XenApp slow logon times, user get black screen for 20 seconds.

[Andy White1709154166]

Hello,

 

We use XenApp 7.6 with Windows 2012R2 on VMware 5.5.

 

Logon times have become slow recently for users, they get a black screen just before their XenApp desktop shows up for about 20 seconds.  How do we find out the cause of this?  Most profiles are under 100mb.

 

If I turn all the GPOs off apart from the UPM GPO it's still slow, if I turn it off logons are fast.

 

The first user logon on the VDAs everyday is always slow (we reboot every night) even with the Citrix Profile Manger service off and all GPOs.

 

Thanks

[Christopher Yue]

For me the active setup method never worked. Powershell script worked which is only to prove the reset cache is causing the issue.

 

Hi Balaji,

 

Q/ Can you confirm if the Powershell content contained the following:-

 

While ($true) {

reg query \\#SERVERNAME#\HKU\#USERSID#\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\StateStore /v ResetCache

reg add \\#SERVERNAME#\HKU\#USERSID#\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\StateStore /v ResetCache /t REG_DWORD /d 0 /f

Write-Host ""

Start-Sleep -Milliseconds 100

}

 

Q/ Can you advise on how you actually deployed the Powershell script to your users?

[Mark DePalma1709157107]

For me the active setup method never worked. Powershell script worked which is only to prove the reset cache is causing the issue.

 

Either it was setup wrong or GPO is blocking reg.exe.

[Christopher Yue]

Either it was setup wrong or GPO is blocking reg.exe.

 

Sorry to be a pain Mark,

 

How would I go about troubleshooting my GPO settings if reg.exe is being blocked?

 

Would it be possible to share screenshots of your working setup?

[Mark DePalma1709157107]

Sorry to be a pain Mark,

 

How would I go about troubleshooting my GPO settings if reg.exe is being blocked?

 

Would it be possible to share screenshots of your working setup?

 

Do a GPO RSoP of the server/user combination. Check for the 'Prevent access to registry editing tools' GPO setting under User Configuration > Administrative Templates > System.

 

Also, post a screenshot of your Active Setup registry key.

[Balaji Baskaran1709154564]

Hi Balaji,

 

Q/ Can you confirm if the Powershell content contained the following:-

 

While ($true) {

reg query \\#SERVERNAME#\HKU\#USERSID#\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\StateStore /v ResetCache

reg add \\#SERVERNAME#\HKU\#USERSID#\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\StateStore /v ResetCache /t REG_DWORD /d 0 /f

Write-Host ""

Start-Sleep -Milliseconds 100

}

 

Q/ Can you advise on how you actually deployed the Powershell script to your users?

 

 

I didn't apply that fix to all users. I tested myself to check if black screen goes away. Ran the powershell from a remote computer which queries & changes the value if exists. Now logged into server via ica as a fresh domain user, the moment the value is changed by userprofilemanager.exe, Mark's script resets the value which runs in a loop. This way the logon was faster with no black screen. If i do not execute the script, then black screen will appear.

[Balaji Baskaran1709154564]

Either it was setup wrong or GPO is blocking reg.exe.

Thanks Mark. It was set up wrong. Stub value wasn't added properly. It works fine now.

[Christopher Yue]

Do a GPO RSoP of the server/user combination. Check for the 'Prevent access to registry editing tools' GPO setting under User Configuration > Administrative Templates > System.

 

Also, post a screenshot of your Active Setup registry key.

 

Hi Mark,

 

Ran RSop.msc which looks OK.

 

Also checked the permissions regarding access to the registry editing tools which is set to Not Configured which I guess should be fine.

 

Please find attached screenshot of the ActiveSetup registry entry from HKLM and HKCU (which does not have the stub reference).

[Mark DePalma1709157107]

Hi Mark,

 

Ran RSop.msc which looks OK.

 

Also checked the permissions regarding access to the registry editing tools which is set to Not Configured which I guess should be fine.

 

Please find attached screenshot of the ActiveSetup registry entry from HKLM and HKCU (which does not have the stub reference).

 

So, one thing I want to reiterate e is that the HKCU path should technically be there if it ran, but if that path is persisted through UPM or any other profile management then the fix will not run again. This is why it is important to exclude the HKCU path from UPM or any other profile management (ex. FSLogix). ActiveSetup is designed sort of as a RunOnce mechanism. Once it runs it stamps the HKCU key so that it doesn't run again. The only way to get it to run is to remove the HKCU key OR change the 'Version' value in the HKLM key. We exclude the HKCU path so that ActiveSetup will run the command every time.

[Christopher Yue]

Hi Mark,

 

I will need to see if FSLogix supports this.

 

If not, I guess a logoff script to delete the HKCU entry should take care of it right?

[Mark DePalma1709157107]

Hi Mark,

 

I will need to see if FSLogix supports this.

 

If not, I guess a logoff script to delete the HKCU entry should take care of it right?

 

Technically yes, but if you have a session that doesn't log off properly then you would run into the issue of the fix not running the next time. The best method for this is to exclude the key from profile management. I am fairly confident FSLogix will support this. Any profile management tool has to have this functionality. I implemented ProfileUnity at my last company and needed to use that constantly. I also use it at my current company with UPM.

 

I tried looking at their documentation, but it seems to be lacking: https://docs.fslogix.com/display/FA26/Profile+Configuration+Tool. I see you can exclude directories, but can't find how to configure registry exclusions.

[Romain Bodeloche]

Hello Mark,

 

about the registry exclusion, we should exclude "HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\StateStore" and not "HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components\DisableUPMResetCache".

Right ?

UPM registry exclusions apply only for HKCU.

[Mark DePalma1709157107]

Hello Mark,

 

about the registry exclusion, we should exclude "HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\StateStore" and not "HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components\DisableUPMResetCache".

Right ?

UPM registry exclusions apply only for HKCU.

 

No need to exclude anything in StateStore. You NEED to exclude the following:

 

Directory - '!ctx_localappdata!\Microsoft\Windows\Caches'

Registry - 'SOFTWARE\Microsoft\Active Setup\Installed Components\DisableUPMResetCache' (HKCU)

[Romain Bodeloche]

ok thanks.

I put a logoff script to remove HKCU entry on existing UPM profiles (upm registry exclusion was made after the reg hotfix)

[Mark DePalma1709157107]

ok thanks.

I put a logoff script to remove HKCU entry on existing UPM profiles (upm registry exclusion was made after the reg hotfix)

 

I believe UPM REGISTRY exclusions added after the fact will take effect after a logon cycle, but putting the logoff script will not hurt anything.

[Christopher Yue]

Technically yes, but if you have a session that doesn't log off properly then you would run into the issue of the fix not running the next time. The best method for this is to exclude the key from profile management. I am fairly confident FSLogix will support this. Any profile management tool has to have this functionality. I implemented ProfileUnity at my last company and needed to use that constantly. I also use it at my current company with UPM.

 

I tried looking at their documentation, but it seems to be lacking: https://docs.fslogix.com/display/FA26/Profile+Configuration+Tool. I see you can exclude directories, but can't find how to configure registry exclusions.

 

That's right Mark.

 

I have just had that confirmed with FSL support (you need the more expensive FSLogix Apps product to do this) so I will try and use a logoff script to remove the entry instead.

[Mark DePalma1709157107]

That's right Mark.

 

I have just had that confirmed with FSL support (you need the more expensive FSLogix Apps product to do this) so I will try and use a logoff script to remove the entry instead.

 

Wouldn't hurt to also add a registry key delete via GPP. That way the key will delete during GPO refresh, that combined with the logoff script should work in most situations.

[Peter Loumlf]

We had the same issue with long black screen, i tried Marks way with Statestore reg keys. That worked and the login got so much quicker. But we don't use classic shell and that solution messed up the Windows 2012 start screen.

We use redirected start screen

 

So instead i used the Shell-Core Operational log and checked one user with slow login and noticed where there was a jump of seconds before the next action. And i noticed some icons took longer time then others. 

I had 4 shortcuts that took some time, but they worked and were properly configured.

Recreated those shortcurts and tried. Blackscreen gone, immediate login.

[Christopher Yue]

Wouldn't hurt to also add a registry key delete via GPP. That way the key will delete during GPO refresh, that combined with the logoff script should work in most situations.

 

Hi Mark,

 

I have made the changes and I am seeing the following:-

 

Black screen phase now between  0-13 seconds which is much better than before.

 

so with or without UPM I am seeing this behaviour.

 

I have doubled checked to make sure my batch file to delete the registry entry works and it does at logoff.

 

Should I be expecting no black screen phase at all?

[Mark DePalma1709157107]

Hi Mark,

 

I have made the changes and I am seeing the following:-

 

Black screen phase now between  0-13 seconds which is much better than before.

 

so with or without UPM I am seeing this behaviour.

 

I have doubled checked to make sure my batch file to delete the registry entry works and it does at logoff.

 

Should I be expecting no black screen phase at all?

 

It depends. I have seen on a Windows machine running Receiver that as soon as I connect to a published desktop I get a black screen. The entire logon is masked with a black screen, including what you would normally see when logging onto a computer locally (loading profile and all the other statuses). If Explorer has been launched and you still have a black screen for 10 seconds then this is not working for you. I can actually see the flash where Active Setup launches the fix and right after I see that my desktop loads. I you can see that flash and still have a delay after that then there is something going on. If you see a black screen UP TO that and then it loads right after then the delay it out of scope of this issue. I actually don't like that Receiver masks the regular loading status. On my Linux client Receiver actually shows the Windows 2012 logon status, so you aren't wondering what is going on.

[Christopher Yue]

So for me, I get to see the loading status, right up to the preparing windows message.

 

I too see the flash which appears in a small dos window, then I will get the black screen delay before the Desktop appears.

 

I will keep tuned on this thread. Hopefully a permanent solution will come soon.

[Andy Vanderbeken1709152516]

to the people that experience a long black phase: please realize that even though you experience the exact same symptom, you still may be experiencing an entirely different issue that is not related at all to this appresolver process but something else. I believe that for me this is the case and I have a different thread running for it. Feel free to gain insight out of my current findings so far or help me find the solution for my specific case. I'm so close to a solution I can smell it :)

 

http://discussions.citrix.com/topic/386208-please-help-me-complete-this-puzzle-long-black-phase-at-login/

[Christopher Yue]

 

Hi Mark,

 

I have made the changes and I am seeing the following:-

 

Black screen phase now between  0-13 seconds which is much better than before.

 

so with or without UPM I am seeing this behaviour.

 

I have doubled checked to make sure my batch file to delete the registry entry works and it does at logoff.

 

Should I be expecting no black screen phase at all?

 

It depends. I have seen on a Windows machine running Receiver that as soon as I connect to a published desktop I get a black screen. The entire logon is masked with a black screen, including what you would normally see when logging onto a computer locally (loading profile and all the other statuses). If Explorer has been launched and you still have a black screen for 10 seconds then this is not working for you. I can actually see the flash where Active Setup launches the fix and right after I see that my desktop loads. I you can see that flash and still have a delay after that then there is something going on. If you see a black screen UP TO that and then it loads right after then the delay it out of scope of this issue. I actually don't like that Receiver masks the regular loading status. On my Linux client Receiver actually shows the Windows 2012 logon status, so you aren't wondering what is going on.

 

Here is an update to something that has appeared to have finally resolved the issue for me anyway.

 

I used Option 2 from the following Unidesk article (disable App Readiness service).

 

https://www.unidesk.com/support/learn/2.7.0/deploy/create_desktops/deploy_desktop_create_nonpersist

 

Once this sevice was disabled, I no longer see the black screen phase.

[Mark DePalma1709157107]

Here is an update to something that has appeared to have finally resolved the issue for me anyway.

 

I used Option 2 from the following Unidesk article (disable App Readiness service).

 

https://www.unidesk.com/support/learn/2.7.0/deploy/create_desktops/deploy_desktop_create_nonpersist

 

Once this sevice was disabled, I no longer see the black screen phase.

 

I have seen this. I had ruled App Readiness out and was not seeing a delay with that, but some people have reported it. It does start pre-shell. Citrix is actually working on a private fix for the UPM issue. They sent me the fix, but I am waiting for more information on it before I try it.

[Christopher Yue]

Yes it would be interesting to see what Citrix says.

 

The private fix must indicate an identified issue which is good.

 

I do not use UPM but suffered the same issue which I assumed was related to the OS more than anything.

 

When I was using Server 2008R2 I had no issues.

[Balaji Baskaran1709154564]

The latest update from Citrix is that their product development team is still working to fix this issue.