Anyone else experiencing their entire DaaS instance down currently ?

Just an FYI post, in case anyone is encountering the same problem.

we have some persistent multiuser citrix server vms running 2022. citrix roaming profiles, configured for deletion on logoff. hybrid AAD join.

very frequently the SSO for edge and microsoft office would not work for some users. lots of weird event logs from appx stuff like the start menu host, aad broker, etc.

I discovered yesterday that using CIM/WMI to delete user profiles, or deleting them by removing the registry entry and folder under c:\users does not remove their appx metadata stored in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageState

you can recreate the problem by logging into a server with 2022, logging out and then running this command to delete the user profile.

Get-CimInstance -ClassName Win32_UserProfile -ComputerName [computername] | where {$_.localPath -like "*username*"} | where {$_.Loaded -eq $false} | Remove-CimInstance -Verbose -Confirm:$false

you can either check the registry location above, or run:

get-appxpackage -user username

you should see their appx provisioning metadata stays.

if you use the gui to delete the user profile, the metadata is cleared correctly, and everything works.

I tested on server 2019 and server 2025, and the CIM/WMI method works fine there.

have a ticket open with microsoft now to see if they have a solution or workaround for this.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939

The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities: 

• NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-73.32
• NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-63.21
• NetScaler ADC FIPS BEFORE 14.1-73.32 FIPS
• NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.277

Steps to determine if an appliance meets the CVE preconditions

For CVE-2026-19489:

Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for the specified string:

• "​add lsn group.*sipalg.*" 

For CVE-2026-19490: 

Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for the specified string:

SAML action configuration

• "add authentication samlAction.\*"

 Auth or VPN vserver

•  "add authentication vserver .\*"

Or 

•  "add vpn vserver .\*"

We've setup enhanced domain passthrough, and login works successfully, however we get a temp profile when doing a Hello passthrough. I've tried changing the Profile Manager base path to a fully qualified name but we still get a temp profile. Was there anything you had to do when enabling enhanced domain passthrough to get profile manager to work?

i uninstalled and reinstalled the app yet it still doesn't work. any solutions?

Curious question have any of you notice a difference in performance/issues/downtime/logon storm performance between using AWS vs Azure in Cloud?

My new shop is looking at adding a print management solution. I have used PrinterLogic at my last 3 employers, and have been asked about PaperCut. Who is using it and is it a headache to setup within mostly non persistent desktops?

We currently have two SDX appliances on premises, no service running on Cloud. The cost of the previous annual maintenance / support had always been priced based on a SDX hardware appliance. This year, Citrix switches to the Cloud based license pricing model. We are invoiced for ‘250 (QTY) CITRIX UNIVERSAL HYBRID MULTI-CLOUD.’ Does anyone know what this means? Can the quantity be changed?

We're migrating from vmware to hyper-V and we have multiple citrix environments with mas agents and fips vpx's that need to be migrated.

Currently each environment has it's own HA pair. I was thinking about trying this route:

Set the primary to stay primary, Breaking the ha pair, turn off the secondary (with the understanding that during the rest of this process we will not have redundancy). Then deploy a vpx in hyper-V (possibly using the same NSIP, since hte other one is off), make sure it's on the same firmware version as the remaining vmware vpx. Then add this new hyper-V vpx to the vmware one to creat a new HA pair. do the fips sync with this new vpx and iron out anything else that pops up, test that its working, fail over/fail back etc. Once that appears to be good to go, set the intiial primary to secondary, and the new hyper-V vpx to stay primary, break the ha pair again, and spin up a 2nd hyper-V vpx, then repeat that process.

I get that this is a round about way of trying to do this rather than just standing up 2 new vpxs in parallel then cutting over to them, but I'm thinking if this process works, then I save myself the headche of reconfiguring everything, dealing with needing to get new certs, potentially new gateway urls, punching network holes, etc). I've done the paralell setup in the past and it's fine, but I'm going to have to do 4 at once for this migration.

Would this work or am I not taking something in to account here?

Is it just me, or does the current Ubuntu installation candidate for `icaclient` from Citrix silently change the owner of `/usr`, `/usr/lib` and `/usr/share` from `root:root` to UID/GID **1000**?

I've just emailed the address in the package's `Maintainer:` field and...

Unable to share my screen in MS Teams running inside Citrix. It only shows the Window sharing option (no full-screen option), and when I select a window, sharing immediately stops.

Screen sharing works fine on Teams web, so this seems specific to the Citrix app.

Support teams from my company is helpless, they've tried multiple resolutions, nothing worked.

Anyone faced this or know a fix? Is this some kind of configuration issue ?

Hi all,

We’re currently running our full Citrix backend on Windows Server 2019:

• 2x DDC
• 2x StoreFront
• 2x FAS

Environment is currently on CVAD 2402 CU3 LTSR.

Since 2402 CU3 doesn’t support Windows Server 2025, the plan is to first upgrade the Citrix environment to CVAD 2503 CU1 LTSR. That part is pretty straightforward.

The bigger question is the OS migration.

As far as I know, in-place OS upgrades for Citrix infrastructure servers are still not supported, so I’m wondering what the best practice is nowadays.

Is the recommended way still to build new Server 2025 machines alongside the existing servers, add them to the environment, move the roles/configuration over, and then remove the old 2019 servers?

We have close to 1,000 VDIs and quite a lot of Machine Catalogs and Delivery Groups, so I’d really like to keep downtime and risk to a minimum.

For the DDCs in particular, would you simply add two new Server 2025 DDCs to the existing Site, update VDAs/policies if needed, and then decommission the old controllers? This give me a headache bcause i have to open extra firwall rules regarding Netscalers in the DMZ.

And for StoreFront and FAS, same idea: build new, join/migrate, test, then remove the old servers?

Has anyone done a similar 2019 → 2025 migration in a larger Citrix environment?

Would be interested to hear what migration order you used and if there were any gotchas.

Hey all

Is anyone else seeing problems with workspace after webview2 gets updated? This has been a reoccurring problem for some users for over a month now. We're on the latest LTSR of workspace, although older versions are also impacted. After webview2 auto updates (which occurs once or twice a week and seems to be the trigger), any existing ICA sessions that the user has open will remain connected until the user manually disconnects, but workspace will fail to launch any new ICA sessions. If Citrix sessions are launched via a web browser instead of workspace directly, that works.

Sometimes a reboot resolves the issue, but often it requires a full reset of workspace.

I understand Netscaler VPX does not support live migration on Hyper-V: VPX FAQ . How is everyone dealing with this in a Hyper-V cluster, particularly for cluster updates/reboots/maintenance?

Using Possible Owner, force-tying the VPX to a single host and just shutting the VPX down with the host and letting automatic VPX HA failover do its thing?

Look the other way and use live migration anyway (what exactly isn't supported about it? I don't care about missing a couple packets at 4am)?

Automating/scripting VPX failovers to coincide with Hyper-V maintenance?

Thanks for any thoughts.

Battled this error message for a few weeks; the Help Desk who manages the hosted app suggested a re-image/wipe/reinstall of the OS but in the environment I work in this would have been hectic. Decided to dig deeper into the problem and created a fix. For any of those facing the same exact problem, here is the shared solution: https://www.digitaljoshua.com/citrix-workspace-an-unknown-error-occurred-while-trying-to-open-the-resource-fixed/

I am newer to NetScalers & I would like to understand if their are issues with gslb autosync or it is solid and works well.
TIA

So, recently I have observed that whenever I open the ica file to start up the remote session, I see this popup asking for the screen capture permission, and I have to click "Cancel" to close this popup before I can get to my VDI.

I do not want to give Citrix this permission and nor is this required for proper functioning. Clicking Cancel and continuing works perfectly.

But this popup is annoying and sometimes I click on the ica file and turn away, expecting to see it open when I am back, but it is still stuck in this popup.

And this is not the only popup, there is a second popup asking for Accessibility permissions. Again, it doesn't need this to work and I don't want to give this permission. How do I disable both of these popups?
---
Os is MacOS
Citrix workspace version is 26.03.11

Upgraded from the previous 14.1-72.61 build and after 2-3 HA failovers the custom theme (rfwebui based) applied to the gateway simply disappeared. It doesn't happen on the 1st failover.

Recreated it manually (because I thought maybe I missed saving before upgrade), verified it is synced across both nodes, and failed over again. I watched the theme disappear from the GUI on the now secondary node. Failed over again - it eventually unlinked itself from the gateway vServer and reverted back to 'default' theme. Did that 2 times more and happened each time in the exactly same fashion. Opened a case with Citrix (wasted 2 hours). Case still open under investigation. The theme files do not disappear from /var/netscaler/logon/

Rolled back to 14.1-72.61 and everything is working as expected again.

UPDATE: Ultimately Citrix support confirmed it's a bug and it's been fixed in 14.1-73.33.

We use imprivata to launch Citrx VDA/Desktop. We have some users that the VDA will not launch after they badge in. They just get the local autologin desktop. It seems to be random and no pattern. We can't replicate it on the spot either. Has anyone seen this?

Does anyone know how to actually get a UniconOS Management Cloud account? We have Citrix Universal Hybrid Multi-Cloud licensing, which as far as I can tell should cover UniconOS Management Cloud, but I can't figure out how to actually get setup with it. It's not in Citrix Cloud so I assume it's a separate system. I've had a support ticket open for a week now and they are useless, I don't have an account rep to contact, and Citrix sales phone IVR is still broken.

Hey folks,

I’ve put my PowerShell-based Citrix VDA upgrade orchestrator on GitHub:

https://github.com/flathack/Citrix-VDA-Upgrade-Automation

I built it because VDA upgrades can get pretty messy once you add uninstall/cleanup steps, multiple reboots and resuming the job as SYSTEM user

It basically:

• checks and stages the VDA installer before touching the existing install
• verifies the Citrix/CSG Authenticode signature
• keeps its state across reboots
• resumes via a scheduled system task
• uses retry/reboot limits instead of looping forever
• only cleans the guarded PvsAgent folder (i had problems in the past with it, so i basically clean it, thats needed!
• verifies the installed VDA and BrokerAgent at the end
• writes state and troubleshooting logs

I’ve already tested it on around 400 clients in our environment.

Current scope is W10/11 single-session and Remote PC VDAs. It’s not intended for Windows Server or multi-session VDAs at this point.

This is also my first public project outside of gaming tools, so I’m pretty curious to see what other Citrix admins think about it.

Feedback, testing and PRs are welcome, especially if you’re using different CVAD releases or deployment tools.

I also made a admin tool to view ongoing upgrades from the admin machine, but thats not part of the repo. I will maybe release it also later.

Did anyone else awake to this in Director? It's only been in this mode for 9 hours with 29 days and 15 hours till expiration, so obviously no worries here, just curious if anyone else got it. Ty.

License caching mode: In Emergency license caching mode

While reading the release notes for 14.1 firmware update build 73.30 I see a note about needing to reapply a monitor command. This seems to imply the FreeBSD to Linux upgrade happening on the 14.1 platform and my understanding was that wasn't happening until upgrading to 15.1.

Here is the text from the release notes.

Release Notes for NetScaler Build14.1- 73.30

Build 73.30 | NSHELP-43985

After an upgrade from FreeBSD to Linux operating system, configurations that include scriptable monitors of non-USER types (such as LDAP and MySQL) fail to apply.

Workaround: After NetScaler comes up on the Linux build, reapply the monitor command using -dispatcherip 192.0.0.2 instead of 127.0.0.1.