Hey all, hoping someone has run into this before opening a can of worms with support.

Setup:

• Fresh, first-time Session Recording install (no prior deployment, not an upgrade)
• Single Session Recording server, Windows Server 2022 Datacenter
• SQL Server 2022 (Enterprise), on a separate/remote server from the SR server
• Installing account has sysadmin on the SQL instance

What happens:

Tried installing Session Recording Administration via both the standalone MSI and the full CVAD metainstaller, across three different product versions:

• 25.7 (2507 Current Release)
• 24.2 LTSR CU4
• 25.7 LTSR CU1

All four attempts fail in the exact same custom action (SsRecDatabase.dll.install), with two distinct errors depending on which authentication method I use for the DB connection:

1. Windows Integrated Authentication (default, no explicit DB credentials):

   Error 1001. Database 'CitrixSessionRecording' already in use. MSI (s): Leaked MSIHANDLE (150) of type 790531 DEBUG: Error 2769: Custom Action SsRecDatabase.dll.install did not close 1 MSIHANDLEs. CustomAction SsRecDatabase.dll.install returned actual error code 1603

The DB and schema actually get created successfully (confirmed on the SQL side - table populated, no errors server-side), but the custom action then fails its own internal "is this DB in use" check - because it apparently never closed its own connection. Time-to-failure varies a lot between attempts (4 sec to 112 sec), which smells like a race condition, possibly only surfacing because SQL is on a separate host (network teardown latency) rather than co-located.

1. SQL Authentication (entering a SQL login in the credential prompt or metainstaller DB screen):

The installer silently sets an internal AZURESQLSERVICESUPPORT=1 flag (even though this is on-prem SQL Server, not Azure SQL at all), and fails with a completely different, genuine error:

Error 1001. Invalid column name 'id'.
CustomAction SsRecDatabase.dll.install returned actual error code 1603

Looks like that code path queries a column that doesn't exist in the schema being used.

What I've ruled out:

• Network/firewall (port 1433 reachable, clean TCP test)
• SQL permissions (sysadmin confirmed)
• Leftover DB artifacts (dropped/recreated DBs before every attempt, verified zero open sessions/locks via sys.dm_exec_sessions each time)
• SQL Server "Force Encryption" (confirmed off)
• TLS/.NET strong crypto registry settings (added them, rebooted, no change)
• AV/EDR interference (none installed on the box)
• System/user culture (tried both a Turkish culture and en-US, identical "Invalid column name 'id'" result in the SQL-auth path either way)
• SQL Server error log shows nothing during the failure window - no rejected logins, no errors

Given it reproduces identically across 3 separate product versions/builds and both possible auth paths, this doesn't look environment-specific to me anymore - looks like a genuine defect in the shared DB setup code that only shows up when SQL Server isn't co-located with the Session Recording server.

Has anyone seen this, or found a workaround (e.g. installing with DB temporarily local, then pointing to the real instance after)? Case is open with Citrix support, just curious if this is a known one in the wild.

• CVAD 2507 LTSR CU1, Citrix Cloud (DaaS), Cloud Connectors on-prem
• Server 2025 multi-session VDA, MCS non-persistent
• First Citrix Cloud tenant

Symptom:
ICA sessions launch clean: desktop renders, UPM profile loads, WEM processes logon, then drop at almost exactly the 2min mark. Reason code 12 every time.

Ruled out:

• RDS licensing: Full role reinstall on the license server, clean CAL database (Retail Per User), server activated, RD Licensing Diagnoser 0 warnings
• OS/network layer: Direct RDP straight to the VDA IP is rock solid, zero drops. This isolated it to ICA/HDX specifically.
• GPO/UPM/connectivity to CCs: all confirmed healthy

Current lead:
CtxUvi Event ID 1005 fires right at failure, pointing to a driver/injection component choking on ICA session init. Also found HKLM:\SOFTWARE\Citrix\MetaInstall\ExitCode = 8 on the gold image (want 0 or 3010) looks like the original VDA install on this image never actually completed, despite registering fine with both CCs and appearing otherwise healthy in Studio.

Anyone dealt with MetaInstall ExitCode 8 before? Or ICA sessions timing out at exactly 2min on Server 2025 with 2507 CU1 specifically? Trying to figure out if this is a known compatibility gap or something specific to our build

I'm in the middle of migrating from vmware to HyperV, moving my dynamic machines are easy enough, I'll just create new catalogs and rebuild the machines, but has anyone migrated static machines?

Once they are moved over, I'm assuming I need to add them to the new machine catalog that is bound to the new hypervisor.

Has anyone done this successfully? If so, could you give me some pointers?

Our current setup is we have Chrome updates disabled on the PVS images.

We use a script to patch the chrome app layer once a month.

We then manually publish the image with the new app layer version, test it for a few days, then push out to production.

We are getting heat to update more frequently, but there is a lot of administrative overhead, as we have about 12 different images across 2 environments. I know we could automate a lot of it, but I'm nervous of doing that, and the potential issues without testing phase.

Just trying to see what solution people have in other organisations.

Have been searching online but all the posts are several years old. I just realized I could select high dpi for my MacBook which solved all of my text issues within Citrix. The only app that is somehow worse (which is saying a lot) is Outlook; it’s blurry text. Every other Microsoft office app is fine though. Is this just one of those Mac things that I’m out of luck on?

Am newish to XenServer, been a few months. This is the first time updating XenTools versions on my PVS images.

Server 2022 CVAD VDAs on XenServer 8.4.

Intalled XenTools 9.6.0

When users launch into virtual App, they get a "XenTools Install Info has stopped working" prompt.

I tried reverse imaging and reinstall of xentools, which did not resolve the message prompt.

I also added reg replace entries in GPO for the following in order to force stop any auto-updates of the XenTools agent or tray.

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\XenServer\XenTools\AutoUpdate
DisableAutoUpdate=1

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\XenServer\XenTools\XenToolsTray
DisableCheckForUpdates=1

Scoured the user's RegHive and profile for anything referencing a previous version of XenTools (image originally had XenTools 9.4). Was assuming something was conflicting.

Deleting the user's Citrix Profile all together is the only thing that seems to get rid of the prompt.

Is this typical?
Are there paths, files, or regkeys that need to be excluded?

Thank you folks...

Has anybody used Citrix SPA (in Citrix Cloud, not on-prem) without using CEP? We've been evaluating the idea of using it, but not sure about wanting to jump thru all the Chrome Enterprise hoops. We have tried setting publishing some basic internal web apps for a POC, but we don't get them to show up in Citrix Workspace/StoreFront Cloud or the Workspace app or even the Secure Access Plug-in. Support said "maybe Chrome Enterprise is a pre requisite to get it to work." So I just wanted to know if anyone else had successfully rolled out SPA without jumping thru all the Google hoops.

I’m running into a strange issue and I’m slowly reaching the point where I’m out of ideas.

We have several different NetScaler gateways configured, each with different targets and authentication methods.

When accessing the gateways through a browser, everything works perfectly fine. Authentication completes successfully, and the user is redirected to the correct StoreFront store.

However, the behavior is different in the Workspace App.

There, authentication against the SAML gateway completes successfully, but immediately after login, an LDAP + RADIUS authentication prompt appears.

What I’ve found so far:

It looks like I’m being redirected to the wrong StoreFront store. That store has a different gateway configured, which then triggers the second authentication prompt.

What’s even stranger is that this seems to happen with all NetScaler gateways. Even an emergency gateway that uses only LDAP redirects to the wrong store after successful authentication.

My first suspicion was the session profiles for the Workspace App, but I’ve already tested a lot there. The profiles are active for the Workspace App and should actually redirect users to the correct store

Has anyone seen this behavior before or has an idea what else I should check?

We are having some weird issue where pasting of files hungs at last 5 sconds and after 15 minutes of waiting it shows finish. We are using CVAD 2402 LTSR CU3 with win 11. Explorer works fine during this hung.

To start with, yes, I know that NetScalers already have built in GSLB functionality.

I'm in the midst of setting up NetScalers in 2 different datacenters. Today, the existing ones use their own specific URL. Part of this project with the new ones is to create an Active/Active set up. There is a whole host of reasons I am building new ones instead of updating the configuration on the existing.

My original plan has been to leverage the internal GSLB capabilities of the NetScaler.

However, I was recently asked by our networking team if we could perform the same using AWS Route53, which is already in use for the company and providing other production workloads. I'm seeing where Citrix has documentation for using Route53 when using NetScalers in AWS, but its crickets outside of that. Our NetScalers are on-prem. We may eventually stand up additional ones in AWS in the future, to get gateways closer to some user groups.

Unless I can find a solid reason not to, I'm really leaning on the Route53 direction. I'm the sole Citrix Engineer/Architect/SME here, and while I have been teaching others how to support many areas of Citrix, no one is close to being able to really touch the NetScalers. That means any support issue is handled by me, and I generally don't get to yell at others unless their system has impacted us.

Going this route means I give up some of that control, also means that when something happens I have a team to yell at to fix the problem.

The URLs are all public addresses, so no internal addresses or split dns involved.

Am I nuts?

I wasn't able to find any applicable Citrix KB about it but when opening a ticket with our wonderful vendor today here's what AI chatbot spat out:

There is a known issue with Microsoft Edge version 150+ in Citrix Virtual Apps and Desktops (CVAD) 2402 LTSR CU4, where downloads do not work in a published app, but do work in a published desktop. This issue does not occur with Edge version 149.
 
Key points:
- The problem is linked to changes introduced in Edge version 150.
- No error messages are displayed, and all users are affected.
- Edge version 149 does not have this issue.

Recommended actions:
 
- Roll back to Edge version 149 as a temporary workaround if possible.
- Monitor Citrix and Microsoft release notes for updates or fixes related to Edge version 150 compatibility with published apps.
- If rolling back is not an option, consider creating a support case with Citrix to track the issue and receive updates.

We're not rolling back due to CVEs. As a temporary workaround published Edge with:

--disable-features=LaunchShellExecuteViaExplorer

Hi everyone,

I'm looking to optimize logon times in our citrix environment and was wondering what UPM settings everyone is using in production.

Our environment:

• CVAD (MCS non-persistent VDAs)
• Windows Server 2022
• Citrix Profile Management (not FSLogix)
• Profile store on a file share

I've added some of the following settings:

• Profile Streaming = Enabled
• Enable profile streaming for folders = Enabled
• Delete locally cached profiles on logoff = Enabled
• Default exclusions enabled
• Chrome/Edge synchronization configured (bookmarks, preferences, history, etc.)

One setting I'm particularly unsure about is the Always Cache

From what I understand, Profile Streaming is designed to load files on demand to improve logon performance, while Always Cache seems to keep a full local cache of the profile. These two settings feel somewhat contradictory... Has anyone noticed any benefit from enabling Always Cache together with Profile Streaming?

The reason I'm asking is that after enabling Always Cache, we started seeing intermittent logon failures for multiple users with the following error:

"The Group Policy Client service failed the sign-in. Access is denied."

So I'm trying to identify whether Always Cache (or another UPM setting) could be contributing by causing registry hive or profile locking during logon

I'd also be interested to know:

• Which UPM policies do you consider "must-have" for non-persistent MCS environments?
• Any settings you've found actually improve logon performance?
• Any settings you've learned to avoid?

Thanks in advance!

Hi!

One of our old citrix farms has been due to be replaced for a while and as such, we didn't bother upgrading to a LAS-supported version before the deadline in april.

Replacement is taking much longer than anticipated though, so we are now looking to upgrade to 2203 with LAS before our old licenses expire. Talking to our citrix rep, theres no supported way to accomplish this.

Does anyone have experiences or suggestions on how to go about this? I'd think this shouldn't be an issue at all. Upgrade DDCs -> no valid licensing, run into 30d grace period -> connect DDCs to a valid LAS license server within those 30d -> profit

Thanks!

I retired 2 weeks ago and have since been locked out of any files or apps that were work related. The problem I'm having is I want to get rid of some of the apps that are listed so that I can clean up my computer a bit. For instance, I don't need DPlite or marksbook. And if I uninstall Citrix it won't get rid of those programs and I can't log in anyway since I'm locked out of anything work related. Any advice as to how I can do this?

Hi!

I used to have a PC and no issues with Citrix but now have had a Mac for a year and most of the time while using Citrix (have the most recent update from June) it will Freeze as I got from patient chart to patient chart. I really cannot find a pattern on why this occurs but would appreciate any help.

For reference,

1. this has been happening over a year now

2. I have been now using 2 different hospital systems that both require logging into citrix via a browser

3. it seems to occur if I switch between "desktops" on the Mac but not always consistent.

any help is appreciated!

I took the ccp-v last week, and I barely failed. I was sort of doing a recon test. I wasn't sure what to expect. So, I rescheduled and just took it again today, but, it seemed like the test was broken. Some questions, I couldn't understand what it was even asking, and other questions seemed to have a completely different group of answers that didn't match the question.

Did I just wake up in the twilight zone and my brain couldn't read, or has anyone else had this issue. I ended up failing way worse than the first exam, and I spent all week covering the things I was fuzzy on. It was crazy.

Update : I was so upset yesterday that I didn't even notice I scored 0 in topics that I scored 100 in last time. There is no way that I went from 100 to 0 in those topics and scored as low as I did without the test being broken. Is this a thing? Has anyone else noticed something like this? I felt so confident going in. I've worked in citrix for 20 years and I was really just refreshing my knowledge and filling the gap over the last few years I wasn't in Citrix.... It just feels crazy that I scored so low. Especially in areas where I mastered the test last week.

We're in renewal negotiations with Citrix currently and they're trying to sell "added value" solutions that are now included in their base pricing. The two that catch our eyes are the Unicon eLux thin client O.S. (we have igel currently but could flash those LG thin clients with Unicon) and UberAgent, which is being touted as a ControlUp alternative.

We're looking to cut costs, and so far our renewal quote doesn't do this for Citrix alone, but with these added value solutions it might be a wash in the end.

Who here has used either of these new tools from Citrix? What do you think of them and can you share your experience with me?

No está funcionando ya que me es imposible hacer login en el teams. Veo que se activa el plugin BCR y luego da error 53000. Las políticas de EntraID no la podemos cambiar.

In our environment, we are using exclusively UPD for printing and this has worked for literally years without surprises for Macs. However, I've recently discovered certain printers where it does not work, and I don't understand why.

Windows devices where these printers are plugged in work fine. Macs where these types of printers simply do not map.

FWIW, I have tried a few things: Connecting the printers locally via USB, connecting directly over a network, and even connecting to the printer on a Windows print server all gets the same result - no autocreation. If I change the driver to something obvious, like "generic post script" the printer is autocreated as expected, so I know the issue is the driver (if I didn't already :).

I'm admittedly nowhere near great with Citrix, and where I'm lost is figuring out why these printers aren't being auto-created. Forget about them working or not, what causes UPD to simply skip a printer? Is there a way to change that behavior?

With the pending deprecation of HDX optimization, we're looking closely at our percentages of HDX vs Slimcore for Teams. At the moment, we're looking at about 50% of our users still sitting on HDX optimization. This is despite looking good from a plugin/Workspace perspective for their Slimcore readiness.

We're working with our partners to validate that they have the right rules set up for optimization, but we're pretty sure that the vast majority are in a good place.

Anyone else seeing their Slimcore numbers lagging from where you'd expect them to be?

Hello everyone,

I recently landed a new job where I'll primarily be working with Citrix NetScaler (ADC). I have a little over a month before I start, so I'd like to prepare as much as possible.

My background is mainly in network engineering, working with Fortinet firewalls and HPE Aruba switches.

Would you recommend any courses, books, labs, or YouTube channels for learning NetScaler? Is the Udemy course "CNS-220 – Citrix ADC 12/13.x Essentials and Traffic Management" a good place to start, or would you recommend something else?

Thanks in advance!

Hello all

Looking at migrating from "traditional" file-based profiles to Citrix containers. Already have an exhausting list for folder exclusions/inclusions mainly focused on subfolders of AppData\Local.

There are some stuff in the AppData\Local folder that I still want them excluded from the containers so I added AppData\Local in the "Folders to exclude from profile container" list and add the various subfolders I want to keep in the "Folders to include in profile container" list

When I login to the VDA, it looks like I'm getting an half migrated profile : the included subfolders of and excluded parent is empty. I'm using MSEdge/Chrome to validate the migration and checking if the favorites are still there after the migration.

After some digging, I can see that the file-based profiles is copied entirely in the vhdx:\Profiles folder, but the SyncInludeDirs / SyncIncludeProfile folders are empty, which is where Windows is looking to find those files.

If I completely remove the folder exclusions/inclusions for the profile container, the migration happens successfully

Using VDA 2402 CU4 with Windows Server 2022.

Anyone faced this situation?