Hi everyone,

We’ve been dealing with a rather frustrating issue affecting our Citrix Remote PC Access environment and wanted to share our findings in case others are experiencing the same problem.

Environment:

• Windows 11 25H2
• Citrix Remote PC Access, VDA 2603 and 2607
• Two Delivery Controllers
• Microsoft Intune with Open Intune Baseline (OIB)
• Windows October 2026 CU (KB5127648)

The problem

Since the September 2026 Windows updates, some of our workstations have started becoming unregistered. Following the October CU, the issue appears consistently on affected devices.

The VDA reports AgentNotContactable, while the Delivery Controller logs Event ID 1039:

The Citrix Broker Service failed to contact virtual machine.

Exception 'The caller was not authenticated by the service.'
of type 'System.ServiceModel.Security.SecurityNegotiationException'.

What we've investigated

• BrokerAgent is running.
• DDC → VDA connectivity on TCP 80 works.
• AD secure channel is healthy.
• Both DDC computer accounts have the required network logon rights.
• Kerberos ticket acquisition for the VDA's HOST SPN succeeds using AES-256.
• Upgrading the VDA from 2603 to 2607 does not resolve the issue.

After extensive troubleshooting, we identified Windows Administrator Protection as the trigger.

We can reliably reproduce the following:

These tests have been repeated successfully on the same workstation.

Interestingly, our Administrator Protection policy was deployed through OIB several months ago. The problems only started appearing with the recent Windows updates, suggesting a change in how Windows enforces this security feature.

Citrix KB CTX340030 describes the same registration error and suggests adding the DDC computer accounts to the local Administrators group. While this works, we don't consider granting our Delivery Controllers local admin privileges on every workstation an acceptable permanent solution.

Microsoft also acknowledges a potentially related issue in KB5127648, where RDP connections for non-admin users fail when Administrator Protection is enabled. However, that documentation does not explicitly mention Citrix VDA registration.

Our current workaround is to disable Administrator Protection (TypeOfAdminApprovalMode = 1) through Intune while keeping the October CU installed.

Questions for the community:

• Has anyone else encountered this with Citrix Remote PC Access?
• Is anyone seeing similar registration failures with Administrator Protection enabled on other VDA deployments?
• Has anyone received confirmation from Citrix or Microsoft, or found a supported fix that allows Administrator Protection to remain enabled?

We're raising a Citrix support case, but I wanted to share our findings and hear whether others are affected.

Any feedback or additional findings would be greatly appreciated.

References:

• Citrix CTX340030
• Microsoft KB5127648

Environment

• CVAD 2507 LTSR, Profile Management 25.7.2100
• Windows Server 2025 single-session VDI, PVS standard image (non-persistent), WEM
• Domain-joined only (no hybrid Entra join); Workplace Join blocked via BlockAADWorkplaceJoin=1
• New Teams installed per-machine

The problem. Neither profile container mode works for us:

1. Container *, local caching OFF: new Teams and Windows Terminal won’t launch, with “The parameter is incorrect” (AppModel-Runtime 216/208, 0x80070057, “Cannot create the Desktop AppX container”). UPM’s driver redirects the profile root to the VHDX volume, and the packaged-app runtime doesn’t like it.
2. Container *, local caching ON: apps launch, but some folders are never written to the container, so they’re regenerated at every logon: The result is that Teams asks for sign-in on every logon, and anything DPAPI-protected is lost.
   • AppData\Roaming\Microsoft\Protect (DPAPI master keys)
   • AppData\Local\Microsoft\TokenBroker
   • AppData\Local\Microsoft\OneAuth
   • AppData\Local\Packages (including Microsoft.AAD.BrokerPlugin)

File-based profiles work fine on the same image. I’m opening a Citrix case, and I’ll update the thread with the outcome.

Has anyone encountered an issue where users cannot reconnect to existing disconnected sessions in Citrix DaaS?

Environment:

• Windows Server 2019 single-session VDAs
• VDA version 2603.0.100.320
• MCS-provisioned, non-persistent machines hosted on GCP

Users disconnect their sessions while long-running engineering simulations continue. When they return, they sometimes receive an "Unable to start" error. In some cases, a new session is created and the original machine is shut down.

The disconnected-session power-off policy is set to 72 hours, but the issue occurs earlier.

Transaction logs include:

• brk.resolve.machine.failure.general
• bka.hdx.prepare.failure.general
• SessionManager.LeaseResolution.Failed

What would you investigate to determine why the existing session cannot be reconnected? Are there any known VDA 2603 issues or specific Broker/HDX logs that could explain this behaviour?

I'd appreciate insights from anyone who has troubleshot similar session-reconnection failures.

I'm having an interesting but annoying problem after updating to the latest Citrix workspace ltsr release (I have been using a really old one).

Whenever I press the shift and left alt to cycle between my languages the windows exclamation sound is played.

Languages switch correctly but it gets annoying having to hear the sound multiple times whenever typing a sentence.

Things I have tried:

1. Sync only once is enabled in keyboard settings of Citrix

2. Changing the keyboard shortcut to shift and ctrl does not produce the sound. Issue seems to be only on shift and left alt

3. Tried setting the windows exclamation sound to none in sound settings but it keeps going

The issue is not affecting my local computer at all, simply the VDI one.

Hello, everyone, I hope all is well!! We upgraded our PVS non-persistent single-session VDI from Windows 10 21H2 to Windows 11 24H2 some time ago. I had exported the Win10 VDisk as a local hard disk using the Wizard tool, booted up as a local disk on a VMWare VM, upgraded to Win11, ran Citrix Optimizer, installed the target software, and created my Win11 VDisk. Everything works great on the original machine used to create the VDisk. However, I noticed a one issue on the PVS target machines I spun up from the VDisk using the machine wizard. The System page nor the Windows Update page is opening when I click it. Nothing opens or happens. This does NOT happen on my upgraded Windows 11 machine that was used to create the VDisk. I didn’t make any other changes either so I’m lost.

Each time System logs says:

“Unable to start a DCOM Server: windows.immersivecontrolpanel_10.0.8.1000_neutral_neutral_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel as Unavailable/Unavailable. The error:
 
"2147942852"
 
Happened while starting this command:
 
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel”

Windows + R and running “ms-settings:windowsupdate” gives “The application has not been provisioned”

Has anyone encountered this? Works fine on the local VM was used to create the VDisk but not on the target VDAs. Thank you for your time!

We have upgraded everything to 14.1 73.46 but the NetScaler Console shows that we are not patched under the "Virtual Patch Status" field. Opening a ticket but is this normal/a bug? When we run the IOC scan, it is clean.

Just asking if anyone sees the same thing - after doing sealing of a golden image, the shutdown hangs forever until the VM is manually powered off. MCS, DaaS, VDA 2603 on VMWare. Same with a simple reboot afterwards, hangs indefinitely, spinner going round and round even after letting it sit for 3 hours.

Feels like the September update all over again…

Hello

I see in the director an alert about a server cpu > 80% utilization I connect in the server by RDP and check eveny viewer system and application and I dont see any relevant event. Do you have any odea where can I check?

Anyone got any further detail on this ?

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697170&articleTitle=XenServer_Security_Update_for_CVE_2026_79610_CVE_2026_79610_CVE_2026_102700_and_CVE_2026_102701

Are there any POCs in the wild?

EDIT: Temporary solution for now is to change the AppProtection service in services to a run mode of manual instead of automatic after using citrix every single time (it changes back to automatic every time it runs) then reboot the computer. It then can play games without issue until citrix is launched again.

I'm required like many people who work from home to use Citrix desktop to access work space. I have to do this on my personal PC and as also like many, I am not supplied equipment from work for this.

However they are now enforcing app protection which forces itself at the PC level. This cannot be closed or worked around or I cannot log in to work. This needs to be installed at the administrator level now as app protection won't install at a local level. This causes ctxapclient32.dll and ctxapclient64.dll to inject itself into every single application that opens across all profiles/accounts on the machine. It does not matter that those accounts don't use Citrix or don't even have it installed.

That means I log into a separate windows account without citrix on it, that will never use or have anything to do with citrix, to use for personal stuff like gaming, and it still launches app protection and injects itself into the games I open. This causes the games anti-cheat software to instantly crash the game to prevent the code injection, and in the worst case gets my long term account banned for cheating.

Is there a work around to only have this install somehow at a local level? So far it really doesn't seem so. Is this something citrix can change or fix? The only solution I can think of now is to make a new partician and create a whole separate windows pc to use to work from home, which is more than a bit bothersome. Alternatively I could uninstall and reinstall citrix every single time I start/finish work. Also not a great solution. Anything else? Trying to close or do anything with app protection on other profiles doesn't work, I've tried everything you can think of and it still just injects ctxapclient64.dll into my games anyway.

Today, Citrix published a critical security bulletin for NetScaler ADC and NetScaler Gateway regarding CVE-2026-107406. 

CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial of service under specific configuration conditions. The issue carries a CVSS v4.0 base score of 9.5 and is rated Critical. We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible. As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability. 

More information here: https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/

FYI:

Citrix has just released a new Image 14.1-73.46/13.1-64.29. This is based on CVE-2026-107406.

You should consider updating your instances that are one version behind the ones listed above if the following applies:

For the following versions: Applicable only when configured as a SAML IdP:
NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive
NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive
NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive
NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive

For the following versions: Applicable only when configured as a SAML SP or SAML IdP:
NetScaler ADC and NetScaler Gateway before 14.1-73.37
NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS
NetScaler ADC and NetScaler Gateway before13.1-64.23
NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279

Citrix just pushed this new version without notification to all of their own tenants.

New CVE ?

I've been thinking about how organizations are approaching NetScaler as they modernize their Citrix environments, particularly with more customers moving toward Citrix DaaS and cloud-managed services.

One question that keeps coming up is whether organizations still need NetScaler or whether Citrix Gateway Service is sufficient.

I think the answer depends heavily on what NetScaler is actually doing in the environment.

If you're primarily using NetScaler Gateway for external HDX access, Gateway Service can make a lot of sense. You're potentially eliminating customer-managed Gateway appliances, firmware upgrades, HA configurations, and some of the operational overhead that comes with maintaining that infrastructure.

But there's another side to this conversation that I don't think gets enough attention.

NetScaler isn't just a Citrix Gateway. Depending on the architecture, it may also be handling application load balancing, WAF, GSLB, authentication policies, SSL offloading, content switching, and traffic management for applications completely unrelated to Citrix.

I've seen environments where NetScaler has become unnecessarily complex over time, but I've also seen situations where organizations don't fully understand how many services depend on it until they start discussing replacement.

And that raises a bigger question about modernization.

Are we actually simplifying the architecture, or are we just moving individual functions to different platforms without understanding the dependencies?

I'm interested in hearing what others are seeing in their environments.

• Have you moved from NetScaler Gateway to Citrix Gateway Service? What improved, and what limitations did you encounter?
• Are you retaining NetScaler primarily for ADC, WAF, GSLB, or advanced authentication requirements?
• Have you found meaningful operational or cost savings after moving to Gateway Service?
• For those running hybrid environments, are you finding value in keeping both?

My view is that neither approach is automatically better. If Gateway Service meets the requirements, maintaining unnecessary Gateway infrastructure doesn't make sense. But removing NetScaler without understanding its broader role can create an entirely different set of problems.

Curious what others are experiencing, especially in larger or more security-sensitive environments.

When installing the latest 2507 LTSR CU2 on a Windows 11 PC it seems to break internet traffic from the PC and makes it almost unusable. Anyone seen this before?

Recently, we've gotten reports of users on the newest mac OS, browser, workspace app getting "your request is being processed" after entering AD credentials into the Citrix Gateway page before it hits the Duo auth & subsequent storefront. Trying in iOS, I get the same outcome.

This is an on-prem storefront (2507CU1 for all CVAD components) and netscaler(current firmware). Nothing has changed in authentication policy/profile and it still works without issue for windows users. We are not supporting users logging into workspace on non-corporate devices, just launching ica from web storefront.

Did I miss a change somewhere?

Curious to know if anyone has implemented a product that works with ICA other than NetScaler

We are currently setup on prem. On prem netscalers, storefronts, delivery controllers, etc. We connect to several on-prem clusters running Xenserver for our Virtual desktops. We create a master image, snapshot it, then update our machine catalog. The delivery controllers then update the virtual desktops running in Xenserver (we use Citrix MCS).

We are looking to migrate the management elements into Citrix Cloud. So the end goal will be to remove on prem servers for delivery controllers, FAS, storefronts, netscalers, etc, and just have it all moved into Citrix Cloud. The actual VDA's will remain on prem connecting to our Xenserver clusters.
So essentially, management aspects in the cloud, compute remains on prem.

We have already configured cloud connectors and single sign on via Entra. We have some older hardware that I've managed to install Xenserver onto, and connecting it to the "Hosting" section in Citrix Cloud, I've managed to do some basic testing with some machine catalogs in the cloud, and all seems to be working perfectly.

I've seen a few different documents articles that explain how to actually go about performing the migration into cloud. We're a 24/7 business, and we're pretty standardised, so we only really have a couple of machine catalogs and delivery groups to serve most users.

To roll this out at our own pace, I wanted to add our existing live Xenserver clusters on prem into the "Hosting" section within the Citrix cloud platform. I'll then create some new catalogues, making sure that the computer names do not match the same as the on prem ones. My hope is that because the catalog and delivery group names are different on prem vs in cloud, and because the computer names are different, there will be no conflict, despite both the on prem and cloud delivery controller being connected to the same Xenserver cluster instance.

My thought process is to provision 10 or 20 new virtual desktops from cloud into the Xenserver cluster, and then I can just use some policies to start switching a few test users to the new storefront URL. Then it will just become a balancing act as we progress and migrate people to the new storefront URLs, reducing the number of available machines on prem, and bringing more online in the cloud.

My mind seems to think this is logical, to keep the systems as seperated as possible, which I'd prefer, but I cannot get away from having to use the same Xenserver cluster for the compute elements. I'm just not sure if having the Xenserver cluster authenticated to both on prem and cloud controls at the same time could potentially cause some conflict?

Thoughts on this are most appreciated.

We’ve been having issues with Citrix Provisioning for several weeks now.

At first, the problem only affected maintenance work on our 2025 images. The target devices would frequently just freeze. In those cases, the maintenance target suddenly lost access to its C: drive. At the same time, on the PVS side, we could see multiple port changes, as if the connection was constantly failing to establish properly. We also run Wireshark on both machines, but there are no dropped packages.

For the last few days, the same issue has also started affecting maintenance on our 2019 images.

There may also be a connection to CTX servers crashing during normal operation. In terms of timing, those crashes often seem to coincide with image maintenance work.

What we’ve tried so far:

Rebuilt the 2025 images from scratch multiple times

Ruled out GPOs

Ruled out Software inside images

Updated VMware Tools

Updated the PVS Version (2507 to 2607)

Disabled NTFS deduplication — no improvement

Disabled Offloading on Target and Server-NIC

Rebuilt PVS-server completely from scratch, using Windows Server 2025 on newer storage

4x PVS-Server (3x 2019, 1x 2025) with 2607.

VMware 8.0.3 with NSX

Has anyone seen similar behavior or has any idea what else we should check?

Being already patched for 88771. I took advantage of adversaries exposing their cards and pulled several scipts off attacker server's between Thursday-Friday just to see what a successful exploit would have done. Which resulted in 3 trends I used to build a list of IOCs. That came in handy today. Hope im wrong but highly expect this will turn out to be some successful rce for the ones that hit the mark.