Citrix Workspace Control and Session Roaming

Last Updated on July 27, 2021

Citrix Workspace Control and Session Roaming work hand in hand in most instances but in quite a few, they work independently.

Citrix Workspace Control in Receiver for Web sites

In simple definition, when Citrix Workspace control is enabled, virtual desktops and published applications follow the user from device to device. Suppose a user has an active session of Microsoft Excel on Workstation A from Receiver for Web Sites. The user then goes to a meeting room, logs into Workstation Z, and opens up Receiver for Web Sites. The moment she does that, Excel, which can either be in disconnected or active state, will be transferred from Workstation A to Workstation Z.

Citrix Workspace control is by default enabled for Receiver for web sites and its default behavior is to Reconnect on user logon or web page refresh. Go to Storefront console, right click the store and select Manage Receiver for Web site. Click Configure in next window and switch to Workspace Control vertical tab. Let’s understand these options one by one.

Logoff action – Determines what should happen to opened apps and desktops when user logs off from Receiver for Web sites (RfW sites).

• Disconnect – (Default) Apps and Desktops are automatically disconnected from client device but remain running on the server. In studio, application or desktop state will remain Active but session state will change from Active to Disconnected. If the user logs in to Receiver for Web site on any other client device, Workspace control will automatically open all application and desktops from previous session. Please understand that same existing session will be used, however, some properties (session tab in 2^nd half) of the session will change, for instance, Client Name and Client Address. Log On time will not change until application is terminated. Same session is used because of the default configuration of Session Roaming, which is Always. More on Session roaming later in this article.

• Terminate – Apps and Desktops sessions are terminated on the server. In studio, first the application state will change from Active to Application not running and then session will also be terminated from the server. If the user logs in to Receiver for Web site on any other client device, there is no application to automatically open up using Workspace Control. This cannot be worked around with Application Lingering. If application lingering is enabled on the delivery group and Logoff action for Workspace Control is set to Terminate then at the time of log off, application state will change to Lingering as expected but soon the session will be terminated.

• None – Apps and Desktops session remain running on the client device as well as on the server. In Studio, the session state as well as application state remains Active. If user logs into RfW sites on another workstation, Workspace Control will transfer all the applications and desktops from previous workstation to this workstation. Again, same session will be used because of Session Roaming’s default configuration i.e., Always.

Workspace Control: Enable Workspace Control – Unchecking this option will disable Workspace Control for Receiver for Web sites. Workspace Control can be disabled for Citrix Workspace app for windows separately. Later in this article, we will see how to disable Workspace control for Receiver for Web sites and Citrix Workspace app/Receiver at one place.

Automatically reconnect to the session when users log on – With this option disabled, if user logs into some another or same workstation then Workspace Control will not be able to automatically open applications and desktops from previous disconnected or active session. In other words, opened applications from previous session (session state: Active) will not be automatically transferred and/or closed applications from previous session (session state: Disconnected) will not automatically open. In such situation, make sure at least Show Reconnect button is enabled. More on this next.

Reconnect and Disconnect button – Show reconnect button and Show disconnect button, once enabled, allow users to manually disconnect or reconnect to their sessions. Disconnect button can be useful when logoff action is set to Terminate but users want their applications and desktops to remain active on server when they log off. In that case users can simply click Disconnect button. This will close all applications and desktops on the client device, user will be logged off from RfW sites, session state in studio will change to Disconnected but application state will remain Active.

Now, if “Automatically reconnect to the session when users log on” is enabled and user logs back in to same user device or re-logs into some other workstation, Workspace Control will automatically open all applications and desktops from previous disconnected or active session. If “Automatically reconnect to the session when users log on” is disabled then after logon, user can click Connect to reconnect with previous disconnected or active session.

Important Points

Here is a list of requirements, conditions and restrictions for Workspace Control configuration in Receiver for Web sites. Each point is sourced from Citrix documentation and I have not rephrased them in my words. Wherever required, I added some additional information.

Source: Optimize user experience (Storefront)

• Workspace control is not available when Citrix Receiver for Web sites are accessed from hosted desktops and applications.
• For users accessing Citrix Receiver for Web sites from Windows devices, workspace control is only enabled if the site can detect that Citrix Workspace app is installed on users’ devices or if Citrix Workspace app for HTML5 is used to access resources.
• To reconnect to disconnected applications, users accessing Citrix Receiver for Web sites through Internet Explorer must add the site to the Local intranet or Trusted sites zones.
• If there is only one desktop available for a user on a Citrix Receiver for Web site that is configured to start single desktops automatically when the user logs on, that user’s applications are not reconnected, regardless of the workspace control configuration.
• Users must disconnect from their applications using the same browser that was originally used to start them. Resources started using a different browser, or started locally from the desktop or Start menu using Citrix Workspace app, cannot be disconnected or shut down by Citrix Receiver for Web sites.

Source: Resource Shortcut topic of User access options (Storefront)

• By default, both workspace control and automatic desktop starts are disabled when users access Citrix Receiver for Web sites through shortcuts.

Source: CEIP topic of Install, set up, upgrade, and uninstall (Storefront)

• When Citrix CEIP (Customer Experience Improvement Program) is enabled, anonymous data about list of Booleans denoting whether “Workspace Control” is enabled (“True” or “False”) for each Receiver for Web site is sent to Citrix.

Source: 5^th point of Configure how resources are displayed for users (Storefront)

• (RELATED TO 4^TH BULLET POINT OF 1^ST SOURCE) When the autoLaunchDesktop (userInterface tag in web.config file at C:\inetpub\wwwroot\Citrix\storenameWeb\) attribute is set to true (or Auto launch desktop is disabled at Storefront > Manage receiver for web > Client Interface Settings) and a user for whom only one desktop is available logs on, that user’s applications are not reconnected, regardless of the workspace control configuration.

Source: Manage Deployment > Sessions (CVAD)

• Workspace control is available only for Citrix Workspace app users who access desktops and applications through a Citrix StoreFront connection. By default, workspace control is disabled for virtual desktop sessions, but is enabled for hosted applications. Session sharing does not occur by default between published desktops and any published applications running inside those desktops.

Citrix Workspace Control in Workspace App/Receiver for Windows

There are three ways in which workspace control can be managed for Workspace app and Receiver 4.2.100 and newer: Group policy, UI and Registry. The default configuration is Automatically reconnect on workspace app launch or app refresh. You can confirm this by looking at the value of WSCReconnectedMode at one of the following registry paths:

For 64 bit – HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\Dazzle

For 32 bit – HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Dazzle

• 0 = do not reconnect to any existing sessions
• 1 = reconnect on launch
• 2 = reconnect on application refresh
• 3 = reconnect on launch or refresh
• 4 = reconnect when Citrix Workspace interface opens
• 8 = reconnect on Windows logon
• 11 = combination of both 3 and 8

The most efficient way to manage Workspace control reconnect for Workspace app is through Group policy. If you haven’t downloaded Workspace app admx files already then go to download page, expand Downloads for admin (Deployment Tools) and click Download files under Citrix ADMX/ ADML Templates for Group Policy Editor ****. Once downloaded, copy all admx and appropriate adml files to policy definition folder inside sysvol of your domain.

Edit (or create a new policy and attach it to an OU that holds target client devices) a group policy that applies to target client devices. Go to Computer Configuration/Policies/Administrative Templates/Citrix Components/Citrix Workspace/SelfService. Enable Control when Citrix Workspace attempts to reconnect to existing sessions and choose the appropriate combination of reconnect condition. There are many options and they are self-explanatory. In my opinion, the default option, Launch, Refresh will work fine in most of the Citrix Virtual Apps and Desktops designs.

If not exclusively disabled, users can manage Workspace Control reconnect from Workspace app UI. Right click Workspace app icon in the notification area and click Advanced Preferences. Click Shortcut and Reconnect and switch to Reconnect Options tab.

To manage Workspace control reconnect behavior for Workspace app by using registry, visit getting started page and scroll down to Manage workspace control reconnect.

Session Roaming

Session Roaming allows sessions to roam with the user between the devices. Session Reconnect behavior of Session Roaming determines how Workspace Control will work. To find current configuration, execute Get-BrokerEntitlementPolicyRule (for desktop sessions) or Get-BrokerAppEntitlementpolicyRule (for application sessions) in PowerShell. Session Reconnect: Always is the default setting. Other possible values are DisconnectedOnly and SameEndpointOnly.

*While explaining each Session Reconnect behavior, wherever I have written Workspace Control is working or Workspace Control is enabled, I am implying that Workspace Control is configured with its default setting i.e., Automatically Reconnect when users logon for RfW sites and Reconnect on Workspace app launch or app refresh for Workspace App/Receiver for windows.

SameEndpointOnly – Suppose Notepad is published from Delivery Group DG-WS2019-RDSH and Session Reconnect behavior of Session Roaming for this Delivery group is configured with SameEndpointOnly. Let’s understand how Session Roaming will work with different states of the session and what impact will Workspace Control have on this.

Set-BrokerAppEntitlementPolicyRule DG-WS2019-RDSH -SessionReconnection SameEndpointOnly

• Disconnected (Session state is disconnected either due to Session time-out policy (not storefront timeout) or logoff action: Disconnect setting in Workspace Control or manually disconnected by user using Disconnect option in RfW sites) –
  • If user logs into RfW sites on another workstation, Workspace Control will not be able to automatically open applications and desktops from previous session. Now, if user clicks on Notepad, Session roaming will not be able to open Notepad on this workstation from the existing session. In Studio, after Notepad is opened, there will be two sessions for the user – one from previous workstation (Session state: Disconnected | Application State: Active) and second from this workstation (Session state: Active | Application State: Active). New applications launched from this workstation (if they are published from same delivery group) will be able to share the session with Notepad. See image below.
  • If user logs back into RfW sites on same workstation, Workspace Control will automatically open Notepad, and Session Roaming will utilize the existing session to open it. As a result, the session state will change to Active from Disconnected.
  • If user logs off from RfW sites, whichever option is configured in logoff action of Workspace Control will take place. Session Roaming has nothing to do with it.

• Active (Session state is Active) –
  • If user logs into RfW sites on another workstation, Workspace Control will not be able to automatically open applications and desktops from previous session. Now, if user clicks on Notepad, Session Roaming will not be able to transfer Notepad to this workstation from previous workstation. It will open Notepad in a new session. As a result, there will be two sessions in Studio for that user – one from previous workstation (Session state: Active | Application State: Active) and second from this workstation (Session state: Active | Application State: Active). See image below.
  • Since session state is Active then even if user logs back into RfW sites on same workstation (assuming storefront session timeout has logged the user off from RfW sites), Workspace Control would not do anything. Similarly, Session Roaming will also do nothing.
  • Again, if user logs off from RfW sites, whichever option is configured in logoff action of Workspace Control will take place. Session Roaming has nothing to do with it.

DisconnectedOnly – Reconnect only to sessions that are already disconnected; otherwise, create a new session.

In below screenshot, user opens Notepad on Device 01, goes to Device 02 and logs into Receiver for Web sites or refreshes apps in Workspace app/Receiver. Nothing will happen regardless of Workspace Control state (enabled or disabled). Now user clicks on Notepad icon on Device 02. Since session is already in active state from Device 01, a new session will be created.

This time user launches Notepad on Device 01 and soon the session gets disconnected (either manually by clicking Disconnect button in Account settings, availed through Workspace Space Control or because of session timeout policy (not storefront timeout) or because Workspace Control’s logoff action is set to Disconnect). Now user logs into Receiver for Web sites or refreshes apps in Workspace app/Receiver on Device 02. If workspace control is enabled, Notepad will be automatically transferred to Device 02 and no new session will be created. If Workspace Control is disabled then user needs to click on Notepad icon and it should be automatically transferred.

Set-BrokerAppEntitlementPolicyRule DG-WS2019-RDSH -SessionReconnection DisconnectedOnly

Always – This is what happens with default configuration of Session Reconnect behavior of Session Roaming:

• Workspace Control is disabled – Regardless of the client device (same or other) and whether the session state is active or disconnected, applications and desktops will not automatically open up during logon or app refresh. User needs to click the application or desktop icon to have all of them transferred from previous session to current client device.
• Workspace Control is enabled – Regardless of the client device (same or other) and whether the session state is active or disconnected, applications and desktops will be automatically transferred from previous session to current client device during logon and app refresh.

Effects from other setting:

Source: Sessions | Citrix Virtual Apps and Desktops 7 2106

Disabling session roaming is affected by the application limit Allow only one instance of the application per user in the application’s properties in the delivery group.

• If you disable session roaming, then disable the “Allow only one instance …” application limit.
• If you enable the “Allow only one instance …” application limit, do not configure either of the two values that allow new sessions on new devices.

Site Entitlement Policy and Desktop/Application Rules

Site Entitlement Policy: It defines rules controlling users’ entitlements to desktop and application sessions from pools of shared machines. Each pool is defined by a desktop group. The entitlement policy comprises a set of rules. Each rule grants users a single entitlement to a desktop or application session in a specified desktop group.

During Site creation, a single Entitlement policy and a single Application and Desktop rule are created per delivery group. As a result, a Delivery Group of type DesktopsAndApps will have one Desktop Rule and one Application rule in the entitlement policy. A Delivery Group of type AppsOnly and DesktopsOnly will have one Application and Desktop Rule respectively. Notice the output of both commands in second screenshot for Delivery Group with Uid 2.

By default, the Application rule is assigned the name, knows as Administrative Name, of the delivery group. Later, it can be renamed using Rename-BrokerAppEntitlementPolicyRule.

Before rename:

After rename:

By default, the name of Desktop Group is appended with _1. Similar to Application Rule, Desktop Rule can be renamed using Rename-BrokerEntitlementPolicyRule.

A new rule can be created using New-BrokerAppEntitlementPolicyRule (or New-BrokerEntitlementPolicyRule). A Delivery Group of any delivery type can have only one Application Rule. Attempt to create a new Application Rule will trigger an exception – New-BrokerAppEntitlementPolicyRule: Operation is incompatible with desktop group. You first need to delete current Application Rule using Remove-BrokerAppEntitlementPolicyRule and then create a new one.

In first screenshot below, I tried to create a new Application Rule in Delivery Group of type AppsOnly. In second screenshot, I tried the same for a Delivery Group of delivery type DesktopsAndApps.

A Delivery Group of type: DekstopsOnly or DesktopsAndApps can have more than one Desktop Rule. In below example, I created a new Desktop Rule with name Delhi Users in the Entitlement policy of Delivery Group with Uid 3 (Name: DG-WIN10-Common, Type: AppsAndDesktops). This new Desktop rule restricts the member of Delhi-Users security group to reconnect to their desktop sessions on the same client device only.

Gather more knowledge about cmdlets related to Entitlement Policy by vising following pages:

• Get-BrokerAppEntitlementPolicyRule – CVAD 2006 SDK Documentation
• Rename-BrokerAppEntitlementPolicyRule – CVAD 2006 SDK Documentation
• New-BrokerAppEntitlementPolicyRule – CVAD 2006 SDK Documentation
• Set-BrokerAppEntitlementPolicyRule – CVAD 2006 SDK Documentation
• Remove-BrokerAppEntitlementPolicyRule – CVAD 2006 SDK Documentation
• Net-BrokerEntitlementPolicyRule – Citrix PowerShell SDK Documentation
• Set-BrokerEntitlementPolicyRule – Citrix PowerShell SDK Documentation
• Get-BrokerEntitlementPolicyRule – Citrix PowerShell SDK Documentation

Disable Citrix Workspace Control for Receiver for Web sites and Workspace App/Receiver for windows

To disable Workspace Control at one place for both; Receiver for Web sites and Workspace App/Receiver, follow below step. Please note that this process has no impact on Auto Client Reconnect and Session Reliability. Also, there is no impact on Session Roaming but as described above, the session reconnect behavior will vary.

Please also understand that below steps will only disable Automatic Reconnect behavior for Receiver for Web sites. If you have enabled Connect and Disconnect buttons then they will continue to function.

Select the store, right click and select Configure Store Settings. Go to Advanced Settings tab and check/uncheck Allow session reconnect.

Workspace Control for Citrix Workspace app/Receiver and Receiver for Web sites can be disabled by using PowerShell as well.

First, close Storefront console if open and import the StoreFront PowerShell modules using below code:

$dsInstallProp = Get-ItemProperty ` -Path HKLM:\SOFTWARE\Citrix\DeliveryServicesManagement -Name InstallDir
$dsInstallDir = $dsInstallProp.InstallDir
& $dsInstallDir\..\Scripts\ImportModules.ps1

Then execute Set-DSAllowSessionReconnect with appropriate switches. Replace ../Store with the name of your store.

Set-DSAllowSessionReconnect -SiteId 1 -VirtualPath /Citrix/Store -IsAllowed $false (or $true)

Alternative way to disable Workspace Control for Workspace app/receiver is to set the value of WSCReconnectModeUser and WSCReconnectMode to 0 at one of these registry locations on the client device. WSCReconnectModeUser needs to created. WSCReconnectMode is created during the installation of Workspace app.

For 64 bit – HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Dazzle

For 32 bit – HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\\Dazzle

Recommended Reads

1. A Deeper look into Workspace Control and its challenges – BramWolfs.com
2. Workspace Control – Connect and Disconnect button in Receiver for Web are not visible – CTX229568
3. Workspace control Stops Working – CTX225625
4. How to disable Workspace Control Session Roaming on Citrix Virtual Apps and Desktops – CTX218855
5. Unable to Disable Workspace Control on StoreFront and XenApp 7.6 – CTX202493
6. How to Enable/Disable Workspace Control in StoreFront – CTX200828
7. Disable or enable workspace control reconnect – Configure user access (Storefront)
8. When WSCReconnectMode Value 8 is Set a Windows Logoff and Logon Happens, Existing Sessions Should Reconnect Automatically – CTX203891
9. Applications Launched from Within Published Desktop Disconnects – CTX136339
10. How to Stop Receiver from Launching All the Published Applications Automatically – CTX212903
11. Stop Multiple Logins Using the Same User Account – CTX208379
12. XenApp 7.5 multiple sessions with the same user account – discussion.citrix.com/topic/351114
13. Session Roaming – Sessions (CVAD)
14. How to launch multiple hosted Desktops or Application using same user account from different client devices – CTX216441
15. Session Roaming Failed or Session Disconnected in XenDesktop 7.15 – CTX239137

If you are interested, see How to install and configure Storefront 1912 LTSR.