As an FYI. The CsFalconUIHost.exe CrowdStrike process was a problem for us recently: https://community.citrix.com/forums/topic/259021-csfalconuihostexe-prevents-citrix-session-logoff/

Hey Jeremy, interesting. Did you see this only in a combination with published apps?

Thanks for the heads-up. We're not on 7.37 for our VDI sensors yet, but will test and send up to our CS TAM for vis.

Hey Balint, yes. It was interesting. We couldn't work out why we had so many sessions that were not logged off from about 6th June and then aligned that to the CS update. We typically have a policy set for N-1 for the CS Agent, so it had only just updated to 7.37.

Good to know - would be worth to document. FYI: we just released a new article where AV (CS in this case) on the endpoint prevented the user from launching apps. https://support.citrix.com/external/article/CTX696676/daas-unable-to-launch-the-desktop-with-e.html

CS has asked for this... To investigate and provide a permanent resolution, we will need diagnostic logs captured while reproducing the issue. Please follow the steps below: Before beginning: Remove the Citrix exclusion for CsFalconUIHost.exe and reboot the affected host to allow the issue to reproduce. • Step 1 – Xperf Capture - Have one user already logged in and ready -Start the Xperf capture using the steps here: https://supportportal.crowdstrike.com/s/article/ka16T000000wuBAQAY (https://supportportal.crowdstrike.com/s/article/ka16T000000wuBAQAY) Have a second user log in and then log out before the 90-second capture window ends • Step 2 – Procmon Capture - Repeat the same reproduction steps as above, but using Procmon instead of Xperf - Procmon has no time limit — simply run it long enough to capture the second user logging in and out: https://supportportal.crowdstrike.com/s/article/ka1Ns0000000Qs9IAE (https://supportportal.crowdstrike.com/s/article/ka1Ns0000000Qs9IAE) • Step 3 – CSWinDiag - Collect a CSWinDiag from the affected host: 🔗https://supportportal.crowdstrike.com/s/article/ka16T000001tkvVQAQ (https://supportportal.crowdstrike.com/s/article/ka16T000001tkvVQAQ)Step • Step 4 – Upload Logs - Please upload all collected logs to this case - Compress the Xperf and Procmon files if needed to facilitate the upload. We found a solution which we are happy with. CS can investigate their own issues.