https://worldofeuc.com logo
Join Slack
Powered by
Another weird one. Server 2025 multisession, for a...
# microsoft-os
n
Another weird one. Server 2025 multisession, for a number of users most of the time none of the autorun apps actually launch at logon - Teams, Webex, Citrix vDisk applet, etc. The only thing that always runs is the WEM agent in the system tray. Anyone ever see this before?
j
And this is a bad thing? 😉
n
I'd agree with Teams because it's a shit UWP app, but literally nothing but the WEM agent system tray is loading. I can't make any sense of it.
j
I use W25, no WEM and I don't see this issue. 2507 CU1 stack
n
Starting to think it's environmental for us. Can't see this issue in our Stage environment, but seeing it a lot in UAT/Prod.
GPOs, WEM, and Citrix policies are identical in all, though.
j
Strange, there are different types of autoruns, which one? Machine/user, etc. there the sysinternals autoruns tool, nice to see them all.
n
HKLM and HKCU
I think I finally caught a logon with procmon
j
OK maybe WEM is in the way, different policy for it? Stripe the onion 🧅
n
This just gets weirder. Reboot the VDA, login, autorun apps fail to launch. I can redo that sequence until the end of time with the same results. Disable CPM, reboot VDA, login, autorun apps successfully launch.
Enable CPM, delete my profile, reboot VDA and login - autorun apps launch successfully. I seem to be able to do this quite a few times without failure. Almost like something in the profile is getting corrupted.
j
It sounds like a profile issue, it wouldn't be the first time a UPM reset fixed it all 😂
😂 1
n
I just can't figure out why it's not happening in Stage with everything else being identical. It makes zero sense.
j
It's probably using the profile that corrupt it, something users do in prod and not in tests.
n
I have been testing with my own profile. Same process I test with everywhere.
I don't even know what environmental factor would be in play here that could cause this very specific issue, but this domain is so locked down and wacky that I can't put anything past it.
If I RDP into the VDA after booting it up and then launch a Citrix desktop from a different account, all autorun apps launch fine.
I narrowed it down to the HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo key being stored in the profile, and then found this: https://docs.citrix.com/en-us/profile-management/2402-ltsr/whats-new/cumulative-update-4/fixed-issues. Guessing that this bug fix did not make it into 2507, or it's just back. Either way, I'm building a new 2402 CU4 Platform layer right now to validate that it works as expected. Hopefully we can get a private hotfix for this quickly because I don't want to go back to 2402. Hell, I don't even know if 2402 supports S25 in the VDA.
Well, definitely didn't make it into 2507 CU1. That was released months before 2402 CU4.
j
Great, you have an answer now! 2402 is not officially supported on W25.
n
Doing more testing this morning to truly confirm. If so, hoping for a private hotfix for now, but CU2 should also be right around the corner. What sucks is that I don't think I can fix this in existing profiles, since CPM's exclusion cleanup doesn't remove registry keys, so new profiles will be required once this is in place.
j
You can potentially create a little script to do the job no?
n
Might be able to use WEM to kill them, but that registry key seems to be locked in session, so maybe not.
j
Tricky, after mount offline ntuser dat with reg.exe, delete key, etc.
n
We're still in UAT, and leadership pushed to start this before I said we were ready, so they will have to sort it out.
This won't affect app testing and such, so as far as I'm concerned, once we get the fix we can reset profiles and call it a day.
j
Ok it makes sense!
n
It does to me, leadership may not see it that way, lol
This project has seen so many issues and roadblocks and the only thing they have done is moved up the timeline, which is honestly hilarious.
j
Lol yeah they clearly have a different perspective than the one doing the job! It does sound like a tricky project indeed.
n
This issue must be intermittent or something because that key in my 2507 and 2402 profiles is identical.
Here's an old NTUSER.DAT with the issue. Session 2 is the problem, not removing most of those keys.
j
Ah I see, it's prob intermittent, I don't have this issue as far as I can see, weird.
n
It has been very strange. Last week and the week before, I could not reproduce this at all, yet my manager was doing it at-will. Then this week, failures every logon. Nothing had changed at all.
I'm trying to login to multiple boxes with each profile to see how the info stores. In the CPM log, it actually shows that it's successfully cleaning the SessionInfo key... though I obviously think that's a false positive because I have proof otherwise.
j
Weird indeed, you can confirm the ntuser.dat is clearly written back to the store?
n
Yep, definitely is being written back.
👍 1
7 Views
Open in Slack
PreviousNext
Powered by