topic Re: Cortex XDR on Citrix non-persistent multi-user server in Cortex XDR Discussions

Cortex XDR on Citrix non-persistent multi-user server

Remo — Tue, 19 Nov 2024 21:32:01 GMT

Hi community

Quite often we have issues with cortex xdr on citrix infrastructure. Currently meinly with windows server 2022 we are in the situation where it is not possible to run cortex at all because of possibel servercrashes which are not yet analyzed and resolved. So we needed to - at least temporary - change to microsoft defender. I wanted to ask here what are your solutions to let cortex xdr run properly on citrix servers without bothering the user too much? Do you use exceptions for different paths or specific configurations?
Would be great to collect some informations on how to do this properly as I assume this could also help others here.

Looking forward to your replies 🙂
Remo

Re: Cortex XDR on Citrix non-persistent multi-user server

jmazzeo — Fri, 22 Nov 2024 18:00:45 GMT

Hi @Remo, thanks for reaching us using the Live Community.

Have you installed the agents following our specific procedure fore VDI environments?: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.6/Cortex-XDR-Agent-Administrator-Guide/Cortex-XDR-agent-for-virtual-environments-and-desktops

Pay attention to this note in the linked doc:

If this post answers your question, please mark it as the solution.

Re: Cortex XDR on Citrix non-persistent multi-user server

Remo — Sat, 23 Nov 2024 00:49:01 GMT

Hi @jmazzeo

Thanks for your answer. Yes we installed cortex according to this document. But on server 2022 we still have big issues. At least until version 8.5.0.

We actually always used the TS_ENABLED=1 param for these multi-user servers, but TAC told us to use the VDI_ENABLED=1 option for out installation, so since about 2 month. Which option would you recommend and are there other hints on how to successfully use cortex xdr on citrix servers?

Re: Cortex XDR on Citrix non-persistent multi-user server

E.Jafarov — Sat, 23 Nov 2024 05:56:08 GMT

Hi Remo

You can disable event collector ("cytool event_collection disable") to reduce CPU usage if high. If does not work , you could create support ticket. The support team will provide YARA rule to map exception profiles, but protection capability performance will reduce slightly

Re: Cortex XDR on Citrix non-persistent multi-user server

Remo — Sat, 23 Nov 2024 08:07:43 GMT

@E.Jafarov to be honest, this does not really help. The issues we have seem to be quite complex as support so far is still analyzing the issue. It is not only the high cpu (even if disabling event collection is also not a solution as if you have cortex xdr you probably want this feature), the servers simply and then need to rebooted. Which results in hours of work lost for our customers every time it happens ...

Re: Cortex XDR on Citrix non-persistent multi-user server

Remo — Sat, 30 Nov 2024 07:47:45 GMT

The troubleshooting goes on. So far support has multiple memory dumps and cortex logs. Unfortunately so far I don't know any result of the analysis. Next week we plan to have a call between Paloalto and Citrix in order to move on in this situation.

At least so far it looks like with version 8.6.0 the situation seem to be more stable.

Re: Cortex XDR on Citrix non-persistent multi-user server

backi0584 — Fri, 21 Mar 2025 08:15:10 GMT

Good morning,

we are experiencing the same issues with the Cotrex XDR Agent (8.7.0.7735) and Citrix VDA (2402 LTSR) on Windows Server 2022 (21H2).

The agent is installed correctly, and the VMs are running properly. However, they suddenly lose connection.

All sessions are disconnected, and new sessions—including Remote Desktop—cannot be established until the VM is rebooted.

This issue occurs even with a low user count and minimal server load, affecting different VMs at various times and durations since startup.