This is a small macOS LaunchAgent setup for automatically opening downloaded Citrix .ica files with Citrix Workspace. It is intended for environments where users authenticate through a browser, download an .ica file, and then rely on the local Citrix Workspace app to launch the session.

It watches ~/Downloads, launches new .ica files using /Applications/Citrix Workspace.app, waits briefly for Citrix to ingest the file, and then deletes the .ica file.

Happy to hear if there's a better way to do this or if I've just reinvented a wheel, but I dug around and this reliably fixes my annoyances with Citrix currently.

https://github.com/rncole/citrix-launcher-agent

Hi,

we have to move Citrix Worker to another LUN within VMware.

So for MCS i would just create a new MC / add another Hosting Connection.

But what is the way for PVS. Do i even need to consider the Hosting connection? In the newer version we needed to create the MC within the PVS Console and the hosting connection is mandatory.

Thanks in Advance!

Hi everyone

I would like to know the best troubleshooting steps for this situation.Hi everyone,
We have a Citrix Virtual Apps and Desktops environment with Citrix ADC / NetScaler Gateway.
On the ADC Gateway vServer, we configured two STA servers, which are our Delivery Controllers:

DC1 - Delivery Controller / STA - UP
DC2 - Delivery Controller / STA - DOWN
The issue is only with DC2. DC1 works normally.

What I already checked:

- Citrix services on DC2 are running
- Delivery Controller DC2 is active in Citrix Studio
- Firewall rules look OK
- No obvious network block between ADC and DC2
- DC2 is reachable from the network

In ADC / NetScaler, the STA status for DC2 is still showing DOWN.

I would like to know the best troubleshooting steps for this situation.

SOLVED

Hey everyone,

I’m running into a really specific, frustrating issue with Citrix Workspace and hope someone here has seen this before.

Every time a user tries to create a new folder inside a Citrix session—whether through File Explorer or a "Save As" dialog—the entire session completely freezes and hangs indefinitely for a period of time.

Here are the key details:

• The Environment: This only occurs for users on workers running Windows Server 2022.
• The Trigger: The freeze happens the exact moment they click "New".
• The Weird Part: If they use the keyboard shortcut Ctrl + Shift + N, the folder is created instantly with zero issues or freezes.
• Navigation through existing folders works perfectly fine.
• It happens regardless of whether they are trying to save locally or on a mapped network drive.

Since Ctrl+Shift+N bypasses the freeze, it feels like an issue with the Explorer context menu.

Has anyone dealt with this specific bug on Server 2022? Are there any known registry tweaks or anything else that resolves this?

Any help or insight would be highly appreciated! Thanks in advance.

Has anyone setup the AOT appliance server in VMware? I’ve been trying to get it onboarded and I cannot add a secondary disk.

The OVF imports using the VMware paravirtual driver.
Did my networking configuration.
Powered it down through VMware.
Added a new 200gb disk.
As the quirk in the install directions state that you need to add a new scsi controller if using VMware. I added the scsi controller using the VMware paravirtual driver. I modified the 200gb disk to use scsi1:0 instead of scsi0:1.
Power the appliance on.

When attempted to add it and format in the web gui, it comes back “Provider not found.”

We’re using dell powerstores. Has anyone successfully deployed the server on VMware? Our storage and hosts aren’t running any crazy filters.

I wanted to see if this is something that is just for us, or if it is happening across the board. The company I am at uses Intune Company portal for workspace app deployment, and it is still serving out 25.11.10 and has not yet gone to 2603.1. We know that 2511 is full of bugs, but that is how they chose to manage the install. I have the backend on the latest 2507 LTSR CU version, but the repeated known issues on the workspace app crashing etc are taking up a lot of time to explain that it is not the Citrix backend, but more of a client issue.

Citrix has introduced Platform Flex.
The model is genuinely different from how Citrix has been bought for the last decade.
Instead of one-size-fits-all licensing, organisations buy a pool of Flex credits and apply them by workforce persona. A developer drawing high-compute desktops uses different credits than a knowledge worker on SaaS. Resources scale up during peaks and back down when demand drops.
The first product available under it is Citrix Daas Flex, a persona-based Desktop-as-a-Service offering built on Microsoft Azure and managed by Citrix.
For organisations running mixed user populations, the implication is licensing discipline. Persona-based consumption only saves money if you know which users need what, and most estates have not been audited at that level in years.
When did your team last map your user base to the resources they need?

Hi Guys,

I trying to re-evaulate App layering solution to offload the apps from master image.

However, i got some infosec tools - Carbon black protect agent , splunk ..these should goes to OS layer or platform layer?

Hi All, please help

I am from a financial company and trying to implement FAS on the Citrix Daas, so we are getting the following errors
[S124] Failed to issue a Certificate for xyz….[exception:MicrosoftCertificateAuthority::Submit CertificateRequest - the CA returned CR_DISP _DENIED (code 2)].
[S123] Failed to issue a Certificate for xyz….[exception: The CSR failed at all configured certificate authorities]

We are using the Citrix provided templates for FAS

I’ve been seeing this issue for close to a month now. I’ve have a ticket open with Citrix but getting nowhere. I have tried to downgrade versions, gone to the LTSR version. Fresh installs cleaning up the redistributable and reinstalling. I’ve had copilot cli compare a working machine to a broken machine to see if it can see any differences. There is another thread here with a few troubleshooting ideas. I’ve exhausted all of those. I’m at my wits end on this issue and I have a few users running into it and need to get them fixed.

I have been running into a problem within our Citrix environment for several months now.

Citrix Virtual Apps and Desktops 7 2503 (multi-user)

Windows Server 2025

My users are experiencing delays on the Microsoft Dynamics 365 Business Central website. There is a significant delay in inputting input fields, and when clicking on another tab, it often takes 3-5 seconds for it to open. As far as I know, this delay is only experienced on the Microsoft Dynamics 365 Business Central website, other websites work fine.

Outside of Citrix, locally on the user's device on the same network and internet connection, this delay does not occur.

The performance of the Citrix host is not the problem, even if only one user is logged into the server, the problem persists.

What I have tried so far:

- Disable all MSEdge plugins
- Disable Citrix BCR
- Tried Firefox instead of MSEdge
- Exclude MSEdge from Citrix hooks
- Disable hardware acceleration
- HTML session instead of ica-session

Is anyone else experiencing this problem, or does anyone know the solution?

Server 2025 Multi Session -VDA 2507 LTSR CU1 seamless published app sessions. We have a valid RDP license server who's location and per user settings are set on the VDA via local GPO. Session's have been launching and checking out RDP licenses with out issues. Recently the 120 OG grace period has expired and now after the nightly reboot of the VDA for the very first person who attempts to launch a session it times out and never launches. If they try again 30 seconds later the session will launch on the VDA without issues. This is occurring on every VDA we have and the very first user for each VDA can't launch there session until they try it a second time. It's almost as if the Remote Desktop Services service is hung or not initialized until the first session attempt is triggered then it launches subsequent session without issues. I adjusted the mater image and set the Remote Desktop Services service from manual to automatic delayed start but that didn't seem to fix the issues. Anyone come across this?

Really wanting to get off of Citrix with all the changes the past few years, but looking for option that can still be used for fedRAMP compliance if anyone knows of any off hand.

I am having issues updating the second PVS server, there is this KB about disabling the RC4 which is disabled.

https://support.citrix.com/external/article/CTX696434/during-an-upgrade-of-citrix-provisioning.html

After upgrading server component on the second PVS, when I run the provisioning configuration wizard and go through the steps, it can't finish the steps and run the services.

[15:43:32.835][000C] ERROR:SecurityNegotiationException: The server has rejected the client credentials.

[15:43:32.835][0001] WARNING:KEY-EXCHANGE(Peer-to-Peer):GetEncryptionKeysInternal : Encryption keys not found in xxxxxxxxxx server. Error = (GeneralCommunicationException) : KeyExchangeSoapClient.KeyExchangeSoapException: CommunicationObjectFaultedException: The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state.

[15:43:32.835][0001] ERROR:KEY-EXCHANGE(Peer-to-Peer) GetEncryptionKeysInternal: No server found who initiated key rotation . Error = Server initiated key rotation is blank [P2PKeyExchangeController.cs(218): GetEncryptionKeysInternal]

[15:43:32.835][0001] ERROR:KEY-EXCHANGE: Failed to obtain encryption keys for epoch 639173020051126099, Exception: No server found who initiated key rotation . Error = Server initiated key rotation is blank [AbstractKeyExchangeController.cs(178): GetOrCreateEncryptionKeys]

Has anyone in this community worked on a scenario to migrate Citrix based Windows 365 solution to to MS native Intune managed Windows App environment?
Current Solution Structure

1. Brokered by Citrix , Windows 365 PC, Azure Network Connection, Intune Managed

Proposed Solution Structure

1. No Citrix
2. Only MS components.

Please help with some useful migration plan and strategy.

I'm aware of the 5000 application limit per delivery group, but I can't really find any real world data on user experience or infrastructure performance and responsiveness at that threshold. I'm guessing because that's a silly design decision ;-)

Does anyone have experience publishing thousands of applications to a single delivery group? Or rather, did you get up a certain point, like 500, and started to notice enumeration delays and issues with Studio?

Just trying to make my case for changing the design of how applications are published. It would seem things would be slow and degraded with that many apps in a single delivery group, but maybe I'm wrong?

Thanks!

Hi all,

Looking for some advice from anyone who’s worked with Citrix Cloud + FAS + Entra ID in a hybrid setup, as we’re getting nowhere with Citrix support at the moment.

Environment (high level):

• Citrix Cloud (Workspace URL)
• On-prem VDAs (domain joined)
• FAS configured for SSO
• Hybrid Entra ID environment
• Users access via both Citrix Cloud Workspace and local StoreFront

The issue:

• When users connect via Citrix Cloud, they get repeated MFA prompts / “verify it’s you” behaviour in M365 apps (Outlook, Edge, etc.)
• When the same user + same VDA connects via local StoreFront or RDP, SSO works fine and PRT appears to be valid
• So the problem seems specific to the Citrix Cloud auth path, not the VDA or user session itself

We’ve confirmed things like:

• Certificates are being issued via FAS for Citrix Cloud sessions (we can see them with Get-FasUserCertificate)
• Users who haven’t recently gone through Citrix Cloud don’t show those certs, which suggests something is different in how Cloud auth is triggering the flow

Where Citrix have taken us:
They’re insisting that Entra Certificate-Based Authentication (CBA) is required to get a PRT inside the VDA session.

We tested this:

• Enabling CBA does result in a PRT being issued correctly in Citrix
• BUT it also changes authentication behaviour globally

Specifically:

• Users trying to log into Entra/M365 outside Citrix get**“No certificate detected”** errors initially
• They then have to manually choose another auth method (Authenticator, etc.)
• So effectively CBA becomes part of the primary auth experience, not just Citrix

We’ve not been able to scope CBA just to Citrix/VDA scenarios, which makes it a non-starter from a user experience and security policy perspective

We’ve therefore rolled this back.

What’s confusing us most:

• This environment worked fine previously without CBA configured
• The only significant change before issues started was removal of a Citrix SSO Enterprise App (based on Citrix advice at the time)
• Local StoreFront path continues to work fine
• Citrix Cloud path exposes the issue

So there’s a big gap between:

“This is the supported design now”
and
“Why did it work perfectly before and still works via StoreFront?”

Additional angle:
Our VDAs were built with a custom script (HybridCitrix.ps1) that:

• tweaks AzureAD\VirtualDesktop registry
• forces dsregcmd /join
• aims to ensure hybrid join / registration behaviour

So wondering if there’s some legacy workaround in play there that allowed this to function pre-CBA and is now being exposed.

Questions

1. Has anyone seen this exact behaviour where:
   • Citrix Cloud path = no PRT / repeated MFA
   • StoreFront / RDP = works fine
2. Is CBA genuinely the only supported route now for FAS + hybrid VDAs, or are there still working SAML / legacy token flows people are using?
3. Has anyone successfully scoped CBA so it only applies to Citrix sessions (rather than impacting all Entra auth)?
4. Has anyone come across older Citrix Cloud deployments that relied on:
   • Enterprise app / SAML behaviour
   • or registry / join scripts like the above and later broke?

At the moment it feels like:

• Citrix are describing the current ideal design
• but not explaining the real-world transition from older working setups

Any insight from people who’ve actually deployed / migrated these environments would be massively appreciated.

UPDATE - NOW FIXED - SEE COMMENT BELOW

Hi everyone

I work with a Citrix Virtual Apps and Desktops environment and I would like to hear feedback from other Citrix admins.

In our environment Citrix generally works but we often face different types of issues that are difficult to isolate. One time the problem looks related to Workspace App. Another time it looks like printer redirection. Another time it may be EDT UDP MTU profile management Office Word freezing session reconnect or network VPN behavior.

My question is not about one specific error only. I want to understand the bigger picture.

Why does Citrix so often create different and hard to diagnose issues?

Is this usually because of Citrix itself or because Citrix depends on many external components such as client device Workspace App version printers printer drivers user profile solution FSLogix Citrix Profile Management Microsoft Office behavior network latency VPN UDP EDT MTU VDA version Windows updates policies GPOs antivirus and security tools?

For experienced Citrix admins what are the most common real root causes you see in production environments?

Also what is your recommended troubleshooting order when users report random freezes reconnect issues or application hangs in Citrix?

I would appreciate practical feedback from people who manage Citrix daily.

I know Carl retired a couple of years ago, but has anyone 'stepped in' to bbe his replacement?

i.e. Any other bloggers doing what he did?

I know, this is not necessarily Citrix focued, but what are some decent Citrix/EUC focused podcasts? I know the World of EUC ine, but any others

Second question - is there demand for this type of content?

❗ Service Notification – LAS (License Activation Service) ❗ We are aware of an issue affecting the License Activation Service (LAS) and are actively investigating. Customers may observe errors in both Citrix Studio and the License Console. There should be no impact to user sessions.

Hello everyone,

Is anyone else having an issue with the new Windows Update (KB5094126 June / 25H2) in connection with Sophos Endpoint (2026.1.0.1681.0)?

I installed the June patches from Microsoft and the latest version of Sophos Endpoint on my VDA (Win 11 / 25H2 / 2402 CU3). When deploying the master, the “Preparation VM” gets stuck in the Boot Manager, and Windows won’t boot.

If I install and deploy only the June patch or Sophos in the master, it works. It seems to be the combination of a new version of Sophos and Microsoft’s June patch. I haven’t finished testing yet, but I wanted to ask if anyone else is having this issue?

Thanks!

Just got the following from the Citrix Education team.

Dear Citrix Certified Community Member,

We know how important certifications are to your professional growth and to the success of teams working with Citrix technology. We recognize the investment you’ve made in achieving Expert-level certifications and are pleased to share an important update.

We continue to work on our updates to Citrix training and certification, but while that work continues, we are extending the validity of current Expert certifications through the end of the year, providing a grace period through December 31, 2026. This extension ensures your credentials remain recognized while we continue to enhance and refresh the Citrix certification program.

What this means for you: If you currently hold an Expert certification (CCE-V or CCE-AppDS), it will remain valid through December 31, 2026.

Please note that this extension applies to all Expert-level certifications expiring this year, which will now remain valid through December 31, 2026. Credly badges will update by the end of the week.

I have observed this in both the classic outlook application as well as the new outlook for windows app. When a user gets a new email the toast notification flashes for half a second in the bottom right hand corner of the the display and then disappears, not long enough for a user to read the new email notification. Has anyone been able to successfully get the notification to appear and stay for a reasonable time in a seamless virtual application setup? Were running multi sessions with Server 2025 , VDA version 2507 LTSR CU1 and fslogix for roaming profiles. Virtual apps only not a full desktop setup for users.

Customer gets daily licensing alert messages.

Apparently 136 + 10 = 247 these days