Jump to content
Welcome to our new Citrix community!
  • 0

Application start stuck on "Welcome"

Kari Ruissalo


I have built a new setup of Citrix Virtual Apps for a customer and whether I'm connecting via Citrix Gateway or directly to the worker, the session launch gets stuck on "Welcome" and eventually disconnecting without any additional errors. On the worker server application log I can see the following Event:


Source: Citrix Desktop Service
Event ID: 1030
Description: The Citrix Desktop Service detected that a user session has ended. Session 15f92c46-3d49-4b5e-920c-852e0cc4c85d for user 'xyz' has ended; reason code ConnectionFailure.

If I connect via GW, I'm also seeing the following in the System log (on worker, x.x.x.x is the ADC SNIP):
The Citrix ICA Transport Driver has received a connect request from x.x.x.x:14582
The Citrix ICA Transport Driver connection from x.x.x.x:14582 has been closed.


... but when connecting directly (client IP z.z.z.z), this is weird, I don't think that there should be an SSL handshake when connecting plain ICA?:
The Citrix ICA Transport Driver has received a connect request from z.z.z.z:64197
The Citrix ICA Transport Driver connection from z.z.z.z:58031 to port 2598 received an invalid packet during its SSL handshake phase.
The Citrix ICA Transport Driver connection from z.z.z.z:58031 has been closed.


I have already tried the following:
- Disabled DTLS (on GW)
- Disabled Session Reliability (on SF)
- Adjusted Windows Cipher settings according to https://support.citrix.com/article/CTX232685

Info about the environment:
CVAD version 1909 (all components, Controllers, VDA, SF...)
Citrix ADC 12.1-55.13
OS Windows Server 2019 (all)

App Layering 1910

Antivirus = Windows Defender (not yet configured, with defaults)


If I build a VM in to same subnet without App Layering, it woks like a charm, so this is not a firewall issue. I have already eliminated Citrix Optimizer and VDA version as possible sources for this issue. Citrix Health assistant doesn't show any warnings. I even disabled Citrix Profile Manager to ensure it doesn't intervene anything here...


One hint that something might be wrong is that I'm seeing the following in the Start Menu (I always run the NGEN scripts prior to packaging the layers):



... and yes, I have already established case with Citrix Support.

Link to comment

3 answers to this question

Recommended Posts

  • 0

I have turned off the "Turn off Automatic Root Certificates Update" policy, but that didn't help (link).


I have also learned that the master image has somehow joined itself to Azure AD (using the dsregcmd.exe /status command) and I can see that the DeviceId and Thumbprint values are the same on all the MCS provisioned machines (technet discussion).


I tried the dsregcmd.exe /leave for the workers from AAD and that seems promising.

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...