Hey Folks, since a good while I have an awful log off time, non-persistent W16 VMs provisioned by PVS, CVAD 2203. VDA CU4. We use UPM 2203 CU4 and other issue give the same issue. The more files it gets the slower it's getting! I suspect and proved the AV is guilty, it's CheckPoint. I uninstall it, log off are great! I can't see any locks, correct exclusions are in place, a procmon doesn't show the AV interfering during the log off, is it a lower level drivers so procmon doesn't show? UPM logs doesn't show any error. I have a case with CheckPoint opened but it's slow. I wonder if somebody else had similar issue? Thank you!

Are you using containers? If you are that might explain why procmon can't see stuff. If you're using file-based UPM, do you see any huge gaps of time in the logs? Do you have AV scanning on the client end and the file server where the profile is stored? If so, it might be prudent to remove it at the server end

Thanks. No I am not. I only use container for O365 .ost file, the rest is file-based UPM. E.g. for a 1,171 sec logoff (no typo here!), no huge gap, it's a lot of files copy, Teams files are the one causing a lot of files copy (I have proper exclusions in place, cleanup also of old Code Cache, it used to work totally fine with this setup). If I roam the Teams files in a container, I fixed the log off issue for my test user. I have streaming enabled, write back for files enabled and use the replication store feature, I tried to disable the replication, active write back (so yes we have load on the servers but they can cope). No AV on the profile servers, UPM central store, it was killing it. Profile servers perf are good, local SSD.

If you've got the exclusions in place then Checkpoint should be not scanning them. Hmmm. Does Checkpoint, like other AVs, have lots of different features (IPS, network threat protection, all that jazz) and can disabling these individually (if possible) pinpoint which one is the issue?

Indeed but in this case, only the malware feature (called blade in Checkpoint) is installed. I am very puzzled by all of this ... but fact if no CheckPoint installed in the vDisk, log off time is back to seconds!

oof, sounds like opening a case with Checkpoint is the right option. Of course, as you mentioned, you could put the problematic folders into containers and solve the issue until Checkpoint issue a fix

Yes, it's a big job for the container and I need a good bit of extra storage, put processes around, etc. but yeah I may be forced to do that ... we'll see what CheckPoint comes back with! And I'll try 2203 CU5, who knows! Thanks for your help James.

Very similar issue on logins, not logouts. Different AV vendor. Working on moving to profile containers to resolve the issues.

Thanks Dennis, which AV do you use? All proper exclusions in place also, right?

We use Deep Instinct. It's not certified/supported on Citrix and we knew that when we started with them. Product is great overall though.

CheckPoint is also not certified. Thanks Dennis. Big pain having to move to containers because an AV can't perform!