Windows Security notification preventing published app logoffs

[Gwyn Williams1709162899]

Windows 10 22H2, MCS

VDA 2303

 

I think that this has only started after did an in-place upgrade of my MCS image from Windows 10 21H2 to 22H2.

 

Now, every time I close the published application (testing with Character Map), I get the following in my Connection Center, and the session remains active (screenshot)

 

When I click on the item in the Connection Center, the actual Windows Security windows opens, complaining that I have a feature disabled. Whether or not I should have this feature enabled is another discussion, but the point is that this should really not be interfering with the user sessions. To try to fix this, I've re-ran Citrix Optimizer Tool, and also ran the following:

 

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f

reg add "HKLM\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v UILockdown /t REG_DWORD /d 1 /f

 

But I still have the issue. Even when I 'Turn on' the feature that it's complaining about and close the window, it still doesn't end the session, so perhaps the disabled feature is a red herring anyway.

 

Any ideas?

 

[Jason Ochs1709152296]

Can you id the process that is holding it up? RDP to the server as admin. Recreate the issue. As admin view open processes the user still has open in task manager. Kill processes one by one. Certain system processes can't be killed or give an ugly warning. Skip those. Once you kill the right process, it will log off the session for the user. Then open regedit, go to SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI. Edit LogoffCheckSysModules. Add the name of the process that is holding things up. Have the user logon once more and recreate the issue. If it fixes the issue, then you can add that registry value in Group Policy if you wish. 

[Gwyn Williams1709162899]

I'm seeing more and more occasions recently of hung logoffs being caused by processes that the user cannot touch due to permissions, including processes in session #0.

 

In the above case, I was able to work around the issue by adding MsMpEng.exe to the 'LogoffCheckSysModules' registry value.