If you are having issues with some users having freeze issues and high response time in Citrix Director, this registry key might help you. It happens in conjunction with dedicated GPUs on notebooks. The key disabled GPU acceleration for Citrix Workspace App.

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\ICA Client\Graphics Engine] “HWacceleration”=dword:00000000

References:

https://support.citrix.com/s/article/CTX297140-screen-freezes-and-takes-a-few-seconds-to-return-to-normal-apps-also-flicker-when-open?language=en_US

Classic Authentication Schemes will soon be deprecated in Citrix Netscaler and should be replaced with nFactor AAA.

Here is a quick tutorial on how to configure nFactor Authentication.

Security > AAA Application Traffic > Policies > Authentication > Basic Policies > RADIUS

Select Servers > Add

Name RADIUS_Server

Server IP xxxx

Secret

Also test the radius reachability

Security > AAA Application Traffic > Policies > Authentication > Basic Policies > LDAP

Select Servers > Add

Fill in all the information that apply to your domain

Security > AAA – Application Traffic, Policies, Authentication, Advanced Policies > Policy. Then, click “Add”

Do the same thing for RADIUS

Create AAA virtual server

Configuration > Security > AAA – Application Traffic > Virtual Servers

Import private certificate and root cert

Click on “No Authentication Policy”

Select Policy LDAP_Pol

Click on Select next to “Next Factor”

Add an authentication policy label

Continue

Policy Binding > Select RADIUS_Pol

Goto Expression > Select END and BIND the authentication Policy Label

Done

BIND

Continue

Add a login schema on the right side

Select “No Login Schema”

Select Policy

Bind and Done

Add nFactor to the Gateway virtual server

Citrix Gateway > Virtual Servers > select VIP > Add Authentication Profile on the right

Create > Ok > Done

If you get this error after logging in, you have to enable SSO on the Authentication Template

Go to Security > AAA Application Traffic > Login Schema > lschema_dual_factor_builtin > … Edit

Edit the profile again

Click on the pencil

> More > Check Enable Single Sign On Credentials > OK > OK

References:

https://community.citrix.com/tech-zone/build/deployment-guides/gateway-mfa/#_=_

Roughly a year ago I had an issue with grey screen on Windows Server 2022 with Citrix Virtual Apps and Desktops. A script helped clear out some registry key but there seem to still be problems with sessions with grey screens. Check out my post from last year: https://www.ajni.it/2023/03/citrix-virtual-apps-and-desktops-2203-grey-screen-connectionfailure-in-eventviewer/

There is a new fix that seems to be better and does not clear any registry keys. Instead it activates Citrix Universal DLL Injection. After upgrading the VDA, make sure this value is set:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CtxUvi]
“UviEnabled”=dword:00000001

This helped in my environment.

References:

https://discussions.citrix.com/topic/412451-just-grey-screen-instead-of-published-desktop/page/7/?sortby=votes

In this article we are going to configure password change through Citrix Netscaler, which is very handy nowadays that a lot of people work from home and are rarely in the office. The steps are very simple but you should always think what the impact of the change could be before blindy following my screenshots.

First of all, you need a certificate on the Domain Controller(s). Since Microsoft does not allow plaintext password change through port 389, you need a certificate for the SSL Port 636. This can be achieved with an internal Certificate Authority. Check my article here: https://www.ajni.it/2020/08/active-directory-certificate-services-ad-cs-on-windows-server-2019/

There is a quick way with a self signed certificate, but I would recommend using a Certificate Authority.

New-SelfSignedCertificate -DnsName dc01, dc01.ajni.it, dc02, dc02.ajni.it -CertStoreLocation cert:\LocalMachine\My

You can also insert multiple Subject Alternative Names separated by comma, that might include two or more Domain Controllers like in the example above.

Testing can be done with lpd.exe, make sure that the newly generated certificate is also placed in the Trusted Root Certificate Authorities.

In Citrix Netscaler go to Citrix Gateway > Virtual Servers > Select the VIP > Primary Authentication > Select the LDAP Policy:

Edit Server

Select SSL under Security Type and Port 636

Further down, select Allow Password Change.

In Citrix Storefront, make sure Password Change is enabled:

The password reminder can also be enabled.

That’s it. Make sure your NetScaler Config is saved!

References:

https://c4rm0.wordpress.com/netscaler-allow-user-ad-password-changes/

https://anandthearchitect.com/2019/10/10/active-directory-self-signed-certificate-for-ldaps/

Having issues with users reconnecting a disconnected Citrix Virtual Apps and Desktops session? These keys might help you. Citrix support confirmed, that they help starting at Server 2016 VDA.

Fastreconnect is a feature that was introduced by Microsoft to enhance session reconnect through RDP, but through Citrix ICA it seems that is does not improve anything.

HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Reconnect
FastReconnect REG_DWORD 0

HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Ica\GroupPolicy
EnforceUserPolicyEvaluationSuccess REG_DWORD 0

References:

https://www.reddit.com/r/Citrix/comments/x6frfq/ltsr_2203_disconnected_sessions_are_lost_upon/