AppSense Published Image / Windows 10 Start Menu issue

[Andrew Gresbach1709152664]

We've been using AppSense Environment Manager along with App Layering for a couple of years w/out an issue but we are trying to get it working with Windows 10 and having an issue with the Start Menu after its included in a published image.   I've made sure to follow the steps at :  https://support.citrix.com/article/CTX221947 . to generalize and the required registry key  and this is what seems to happen:

- In a packaging machine all works fine with the Start Menu (in the original an any new revision)

-Once included in a published image,  logging in with local admin the Start Menu does nothing when you click on it for a good 5 + min.  Eventually it starts to work and continues to until a reboot in which it starts all over again.    If I publish the image to my MCS pool we see the same thing on the first user login.  

-I've tried including only the OS layer,  Appsense Agent layer and platform layer and still experiences the issue

-If i try again w/ the same image but exclude appsense all works fine

 

I can't figure out what might be the hangup since it seems to work fine in the actual layer packaging machines so it seems to be something that happens during the published image stage that is angering things.  I am going to open a ticket on this in the morning but thought i'd throw it out here too in case anyone else has run into it

[Levi Van Manen1709152582]

This was just provided to me from Ivanti support.  I have not tried it yet to see if it works but will post back once I have.

 

You can exclude ShellExperienceHost.exe from our AsModLdr. Look at the following section "AsModLdr Shared Driver Environment Manager Exclusions" in our AV exclusions doc at https://forums.ivanti.com/s/article/Recommended-Anti-Virus-and-AppSense-Exclusions .  This does come at a very small cost of not being able to catch any personalization and/or process start/stop triggers specifically spawned by the ShellExperienceHost.exe process.  This is usually not too much of an issue as there are very few processes launched by that .exe.  Anything from the start menu or search spawns from the RuntimeBroker.exe process, which means it will work correctly.

 

With that said, we have identified what component of Citrix is causing the issue.  Specifically, it is the UWPBridgeHook.  By following this article from Citrix, https://support.citrix.com/article/CTX107825 , that UWP feature can be disabled for ShellExperienceHost.exe and the issue is also fixed.

[Kate Mangan]

We saw similar behavior with 1811xAppSense.  I noticed that while the start menu is broken, if you launch file explorer you can use it but can't move it.  Using task manager to restart explorer.exe resolves both (not that it's a solution).  We tried downgrading to 1808.2 and the start menu is better but same behavior for explorer.exe.  Thinking about turning on 'launch folder windows in a separate process' as that also seems to get around it.  Does 1808.0 play better with AppSense than 1808.2?

[Mike Kelly1709153237]

On 6/7/2019 at 10:54 AM, Levi Van Manen1709152582 said:

This was just provided to me from Ivanti support.  I have not tried it yet to see if it works but will post back once I have.

 

You can exclude ShellExperienceHost.exe from our AsModLdr. Look at the following section "AsModLdr Shared Driver Environment Manager Exclusions" in our AV exclusions doc at https://forums.ivanti.com/s/article/Recommended-Anti-Virus-and-AppSense-Exclusions .  This does come at a very small cost of not being able to catch any personalization and/or process start/stop triggers specifically spawned by the ShellExperienceHost.exe process.  This is usually not too much of an issue as there are very few processes launched by that .exe.  Anything from the start menu or search spawns from the RuntimeBroker.exe process, which means it will work correctly.

 

With that said, we have identified what component of Citrix is causing the issue.  Specifically, it is the UWPBridgeHook.  By following this article from Citrix, https://support.citrix.com/article/CTX107825 , that UWP feature can be disabled for ShellExperienceHost.exe and the issue is also fixed.

Just so I'm clear...

 

The ultimate fix is to add ShellExperienceHost.exe to the ctxhook reg keys listed in https://support.citrix.com/article/CTX107825  ??

[Andrew Gresbach1709152664]

just verified that excluding ShellExperienceHost.exe on the Appsense side did the trick for us too.  I'm sure the Citrix way we could have done too but i had already been working on my Appsense layer so wanted to try there first.  Thank you for everyones help with this! Did Citrix or Appsense happen to mention which vendor caused it out of curiosity?  

[Daniel Esparza1709157511]

Just spoke with Citrix and they mentioned the  UWPBridgeHook key is being added by default by the VDA agent even if you tell the agent to exclude Profile Manager from installing as well.  They told me to go ahead and set the  UWPBridgeHook flag to 0 and this will fix the issue with the start menu.  Since we are not using UPM setting this key to 0 will have no issue.  I am going to set this instead of adding the shellexperience to the appsense exclusions since appsense support told me that putting this in there could have issues if we ever set a process started in EM and have this excluded.  Hope this helps everyone.

[Andrew Gresbach1709152664]

thanks for the update and everyones time on this! i am working on putting this exclusion in place now as well so glad to hear its helping for others!

[Levi Van Manen1709152582]

Verified this worked for us as well.

[Daniel Esparza1709157511]

3 minutes ago, Levi Van Manen1709152582 said:

This was just provided to me from Ivanti support.  I have not tried it yet to see if it works but will post back once I have.

 

You can exclude ShellExperienceHost.exe from our AsModLdr. Look at the following section "AsModLdr Shared Driver Environment Manager Exclusions" in our AV exclusions doc at https://forums.ivanti.com/s/article/Recommended-Anti-Virus-and-AppSense-Exclusions .  This does come at a very small cost of not being able to catch any personalization and/or process start/stop triggers specifically spawned by the ShellExperienceHost.exe process.  This is usually not too much of an issue as there are very few processes launched by that .exe.  Anything from the start menu or search spawns from the RuntimeBroker.exe process, which means it will work correctly.

 

With that said, we have identified what component of Citrix is causing the issue.  Specifically, it is the UWPBridgeHook.  By following this article from Citrix, https://support.citrix.com/article/CTX107825 , that UWP feature can be disabled for ShellExperienceHost.exe and the issue is also fixed.

 

I am currently working with Ivanti support and I can confirm that excluding the Shell from the AsModLdr works.  I have reached back out to Citrix support to see if they can provide any info on the UWPBridgeHook and when that is disabled the start menu works.  Hope to find a resolution soon on this.

[Levi Van Manen1709152582]

I have opened a ticket with Citrix  and they said they are working with engineering on the issue.  I'll post any further updates once I hear back from them.

[Andrew Gresbach1709152664]

Has anyone opened a ticket on the Citrix or Appsense side yet? I wonder which side would be best to target to start given the newer VDA's work fine w/out appsense.  I'll probably open an Appsense ticket in the morning and can report back if i get any progress

[Paul Fulbright1709158471]

This appears to be a fairly widespread problem and there seems to be no real answer from Citrix...1811, 1903, with AppSense 10.1 or 2019.1 same result, broken start menu.

[Andrew Gresbach1709152664]

i never got anywhere further with it yet but i have it on my list.   I initially submitted a ticket but they weren't able to replicate it on their end at first and we had too much going on to dedicate time to it like I wanted to so had to let them close it for now but i had plans to circle back to it.    I believe the last question was if we tried the latest version to see if it made a difference but when i tried that i had the same issue.    we just have too many other odd issues going on right now so that was lower on the list.  if you happen to stumble on anything let us know otherwise i'll chime in if i get time to try and tackle it again

[Levi Van Manen1709152582]

Was there ever a solution found on this?  We are running 7.18 and having no issues but when we try 1811 or 1903 we experience the same issue with the start menu.

[Mike Kelly1709153237]

I was on a Citrix webinar earlier this week and they mentioned the MS teams client optimization is coming with HDX optimization pack 2.8 (coming soon).

[Andrew Gresbach1709152664]

cool thanks Gunther! i have a ticket opened......narrowing down a bit further it seems to work up until the 1808 VDA......something in 1811 makes it cranky so we'll see what happens

 

ultimately we were trying to get on the current release so we can keep current whenever they release the MS Teams client optimization.  I dont suppose you've heard any rumblings of a rough ETA for that? not your department i know but in case you've heard.  Thats a big feature we're waiting on to switch from Skype to Teams to use video conferencing

[Gunther Anderson]

If you do open a case, do with the virtual desktops team.  I seem to recall that there is something like that with UPM (now called CPM) versus the start menu, but I (and the App Layering team) don't know anything specific. 

[Andrew Gresbach1709152664]

and just to clarify, if i exclude Appsesense Environment Manager agent layer from the published image, the 1811 VDA / Start menu works just fine  or if i include Appsense and Exclude the 1811 platform layer all works fine too so i dont think its an issue w/ the VDA and Windows 10, more so that vda and appsense liking each other

[Andrew Gresbach1709152664]

I just tested using the same template but once using revision 1 of each VDA version (1811 vs 7.15.2000) which is JUST the VDA install (no domain join, etc).     the version with 7.15.2000 the start menu in the published image works right out of the gate as it should.    the version with 1811 has a huge delay after login before the start menu does anything (usually about 5 min but not consistent....latest test is going on 8 min now and no rhyme or reason what fixes it...seems to just start working eventually).    I'm going to open a ticket on it but not sure if i should assign to Xendesktop (virtual desktop) or app layering team

[Gunther Anderson]

Make a new platform layer with the 7.15.2000 VDA just to be sure.  I haven't heard of anything like that, but I probably wouldn't have if App Layering isn't a required element.  But there could be other differences, like maybe some GPO changed between when you joined the previous platform layer to the domain and when you joined the current one.

[Andrew Gresbach1709152664]

it looks like this is related to something in my Platform layer.   the only thing different in this platform layer vs my old one i had for Windows 10 is this has the 7.18 vda and the old (which seems to work fine) has 7.15.2000.   could there be a conflict/bug w/ this new vda w/ appsense/windows 10?