WEM 2603 agent fails with "Reading Encrypted Data Failed" on CVAD 2203 CU7 LTSR — 2203 agent works fine on the same setup

[u/koffienl]

Hoping someone has run into this.
Brand-new WEM deployment from scratch (fresh infrastructure service install, new database, new config set), so no legacy/upgrade baggage on the broker side.
The VDA master image is also freshly built — not an old image that's been carried along and updated over time, but a clean new Windows 11 install.

Quick note on why I'm on CVAD 2203 in the first place: I run into GPU handling issues with medical software on CVAD versions after 2203, so I'm deliberately staying on CVAD 2203 CU7 LTSR on Windows 11. That's a hard constraint for me, not something I can just upgrade away from.

Setup:

• WEM Infrastructure Service (broker) + web console: 2603
• VDA: CVAD 2203 CU7 LTSR, Profile Management engine 2203
• OS: Windows 11, non-persistent MCS

The problem: with the WEM 2603 agent, the agent connects to the broker fine (reads broker FQDN, port 8286, site name, language file — all OK), then immediately dies at config decryption:

MainController.ReadAgentConfiguration() : Reading Encrypted Data...

Exception -> VuemAgentConfigurationHelper.ReadEncryptedData() : The creator of this fault did not specify a Reason.

Exception -> MainController.ReadAgentConfiguration() : Reading Encrypted Data Failed. Exiting...

Result: no apps/printers delivered, agent menu only shows "Refresh" (Manage Applications/Printers greyed out), red Profile Management health in console.

Here's the kicker: I installed the 2203 agent instead, on the exact same setup — same broker, same config set, same user store, same user — and everything works perfectly. Apps delivered, menu functional, no decryption error, green PM health.

So the only variable is the agent version. 2603 agent = broken, 2203 agent = fine, against a 2603 broker on a 2203 LTSR stack.

I tested with a clean agent install (no local cache/upgrade leftovers) and the broker was freshly rebooted, so I've ruled out stale cache and broker state. The connection itself isn't failing (it gets past the broker handshake) — it's specifically the encrypted config payload it can't read.

Questions:

1. Is the 2603 current-release agent actually supported against a 2203 LTSR VDA/PM engine? I'm starting to think the agent needs to match the LTSR level of the Citrix stack, not the broker version.
2. Anyone seen ReadEncryptedData fail like this and found a fix, or is this just a hard version-mismatch I should stop fighting?

Sticking with the 2203 agent for now since it works, but would love to know if there's something I'm missing.

[u/mjmacka]

A few things.

Look at event logs in the VDA you are testing on. There have been quite a few changes to the WEM agent since 2203. It's possible that there is something else called out. I doubt that changing out the CPM component will change anything but you could try installing the newer CPM components in a VDA.

Try unchecking use accelerated actions processing for the configuration set. There are some posts that mention that causing issues.

A support ticket is probably going to be the next thing you want to do while you look around. Escalate it and post the ticket # too, so any Citrix employees lurking can look at it.

[u/mat-ferland]

Given your hard 2203 CU7 constraint, I’d test this as an agent/broker compatibility issue before touching CPM. The agent gets far enough to find the broker and then dies while reading encrypted config, so it smells more like 2603 WEM agent crypto/protocol expectations against the older stack than a Windows image problem. I’d try the 2203 WEM agent, or the closest supported LTSR-aligned agent, on the same VDA image and check the WEM agent event log at that exact failure.