Does anybody know if it's possible to create exceptions for the DLL injection Citrix App Protection does to various processes? So this feature: To offer the App Protection solution, few Citrix signed DLLs such as ctxapclient32.dll and ctxapclient64.dll are injected into all processes. Until Citrix Workspace app for Win‑ dows versions 2405.12 and 2402 CU3, an additional DLL, FeatureFlagHelper32.dll and FeatureFlagHelper64.dll was being injected. These DLLs are harmless and it is safe to have the traces of these DLLs in the log files of other processes. It causes our VPN service to not start sometimes. The workaround from the supplier (Palo Alto) is to switch it to delayed start. But this will impact the user experience as it will take a lot longer before the VPN connection is started.

You can configure it via Global App configuration service. https://docs.citrix.com/en-us/citrix-workspace-app/app-protection/configure/process-exclusion-list

Thanks, but this is for Citrix Cloud. We are running on premises. Is there a way to set this locally or through a GPO?

You can configure GACS to control your on-premise resources as well. You just have to register the FQDN. https://docs.citrix.com/en-us/citrix-workspace/global-app-config-service/configure-gacs-storefront.html

How about this: https://docs.citrix.com/en-us/citrix-workspace-app/app-protection/configure/configure-anti-dll

That is to prevent DLL injection for Citrix Workspace App itself, so which DLL it's using and basically the opposite of what I want to prevent. According to Citrix support the process exclusion list setting should be available in the ADMX files, but I can't find it (should be under Computer Configuration -> Adminstrative Templates -> Citrix Components -> Citrix Workspace -> App Protection) in the ADMX file of CWA 2503.2. Although I can also do it through registry, so I guess I will try that: Navigate to the Citrix Workspace Registry Key: a. For 64-bit systems, navigate to:`HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Workspace` b. For 32-bit systems, navigate to:`HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Workspace` Create a New Key for Process Exclusions: Right-click on the Workspace key, select New > Key, and name it

ProcessExclusionList

Add the Excluded Process: Inside the

ProcessExclusionList

key, create a new String Value for each process you want to exclude. Name the value with the process name (e.g.,

vpnclient.exe

) Anyway, thanks for the suggestions :-)

@Chris Jeucken Process exclusion list is not available via registry. If you have a Citrix support case number let me know I will check internally why is that communicated.

@Ashish Goyal I have messaged you the case number.