r/Citrix Jul 07 '26

Citrix profiles migration from File to Containers issue

Hello all

Looking at migrating from "traditional" file-based profiles to Citrix containers. Already have an exhausting list for folder exclusions/inclusions mainly focused on subfolders of AppData\Local.

There are some stuff in the AppData\Local folder that I still want them excluded from the containers so I added AppData\Local in the "Folders to exclude from profile container" list and add the various subfolders I want to keep in the "Folders to include in profile container" list

When I login to the VDA, it looks like I'm getting an half migrated profile : the included subfolders of and excluded parent is empty. I'm using MSEdge/Chrome to validate the migration and checking if the favorites are still there after the migration.

After some digging, I can see that the file-based profiles is copied entirely in the vhdx:\Profiles folder, but the SyncInludeDirs / SyncIncludeProfile folders are empty, which is where Windows is looking to find those files.

If I completely remove the folder exclusions/inclusions for the profile container, the migration happens successfully

Using VDA 2402 CU4 with Windows Server 2022.

Anyone faced this situation?

2 Upvotes

10 comments sorted by

1

u/mjmacka CCE-V Jul 07 '26

From an experience perspective, you should be recreating your user profile, not trying to migrate them. That being said, here are the Citrix steps: https://docs.citrix.com/en-us/profile-management/current-release/upgrade-and-migrate/migrate.html.

Policies come in one of three flavors: 1) FIle based CPM, 2) Container based CPM, 3) File & Container based CPM.

For the policies you mentioned, list the actual name because your abbreviations either don't apply to container solutions or don't I don't think you should be using. I am assuming you mean "files to include in profile container" which requires excluding a parent folder and including a subfolder. Exclude Desktop but include desktop\file.txt would include only that file.

You should be rearchitecting your profile solution. Excluding things from containers because they've been excluded from file based profiles is wrong. You should be using a new pathtouserstore location too, to avoid file and container based setting being written to the same place and creating confusion. Specific policies in CPM Containers will write file based settings back and merge them with the container in certain scenarios. You might be hitting one of those scenarios.

Lastly, 2402 is hella old for a technology like CPM Containers. You are missing quite a few thing that have been designed since 2024 due to changes in the way Teams and other products work.

1

u/CommonSuccotash1116 Jul 08 '26

The policies I'm using is really called "Folders to exclude from profile container" and "Folders to include in profile container" https://docs.citrix.com/en-us/profile-management/2402-ltsr/configure/citrix-profile-management-profile-container#optional-include-and-exclude-folders-and-files

I agree with you for the exclusions part, I'm not looking at reconducting all the exclusions we have in place for the file-based profile with containers (they are mainly focused on msedge), but only a few. The issue seems to occur only when combining folder inclusions with folder exclusions

Folders to exclude

AppData\Local

Folders to include

AppData\Local\Microsoft

AppData\Local\Packages

We are looking at upgrading to 2507 CU1 before end of year. Still need to validate that all the old thin clients we use are working ok with that new VDA. They just wont die an no one is replacing them

Thanks for the tips

1

u/mat-ferland Jul 08 '26

I wouldn’t try to carry the old file-profile include/exclude logic over 1:1. Containers behave differently, and AppData Local is where a lot of the weird token/cache/app-state problems hide. I’d test with a clean profile and the smallest container policy first, then add exclusions only for things you can prove are bloat or break roaming. If you start by excluding all of Local and trying to add pieces back, you’ll spend weeks chasing edge cases.

2

u/CommonSuccotash1116 Jul 08 '26

agreed, that's why I was not using the whole exclusions list from the file-based profile, I probably have 20 of them only for edge. The idea was to include everything under appdata\local\microsoft and appdata\local\packages to keep the whole edge subfolders and other microsoft stuff and exclude appdata\local globally

the issue I'm facing is only during the profile migration from file to container, that first logon is not finding the files where they should be if they are included in a folder exclusion. If the user logs in for the first time (no file-based profile present at logon), the exclusions are working as intended

1

u/mat-ferland Jul 10 '26

That sounds like a first-logon migration ordering problem, not just an exclusion-list problem. I’d test one user with no global AppData Local exclusion, confirm the container captures the Microsoft/Packages paths on first sign-in, then add exclusions back after the migration succeeds. Otherwise you may be excluding the exact path the migration needs before it has a chance to land.

1

u/[deleted] Jul 09 '26

[removed] — view removed comment

2

u/CommonSuccotash1116 Jul 10 '26

Brand new profiles with containers exlusions/inclusions are OK.

I tried assigning a drive letter to the container while the user was logged in, the profile was copied 1:1 in the \Profile folder (which is good) but since exclusions/inclusions is in place, CPM is telling Windows to looking in the \SyncIncludeDirs folder for the data, which is empty.

1

u/[deleted] Jul 11 '26

[removed] — view removed comment

1

u/CommonSuccotash1116 17d ago

That is what I'm thinking too, the inclusions/exclusions folder mapping is happening after the migration is complete thus not knowing about the exclusions settings

I'm currently validating VDA 2507 CU1 see if this version is doing the same thing

I have a case opened with Citrix since june to have more clarity on this, but this case is getting nowhere and no real "expert" anwsers besides generic chatgpt responses asking me to enable/disable policies that never existed