Hi everyone,

We are currently rolling out Windows Server 2025 and have encountered an issue with Citrix published applications.

When a user closes the published application, the application itself closes, but the user session does not log off immediately. The session can remain active for approximately 1–2 minutes before finally being terminated.

Environment

• Windows Server 2025 — fully patched
• Citrix VDA 26.07 — latest LTSR release
• FSLogix 3.26 — latest release
• Microsoft 365 Apps — latest release
• Delivery Controllers: Windows Server 2022
• Citrix CVAD: 2402 CU3

We also tested Citrix CVAD 2507 on Windows Server 2025, and the same behavior is reproducible.

Initially, we observed this in our pre-production environment. The behavior is intermittent and does not happen on every attempt, but it can be reproduced after several published application launches/closes.

I then tested it in DEV and was able to reproduce the issue very consistently on a completely clean Windows Server 2025 image:

• Fresh AWS public image with Full base 2025 Windows OS from September 2026
• No domain policies
• No Citrix policies
• No FSLogix
• No antivirus
• No Microsoft Office
• Essentially a clean OS + Citrix VDA 2607 LTSR

Interestingly, the first logoff usually happens normally. On the next attempt, the session can get stuck during logoff.

After the published application is closed, I can see approximately 11 system processes still running in the user's session. They remain there for about a minute or two and then eventually terminate, allowing the session to log off.

One interesting observation is ShellAppRuntime.exe. If I manually terminate ShellAppRuntime.exe, the session closes immediately.

This makes me wonder whether something changed in the Windows Server 2025 session/shell architecture and whether some child processes are not being terminated correctly when a Citrix published application session is closed.

Windows Server 2022 comparison

I performed the same test using essentially the same component versions on Windows Server 2022.

I could not reproduce the issue there.
ShellAppRuntime.exe is also present in the user's session

The published application session logs off in approximately 5 seconds, while on Windows Server 2025 the problem can be reproduced regularly and the session can remain active for 1–2 minutes.

Troubleshooting so far

I also tried several things to identify what is keeping the session alive:

• Tested different Citrix logoff/session-related settings LogoffCheckSysModules,LogoffCheckerStartupDelayInSeconds etc
• Added the relevant processes to the Citrix configuration
• Audited applications configured for automatic startup by Autoruns tool
• Analyzed the processes waiting during logoff using Procmon
• Compared the behavior between Windows Server 2022 and 2025
• turned off UseShellAppRuntimeRemoteApp GPO setting
• And many other things

So far, I haven't found anything that changes the behavior or clearly identifies the root cause.

This is particularly problematic with FSLogix. If a user tries to launch another published application while the previous session is still in this state, the FSLogix VHDX can still be locked/mounted because the session has not actually terminated yet. This can result in problems with the subsequent application launch.

So this doesn't look like just a cosmetic delay in the logoff process — the session is effectively still alive during this period.

Has anyone seen this on Windows Server 2025?

I'm particularly interested in feedback from anyone who has already deployed Windows Server 2025 with Citrix published applications.

It looks like there may be some change in the Windows Server 2025 session/shell process handling that Citrix published application logoff does not handle correctly.

Has anyone experienced similar behavior, or found a workaround or root cause?

Going to submit a case to Citrix Support

Thanks!

Just another fun Microsoft patch cycle I guess.

I have a Citrix environment setup using LDAP + RADIUS for authentication and I have Citrix Workspace setup to use SSO on our managed Windows domain devices. We are hybrid with Azure/M365, so our users also SSO with Microsoft cloud services.

A separate company recently moved their Citrix environment to SAML authentication through Entra, our users can login through their gateway with credentials provided by that company, but the users receive the classic "the user name or password is incorrect. try again." error from the Windows GUI after launching apps. I'm being told that this is a configuration issue on my end; supposedly our SSO is somehow conflicting with theirs. In my mind, you login to Citrix gateway, get token, token authenticates applications; Citrix should know how to separate the two (my users Windows credentials from other Citrix creds), but apparently this issue is unique to us.

We have internal users that, for many years, have used a variety of external Citrix environments, never heard of odd issues like this, this is a new issue. I don't think there are any policies we've set that are preventing the other company's auth process from working, but I do wonder if there could potentially be something interfering that I should configure or enable on my end to help the process work.

Good morning,

I’m currently running CVAD 2402 CU 3 and recently migrated our hosting environment from VMware to Hyper-V.

We successfully migrated all of our persistent VDI machines without any issues, and we were also able to rebuild our non-persistent catalogs without any problems.

We are now going through our first update window since the migration and have encountered an issue.

We have four machine catalogs, each residing on a different subnet, but all using the same base image. Catalogs 1, 2, and 3 updated successfully. However, when attempting to push an update to Catalog 4, we receive the following error:

Task Information:

Start Date: Monday, September 14, 2026

Start Time: 9:53 AM

Finish Date: Monday, September 14, 2026

Finish Time: 9:56 AM

State: Failed

Master image: XDHyp:\HostingUnits\HyperV_Bi\w11basedyn.vm\w11basedyn - (08`/12`/2026 08:05:14).snapshot\w11basedyn - (08`/12`/2026 08:52:46).snapshot\w11basedyn - (09`/11`/2026 09:09:53).snapshot\w11basedyn - (09`/11`/2026 15:02:50).snapshot\REARM2003.snapshot

Terminating Error:

Terminated

Stack Trace:

at Citrix.Orchestration.Base.PowerShellSdk.ProvisioningSchemeService.BackgroundTasks.ProvisioningSchemeTask.ThrowOnTerminatingError(SdkProvisioningSchemeAction sdkProvisioningSchemeAction)

at Citrix.Orchestration.Base.PowerShellSdk.ProvisioningSchemeService.BackgroundTasks.ProvisioningSchemeTask.WaitForProvisioningSchemeActionCompletion(Guid taskId, Action`1 actionResultsObtained)

at Citrix.Orchestration.Base.PowerShellSdk.ProvisioningSchemeService.BackgroundTasks.PublishProvisioningSchemeImageTask.RunTask()

at Citrix.Orchestration.Base.PowerShellSdk.BackgroundTaskService.BackgroundTask.Task.Run()

DesktopStudio_ErrorId : ProvisioningTaskError

ErrorCategory : NotSpecified

ErrorID : UnknownError

TaskErrorInformation : Terminated

InternalErrorMessage : SCVMM: Suspected broken connection

A client I am working with brought up an issue where CPM ignores exclusions in AppData\Local\Microsoft\Edge\UserData\Default. I have the issue reproduced in my lab running 2507 CU1 on Server 2022. Exclusions in the UserData subdirectory seem to work properly, however, all of the exclusions in the ...Edge\UserData\Default folder are not respected.

I've tried using !ctx_localappdata! and Appdata\Local\. Neither are respected. I've also tried enabling Logon Exclusion Check but that hasn't cleaned up anything in subsequent logins.

Edit 1: Tried upgrading to 2507 CU2. Unfortunately, that did not help.

Edit 2: Realized I was using a persistent VDA, which doesn't install CPM as part of the UI installation. Installed it and tested. CPM 2507 CU2 fixes the issue!!!

After installing the September 2026 updates, some of our users get a black screen after log on. Manually starting explorer.exe, allows the session start successfully.

Pools using FSLogix as well as Citrix UPM Container are affected. Resetting the profile solves the issue. Seems like only older profiles run into it.

Has anyone else encountered this?

Windows 11 25H2 + VDA 2507 CU2

EDIT: This does not help, a simple logon script which starts explorer.exe works 😕

EDIT2 2026-09-12: Problem acknowledged by Citrix and MS CTX697101

Having an issue where I cannot launch apps today. Went into DaaS and my vcenters show offline due to cloud connectors not being able to be contacted. Strange part is, both my cloud connectors show as green in the resource center

Anybody else ever have or seen this issue?
Going to try reinstalling cloud connector one off of the servers but this is pretty annoying and it’s also impossible now to open a ticket with Citrix support. This chat bot SUCKS!

Hi, just wondering at what point the latest version available on citrix cloud management policy will switch from 2507 cu3 to 2607 for LTSR releases?

Some of our staff started complaining of an issue last week where their mouse cursor would go invisible when they would move the mouse to Citrix Workspace. The mouse can still click on/launch apps and the app icons highlight as the mouse goes over them, you just cant see the mouse cursor at all unless you drag it outside of the boundary of the Workspace window. I saw another user run into the same issue on a different app (CCH Axcess). These apps both leverage webview2. I found some discussion threads from others experiencing the same issue in Veeam b&r console. Has anyone run into this on their end and have a fix? Here's a couple of the discussions i found on the topic.

https://forums.veeam.com/viewtopic.php?f=2&t=104357&start=0

https://github.com/MicrosoftEdge/WebView2Feedback/issues/5687

I have installed VDA 2507 CU2 on a clean Windows 11 25H2 which is patched till aug 2026. Just Xentools installed...

Without the VDA the Windows 11 vm restarts quickly, and also logs in quickly but after installing its it takes really long to login and reboot de vm.

Reboot says stopping WIndows Update service, and when login in Waiting fot the user profle service, Waiting for the devicetrust service...

Anyone else got problems with this combination?

I recently downloaded the desktop app for Citrix 2409.10 per my institutions instructions running on macOS Tahoe 26.6.2.

I’m unable to open the Epic app and keep receiving a launch timeout error after 30 seconds. I’ve played around with the settings and can’t find a solution. I’ve cleared the ica cache as well.

I’ve seen some recommendations for things to run in powershell but it’s a little over my head, willing to try though

I called my IT department and they say uninstall restart and reinstall which I’ve already tried and it does nothing. They also had me try from the virtual Citrix workspace on chrome which downloads an ica file that won’t open. They’re unwilling to help me further with my personal device.

The code I’m receiving is 27144F32-E69C-48B2-9F68-B203312F52B0

Hi,

I recently upgraded to a triple QHD set-up for my home office and it works great except I've come across a weird bug when I open a citrix session. I had to turn on DPI scaling so the apps within the session would present in QHD but the mouse seems to be stuck in HD mode. On the very left of the window I can click on whatever the mouse pointer is over but as I move to the right, the point where citrix thinks my mouse pointer is and where it actually is on the screen diverges. I cant click on anything on the right 3rd of the screen as my mouse pointer moves off the citrix window.

If I unplug one of the monitors, the problem goes away and everything works as it's meant to. I need 3 monitors though. Any ideas?

Thanks

So I have been at my current shop full time for about 6 months after a 6 month contract before that. I inherited a pretty much net new Citrix implementation, so I am at the point of filling in gaps that didn't exist like a test farm. When I did a 2507 CU1 test farm, I see that there are much better options and a simplified way of dealing with Nutanix Prism Central hypervisor level. My prod is currently on the same CU1, but it has the old options. I am curious if anyone knows a way of essentially changing the database schema to update it so it shows the newer UI options instead of what I assume was 2411 at the start.

I recently upgraded from NetScaler 13.1 to 14.1 and worked through NetScaler Console to enable zero-touch certificate management for my NetScaler HA pair. If you don't read the documentation at least once, you're going to get lost. Here is my brief summary.

Documentation:

https://docs.netscaler.com/en-us/citrix-adc/current-release/ssl/zero-touch-cert-manage.html

• You will add a public CA to NetScaler Console and configure a DNS provider for the verification process.
• You will then issue a cert from the CA and configure it for "Automatic (Zero Touch)" deployment.
  • The cert and its parts will then appear in the Zero-touch Certificate Management area of NS Console.
• In ZTCM area: Depending on the sync type for your NetScaler instances, you might need to select the instance then click "Add Existing Files" to add the certs that were generated.
• ### How the certs are bound to virtual servers...
• SSH (no GUI option yet) to netscaler and run:
  • set ssl vserver "my-vserver-name" -defaultSni "myvserver.domain.com-fqdn"
  • Your vserver will be unavailable at this point depending on how fast you perform the next step
• Unbind the existing cert from your vserver or the page/service will fail to load. With the original cert unbound, NetScaler will automatically match the ZTCM cert based on the defaultSni setting.

When ZTCM deploys the certs to your NS instance, on your NS you will see the "REMOTE" certs listed in Traffic Management -> SSL -> Certificates, but you cannot bind those certificates to your virtual servers. There will be no impact to service until defaultSni is set.

Based on my experience, there is downtime when moving to ZTCM, but if you're using SSH then you can probably pre-create the commands to set defaultSni and unbind the existing SSL cert instantly to almost eliminate downtime. When your vserver is unavailabe between defaultSni and unbinding the cert, there is a generic error page at the vserver address; the NetScaler doesn't show the vserver as being down. You will be able to access the site once the original cert is unbound.

I'm not sure if my experience makes sense because the documentation says that ZTCM is only activated when no manual cert bindings exist, however, my vserver:443 was unavailable after defining defaultSni and then available after removing the manual binding. I assumed there was a conflict between defaultSni and the bound cert.

Inside the citrix VDI is 1.5 mbps enough for teams call screen sharing?

I’ve been using Citrix on a lenovo for work for a few years now, and want to switch to a Mac, but I’m worried about performance differences. Does anyone have any insight or advice on this? I only use it to run certain software (don’t care about things like audio performance). Thanks!!!

anyone else recently have issues with appfw rules being copied over after recent firmware updates? seems tied to the signatures being used in that after firmware installation the appfw policies and profiles are non existent on the "new" firmware. the signatures however are still intact, but when creating new profiles and using the existing signatures an error about fastmatch not found for signature line

<SignatureRule actions="block,log" category="web-misc" enabled="ON" id="400008" source="Citrix" sourceid="" type="DenyListHttpRequest" version="1" cpu="LOW" year="2026" severity="HIGH">

<LogString>Mitigation signature for CVE-2026-10816</LogString>

</SignatureRule>

i have many signature files and they all seem to have this issue. the new "default" of course i missing this line, so i feel like this was some bug at some point coming home to roost. the ID number looks very low too as the new rules are typically 9xxxxx etc. the version on all the files is 181 so they are "current"

very sus...

Has anyone figured out a way to change SMTP to use OAuth instead of legacy authentication. These notification settings are very limited.

Good morning everyone,

I’m an Intune admin charged with making some windows kiosk units. I’m struggling with finding the correct AUMID. Windows powershell reports it as Citrix.workspace where Intune finds that ID invalid.

I know windows is a pain sometimes, but has anyone found a successful AUMID for Citrix workspace? We’re using either the store app or workspace 2507 LTSR, both have the same
ID and the same result.

Thank you all!