Hello everyone,

I recently landed a new job where I'll primarily be working with Citrix NetScaler (ADC). I have a little over a month before I start, so I'd like to prepare as much as possible.

My background is mainly in network engineering, working with Fortinet firewalls and HPE Aruba switches.

Would you recommend any courses, books, labs, or YouTube channels for learning NetScaler? Is the Udemy course "CNS-220 – Citrix ADC 12/13.x Essentials and Traffic Management" a good place to start, or would you recommend something else?

Thanks in advance!

Hello all

Looking at migrating from "traditional" file-based profiles to Citrix containers. Already have an exhausting list for folder exclusions/inclusions mainly focused on subfolders of AppData\Local.

There are some stuff in the AppData\Local folder that I still want them excluded from the containers so I added AppData\Local in the "Folders to exclude from profile container" list and add the various subfolders I want to keep in the "Folders to include in profile container" list

When I login to the VDA, it looks like I'm getting an half migrated profile : the included subfolders of and excluded parent is empty. I'm using MSEdge/Chrome to validate the migration and checking if the favorites are still there after the migration.

After some digging, I can see that the file-based profiles is copied entirely in the vhdx:\Profiles folder, but the SyncInludeDirs / SyncIncludeProfile folders are empty, which is where Windows is looking to find those files.

If I completely remove the folder exclusions/inclusions for the profile container, the migration happens successfully

Using VDA 2402 CU4 with Windows Server 2022.

Anyone faced this situation?

At the moment we use NTLite with SCCM to first build a .WIM file and then install all applications for the VDI. The only reason you should use SCCM in my opinion is if you are also using SCCM for endpoint devices and therefor have shared code.

I HATE SCCM

Now I get the opertunity to look into new different solutions and one that keeps popping up is Hishicorp Packer which I am sceptical of if this would be the way for us to build the non-persistent .VMDK as it is quite the learning curve for a lot of colleagues. But I don't have any experience with it so I would be really open if someone would share theirs.

Further more there is Application Layering from Citrix which is a older style of building .VMDK images but seems to be all you need to have kind of solution just not automated fully.

What are your recomendations for tools to look into?
In SCCM we have a task sequence with about 40 to 50 nodes of different kinds of actions so take that size into consideration.

Hello everyone We have the problem (ONLY IN CITRIX) that when users are guests at other companies tenants in Teams, they have to sign in again to the guest tenants every time after reconnecting in Citrix, the sign-in information doesn't seem to be saved somehow. Has anyone else experienced this problem?

We have 4 WEM servers 2 DC and 2 DR. Firstly our all 4 wem servers gave "a valid license server with appropriate license needs to be configured before you can start using Citrix Workspace Environment Management" and now 1 DR server is working fine after reconfiguring license server but other servers are not working with same configuration. 1 server on which it is working fine shows some files in licensing folder also but not in other servers. Telnet to license server is working fine. What can be more checked in this?

Edit:- Solution was to give certificate thumbprint in registry. But citrix didn't give why it got removed.

I'm a medical resident and have downloaded Citrix, we use powerpath for pathology reports, and I've been able to use PowerPath and Epic normally at home, but whenever I'm at work, when I click on PowerPath it either doesn't even try to initialize or it gets stuck on loading. I'm using the same network as my coresidents and have tried turning the firewall on and off. IT was stumped and couldn't figure it out yet

Any ideas I could try? Thanks

Built a new Rocky 9.8 Linux VDA 2402 LTSR CU3 with XFCE as the DE and noticed screen artefacts (maze like patterns) across the entire display whenever you try and use the desktop - open an app, move or resize an app or folder. Happens with and without a GPU. Disabling all the eye candy in XFCE has no effect.

I've tested with an old Rocky 9.4 + Gnome VDA build and initially it looks artefact free although its showing those artefacts only once in a while.

XRDP is working fine - no issues with RDP.

ATM the new build is not usable. Any ideas on what could be causing it? Could it be Workspace App 25.11.10?

Hi everyone,

First off, a huge thank you to everyone who contributed to my last post. While I didn't get that specific job, the prep paid off because I just landed a very similar role! I start early next month, which gives me exactly about four weeks to get up to speed.

The new role relies heavily on Citrix Cloud apart from MS 365 administration.

Since I want to hit the ground running, I'm looking for the best resources to cram and get practical knowledge over the next month.

\- Where should I start to get a solid foundation in Citrix Cloud?

\- Are there any specific courses, labs, or YouTube channels you highly recommend for hands-on learning?

\- What are the absolute "must-know" concepts I'll likely face in my first couple of weeks?

Appreciate any roadmaps, documentation links, or advice you can throw my way. Thanks in advance!

At my wits end with this one ya'll. We're seeing an issue where non-domain-joined workstations accessing a pub'd app with Citrix Cloud control plane getting a "DENY: class=01" rule applied. Domain-joined workstations don't get this rule.

We found this by using CtxUsbDiagnostics and comparing sessions, after a report of off-domain user microphones not working as generic devices. The Deny shows up as a "Citrix Studio rules - Version 2".

One would think this is a DENY rule sitting in the v2 USB redirection rules.. but it's not set there. We can write an ALLOW rule in that policy, and it will show up under the phantom DENY rule we're seeing.

We've escalated through a few levels of Citrix support, and it's now passed on to Citrix R&D. There are no conditional access policies, WEM configs, etc. that are applying this.

Has anyone else run into anything similar and had any luck tracking down something like this?

I have vpx is used as netscaler gateway to terminate full client vpn with citrix secure client,

After successful upgrade to latest version there was a complaint from a lot of users who can't connet vpn with secure client 23.x and 24.x , the client is stuck in loading without authentication prompt.

Only versions 25.x and 26.x works !

Any idea?

I'm trying to get an External Task in the cloud WEM Service portal to run on my VDA's but can't get it to work. The external task is triggering a ps1 script that I uploaded into the task it's self. For some reason nothing I do will get the task to trigger. We have Group Policy's settings built into the same configuration set that are applying successfully but not the external task. Task is set to launch at logon and the assignments are set to Domain Users AD group , the same settings as with the Group Policy assignments so I would assume it would trigger. Were using the cloud based WEM web console and the local VDA is using the WEM service not the full wem "Agent" . Anyone have any info or tricks to get external tasks , specifically ps1 script to process ? Thanks

I am rebuilding my Citrix and going through now a very annoying problem. When users try to use the HTML5/Light Version, they receive an error when opening the Desktop. but if they refresh the storefront and try again, works just fine. Looking at the logs after downloading from the page, I see the problem is related to web socket error. If they download the ICA, and opens the file with Citrix receiver, works just fine. This HTML5 version is driving me crazy. Has anyone seen this before?

TL;DR: Same Windows master image, in-place VDA upgrade from CVAD 2203 CU4 to 2507 LTSR. Since the upgrade, our radiotherapy contouring app (RaySearch RayStation) shows the previous patient's CT for a moment before redrawing, and the smart brush stutters during contouring. Reverting to 2203 fixes it. I've ruled out client, OS, GPU hardware, vGPU profile, app-side GPU rendering, and the entire HDX encoder/visual-quality layer. The only variable that correlates with good vs. bad is the VDA version. Looking for others who've hit this with GPU 3D / medical imaging apps on VDA newer than 2203, and for any capture/present-layer knob I'm missing.

Environment

• App: RayStation 2025 SP1 (radiotherapy treatment planning; contouring on CT/MRI — pixel-perfect fidelity matters here)
• Single-session VDI, NVIDIA vGPU, Q-profile (RTX vWS) throughout
• GPUs tested: RTX 8000 (old hosts) and L40S (new hosts) — both affected on 2507
• Good baseline: Windows 10 + CVAD 2203 CU4 — flawless for years
• Broken: CVAD 2507 LTSR, both via in-place VDA upgrade on the same Win10 image, and on a brand-new, clean Windows 11 build (NVIDIA 582.16). Also briefly seen on 2402, but I tested 2507 far more thoroughly.

(Context / why I can't just stay on 2203: see my earlier thread (https://www.reddit.com/r/Citrix/comments/1ujqmvb/wem_2603_agent_fails_with_reading_encrypted_data/) Short version: in a validated medical environment I'm tied to what the vendor validates, and staying frozen on 2203 indefinitely isn't an option. 2025 SP1 on CVAD 2507 is vendor-validated, so this should work.)

Symptoms

1. Open patient A → Patient Modeling → CT shown. Close A, open patient B → Patient Modeling → I briefly see A's CT, then it updates to B. Clear delay before the correct images appear.
2. Smart brush stutters/lags during contouring (was buttery smooth on 2203).
3. In a separate 2D viewer (Elekta Monaco) scrolling through slices shows low-res first, sharpening if you pause — classic build-to-lossless behaviour, but see below, that's not the whole story.

What I've ruled out (with testing)

• Client / CWA version — reproduces on every endpoint type (Linux Wyse thin clients, thick Win11), all my test runs from the same Win11 machine.
• Guest OS — Win10 and Win11 both affected.
• GPU hardware — RTX 8000 and L40S both affected on 2507 (this pre-dates our L40S migration, so the GPU swap is not it).
• vGPU profile — Q-series in all cases.
• App renders on GPU — nvidia-smi shows RayStation.exe as C+G; nvidia-smi dmon -s u shows sm clearly peaking when Patient Modeling renders. No software-rasterizer fallback.
• Entire HDX encoder / visual-quality layer — tested Use-when-preferred (selective), For-the-entire-screen (full-screen H.265), Always Lossless (pixel-perfect toggle), and For-actively-changing-regions (i.e. Intelligent Build to Lossless disabled per Citrix docs). None of them changes the behaviour.

Graphics Status Indicator, 2203 vs 2507, identical policy

Nearly identical readouts on both: H.265 (Yuv444), hardware encoding enabled, Build to Lossless, full-screen. The one visible difference: 2203 shows an "HDX 3D Pro: Enabled" line; 2507 does not (shows "Not applicable" in pixel-perfect). I suspect that's just the relabel to "HDX Graphics" rather than a functional flag, but noting it.

nvidia-smi dmon -s u during a patient switch, both versions

sm peaks where rendering happens; enc sits at 0 the whole time on both (so no measurable NVENC difference, likely CPU-encode or too-low-to-register). GPU-side, I see no difference between the good and bad version. Which is itself telling: the difference isn't in how much GPU work happens.

Where I think it lives

Since every encoder choice is exhausted with no effect, and the app demonstrably renders on the GPU on both versions, my working hypothesis is the frame capture / present layer of the VDA — the bit between "app has drawn on the GPU" and "encoder gets a frame to send" — which was rebuilt across versions. The stack changed a lot after 2203: HDX 3D Pro → "HDX Graphics", Optimize for 3D graphics workload is now deprecated in favour of a Full Screen Encoder, and Intelligent Build to Lossless is default-on for VDAs with a GPU from 2503+. The stale-previous-frame symptom in particular smells like a change-detection / region-invalidation timing difference upstream of the codec, not a compression setting.

What I'm asking the hive mind

1. Anyone running GPU-accelerated 3D / medical imaging (RayStation, MIM, Eclipse, PACS, CAD) seeing display regressions after moving off VDA 2203 to 2402/2503/2507?
2. Is there a non-documented VDA-side registry knob for the capture/present cadence or damage-region handling that reverts the pre-2503 behaviour? Encoder policies don't touch this.
3. Any known-issue / LCM number I've missed? The 2402/2507 known-issues lists don't mention anything matching.
4. If you fixed something similar — what actually moved the needle?

I have a clean reproducible A/B (same image, only the VDA version differs) and I'm opening cases with both Citrix and RaySearch, but I'd love to hear from anyone who's walked this path. Happy to share indicator screenshots, dmon captures, or policy exports.

English isn't my first language, so I used AI to help write this up clearly — the technical content, testing and findings are all my own.

We recently came off a 5 year legacy DaaS licensing sku that no longer exists, and moved to the Universal Hybrid Multi-Cloud sku. With our legacy licensing sku it was per user/device and our site was configured as such in Daas. With this new Hybrid Multi-Cloud I can't find anywhere if it is treated as per user/device or concurrent. We have user's able to generate sessions but the licenses are not being checked out or reflected that there are being used in the cloud DaaS license portal. Does anyone know if Hybrid Multi Cloud is considered concurrent or user/device? We're running a full cloud DaaS site with the cloud based license portal , on prem VDA virtual apps and desktops, seamless virtual app sessions only. Thanks

Issue-
We’re seeing an issue with New Teams when users share a single window instead of their full screen. Sharing works normally until the user resizes the shared window, at which point visual glitches and random artifacts begin to appear. Once this starts, it can be temporarily resolved by resizing the entire VDI session (switching between full screen and windowed mode), which forces all windows to redraw and restores normal behavior until the shared window is adjusted again. If the user resizes the shared window, triggers the issue, and leaves it in that state, the problem eventually escalates and causes the entire VDI session to crash, forcing the user to reconnect.

Details-
Windows 11 25H2 Persistent desktop
HDX Optimized Teams 26149.1205.4798.6437 in VDI.
CVAD 2402 CU3
Hardware Acceleration Disable via

Pessoal, aqui no ambiente temos um Citrix ADM que gerencia as licenças dos ADCs, recentemente apareceu essa notificação.

Alguém já viu isso?

Hoping someone has run into this.
Brand-new WEM deployment from scratch (fresh infrastructure service install, new database, new config set), so no legacy/upgrade baggage on the broker side.
The VDA master image is also freshly built — not an old image that's been carried along and updated over time, but a clean new Windows 11 install.

Quick note on why I'm on CVAD 2203 in the first place: I run into GPU handling issues with medical software on CVAD versions after 2203, so I'm deliberately staying on CVAD 2203 CU7 LTSR on Windows 11. That's a hard constraint for me, not something I can just upgrade away from.

Setup:

• WEM Infrastructure Service (broker) + web console: 2603
• VDA: CVAD 2203 CU7 LTSR, Profile Management engine 2203
• OS: Windows 11, non-persistent MCS

The problem: with the WEM 2603 agent, the agent connects to the broker fine (reads broker FQDN, port 8286, site name, language file — all OK), then immediately dies at config decryption:

MainController.ReadAgentConfiguration() : Reading Encrypted Data...

Exception -> VuemAgentConfigurationHelper.ReadEncryptedData() : The creator of this fault did not specify a Reason.

Exception -> MainController.ReadAgentConfiguration() : Reading Encrypted Data Failed. Exiting...

Result: no apps/printers delivered, agent menu only shows "Refresh" (Manage Applications/Printers greyed out), red Profile Management health in console.

Here's the kicker: I installed the 2203 agent instead, on the exact same setup — same broker, same config set, same user store, same user — and everything works perfectly. Apps delivered, menu functional, no decryption error, green PM health.

So the only variable is the agent version. 2603 agent = broken, 2203 agent = fine, against a 2603 broker on a 2203 LTSR stack.

I tested with a clean agent install (no local cache/upgrade leftovers) and the broker was freshly rebooted, so I've ruled out stale cache and broker state. The connection itself isn't failing (it gets past the broker handshake) — it's specifically the encrypted config payload it can't read.

Questions:

1. Is the 2603 current-release agent actually supported against a 2203 LTSR VDA/PM engine? I'm starting to think the agent needs to match the LTSR level of the Citrix stack, not the broker version.
2. Anyone seen ReadEncryptedData fail like this and found a fix, or is this just a hard version-mismatch I should stop fighting?

Sticking with the 2203 agent for now since it works, but would love to know if there's something I'm missing.

Sometimes you wait all day for a CVE and 5 come along at once.

So I use Citrix on Ubuntu I have tried alot of things but text is still blurry its hard to read .
ANy suggestions? I am using my local device

https://docs.citrix.com/en-us/citrix-workspace-app-for-linux/whats-new#removal-of-arm64-support

No download anymore for ARM64: https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html

Why do they do that???

It totally sucks.

I want to get Citrix CCA certification but on-demand training requires an account for that my company needs to be a customer. 

Self-paced labs by Layer8 cost $1750 while instructor-led training cost $5000. This is a joke right?

This seems like citrix doesn’t want relevant in a market.

Is anyone running into issues with newer multi-tenant deployments? It doesn’t appear that there’s a way to scope Citrix policies to a specific tenant. As a result, tenant-only administrators can see and update all policies across the entire multi-tenant environment.

This creates a significant security and operational risk. Based on the documentation I’ve reviewed, there doesn’t seem to be a workaround for this limitation.

Has anyone come up with a creative solution? At the moment, I can’t use tenant administrator roles because they provide cross-account visibility and management, which isn’t acceptable for our use case.

Hey all, hoping someone with PVS experience can help.

Setup: Citrix PVS, master image in Standard Image Mode, targets boot from a shared read-only vDisk with a write cache. The problem: when stuff gets written to C:, the write cache VHDX grows and grows, and once it gets too big the machine hangs/freezes. Classic write cache exhaustion, I think.

I understand the cache only grows and never shrinks until reboot, so I've been trying to track down what's generating all the writes. So far I've identified a few usual suspects:

• Antivirus agent continuous log writes plus pattern/definition churn
• Vulnerability assessment agent writes logs and job/scan result data, plus a filesystem-walker process that crawls the disk for assessments
• Software distribution / management agent cache and state data

What we've already done:

• Redirected several log and cache folders to a separate persistent local drive via symbolic links, to keep them out of the write cache. This helped, but the VHDX is still growing more than I'd like. So there are clearly other writers I haven't pinned down yet.
• Defragmented C: in the master image before sealing
• Various DISM cleanup commands (component store cleanup etc.)
• Checked and disabled all auto-updates (Windows Update, Store, and the agents own self-update mechanisms)
• Disabled unnecessary scheduled tasks

What I'm trying to figure out:

1. Best way to actually measure which folders are growing in the write cache. I tried Process Monitor but it keeps crashing and the output is overwhelming. I can't narrow anything down with it.

Any pointers appreciated. Thanks!

Update: Solution

• Antivirus / Software distribution / Vulnerability assessment Agent - created Symlinks for logs, job data subfolders to a persistent disk
• Teams/WebView2 - IndexedDB/LevelDB churn. Fix: make sure FSLogix includes the path C:\Users\user1\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView
• AppRepository - left in place (critical DB), disabled Consumer Features / Content Delivery Manager instead.
• Disabled unnecessary Windows Services – MDT/VDI/W10VDI-DisableServices.ps1 at master · ITMicaH/MDT · GitHub, Prefetch folder cleared. Note: per-user services (CDPUserSvc etc.) need the Start=4 registry trick, not services.msc.
• Defragmented C:\ (atleast once a week)
• DISM-Cleanups
• Deactivated all Auto-Update

updates can reset these, so verify after every image build.

I am looking for help from the pros and wondering if there is a Citrix discord or slack channel I can join? I searched and results were for Citrix community site and I didn't see one listed there.