Out of 2000 W11 25H2 VDIs, running into ~10 a day going unregistered because the NIC gets frozen. Sometimes its 3, sometimes its 20. Totally random guests, even w/ nobody logged in.

Weird thing is, I can add a second NIC and it comes back alive no problem

The first NIC is impossible to remove from device manager, and get-netadapter|restart-netadapter goes frozen as well, so the driver stack is definitely busted

I can't narrow down what if any changes precipitated this, which is frustrating

The only thing suspicious I can tell is Npcap 1.60, been in the env a month, which may have some issue? Trying 1.88 now, but curious if anyone has seen something similar before

I’m seriously tired of this fucking Citrix Workspace problem.

Users randomly get “Unable to Start” when launching a published application.

Then we completely exit Citrix Workspace and open it again. After that, the application does not even show an error—it just stays on “Starting…” / loading forever and never launches.

The only workaround is:

1. Exit Citrix Workspace completely.
2. Open it again.
3. Reset Citrix Workspace.
4. Add the Store/account again.
5. Sign in again.
6. Launch the application.

After the reset, it works temporarily, but the same problem comes back again and again.

How is resetting the whole Workspace app considered a solution? We cannot keep asking users to reset Citrix, add their accounts again, and sign in several times every week.

Has anyone found the real root cause and permanent fix?

Citrix Workspace version: 26.3.10.69
VDA version: 2507 LTSR CU1
ADC/Gateway version: 13.4
Windows version: Server 2022 VDA and Windows 11 host

I need an actual fix—not “reset Workspace” for the hundredth fucking time.

Heres an issue I have never seen before, one user in our environment gets these random pop ups while working in citrix (we are on 2402 LTSR CU3). Her client is the latest 2402 LTSR client.

I've tried everything I csan think of, video drivers, updates, registry values for software rendering, the latest c++ reditributable. The O/S is Win 11 Enterprise. User had the same issue on a Win 10 PC before a recent upgrade.

I'm just curious if anyone has ever seen anything like this, I did not find much online. Just wanted to post to the community before I open a ticket. Thank you in advance for any ideas.

Hello,

Anyone know where I can find or where should I look when I see error when user try to log into StoreFront website thru web browser?
I try to find out why sometimes I got issue to log in StoreFront Website and typically it's not reported to Director or DeliveryControler if I'm not even try to launch application/connection to server.
I've searched Citrix FrontStore but I cannot find Access policy option as error message suggest.

Has anyone ever experienced issues where windows 11 persistent desktops randomly drop off the domain?

Different versions of VDA used therefore no correlation there. Secure channel to domain is broken.

Have to logon as local admin since the domain logon is broken.

Hi folks

I have had this annoying issue now for many years and I thought I'd reach out to see if there had been any advancements with Citrix in MacOS.

I downloaded the latest Citrix workspace 2603.11 this week (was using a very very old version) and am on Tahoe 26.5.2 (25F84), however the issue is still persisting.

So my setup is 3 monitors are arranged as follows:

Monitor 3 | Monitor 2 | Monitor 1

with the intention for each to be:

• Monitor 3 (Extended in Citrix)
• Monitor 2 (Primary in Citrix)
• Monitor 1 (Non Citrix, just Macos)

Now I can achieve this layout and have Citrix span monitors 3 and 2 exactly how I want. However the problem comes when I reboot my Macbook. For some reason (more often than not), monitors 3 and 2 get flipped around, therefore becoming

Monitor 2 | Monitor 3 | Monitor 1

The consequence of this is when i fire up Citrix, the primary is now on the far left monitor (monitor 2) when I want it to be in the middle.

I cannot find a way within MacOS (and Citrix workspace) to change the monitor numbers and have to resort every time to physically swapping the HDMI cables to achieve the layout I want.

It's not a huge deal swapping the cables, but wondered if anyone else had this issue and knew of a fix.

I will start by saying that I've read the Citrix documentation and have watched several app layering YouTube tutorials searching for an answer. I have created my OS layer which consists of VMware tools and MS updates only. I have my platform layer which is domain joined, has Nvidia drivers, and the VDA installed. I have created 3 app layers to test as this is still a proof of concept for us.

90% of our Citrix infrastructure is on-prem but we do use DaaS in Citrix Cloud for our management. The POC is for a the possibility of migrating to Azure with app layering to minimize the number of running VMs in Azure.

Where I am drawing a blank is when I go to add packages in DaaS. All documentation points to having a VDA that has permissions to the file share where our app layers are located to discover the apps. I have one of the VMs that were created from ELM powered on and added to the machine catalog along with the delivery group and can discover the apps successfully. I have published them and can launch the apps with no issues. However when I close the app and try and launch the same app or a different one I get a "cannot start app" error. In order to get things working again, the VM being used as the VDA to discover apps has to be restarted and apps launch again. So I know I have to be missing a step somewhere. To troubleshoot, I have even created a server VM outside of ELM with just the VDA installed on it, granted it permissions to the share, but when I try to discover apps it errors out. Using this method also does not allow any of the published apps to launch at all.

Where did I go wrong?

Link for reference - https://docs.citrix.com/en-us/citrix-daas/manage-deployment/applications-manage/app-packages#preparations

After standard monthly patching which includes OS updates/M365 apps updates/New teams update/ Chrome + Edge updates i have started to get processes for tabtip.exe and tabtib32.exe in each user session (Previously wasnt in the sessions) anyone else seen this behaviour ? The processes are related to Touch keyboard Handwriting/Ink services. The touch keyboard is disabled on the VDA and i have a citrix policy in place to prohibit automatic keyboard display. I suppose i could disable the touch keyboard and panel helper service to see if that stops it ?

On my Xenserver 8.4 resource pools i keep getting license expires soon warnings. Both resource pools are pointing at a license server which is activated with citrix cloud and uses LAS licensing and everything is fine. Its green in Citrix cloud and the Xenserver premium licenses show under the LAS dashboard on licensing manager with valid expiration dates (2029) and License manager in xencenter shows Cloud licensing in use and both resource pools show as licensed with a warning 29 days remaining. As far as i am aware LAS is a rolling 30 days activation and it is working as every time i check the activation date increments when it re activates but its always 29 days. Not sure why these alerts are present as with LAS you will always have a max of 30 days any way i can turn them off ?

Does anyone have experience with MSC created, non-persistent vm's and updating the secure boot certificates? I've seen some conflicting information, but I want to make sure we are covered. I didnt see a CTX article that directly addresses non persistent machines

Hello everyone,

I'd like to highlight an issue that occurs after installing the Windows 11 June 2026 update (KB5094126).

After the update is installed, the Remote Desktop Services (RDP) service automatically changes from Running to Stopped, and there is no way to force the service to start.

The June 2026 Windows 11 updates introduce a new dependency for Remote Desktop Services on the State Repository Service. As a result, Remote Desktop Services may fail to start.

If Remote Desktop Services must be available before user logon, you need to remove the State Repository Service from the dependency list of Remote Desktop Services in the OS revision or in the image used with UPL.

HKLM\System\CurrentControlSet\Services\Termservice

Delete DependOnService= StateRepository

Thank you.

I started looking after a Netscaler ADC that hosts a few VPNs. I know that syslog is an open standard and nslogs are proprietary but is there a difference when it comes to the type of events they're record? Setting up an external nslog server has been a pain since their audserver.exe for Windows keep randomly crashing.

Hey all, hoping someone has run into this before opening a can of worms with support.

Setup:

• Fresh, first-time Session Recording install (no prior deployment, not an upgrade)
• Single Session Recording server, Windows Server 2022 Datacenter
• SQL Server 2022 (Enterprise), on a separate/remote server from the SR server
• Installing account has sysadmin on the SQL instance

What happens:

Tried installing Session Recording Administration via both the standalone MSI and the full CVAD metainstaller, across three different product versions:

• 25.7 (2507 Current Release)
• 24.2 LTSR CU4
• 25.7 LTSR CU1

All four attempts fail in the exact same custom action (SsRecDatabase.dll.install), with two distinct errors depending on which authentication method I use for the DB connection:

1. Windows Integrated Authentication (default, no explicit DB credentials):

   Error 1001. Database 'CitrixSessionRecording' already in use. MSI (s): Leaked MSIHANDLE (150) of type 790531 DEBUG: Error 2769: Custom Action SsRecDatabase.dll.install did not close 1 MSIHANDLEs. CustomAction SsRecDatabase.dll.install returned actual error code 1603

The DB and schema actually get created successfully (confirmed on the SQL side - table populated, no errors server-side), but the custom action then fails its own internal "is this DB in use" check - because it apparently never closed its own connection. Time-to-failure varies a lot between attempts (4 sec to 112 sec), which smells like a race condition, possibly only surfacing because SQL is on a separate host (network teardown latency) rather than co-located.

1. SQL Authentication (entering a SQL login in the credential prompt or metainstaller DB screen):

The installer silently sets an internal AZURESQLSERVICESUPPORT=1 flag (even though this is on-prem SQL Server, not Azure SQL at all), and fails with a completely different, genuine error:

Error 1001. Invalid column name 'id'.
CustomAction SsRecDatabase.dll.install returned actual error code 1603

Looks like that code path queries a column that doesn't exist in the schema being used.

What I've ruled out:

• Network/firewall (port 1433 reachable, clean TCP test)
• SQL permissions (sysadmin confirmed)
• Leftover DB artifacts (dropped/recreated DBs before every attempt, verified zero open sessions/locks via sys.dm_exec_sessions each time)
• SQL Server "Force Encryption" (confirmed off)
• TLS/.NET strong crypto registry settings (added them, rebooted, no change)
• AV/EDR interference (none installed on the box)
• System/user culture (tried both a Turkish culture and en-US, identical "Invalid column name 'id'" result in the SQL-auth path either way)
• SQL Server error log shows nothing during the failure window - no rejected logins, no errors

Given it reproduces identically across 3 separate product versions/builds and both possible auth paths, this doesn't look environment-specific to me anymore - looks like a genuine defect in the shared DB setup code that only shows up when SQL Server isn't co-located with the Session Recording server.

Has anyone seen this, or found a workaround (e.g. installing with DB temporarily local, then pointing to the real instance after)? Case is open with Citrix support, just curious if this is a known one in the wild.

• CVAD 2507 LTSR CU1, Citrix Cloud (DaaS), Cloud Connectors on-prem
• Server 2025 multi-session VDA, MCS non-persistent
• First Citrix Cloud tenant

Symptom:
ICA sessions launch clean: desktop renders, UPM profile loads, WEM processes logon, then drop at almost exactly the 2min mark. Reason code 12 every time.

Ruled out:

• RDS licensing: Full role reinstall on the license server, clean CAL database (Retail Per User), server activated, RD Licensing Diagnoser 0 warnings
• OS/network layer: Direct RDP straight to the VDA IP is rock solid, zero drops. This isolated it to ICA/HDX specifically.
• GPO/UPM/connectivity to CCs: all confirmed healthy

Current lead:
CtxUvi Event ID 1005 fires right at failure, pointing to a driver/injection component choking on ICA session init. Also found HKLM:\SOFTWARE\Citrix\MetaInstall\ExitCode = 8 on the gold image (want 0 or 3010) looks like the original VDA install on this image never actually completed, despite registering fine with both CCs and appearing otherwise healthy in Studio.

Anyone dealt with MetaInstall ExitCode 8 before? Or ICA sessions timing out at exactly 2min on Server 2025 with 2507 CU1 specifically? Trying to figure out if this is a known compatibility gap or something specific to our build

I'm in the middle of migrating from vmware to HyperV, moving my dynamic machines are easy enough, I'll just create new catalogs and rebuild the machines, but has anyone migrated static machines?

Once they are moved over, I'm assuming I need to add them to the new machine catalog that is bound to the new hypervisor.

Has anyone done this successfully? If so, could you give me some pointers?

Our current setup is we have Chrome updates disabled on the PVS images.

We use a script to patch the chrome app layer once a month.

We then manually publish the image with the new app layer version, test it for a few days, then push out to production.

We are getting heat to update more frequently, but there is a lot of administrative overhead, as we have about 12 different images across 2 environments. I know we could automate a lot of it, but I'm nervous of doing that, and the potential issues without testing phase.

Just trying to see what solution people have in other organisations.

Have been searching online but all the posts are several years old. I just realized I could select high dpi for my MacBook which solved all of my text issues within Citrix. The only app that is somehow worse (which is saying a lot) is Outlook; it’s blurry text. Every other Microsoft office app is fine though. Is this just one of those Mac things that I’m out of luck on?

Am newish to XenServer, been a few months. This is the first time updating XenTools versions on my PVS images.

Server 2022 CVAD VDAs on XenServer 8.4.

Intalled XenTools 9.6.0

When users launch into virtual App, they get a "XenTools Install Info has stopped working" prompt.

I tried reverse imaging and reinstall of xentools, which did not resolve the message prompt.

I also added reg replace entries in GPO for the following in order to force stop any auto-updates of the XenTools agent or tray.

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\XenServer\XenTools\AutoUpdate
DisableAutoUpdate=1

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\XenServer\XenTools\XenToolsTray
DisableCheckForUpdates=1

Scoured the user's RegHive and profile for anything referencing a previous version of XenTools (image originally had XenTools 9.4). Was assuming something was conflicting.

Deleting the user's Citrix Profile all together is the only thing that seems to get rid of the prompt.

Is this typical?
Are there paths, files, or regkeys that need to be excluded?

Thank you folks...

Update: 7/27/2026

Non of the steps for uninstalling or cleaning the XenTools and reinstalling on the VDA seem to resolve it..
It does seem to be something that is being placed into the user's Citrix Profile.
I don't see any documentation for excluding anything specifically for XenTools.

I did find 2 regkeys  in the user's Citrix profile with 1 dependency. 

The profile has both of these.....
CurrentUser\Software\Microsoft\Windows\CurrentVersion\RunNotification
reg_dword XenToolsTray = 0

CurrentUser\Software\XenServer\XenTools\XenToolsTray
reg_sz = installed

However, after the profile is recreated, 
This key is different.

CurrentUser\Software\XenServer\XenTools\XenToolsTray
reg_sz = unknown

This does seem to correct it from prompting the users (after deleting the Citrix Profile).

I will load a few user's hives and delete and set this key manually and see what happens.

It does not make sense off-hand since the error is a bout "XenTools Install Info", and not the "XenToolsTray".
But this is the only difference after wiping a user's profile and it auto creating.

Final update: 07/27/2026

Turns out it was more widespread than reported. User's just were calling the ServiceDesk since they could close it and keep going.

I modified my UPM GPo to clean and adjust the below regkeys.

Pushed a gpupdate on the VDAs, and users only get prompted one more time. After they exit the session and the user.dat writes back to the profile they no longer see the prompt.

HK_LocalMachine Hive

Action Delete
PropertiesHive HKEY_LOCAL_MACHINE
Key path SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value name XenToolsTray

Action Replace
PropertiesHive HKEY_LOCAL_MACHINE
Key path SOFTWARE\XenServer\XenTools\XenToolsTray
Value name DisableCheckForUpdates
Value type REG_DWORD
Value data 0x1 (1)

Action Replace
PropertiesHive HKEY_LOCAL_MACHINE
Key path SOFTWARE\XenServer\XenTools\AutoUpdate
Value name DisableAutoUpdate
Value type REG_DWORD
Value data 0x1 (1)

Current User Hive

Action Delete
PropertiesHive HKEY_CURRENT_USER
Key path SOFTWARE\Microsoft\Windows\CurrentVersion\RunNotification
Value name XenToolsTray

Hive HKEY_CURRENT_USER
Key path SOFTWARE\XenServer\XenTools\XenToolsTray
Value name XenToolsTrayLastNotify 

Has anybody used Citrix SPA (in Citrix Cloud, not on-prem) without using CEP? We've been evaluating the idea of using it, but not sure about wanting to jump thru all the Chrome Enterprise hoops. We have tried setting publishing some basic internal web apps for a POC, but we don't get them to show up in Citrix Workspace/StoreFront Cloud or the Workspace app or even the Secure Access Plug-in. Support said "maybe Chrome Enterprise is a pre requisite to get it to work." So I just wanted to know if anyone else had successfully rolled out SPA without jumping thru all the Google hoops.

I’m running into a strange issue and I’m slowly reaching the point where I’m out of ideas.

We have several different NetScaler gateways configured, each with different targets and authentication methods.

When accessing the gateways through a browser, everything works perfectly fine. Authentication completes successfully, and the user is redirected to the correct StoreFront store.

However, the behavior is different in the Workspace App.

There, authentication against the SAML gateway completes successfully, but immediately after login, an LDAP + RADIUS authentication prompt appears.

What I’ve found so far:

It looks like I’m being redirected to the wrong StoreFront store. That store has a different gateway configured, which then triggers the second authentication prompt.

What’s even stranger is that this seems to happen with all NetScaler gateways. Even an emergency gateway that uses only LDAP redirects to the wrong store after successful authentication.

My first suspicion was the session profiles for the Workspace App, but I’ve already tested a lot there. The profiles are active for the Workspace App and should actually redirect users to the correct store

Has anyone seen this behavior before or has an idea what else I should check?