When configuring MCS in Citrix Cloud, where your VDAs and master image are onprem, do you make sure that the master image is in the domain? I noticed it creates weird issues when the master image is not in the domain.

Yes. Because MCS handles the SIDs and trust relationship

Mcs does not require the master image to be in the domain the vdas will get added during image prep. The issue w adding an image to the domain is that you often get tatooed policies in the image if you are not careful.

And that's why I like joining my master to the domain and putting it in the same ou as the built machines. Getting those policies in place help wonders if AD has any performance issues.

Bur doesnt that cause issues if you change policies

Only when there are those AD issues, but you would have that regardless. And when you run the maintenance machine through it's next cycle it will get those updated and cached locally.

Thanks guys, I did as Jeff said, works flawlessly. On another note.. any of you have some Citrix Cloud WEM user lock down / optimization / M365 policy templates that are bare minimum and works well in locked down multi session environments? I have for persistent VDIs but not for non persistent multi session envs. Don't want to sound lazy but it takes heck of a time to create these manually... things like "hide servermanager" etc etc..

Here you go. https://docs.jeffriechers.com/Citrix/WEM/best-practices-start-environments-strong-with-wem-or-gpo/

you can run into RDP timebomb licensing issues with non domain joined server VDA if you don't update them very often

Good one Mike, thanks!