Citrix VDA sessions hung in disconnected state on Server 2012

[Bruce McDonald]

Hi All,

My environment is Citrix XA/XD 7.11 with SF 3.8, Netscaler VPX 11, UPM 5.5, VDA 7.11. My Citrix environment uses SAML authentication with Citrix FAS (integrated into Okta, Okta is the IdP). The recent integration into Okta and turning SAML auth on with FAS is new to my environment. Whats happening now is, and its intermittent, users are logging onto Citrix desktops and their sessions are not logging off properly. They are listed as disconnected in Studio and I cannot kill them in Studio or even by trying to log the sessions off directly on the Windows 2012 server. They are hung. I've attached some screen shots. I had this same problem with 7.9 so I upgraded to 7.11 including upgrading the VDA versions and UPM. The same problem persists. I've seen a fair few forums on citrix ghost sessions, this seems to be my problem with fixes being 1) reboot the VDA servers (thats all I've been doing) or 2) upgrade Citrix (done that too, do I need to upgrade again, will this fix my issue?). Just wondering if someone else in the community has anything else for me try (like an actual fix would be nice). Thank you for you time.

[Bruce McDonald]

On 11/26/2019 at 8:42 AM, GianMarco Occhionero1709155336 said:

Take a look at the LogoffCheckSysModules reg key.  You will have to create it (i recommend via GPO) and include the process names that are preventing logoff

https://support.citrix.com/article/CTX891671

 

 

Thanks for the link but this is not my problem unfortunately. Your link to the Citrix articles says this "Sessions can be reset or exited correctly by manually resetting them, or by terminating remnant user processes in Terminal Services Administration, the Management Console, or Access Suite Console" but with Citrix ghost sessions, which is what I was experiencing, there is no way that I have found to terminate the hung sessions, only a reboot of the server terminates them.

 

Anyway, my problem is now resolved, I upgrade to 7.15 LTSR CU4 and the problem has disappeared.

[Bruce McDonald]

bump

 

[GianMarco Occhionero1709155336]

Take a look at the LogoffCheckSysModules reg key.  You will have to create it (i recommend via GPO) and include the process names that are preventing logoff

https://support.citrix.com/article/CTX891671

 

[Luc ST-Pierre]

Thank you for sharing this info, we have the exact same issue with CU3 and will see to install CU4 as soon as possible.

Until this a scheduled reboot will temporary be used to fix this issue.

[Luc ST-Pierre]

We was not ready to update all our environment and I Try to update only the VDA on two impacted server and it did not correct the issue.

Rebooting the serveur periodically was not implemented and will not as the server was already reboot the day before, this will not help.

Symptom, when user try to open app published on this server progress bar dissapear after logon as normally but nothing open after.

 

[Joshua Millen]

Old thread, I know 

 

I am adding this because I am sure it will help someone from banging their heads against a wall.

 

Server 2012 r2
VDA 7.15 cu3

Storefront 7.15 cu3 (then upgraded to 1912 CU5)

DDCs 7.15 cu3

 

Did start seeing the "disconnected" with "Application not running" sessions in Studio with no username associated with the session. I could track down the IP/Client info.

In windows task manager on the server, we had the "disconnected" with the number of processes running for that failed session.

 

Turns out, the sessions were not "disconnected", they just failed to log in entirely. I had users, when launching apps to certain delivery groups that would get stuck at "welcome" and then disappear without launching the app.

 

My eureka moment...

I added one of the impacted users to my citrix admin group to give them admin on the VDA.

I launched into vmware on their machine and had them log DIRECTLY into the windows console of the Server 2012 R2 VDA. And it just sat at the "Welcome" and spinning. Never ended. I could kill the "winlogon.exe" process for that instance to kill the login process and get back to the credential prompt. But WINDOWS could not process the login for that particular user.

 

I could see in event viewer that the "explicate credentials" logon was "successful". But it was not going beyond that. I did not dive deep into logs after that and event viewer was useless. Also, since the logon process was not being handed off to UPM there were no useful citrix logs. Which is also why the app never launched and you get the "disconnected" sessions... windows is still trying to log the user session in while Citrix has timed out and abandoned it.

 

And it followed the user, not any particular device. I even deleted the VDA AD computer objects and let PVS recreate them. No dice.

So, I figured something must be fudged with the user object. Some arbitrary BS SID or Kerberos setting or attribute that did not get changes/updated for whatever reason.

Figured I would have to delete the AD user object and recreate it. Thankfully I did not have to.

 

Reset the user's password.....

And holy crap, they could now launch all their apps.

 

This outcome was duplicated over every user that had this issue. (only 5 so far)

 

__________________________

The only error event recorded from Citrix was on the DDC. When Citrix abandoned the session after logon timeout was reached.

Citrix-XenDesktop-BrokerMonitor

EventID 45 

BrokeringUpn USERNAME@ORG 

ClientName TESTINGPC01

FailureReason 7