How to check whether a workspace client is Windows/Linux/Mac based on it’s version number

The following OData Director report can be used to achieve this objective.

In Director: Configure the following custom query:

Note: It’s the ClientPlatform we are interested in as this will tell what endpoint the user is using.

Connections?$filter = LogOnStartDate ge datetime’2020-04-15′ and LogOnStartDate le datetime’2020-05-15’&$select=ClientName,ClientAddress,ClientPlatform,ClientVersion,Session/User/UserName,Session/LogOnDuration,Session/Machine/Name,Session/Machine/Id,&$expand = Session/User,Session/Machine


  • No Related Posts

Error: “The Network Connection to your Application was Interrupted” on ICA Client

RD Licensing formerly Terminal Services Licensing (TS Licensing), manages the Remote Desktop Services client access licenses (RDS CALs) that are required for each device or user to connect to a Remote Desktop Session Host (RD Session Host) server

Broker Database would have a new table for maintaining RDS CAL as a key/value pair. On a non-Windows client connection to a TS VDA, if a license is checked out, ICA populates the registry entries. Behaviour on following session events is described below:

  • On Logon or Reconnect:

HKLMSoftwareCitrixMSLicensigReplicateCache registry key and corresponding nodes under HKLMSoftwareCitrixMSLicensig registry key to check if any of the licenses has same index as RdsCalId.

  • On session audit event:

HKLMSoftwareCitrixMSLicensigReplicateCache registry key and corresponding nodes under HKLMSoftwareCitrixMSLicensing registry key. For each node under HKLMSoftwareCitrixMSLicensigReplicateCache registry key, Stack Control would read license information from corresponding node under HKLMSoftwareCitrixMSLicensing, create a blob of byte array and write license information to the blob.

  • On Validate event:

Create node and write license information to node under HKLMSoftwareCitrixMSLicensing


  • No Related Posts

Published Application Launch Hangs at “Connection established. Negotiating capabilities”

During session launch Citrix Profile Management Service identifies if the user should be processed and also determines the path where the User Profile is stored.

If the Policy contains any variables in the User Store profile path, these will be completed at run time. During the logon process a delay occurs for hostname resolution of the profile share during the lookup phase for the user profile path.


  • No Related Posts

Error Message: Cannot Start Desktop “[DesktopName]” When Trying to Launch a Desktop VDA

Open an RDP connection to the Desktop VDA that cannot be launched and check if there is another existing connected/disconnected session in the Task manager. If that is the case then logoff the session and try to launch the published Desktop again.

Note: If the session cannot be logged of from the Task Manager, that probably is because it is an administrator account. Administrator accounts cannot be logged off from the Task Manager. In that case try to contact the person who owns the administrator account and request to logoff. Otherwise, proceed to reboot the host. Then try to launch the published Desktop again.


  • No Related Posts

ICA Sessions get stuck at Prelogon with blank Current User or Associated User name in Citrix Studio and Director

Incorrect Remote Desktop Services Licensing Mode was specified on the VDA machines. Customer had purchased Per User RDS CALS but had specified Per Device Licensing mode on the VDA servers.

While investigating why the sessions that were stuck at “LogonInProgress” we found the below Licensing events being logged on the effected VDAs.

Log Name: System

Source: Microsoft-Windows-TerminalServices-RemoteConnectionManager

Date: 11/16/2016 11:37:13 PM

Event ID: 1011

Task Category: None

Level: Warning

Keywords: Classic

User: N/A

Computer: xxxxxx


The remote session could not be established from remote desktop client xxxxx because its temporary license has expired.

Log Name: System

Source: Microsoft-Windows-TerminalServices-RemoteConnectionManager

Date: 1/5/2017 8:40:45 AM

Event ID: 1028

Task Category: None

Level: Warning

Keywords: Classic

User: N/A

Computer: xxxx


The remote session could not be established from remote desktop client xxxxx because its license could not be renewed.

You can look for other RDS Licensing errors or warnings as well. Please note that sessions get stuck at prelogon state because of various reasons. RDS Licensing issue is just one of them.

Data to be collected in such scenarios:

1.Scout Logs from effected Xendesktop and DDC’s.

2. CDF logs from effected Xendesktop and DDC’s

Screenshot of Studio and Director showing the session without any associated username and the client machine name.

4. Output of below commands from Delivery Controller.


Get-BrokerSession -DesktopGroupName GROUP_NAME –LogonInProgress $true

Get-BrokerSession -DesktopGroupName GROUP_NAME


  • No Related Posts

Error: “A Device Attached to the System is Not Functioning” While Reconnecting To Previous Session

Solution 1


Csrss.exe has a deadlock with Microsoft Excel or Microsoft Visio

Solution 2


The issue occurs because of a problem in the Win32k.sys driver.

If a remote desktop session exits before the session is completely initialized, the state change notification of the session is not sent to the third-party driver. In this situation, the driver can leak resources, such as a system thread, in the context of Csrss.exe because the third-party driver cannot unload. The leaked thread causes the remote desktop session not to exit completely. After the computer is running in this status for some time, the Local Session Manager (Lsm.exe) blocks new incoming connections. Additionally, these orphaned sessions also cause the shutdown process to stop responding. Therefore, you experience the issue that is described in the “Symptoms” section.,-and-you-cannot-establish-new-remote-desktop-sessions-to-a-computer-that-is-running-windows-server-2008-r2

Solution 3

Solution 4

Configure session idle and disconnect policy in studio or MS policy for the VDI. That is logoff the session after disconnect for sometime


  • No Related Posts

Session has been idle over its time limit – Message Pop-up

From Microsoft:

“This behavior occurs if a policy setting enforces a time limit for idle Remote Desktop sessions. If an active session has not received user input for the time that is specified in the policy setting, the session disconnects. Pressing a key closes the warning message that you receive two minutes before you are disconnected. However, this action does not reset the idle timer. To reset the idle timer and keep the session active, you must provide user input other than the keystroke that closes the warning message.”


  • No Related Posts

Graceful Logoff from a Published Application Renders the Session in Active State

When publishing an application, only the main executable file is specified. However, some applications might spawn additional processes that run in the background and are not closed by the corresponding main executable file. Additional processes might also be created, from scripts that are executed, or from specific registry keys, such as the RunOnceKey:


Some processes might create a visible window for added functionality, and others might not.

Because the Explorer.exe Desktop is not running when launching an application in one of these ways, there is no default mechanism in either Presentation Server or Windows to terminate these background processes when a user has exited the main application.

Presentation Server has a hard coded list of what are considered ‘System’ type secondary processes that are checked for and terminated once all user application processes have terminated, these include:

  • atok1*.exe

  • clipsrv.exe

  • conime.exe

  • csrss.exe

  • ctfmon.exe

  • ddhelp.exe

  • eventlog.exe

  • iatokik*.exe

  • iatokqb*.exe

  • iatqb1*.exe

  • ibdbsch.exe

  • imejp98m.exe

  • imejpmgr.exe

  • imepadsv.exe

  • jsvschvw.exe

  • lmsvcs.exe

  • lsass.exe

  • msgsvc.exe

  • nddeagent.exe

  • nddeagnt.exe

  • netdde.exe

  • netstrs.exe

  • os2srv.exe

  • proquota.exe

  • screg.exe

  • smss.exe

  • spoolss.exe

  • ssonsvr.exe

  • wfshell.exe


  • winlogon.exe

  • wpabaln.exe

  • wuauclt.exe

Note: To specify additional processes specific to your environment, see the Solution section of this article.

Examples of Secondary Processes

CTX123073 ‑ ICA Session Remains Active for Five Minutes when Streaming to Server with the Version 5.2 Offline Plug-in

Cwbprovd.exe is a process initiated by IBM Client Access. If you have IBM Client Access on your system and observe the same behavior as stated above, complete the following tasks:

  1. Verify the sessionID, which is experiencing this issue.

  2. Before logoff, type the following command from the command prompt to manually kill Cwbprovd.exe:

    kill cwbprovd.exe session id

  3. Gracefully exit the published application.

    The Cwbprovd.exe process (among two other processes) is being launched at logon by IBM Client Access (even if you do not run it) through the following registry key:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit

    Contact IBM for a utility called CWBCFWTS to remove these processes from the registry.

    Note: Servers running IBM’s Client Access Express ARE NOT known to exhibit this behavior.

Proquota.exe is a process initiated by having a Windows 2000 policy, Limit Profile Size, enabled. This might conflict with the Seamgr.exe process. Manually terminating either of these two processes temporarily fixes the problem and allows the session to reset. This issue is resolved by installing Service Pack 2 for MetaFrame 1.8 for Windows 2000.

Sxplog32.exe is a process initiated by the Software Delivery Agent by Computer Associates and can be found in the userinit value of the winlogon registry key. Manually terminating the process temporarily fixes the problem and allows the session to reset.

Etlits.exe and Entell50.exe are processes initiated by Entrust 6.1 and can be found in the userinit value of the winlogon registry key. Manually terminating the process temporarily fixes the problem and allows the session to reset.

Wisptis.exe is a process that runs as a system service that provides pen-data collection for other components of the SDK. When a component needs to interact with the pen (for example, to collect ink or to detect gestures), this executable is spawned as a service to communicate directly with the input device. On a Tablet PC, Wisptis.exe interacts with the digitizer, whereas on a desktop it interacts with the mouse as well. The executable’s name is an acronym that references an outdated internal name for the team that developed it (Windows Ink Services Platform Tablet Input Subsystem). You cannot remove wisptis.exe by renaming or deleting it: Windows File Protection would reinstall the file the next time Adobe Acrobat 6.0 started. In general, the ways in which wisptis.exe can get installed on the system are by installing Journal Viewer using the Windows Update or installing Microsoft Office 2003.


If a starting program was specified under the Environment tab in the User Account Properties and if the ICA pass-through Client had pass through authentication enabled, Ssonsvr.exe was running in the ICA session of the user. When the user exited the application (specified in the Environment tab in User Account Properties), the ICA session could not be logged off; the administrator had to manually stop the Ssonsvr.exe process. The thread that caused the Ssonsvr.exe process to exit when the user logged off from the application was not being started.

Now the thread that causes the Ssonsvr.exe process to exit is started when the user logs off from the application.

From Hotfix XE103W2K030:



Xenapp 7.15 Getting multiple sessions on studio for single user

Prior to installing the 7.15 VDA session sharing was enabled, ie, one user launching multiple apps would have all applications running on the same server. After installing the 7.15 VDA on one server the user started noticing sessions across different VDA’s. Now all servers are exhibiting this behavior and resources are running low.