99.99 reliability for Citrix Cloud services apply, else, I usually recommend new/existing users migrate to Citrix cloud services where possible

Well, I mean so not paying for the workspace service and using the basic storefront interface with gateway service yeah.

Ah, gotcha. I would still recommend going with both, one less item to maintain on prem, unless your client has an ultra tight budget, go all cloud for your access layer

Hi, Does anyone have an issue where they launch Outlook (Office 365) and a published application, which prompts them to log in and freezes?   However, it works fine when using it on a published desktop.     Also, I noticed that when users launch Word (office 365) on their desktop, they can't open it as a published application. Again, however, the published desktop works fine.   Has anyone seen issues like this? If so, how have you resolved it?

Go to the controlUp channel and sign up. Then there are tons up help

There is a controlUp channel In world of EUC. As well as a controlUp slack workspace (like world of EUC).

But this will get you going 
<https://support.controlup.com/docs/first-steps-with-vdi-and-daas-hybrid-cloud|https://support.controlup.com/docs/first-steps-with-vdi-and-daas-hybrid-cloud>

Many Thanks <@UL5TCJ57D> and <@U036002AF08>

pre-fetching. Windows uses more memory than it is "using" to launch stuff faster

thanks <@UL5TCSW3D>, I see your point but don’t you find this value to big, I means 12vCPU/48GB memory for 12 users ? Is there way to optimize that part regarding pre-fetch ?

If there's less available, it will use less

ok, so for you the only way to consume less, would be to have less user or less process per user, correct ?

IME you will always see Windows memory usage up around 80-90% unless your load is very low. It's nothing to worry about though.

Push more users onto the platform and the delta should drop

ok so I should adjust my load balancing citrix policie and keep the memory usage to disable instead of 90% currently ?

SR is enabled, and 2598 is also open from the Azure workstation &gt;&gt; session host

What version of the client is being used?

I'd check STAs on Storefront just to be sure.

If you did a packet capture on both sides, client and VDA I may be able to potentially tell you what the issue is.

It's working for all other clients so not sure what would need to be changed on Storefront - I am in the process of getting a Wireshark and ProcMon, so might be able to share something when I get them

James is there an ADC being used or is it trying to open the VDA directly

Direct to on-premises Storefront, no NetScaler in the mix

And are any of the working endpoints in Azure or is this the only azure one

This is the only Azure one, and it is the only one that fails

Any Secure ICA involved? Only thing I can think of if you get the ICA file. Looks like a secure negotiation failed or something. Event logs on the VDA may lend a hand.

Any additional firewall or proxy in the mix when using the azure workstation? e.g. SSL Inspection

Not as far as I could tell....will ask the admin to check again

There is an error logged on the VDA - not particularly helpful though

Looks like something in the middle is disrupting data, some sort of inspection. This isn't an SSL error so thats that ruled out.

<@ULHA2NPPX> - Yeah, same here. I recall disabling UDP and hard setting the MTU so it didnt adjust based on network conditions for certain sites/locations, cheers

Is there somewhere you can do that from a central config area? Is it a Storefront setting?

Ah, the default.ica file - and the article mentions Azure limits, ah-ha <https://support.citrix.com/article/CTX231821/how-to-configure-mss-when-using-edt-on-networks-with-nonstandard-mtu>

When I had this issue it was a couple of sites totalling about 15 users... from memory we bumped them into a DG with UDP/EDT disabled and the SD done some client config on the handful of users, cheers

CitrixLaunch.pcapng

managed to grab a Wireshark trace as well, I have told the admin to check the MTUs (although he's probably writing me a Teams message right now saying "I don't understand" :grinning:). Just wondering if the trace indicates that it is indeed an MTU issue (doesn't seem to tell me anything, but I hate networky stuff)

Do I just need to make this change by editing the ICA file directly, or does it need to be changed on Storefront in the default.ica file? We edited a downloaded ICA file manually and ran it, but it still generated the same error.....

There's no way of telling the MTU from a packet trace, could take an educated guess, but that's not what you want.

I do, however, see malformed UDP packets, so this makes sense and lines up with what everyone else is saying.

I've seen this with Networking devices too in Azure, having to lower the MTU.

So can I simply edit the ICA file or do I need to make the change on the SF end?

(I edited the ICA file and it gave the same error)

Editing the ICA file should make the change. Yep.

Hmmm. It made no difference, using Receiver 4.11 so didn't need the additional Registry changes

You can also disable EDT MTU discovery on the VDA side with a registry key.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\icawd
MtuDiscovery - DWORD - 0

So setting that should have the same net effect?

I am not sure on the behaviour with the combination of settings.

Technically if you specify it in the ICA file you'd expect that to win, but if the feature is also enabled on the VDA side I am not sure what wins.

ha ha, Well - it says you need VDA 1912/2103 or later so you should be fine with that

Workspace app 1912/2105 or later on the client

Discovery does overwrite manual settings.

<https://support.citrix.com/article/CTX231821/how-to-configure-mss-when-using-edt-on-networks-with-nonstandard-mtu>

But you're using a 6.5 farm agent so this should not be applicable.

<https://support.citrix.com/article/CTX114680/event-log-error-an-error-occurred-when-processing-incoming-cgp-downstream-data>

This is for 6.5, I've not come across this before so it may or may not be related. Do you see event log errors on the VDA?

Upgrade to a VDA and join it to the new farm?

Let me see what we can do with those reg changes.....will update when I hear more :slightly_smiling_face: New farm? 6.5 *is* the new farm......

3.0 is gone and 5.0 is down to a few servers....consolidating on 6.5 :slightly_smiling_face:

Oh god James! :joy: consolidating to 6.5. :joy:

Well dang, sorry, was my best idea.  Manually editing the ICA file should be fine.  In my Azure enviornment i did edit the file in Storefront C:\inetpub\wwwroot\Citrix\&lt;STORENAME&gt;\App_Data\default.ica

Is there a setting equivalent to Storefront's "default.ica" on a Web Interface server? (No laughing at the back)

yes....  it's in inetpub somewhere as well

i'm pretty sure it's just a default.ica file somewhere in there too

Damn - looks like this is a 6.5 issue, same Azure workstation can launch newer Citrix resources just fine

That's odd.  Not sure why Azure would care?

Currently trying to build a 6.5 environment to see if it is something peculiar to their implementation......the joy

now that sounds terrible.  I'm sure you have built 100 of them, like I have, but still a joy....

I have a lot of Clients add another licensing Host ID and allocate them for the site, install them, and they are in a standby state for a DR. Or Replicate the License server to the DR location and use it.

<@ULLH5JGFR>  - you mean on <http://citrix.com|citrix.com> or edit the actual license file?

If you edit the license file you'll blow it up, they're signed.

Definitely don’t edit your license file(s)

i won't.   splitting the licenses is probably the only support option, right.   i don't think adding another host id is.

<@UM2G5G8E5> I mean <http://Citrix.com|Citrix.com> Licensing portal.

Reallocate/standby, protect existing, etc 

I remember, back in 2004, a certain Health Care provider that I was working with had a 100,000 user farm.  For HA, the (internal) architect had them buy double the licenses...

I don't know.  You're using the non-deplume of Newbie1998.  How do I know ir WASN'T you?!?!?!  :slightly_smiling_face:

Citrix licenses have a 30 day grace period, so you have 30 days to restore the license server.
I do not see any reason to have a second active license server running. 
All you need is to setup a new server with the same name as the old one, install the license service and add the license file. This is only if you can’t restore the old license server. So all you need is the license file, the install media for the license service and of cause a small install guide with the hostname.

That is exactly what I would do as well. I did it twice this week to be extact.

Yes we are using this key on our VDAs as such it does not matter if workloads in azure or on prem. That enables communication over EDT protocol for the VDA

We had enough issues with EDT on VPN and wireless that we killed it and went straight TCP....

This is only required if you have specific challenges with MTU - Azure had it back in the early days of NetScaler deployments, but I hadn't touched that in the last 4 or 5 i did prior to leaving consulting - so no in short, it's there on a per-use-case basis.

MTU discovery should be your friend now though?

MTU Discovery should handle that just fine now. Previously there was only hard coding the MTU as no client supported it, then Windows did and others but not -  Linux for example we had to wait for and still hardcode as the IGEL/Linux situation didn't support the auto discovery in tandem. But yea, if you had any CWAs that didn't support the auto negotiate you still have to hard code it in. Azure you still have to usually make sure it stays under some value for NetScaler but autodiscovery on supported VDA and CWA together should handle figuring it out now.

I may be spinning my wheels on this but have to satisfy those asking to do some testing. Biggest complaint is Teams (if you can believe that) and with HDX redirection, any MTU changes aren't going to affect that traffic because it's outside the ica tunnel.

You need to have it reserved in the template VM the catalog was built with, if you change it after the fact I don’t think the clones get it. Try it on a new Machine Catalog, I’ve done it and it carries over to the clones.

Hi Mike, I tried it by creating a new machine catalog.
I modified the vm master image with reserved memory and took a snapshot.
Created a new MCS catalog, but memory is not set to reserved.

Tomorrow I will calmly try to redo the whole process from 0

because it crashed out entire nutanix cluster and caused rolling reboots when we ran out of RAM by spinning up too many machines with reservations

so the setting definitely carried over then, can’t remember having to do anything special

by heart I also remembered it was like this, tomorrow I'll try on another cluster

It should be carried over from template. I know it is for all my GPU stuff where its a requirement

Ive not had any issues, I normally go latest version of FAS available with CVAD 1912 etc.. no issues here.. Lets see what others say as I may get shot down :wink:

That is what I was told as well. I just wanted to double check here.

I would think you’d want LTSR FAS if on LTSR but otherwise go the latest, they all seem to be back compatible

FAS isn't LTSR compliant. We always do CR

oh. <@UM531NUFJ> recommends using LTSR on his site so I just assumed he’d checked :stuck_out_tongue:

<https://carlstalhood.com/citrix-federated-authentication-service-saml/#versions>

also, what’s this? It’s tagged as LTSR… <https://docs.citrix.com/en-us/federated-authentication-service/2203-ltsr.html>

FAS is listed as a baseline component of LTSR so I’m not sure where you’re seeing that it’s not LTSR compliant

maybe it is one of them for CVAD. Most of mine DaaS now where CR is our play. Can't say i have many strictly CVAD anymore at all

<https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/1912-ltsr/whats-new/1912-ltsr-initial-release.html#baseline-components>

but issues wise, no. works perfectly in either situation

yeah, it’ll work, it’s just if you’re in healthcare on prem or something where they get reallystrict about LTSR

it’s not in the LTSR compliance checker tool though

no, they didn't add it in. Again, rule of law yea, if support calls you out, guess CVAD you stay at LTSR if you have to there.

I just went through this with our guys internally as well, everyone goes latest version unless there’s a reason not to

Yea I went to the latest. Makes me wonder if Support will ding them now. Hmmm

the only people that seem to care are EPIC

I would not think so. I always looked at FAS independent like WEM.

honestly. they probably won't at all. support always wants to go the latest with anything as most of them probably don't even understand that LTSR model anymore

The only time I ever get hassled about LTSR components are with health clients because they don’t get support from their app providers if they aren’t on LTSR

Thank you James. Already done but looks like AVD Channel is not so active our Citrix Chaneel :slightly_smiling_face:

Ask away I say, can always move the convo if it doesn't fit

I can't answer that, but the better question is why on earth would you consider continuing to run 2012?

If the question is can you run OneDrive on Server 2019 then the answer is yes.

For MCSIO I look to see if the driver exists under C:\Program Files\Citrix\MCS IO (this path may be different on older VDAs)
and the corresponding registry entries under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CVhdFilter
Not sure about the rest sorry

I see that entry on a system where I was told MCSIO wasn’t installed.  It’ there so I’m wondering if the Start key tells the system to start it or not 1 maybe being enable, 0 disable.  Hmm

Not sure off the top of my head, but I know the driver under \Program Files\Citrix\MCS IO definitely doesn't get put there if MCSIO isn't selected in the install wizard

Wouldn't it be listed in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer with the rest of the components?

You'd have to search for "Citrix", but I imagine it'd show up there with CPM, etc.

A Start value of 0 does mean that the driver is disabled.