This message was deleted.
# citrix-vads
Slackbot
03/15/2023, 3:52 AMThis message was deleted.
k
Kasper Johansen
03/15/2023, 4:09 AMYou can use the "Don't run specified Windows applications" policy:
👍 1
j
Jonathan Pitre
03/15/2023, 4:21 AMThat's plan B. There's no native Sophos way to disable that crap?
k
Kasper Johansen
03/15/2023, 5:27 AMI don't know. I have never come across Sophos. It's note widely used here in Denmark.
d
Dennis van Dam
03/15/2023, 7:33 AMor add the process to the "LogoffCheckSysModules" registry entry
👍 2
💯 5
b
Balint Oberrauch
03/15/2023, 7:49 AMLogoffCheckSysModules should fix this, like Dennis mentioned.
💯 1
s
Shane Swacus
03/15/2023, 12:24 PMvda 2212? its a new feature..
j
Jonathan Pitre
03/15/2023, 2:20 PMIt's not since it's a protected process, Citrix cant kill it.
r
Ray Davis
03/17/2023, 12:50 PMLogoffCheckSysModules did not help?
Ray Davis
03/17/2023, 12:54 PM7 years ago, MacAfee did the something, and the LogoffCheckSysModules did not help. I had to open a ticket with them, and if I can remember right, they had to help me do a custom security policy for the CVAD side. This is super old, but may be worth looking into. I know it's not dispalying in the sys tray, but it might be worth testing.
https://support.citrix.com/article/CTX121599/an-active-session-exists-even-after-loggi[…]-endpoint-protection-is-installed-on-a-citrix-xenapp-server
k
Kasper Johansen
03/17/2023, 12:55 PMI think if it's a protected process, Citrix can do anything about it
r
Ray Davis
03/17/2023, 12:56 PMYea, that is a good point.
d
Dennis van Dam
03/17/2023, 1:51 PMNever used applocker but, can’t you block that process with it so it simply doesn’t start?
k
Kasper Johansen
03/17/2023, 2:22 PMYes, you should be able to block it for Domain Users, however the users will received a "this app has been blocked" notification everytime they log on
j
Jonathan Pitre
03/17/2023, 2:23 PM"Don't run specified Windows applications" policy did the trick.
But I haven't check in the AV console if there's a native way to disable it yet.
Thanks @Kasper Johansen for the suggestion.
👍 1
k
Kasper Johansen
03/17/2023, 2:27 PMOldie but still goodie 🙂