For those using WEM service, what is your experience with binding the configuration set to the DaaS machine catalog? I was attempting that with FSLogix gpo and the gpo settings were not applied on time for user logon. Moving FSLogix GPO to AD GPO works immediately ( windows 10 non-persistent on 2411).

Hi, whether WEM App Access Control rules are stored in file system like FSLogix? We would easily delete/replace FSLogix rules file for troubleshooting quickly.

HI all, I'm trying to call a batch file using an external task in the Citrix WEM Service. It doesn't call the batch file with an error in the agent log stating "Unable to validate target file existence"....followed by "Cannot start process because a file name has not been provided". The file location is definitely correct. I have tried using the "Run Script" (which imports the file), and also "Run Command" methods for WEM external tasks but the error is the same. The next step is a call to support - does anyone have any suggestions on this however?

Testing out migrating my GPOs over to a new WEM instance. Is there any way to import a GPO into template view instead of Registry-Based? Both have worked fine for me, but looking at something more visually familiar for customers.

What is the expected syntax for the WEM Active Directory Group Match filter condition? I'm a little confused about the syntax. My group is DOMAIN\Special Users. Does the condition want: • DOMAIN\Special Users • "DOMAIN\Special Users" • Special Users • "Special Users" This now sounds like a certification question.

So, we tested out using WEM to first launch onedrive for a published app, once it is in your profile, then it auto launches each time. However WEM launching it as an external task launches it BEFORE all the adal and shellbridge info was in place, so it would never auto-sign in. If we used my previous method of launching it from a scheduled task set to logon, it worked. Is there anything we can do in WEM to setup that launch after all the MS creds are in place?

Does any know when WEM service will be supporting Windows Server 2025 for WEM Agent. Today its only supporting Windows Server 2022 for WEM Services. Today WEM current release "onprem" Supports for infrastructure Windows Server 2025 Supports WEM agents for Windows Server 2025

Trying to export Application Security Logs from WEM to CSV or json, but the pop up window for CSV doesn't appear. If I choose third party, that does pop up. Anyone else seen this? Following the steps here. https://docs.citrix.com/en-us/workspace-environment-management/service/manage/monitoring/reports#export-reports

Hey all, has anyone seen a problem when using Citrix WEM to import GPO settings, that it creates a second (Default) registry string value when you try to set that (Default) value with WEM. The result is that Windows seems to ignore the second one with the desired value. There's a reddit thread here with the same issue, but no apparent fix. https://www.reddit.com/r/Citrix/comments/1doy9ge/using_wem_to_set_default_registry_entries/

Have a request for WEM. I'd like to see a filter that checks disconnected sessions on an image. Often RDS will barf and a machine will occasionally stack up with disconnected ghost sessions. Would like that as a condition to execute a scripted task to reboot the machine.

Our users like this feature on non-persistent multi session, but the issue we're facing is the apps (office, explorer) launch before wem has finished processing. Anyone have a suggestion on how to get the system to relaunch apps after wem has applied its config?

Hi, Is it possible to prepopulate the domain at the WEM web sign in? I thought I saw something a while ago but can't find it anymore.

Any hints how to us the right commandline for WEM, if using the VUEMAppCmd.exe to start the Published Application with that commandline "C:\Program Files (x86)\SAP\FrontEnd\SAPgui\saplgpad.exe" /LSXML_File=\”\\Server\share$\SAP\SAPUILandscape.xml\” . The commandline is wrong, no Session logon is performed.

Hi, When using WEM to manage the profile, is it possible to create a separate profile if a user has access to multiple different VDI's? So User A signs in on VDIT01 in Delivery Group Test, and the path is \\server\UserA\VDI-Test\ and he signs in at VDIP01 in the delivery group Prod and the path is \\server\UserA\VDI-Prod\

Is there an ETA for action groups in OnPrem Web Console?

Really like the Scripted Tasks function in WEM, far faster than remote powershell execution. But we NEED to be able to select more than 30 objects at a time. Had to stop services on 3000 servers and had to go back to powershell and it taking an hour to process.

Looking for advice, we found that the very first user to log on to a server after it has been rebooted has a much longer logon sequence of several tens of seconds at "Please wait for the Citrix WEM User Logon Service". Users who log on afterwards are not affected.

Hi, when using the GPO's in WEM after some time I keep getting this error: Unable to show settings configured in this GPO due to an error. The settings you configured will still function normally. However, if you edit this GPO, those settings will be lost. When editing the GPO all older settings get lost.

Anyone see the WEM Infrastructure Service going wild, constantly filling up the logs with warnings saying “Updating Agent Information…” and “Retrieving Agent Configuration for Configuration Set xxxx….” and “Updating Agent Statistics…” etc. Haven’t been able to find any known CTX articles on these events. Have several WEM infrastructure servers stood up - some are doing this, some are not. Given many of these messages seem to talk about statistics and “Agent Information” I was wondering if the WMI performance counters needed to be reset of the image in play. Anyone seen something similar? Event ID for all the various message is 0.

I see a Citrix WEM Agent User Session Utility log in our %userprofile%, we have debug on. I can't seem to find any documentation on the contents/purpose of the log, but I do see group policy filtering logged here. Does anyone know what else would write to this log?

Twice in our environment, WEM has been installed on the Win10 MCS master image and something has removed the service and the complete program files directory. only thing that remains is the entry in appwiz.cpl. could something like crowdstrike be doing this? i'm at a loss

I have a problem with Citrix cloud wem backend and 2411 wem agent. Hide disks is not set in the wem console but he hide and lock the disks in user context. Anyone else see this behavior in Citrix cloud wem backend?

I was hoping this was fixed in 2503. But no. Can we get this configuration utility recompiled with the ability to resize the window please?

Was testing out the new WEM and noticed that anything on Backups and Restores was erroring out. Rolled back, and saw the same problem. It ended up being an additional folder had been added into the WEM_Storage folder for the WEM Web Console caused it to error out. (Was when I was creating my easy CVAD setup process) Once I removed the extra folders it worked fine. So if you see any errors and see your backups missing check the contents of that folder.

We are exploring Citrix WEM as an alternative for our current workspace solution. I'm kinda struggling on the following example: In Outlook there are certain plugins that we don't want for certain AD groups. With our current workspace solution we can modify registry keys at application launch linked to AD groups. I've found the following and i want to know is this the best practice to receive the result • Create a Registry Action: You can create a registry action in WEM that applies the specific registry key. • Assign the Action to an AD Group: Use WEM's assignment rules to target the registry action to the specific AD group. • Application Filtering: Ensure that the registry action is applied only when Outlook is launched by using application-specific filters.

Look at external tasks/triggers. the reg action you see in the actions section would be applied to everyone or a user/session based filter, not to a process start (if I recall correctly), but overall yes WEM can handle this.

Testing out 2503 in my lab. Windows 11 was giving me issues from the previous image, so I deployed a new Windows 11 Insider build. Everything seems to be working great, except the WEM vuemuiagent doesn't seem to launch for any admins other than the one that installed it. I checked and it is set to run for administrator in the settings. I even put a shortcut in the run key, and it still doesn't seem to kick off. I can manually launch it in the session and all seems to be fine. On my Server 2025 image it seems to work fine.

This is driving me nuts... I've tried several ways but still getting the same error Unable to import GPO into Workspace Environment Management service - Invalid Zip file

So I have been rolling AppLocker out to more people with WEM. However parsing the WEM logs to get false positives to add to my config is a PITA. So with the help of CoPilot AI (not sponsored) I created a powershell script that can read WEM reports for much easier review. Test it out, and let me know what you think. https://www.jeffriechers.com/wiki/wem-applocker-report-parsing/

Anyone ever seen an issue where WEM Agents don't detect new Configuration Sets? Working on migrating some machines to new configuration sets and some pick up the new set no problem. Others require a full uninstall and reinstall of the WEM agent to get it to detect the new set. We are using OU assignments.