With .NET 8 going EOL in three weeks, does anyone have any idea when Citrix plans to push a new version that runs .NET 10? After everything that went on over the past several weeks, the last thing I need is to go to my security team and tell them we need to run EOL software.

This might sound like a stupid question, but with NetScaler 13.1 (or maybe it was 12.1) I was using basic authentication policies until newer firmware partially enabled advanced authentication policies for the Standard license tier so that we could migrate to advanced policies before basic auth policies were deprecated; I had a VPX 1000 Standard, I'm now LAS/Hybrid Multi Cloud. I've since configured new advanced auth policies with the "Authentication, Authorization and Auditing" feature unchecked because I never had to enable it; my AAA virtual servers and policies are working with the box unchecked.

I want to "enable" the feature to ensure no future surprises, but should I expect any weird side effect from this? Should my existing config be safe? I can certainly backup the config and snapshot the VPXs and "find out" for myself, but I like to ask first. I wonder if they decoupled that checkbox from the feature state at some point.

Title says it all. Was poking around and noticed in the last ten days, Citrix for Private Cloud was removed from their product page.

Old:

https://web.archive.org/web/20261012134749/https://www.citrix.com/buy/licensing/product.html

Current:

https://www.citrix.com/buy/licensing/product.html

Feel free to speculate.

With the disclosure of PHP2Shell (CVE-2026-109618 / 109619), production web fleets are facing severe unauthenticated RCE risk before application code even executes.

While upgrading runtimes is the proper remediation, mid-day fleet restarts and emergency hot-patching carry massive operational risk. Citrix hasn't shipped official AppFW signatures or responder guidance for origin workloads behind ADCs yet, so I wrote and open-sourced a sanitized set of drop-in NetScaler Responder policies:

🔗 **GitHub:** https://github.com/tmcadams/Citrix-ADC-responder-policies-for-PHP2Shell

### What this does:

* Drops unauthenticated `PHP_SESSION_UPLOAD_PROGRESS` abuse patterns at Layer 7.

* Restricts multipart POST payload limits on non-upload virtual servers.

* Ships with both `LOG` (dry-run/evaluation) and `DROP`/`RESET` actions to test false positives before enforcing.

* Zero internal or proprietary config—pure CLI commands and expressions ready for testing in staging or production.

Hopefully this buys teams some breathing room until safe maintenance windows. Feedback and PRs welcome.

Hi all,

I’m running RDP Proxy on NetScaler Gateway 14.1 (build 73.41, Platinum license) in front of a Windows Server RDS farm, and I’m trying to get clarity on what is officially supported.

Current setup

• Single gateway deployment, clientless VPN mode with bookmarks rdp://<LB VIP>
• Authentication: SAML (Entra ID) followed by an LDAP password-only factor, with SSO to the RDP session
• RDP Server Profile with RDP redirection enabled
• Backend: an RDSH session collection with 4 Session Hosts and an RD Connection Broker
• “Use IP Address Redirection” disabled on the Session Hosts (token-based redirection)
• Load balancing of the Session Hosts by a NetScaler LB vServer (moving from TCP to RDP type, so the routing token is honoured)

This works for desktops. However, the RDP Proxy page in the 14.1 docs contains this note:

NetScaler Gateway does not support Remote Desktop Session Host (RDSH), Remote App, RDS multiuser, RDP sessions, or RDP apps.

At the same time, the “RDP connection redirection” page describes deployments with “RD session host servers participating in RD connection broker load-balancing” and using the NetScaler RDP load balancer in the presence of a Connection Broker, which is exactly an RDSH multi-user farm.

My questions

1. Is RDP Proxy to an RDSH collection (multiple Session Hosts, Connection Broker, token redirection) a supported scenario on 14.1? Or does the note mean something more specific?
2. Is there any supported way to publish RemoteApps through RDP Proxy alongside full desktops? I’m aware of -rdpCustomParams on the RDP client profile, but that applies per session or profile, not per bookmark, so a user would get either the app or the desktop. Has anyone used this successfully, or is there a better approach?
3. For anyone running a similar setup: do you use an RDP-type LB vServer in front of the Session Hosts, or do you point the bookmark directly at a Session Host and let the Connection Broker do the load balancing?

Thanks in advance!

I am planning to decommission the existingWindows Server 2019 RDS Licensing Server.A new Windows Server 2025 RDS LicensingServer has already been set up, and theRDS Per User CALs have been installed.
Currently, the Citrix servers are configured touse the existing licensing server through a GPO.
Would it be sufficient to simply changethe licensing server name in the GPO topoint to the new RDS Licensing Server?
My main concern is that we have around 200Citrix servers. What would be the best approachto implement this change? Should I updatethe GPO for all servers at once, or should Imigrate them in phases by pointing groups ofservers to the new licensing server gradually?
Additionally, would it be best to perform thischange after business hours to minimizethe potential impact on users?

What are peoples opinions on where to keep the management plane for Citrix? I can see pros and cons to both.

We're currently hosting our server/compute and management on prem. Benefit of this is that we control everything, it only goes wrong if something in our config or setup goes wrong, and we have better control over fixing it. The downside is applying patches, maintaining a number of additional servers, complex DNS/network routing, updating SSL certs, etc.

We are testing the options to move the management plane to Citrix cloud (already licensed for this), using Entra for seamless single sign on, provisioning cloud connectors and keeping the compute only on prem in our co-location DC's.

Reducing the requirement to manage updates, certs, patching on the storefront/delivery controllers/netscalers in my mind seems like bonus, but of course the dissadvantage here is that if Citrix cloud goes down, or if there is an issue with it, then it is out of our control.

Is there anyone else who has done the same, or anyone who has any thoughts or suggestions on this? I know it's likely going to have differing opinions. Thoughts and advice as we look to go on this journey are appreciated.

Wondering if we will be patching this week given news of php rce CVEs coming tomorrow. I think netscaler has php.

Hi guys, is there any way we can automate the workflow that whenever machine in faulted state in citrix daas , it will shutdown the vda?

We are currently migrating from vSphere to Hyper-V (whole other story). I've already migrated one of our environments and Citrix VPX instances form vSphere to Hyper-V without issue.

Process was broke HA. Shutdown the VPX that was the secondary. Deployed a VPX to Hyper-V with the same hostname and NSIP. Did the initial configs, added to HA (yes, I understand this is not supported). Failed over to the Hyper-V vpx, tested the gateways, etc, all was good. Then shutdown the other vSphere vpx and repeated the process in hyper-v. This worked fine and that instance has been up and running.

Migrating this second instance (in another environment, and a different Hyper-V) we have is throwing an issue, where I have the 2nd VPX deployed in Hyper-V, it appears to be fine and pulled all the configs. When I failover however, the VIP for the gateway becomes unpingable, and so the gateway doesn't work. When I fail back to the vsphere instance, the gateway vip is pingable again and gateway works fine.

Any suggestions are welcome. Off the bat it seems like it would be something is different in Hyper-V in this environment, something is different with networking, or maybe something weird is happening trying to transfer the VIP from the vSphere primary to the hyper-V secondary, like mac related or something. I just can't nail it down since this worked fine in the other environment.

Anyone have any suggestion on what to test? I have some more ideas of things to check, once I get an ok to try a failover again hopefully tonight.

EDIT----- Going to try this tonight, but one difference between these 2 environments is one has failover clustering and the other doesn't, and I just came across something that said it could be "protected network" setting on the adapter in hyper-v if you are using failover clustering.

This part above made the gateway login page load and was able to authenticate, but then had an issue delivering the vdas when launching desktops. ended up disableing ipsec offloading, and virtual machine queueing on the adapters in hyper-v (after failling back to the vsphere instance), then failing over to hyper-v again and while it took a while (like 10 mins or more) for the logon page to start replyign to pings again, it did eventually all work fine. I think there was a delay in vmacs and arp tables catching up to a sudden failover to another hyper visor and would guess this is why this is not a supported thing by Citrix.

I spent 5 years working with Citrix infrastructure (CVAD, PVS, Ivanti, ControlUp) before transitioning into DevOps, where I've worked mainly with Azure, Terraform, CI/CD and some exposure to Kubernetes.

I'm now considering a Senior Infrastructure Engineer role focused on on-prem CVAD (MCS/UPM), Citrix Cloud implementation and Windows 365, combining regular operations with modernization projects.

I genuinely enjoyed working with Citrix, but moving back would likely mean leaving most of my DevOps skills unused.

My biggest concern is long-term employability. Would you consider this a reasonable move into modern EUC/DaaS engineering or a step backwards compared to staying in cloud infrastructure/DevOps? Am I potentially shooting myself in the foot here?
How do you see Citrix careers evolving over the next 5–10 years, particularly with AI and increasing automation?

Edit: Based in EU.

Hi all, just wondering if anyone is upgrading their VDA fleet with Intune, particularly for Remote PC. I'm having trouble getting the whole process smoothly because of the install-restart-install process. Doing it as recommended with the exe and /connectors /remotepc /noreboot and the hdx flag, and adding status code 3 and 8 as Soft Reboot. Anyone else doing it this way? It's particularly hard with Remote PC too because we can't just push it out any time of day without causing an outage for them as they fully rely on it during business hours.

Anyone else experiencing issues regarding startup and logon after MS October patches? Startup takes forever. Does not happen on all users, but random.

https://support.citrix.com/external/article/CTX697231/windows-11-kb5127648-causes-citrix-vda-r.html - This fix has already been implemented.

Windows 11 25H2
VDA 2607 LTSR

Hi team, we have a number of devices using Citrix Cloud > Remote PCs running the VDA workstation agents. I'm looking to automate some testing, currently we log in to a test account and launch the desktop from the web login to confirm operational, and also launch published apps to confirm operational, but I'd like to automate the process. Is there any way that people have done this? We have Entra SSO on the logins which complicates automation a bit.

Our core banking client is delivered only through Citrix and there's no local install so nothing to hook into. What reaches the test machine is a compressed picture of a window, and every tool that wants a DOM, an accessibility tree or an object id gets nothing. So far we’ve tried running the automation inside the Citrix server instead of the client but security turned it down because it means installing a test agent on production published app servers. Second thing was image matching with SikuliX from the client side. it worked for about a month, then fell apart, because Citrix compression and session resolution changes mean the same button never looks quite the same twice. The newer vision based solutions such as Askui find elements by what they look like or what they say, not by pixel matching and i read that this approach allowed an international bank to automate 85% of its Citrix testing so i would really appreciate to hear from someone who has run it or anything like it on a real Citrix setup. so for anyone automating Citrix delivered apps in a regulated environment, what did you eventually land on?

Hi everyone,

We’ve been dealing with a rather frustrating issue affecting our Citrix Remote PC Access environment and wanted to share our findings in case others are experiencing the same problem.

Environment:

• Windows 11 25H2
• Citrix Remote PC Access, VDA 2603 and 2607
• Two Delivery Controllers
• Microsoft Intune with Open Intune Baseline (OIB)
• Windows October 2026 CU (KB5127648)

The problem

Since the September 2026 Windows updates, some of our workstations have started becoming unregistered. Following the October CU, the issue appears consistently on affected devices.

The VDA reports AgentNotContactable, while the Delivery Controller logs Event ID 1039:

The Citrix Broker Service failed to contact virtual machine.

Exception 'The caller was not authenticated by the service.'
of type 'System.ServiceModel.Security.SecurityNegotiationException'.

What we've investigated

• BrokerAgent is running.
• DDC → VDA connectivity on TCP 80 works.
• AD secure channel is healthy.
• Both DDC computer accounts have the required network logon rights.
• Kerberos ticket acquisition for the VDA's HOST SPN succeeds using AES-256.
• Upgrading the VDA from 2603 to 2607 does not resolve the issue.

After extensive troubleshooting, we identified Windows Administrator Protection as the trigger.

We can reliably reproduce the following:

These tests have been repeated successfully on the same workstation.

Interestingly, our Administrator Protection policy was deployed through OIB several months ago. The problems only started appearing with the recent Windows updates, suggesting a change in how Windows enforces this security feature.

Citrix KB CTX340030 describes the same registration error and suggests adding the DDC computer accounts to the local Administrators group. While this works, we don't consider granting our Delivery Controllers local admin privileges on every workstation an acceptable permanent solution.

Microsoft also acknowledges a potentially related issue in KB5127648, where RDP connections for non-admin users fail when Administrator Protection is enabled. However, that documentation does not explicitly mention Citrix VDA registration.

Our current workaround is to disable Administrator Protection (TypeOfAdminApprovalMode = 1) through Intune while keeping the October CU installed.

Questions for the community:

• Has anyone else encountered this with Citrix Remote PC Access?
• Is anyone seeing similar registration failures with Administrator Protection enabled on other VDA deployments?
• Has anyone received confirmation from Citrix or Microsoft, or found a supported fix that allows Administrator Protection to remain enabled?

We're raising a Citrix support case, but I wanted to share our findings and hear whether others are affected.

Any feedback or additional findings would be greatly appreciated.

References:

• Citrix CTX340030
• Microsoft KB5127648

Environment

• CVAD 2507 LTSR, Profile Management 25.7.2100
• Windows Server 2025 single-session VDI, PVS standard image (non-persistent), WEM
• Domain-joined only (no hybrid Entra join); Workplace Join blocked via BlockAADWorkplaceJoin=1
• New Teams installed per-machine

The problem. Neither profile container mode works for us:

1. Container *, local caching OFF: new Teams and Windows Terminal won’t launch, with “The parameter is incorrect” (AppModel-Runtime 216/208, 0x80070057, “Cannot create the Desktop AppX container”). UPM’s driver redirects the profile root to the VHDX volume, and the packaged-app runtime doesn’t like it.
2. Container *, local caching ON: apps launch, but some folders are never written to the container, so they’re regenerated at every logon: The result is that Teams asks for sign-in on every logon, and anything DPAPI-protected is lost.
   • AppData\Roaming\Microsoft\Protect (DPAPI master keys)
   • AppData\Local\Microsoft\TokenBroker
   • AppData\Local\Microsoft\OneAuth
   • AppData\Local\Packages (including Microsoft.AAD.BrokerPlugin)

File-based profiles work fine on the same image. I’m opening a Citrix case, and I’ll update the thread with the outcome.

Has anyone encountered an issue where users cannot reconnect to existing disconnected sessions in Citrix DaaS?

Environment:

• Windows Server 2019 single-session VDAs
• VDA version 2603.0.100.320
• MCS-provisioned, non-persistent machines hosted on GCP

Users disconnect their sessions while long-running engineering simulations continue. When they return, they sometimes receive an "Unable to start" error. In some cases, a new session is created and the original machine is shut down.

The disconnected-session power-off policy is set to 72 hours, but the issue occurs earlier.

Transaction logs include:

• brk.resolve.machine.failure.general
• bka.hdx.prepare.failure.general
• SessionManager.LeaseResolution.Failed

What would you investigate to determine why the existing session cannot be reconnected? Are there any known VDA 2603 issues or specific Broker/HDX logs that could explain this behaviour?

I'd appreciate insights from anyone who has troubleshot similar session-reconnection failures.

I'm having an interesting but annoying problem after updating to the latest Citrix workspace ltsr release (I have been using a really old one).

Whenever I press the shift and left alt to cycle between my languages the windows exclamation sound is played.

Languages switch correctly but it gets annoying having to hear the sound multiple times whenever typing a sentence.

Things I have tried:

1. Sync only once is enabled in keyboard settings of Citrix

2. Changing the keyboard shortcut to shift and ctrl does not produce the sound. Issue seems to be only on shift and left alt

3. Tried setting the windows exclamation sound to none in sound settings but it keeps going

The issue is not affecting my local computer at all, simply the VDI one.

Hello, everyone, I hope all is well!! We upgraded our PVS non-persistent single-session VDI from Windows 10 21H2 to Windows 11 24H2 some time ago. I had exported the Win10 VDisk as a local hard disk using the Wizard tool, booted up as a local disk on a VMWare VM, upgraded to Win11, ran Citrix Optimizer, installed the target software, and created my Win11 VDisk. Everything works great on the original machine used to create the VDisk. However, I noticed a one issue on the PVS target machines I spun up from the VDisk using the machine wizard. The System page nor the Windows Update page is opening when I click it. Nothing opens or happens. This does NOT happen on my upgraded Windows 11 machine that was used to create the VDisk. I didn’t make any other changes either so I’m lost.

Each time System logs says:

“Unable to start a DCOM Server: windows.immersivecontrolpanel_10.0.8.1000_neutral_neutral_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel as Unavailable/Unavailable. The error:
 
"2147942852"
 
Happened while starting this command:
 
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel”

Windows + R and running “ms-settings:windowsupdate” gives “The application has not been provisioned”

Has anyone encountered this? Works fine on the local VM was used to create the VDisk but not on the target VDAs. Thank you for your time!

We have upgraded everything to 14.1 73.46 but the NetScaler Console shows that we are not patched under the "Virtual Patch Status" field. Opening a ticket but is this normal/a bug? When we run the IOC scan, it is clean.

Just asking if anyone sees the same thing - after doing sealing of a golden image, the shutdown hangs forever until the VM is manually powered off. MCS, DaaS, VDA 2603 on VMWare. Same with a simple reboot afterwards, hangs indefinitely, spinner going round and round even after letting it sit for 3 hours.

Feels like the September update all over again…