Diagnose user logon issues

Use Logon Duration data to troubleshoot user logon issues.

Logon duration is measured only for initial connections to a desktop or app using HDX. This data does not include users trying to connect with Remote Desktop Protocol or reconnect from disconnected sessions. Specifically, logon duration is not measured when a user initially connects using a non-HDX protocol and reconnects using HDX.

In the User Details view, the duration is displayed as a number value below which the time the logon occurred is displayed and a graph of the phases of the logon process.

As users logon to Citrix Virtual Apps and Desktops, the Monitor Service tracks the phases of the logon process from the time the user connects from Citrix Workspace app to the time when the desktop is ready to use.

The large number on the left is the total logon time and is calculated by combining the time spent establishing the connection and obtaining a desktop from the Delivery Controller with the time spent to authenticate and log on to a virtual desktop. The duration information is presented in seconds (or fractions of seconds).

Prerequisites

Ensure that the following prerequisites are met for logon duration data and drilldowns to appear:

1. Install Citrix User Profile Manager and Citrix User Profile Manager WMI Plugin on the VDA.
2. Ensure that the Citrix Profile Management Service is running.
3. For XenApp and XenDesktop sites 7.15 and earlier, disable the GPO setting, Do not process the legacy run list.
4. Audit process tracking must be enabled for Interactive Session drilldown.
5. For GPO drilldown, increase the size of Group Policy operational logs.

Note:

Logon duration is supported only on the default Windows shell (explorer.exe) and not on custom shells.

Steps to troubleshoot user logon issues

1. From the User Details view, troubleshoot the logon state using the Logon Duration panel.
   • If the user is logging on, the view reflects the process of logging on.
   • If the user is logged on, the Logon Duration panel displays the time it took for the user to log on to the current session.
2. Examine the phases of the logon process.

Logon process phases

Brokering

Time taken to decide which desktop to assign to the user.

Machine Start-up

If the session required a machine start, this is the time taken to start the virtual machine. The following sub-section provides breakdown of the time taken to start a virtual machine during different phases:

• Power On - Displays the time taken to power on a virtual machine
• Boot-up and registration -  Displays the time taken to boot up and register a virtual machine

You can use the collapsible button to collapse or expand the options under the Machine Start-up.

HDX connection

Time taken to complete the steps required in setting up the HDX connection from the client to the virtual machine.

Authentication

Time taken to complete authentication to the remote session.

GPOs

If Group Policy settings are enabled on the virtual machines, this is the time taken to apply group policy objects during logon. The drill-down of the time taken to apply each policy as per the CSEs (Clients-Side Extension) is available as a tooltip when you hover on the GPO bar. Click Detailed Drilldown to see a table with the policy status, and the corresponding GPO name. The time durations in the drilldown represent the CSE processing time only and do not add up to the total GPO time. You can copy the drill-down table for further troubleshooting or use in reports. The GPO time for the policies is retrieved from Event Viewer logs. The logs can get overwritten depending on the memory allocated for the operational logs (default size is 4 MB). For more information about increasing the log size for the operational logs, see the Microsoft TechNet article https://docs.microsoft.com/en-us/previous-versions/tn-archive/dd277416(v=technet.10).

Logon scripts

If logon scripts are configured for the session, this is the time taken for the logon scripts to be run.

Profile load

If profile settings are configured for the user or the virtual machine, this is the time taken for the profile to load.

If Citrix Profile Management and FSLogix are configured, the Profile Load bar includes the time taken by Citrix Profile Management and FsLogix to process user profiles. This information helps administrators to troubleshoot high profile processing duration issues. When Profile Management and FSLogix are configured, the Profile Load bar displays an increased duration. This increase is caused by this enhancement and does not reflect a performance degradation. This enhancement is available on VDA versions 2407 or later.

Hovering over the Profile Load bar displays a tooltip showing the user profile details for the current session. This additional information can help troubleshoot high profile load issues.

Click Detailed Drilldown to drilldown further into each individual folder in the profile root folder (for instance, C:/Users/username), its size, and the number of files (including files inside nested folders).

Profile drilldown is available on VDAs 1811 and later. Using the profile drilldown information, you can resolve issues involving a high profile load time. You can:

• Reset the user profile
• Optimize the profile by removing unwanted large files
• Reduce the number of files to reduce the network load
• Use profile streaming

By default, all folder names are visible. To hide the folder names, edit the registry values on the VDA machine using the following steps:

Warning:

Adding and editing the registry incorrectly can cause serious problems that might require you to reinstall your operating system. Citrix does not guarantee that problems resulting from the incorrect use of the Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.

1. On the VDA, add a new registry value ProfileFoldersNameHidden at HKEY_LOCAL_MACHINE\Software\Citrix\Director\
2. Set the value to 1. This value must be a DWORD (32-bit) value. Folder names visibility is now disabled.
3. To make the folder names visible again, set the value to 0.

Note:

You can use GPO or PowerShell to apply the registry value change on multiple machines. For more information about using GPO to deploy registry changes, see the blog.

Additional information

• Profile drilldown does not consider redirected folders.
• NTUser.dat files in the root folder might not be visible to end users. However, they are included in the profile drilldown and displayed in the list of files in Root Folder.
• There are some hidden files in AppData folder which are not included in profile drilldown.
• Number of files and profile size data might not match with the data in the Personalization panel due to certain Windows limitations.

Interactive Session

This is the time taken to “hand off” keyboard and mouse control to the user after the user profile has been loaded. It is normally the longest duration out of all the phases of the logon process and is calculated as Interactive Session duration = Desktop Ready Event Timestamp (EventId 1000 on VDA) - User Profile Loaded Event Timestamp (EventId 2 on VDA). Interactive Session has three subphases: Pre-userinit, Userinit, and Shell. Hover over the Interactive Session to see a tooltip showing the following:

• subphases
• the time taken for each subphase
• the total cumulative time delay between these subphases

You can use the collapsible button to collapse or expand the options under the Interactive Session.

Note:

This feature is available on VDAs 1811 and later. If you have launched sessions on sites earlier than 7.18 and then upgraded to 7.18, a ‘Drilldown unavailable due to server error’ message is displayed. However, if you have launched sessions after an upgrade, no error message is displayed.

To view the time duration of each subphase, enable Audit process tracking on the VM (VDA). When the Audit process tracking is disabled (default), the time duration of Pre-userinit and the combined time duration of Userinit and Shell are displayed. You can enable Audit process tracking through a Group Policy Object (GPO) as follows:

1. Create a GPO and edit it using the GPO editor.
2. Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy.
3. On the right pane, double-click Audit process tracking.
4. Select Success and click OK.
5. Apply this GPO to the required VDAs or Group.

For more information about Audit process tracking and enabling or disabling it, see https://docs.microsoft.com/en-us/previous-versions/ms813609(v=msdn.10) in the Microsoft documentation. Logon Duration panel in the User Details view.

• Interactive Session – Pre-userinit: This is the segment of Interactive Session which overlaps with Group Policy Objects and scripts. This subphase can be reduced by optimizing the GPOs and scripts.
• Interactive Session – Userinit: When a user logs on to a Windows machine, Winlogon runs userinit.exe. Userinit.exe runs logon scripts, re-establishes network connections, and then starts Explorer.exe, the Windows user interface. This subphase of Interactive Session represents the duration between the start of Userinit.exe to the start of the user interface for the virtual desktop or application.
• Interactive Session – Shell: In the previous phase, Userinit starts the initialization of Windows user interface. The Shell subphase captures the duration between the initialization of the user interface to the time user receives keyboard and mouse control.
• Delay: This is the cumulative time delay between the Pre-userinit and Userinit subphases and the Userinit and Shell subphases.

The total logon time is not an exact sum of these phases. For example, some phases occur in parallel, and in some phases, extra processing occurs that can result in a longer logon duration than the sum. The total logon time does not include the ICA idle time that is the time between the ICA file download and the ICA file launch for an application. To enable the automatic opening of ICA file upon application launch, configure your browser for automatic ICA file launch upon download of an ICA file. For more information, see CTX804493.

Note:

The Logon Duration graph shows the logon phases in seconds. Any duration values below one second are displayed as subsecond values. The values above one second are rounded to the nearest 0.5 second. The graph has been designed to show the highest y-axis value as 200 seconds. Any value greater than 200 seconds is shown with the actual value displayed above the bar.

Export data

Along with the default Logon Duration Phases table options, which is Session Logon Phase and Duration, you can also choose the following columns on the Session Logon page:

• Start time
• End time
• Delivery Group - 7d Avg (sec)
• User - 7d Avg (sec)

You can also export the preceding data to a .CSV file.

Troubleshooting tips

To identify unusual or unexpected values in the graph, compare the amount of time taken in each phase of the current session with the average duration for this user for the last seven days, and the average duration for all users in this delivery group for the last seven days.

Escalate as needed. For example, if the Machine Start-up is slow, the issue might be in the hypervisor, so you can escalate it to the hypervisor administrator. Or, if the brokering time is slow, you can escalate the issue to the site administrator to check the load balancing on the Delivery Controller.

Examine unusual differences, including:

• Missing (current) logon bars
• Major discrepancy between the current duration and this user’s average duration. Causes include:
  • A new application was installed.
  • An operating system update occurred.
  • Configuration changes were made.
  • Profile size of the user is high. In this case, the Profile Load is high.
• Major discrepancy between the user’s log on numbers (current and average duration) and the delivery group average duration.

If needed, click Restart to observe the user’s logon process to troubleshoot issues, such as Machine Start-up or Brokering.