WS2016 Start Menu not clickable when connecting through XenApp 7.15 session

[gwynll | 77]

I've built a brand new Windows Server 2016 image, to be used for publishing a full server desktop (XenApp 7.15).  It's booted up from a PVS vDisk in Standard Mode.  When I log in through the XenApp published desktop, clicking the Start Menu does nothing - the Start Menu doesn't even appear.  Same goes for the Date and Time - the calendar doesn't pop up.  Clicking taskbar pinned items works.  Also, right-clicking anything (including Start Menu and Date&Time) works fine.

 

When I log on with the same user through a XenCenter console screen, I don't have the above problems.

 

I've read some people say that setting the GPO...  Administrative Templates / Windows Components / App Privacy / Let Windows Apps run in the background  ...causes this behaviour, but I've done a Group Policy Modelling and can confirm that this is not set, and the corresponding registry setting isn't set either.

 

Although UPM is disabled via Citrix Policy, I've stopped the UPM service, re and logged on again, but it's not mand a different.  I also stopped the AppSense User Virtualization service to no avail.

 

I'm using a mandatory profile, and I believe that the problem is linked to this, because if I delete the mandatory profile folder (thereby forcing a temp profile) then the Start Menu opens fine.

 

The way I did my mandatory profile is the same way that I've done many times before - I have another image that is Windows Server 2008R2 and has been working fine for years. I created an user, logged in with that, set everything up as I wanted it, rebooted, copied the folder to somewhere else on the disk, deleted a couple of things like the Local and LocalLow folders, sorted the file permissions and loaded the hive into regedit to sort the registry permissions, then renamed NTUSER.DAT, then named the folder TSmandatory.v6 (whereas my 2008R2 one was TSmandatory.v2)

 

Any idea why my Start Menu is broken?

Thanks.

[gwynll | 77]

Fixed it now.

 

In the steps I took above - giving permissions to Authenticated Users to that reg key - it doesn't work if I give Read - I have to give Full Control.  I had to do this whilst logged in as the user (not while loading the hive in Regedit).  But I figured that it is OK to give full control since the standard mandatory profile instructions say to give Full control to the whole hive anyway.

 

Now I'm on to the next challenge, getting the Start Menu layout XML working - which I'm having trouble at the moment.  But I'll open another thread if I need help with that.

 

Thanks.

[Mbraak | 9]

Could it be you have enabled applocker? If so you have to allow appx packages to run because the start menu is an appx package.

[gwynll | 77]

Hi Mbraak, no unfortunately, AppLocker is not enabled.

[Måns Hurtigh | 116]

Hi! Does it work if you log in normally without a mandatory profile? I am creating our default profile by just copying "C:\Users\Default" to a file share and removing some files and folders in it. Have you tried to disable all GPOs and try to log in with a user? Does it make any difference?

[gwynll | 77]

Hi Måns

 

Yes it works if I log on with a local user (GPO doesn't apply therefore this creates a local profile).  So it's definitely something to do with the mandatory profile - however, as I said, it works fine if I log in through XenCenter - so the problem is specific to a XenApp connection.

 

I could try creating my mandatory profile as you said, but I need to do some customizations to it (look and feel, pinning items to Start and taskbar) beforehand, so this profile will then be different to the Default Profile.  I could then copy my profile folder over the Default Profile, but then I'm in the position as I began with.

 

Thanks.

 

[gwynll | 77]

These may be unrelated to my problem, but here are the Warning/Error events logged for every user logon (but not for local users)...

 

Log Name:      Application
Source:        Microsoft-Windows-User Profiles Service
Date:          30/01/2018 10:48:05
Event ID:      1534
Task Category: None
Level:         Warning
Keywords:     
User:          SYSTEM
Computer:      xenprawf03.domain.local
Description:
Profile notification of event Create for component {2c86c843-77ae-4284-9722-27d65366543c} failed, error code is Not implemented

 

...and this one logged twice...

 

Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
Source:        Microsoft-Windows-DeviceSetupManager
Date:          30/01/2018 10:48:15
Event ID:      121
Task Category: None
Level:         Error
Keywords:     
User:          SYSTEM
Computer:      xenprawf03.domain.local
Description:
Driver install failed, result=0x80070422 for devnode 'SWD\MMDEVAPI\{3.0.0.00000007}.{65705301-6B61-7265-7320-285265616C00}'

 

[gwynll | 77]

I've also tried installing Hotfix 1 of XenApp 7.16, but the problem remains

[Måns Hurtigh | 116]

19 hours ago, gwynll said:

Hi Måns

 

Yes it works if I log on with a local user (GPO doesn't apply therefore this creates a local profile).  So it's definitely something to do with the mandatory profile - however, as I said, it works fine if I log in through XenCenter - so the problem is specific to a XenApp connection.

 

I could try creating my mandatory profile as you said, but I need to do some customizations to it (look and feel, pinning items to Start and taskbar) beforehand, so this profile will then be different to the Default Profile.  I could then copy my profile folder over the Default Profile, but then I'm in the position as I began with.

 

Thanks.

 

 

Hi! Yes, please try to recreate the mandatory profile. Have you seen this guide from Carl Stalhood on how to create a default profile? 

 

http://www.carlstalhood.com/citrix-profile-management/#mandatory

[gwynll | 77]

I did all the steps outlines by Carl Stalhood.  The only difference is I'm using Microsoft GPO to apply the Mandatory profile, rather than following the 'Citrix Method'.  The reason for this is that I'm using AppSense Environment Manager to personalize parts of the profile, rather than Citrix UPM, so it is unclear what parts of the 'Citrix Method' relate to User Personalization and which relate to applying the Mandatory profile.

 

But I have progressed slightly on this issue.  I found this article... https://social.technet.microsoft.com/Forums/en-US/f5bb2326-a57c-4c11-8b54-79e9b3af661d/start-menu-not-working-with-mandatory-profiles?forum=win10itprosetup

 

which says that the problem is caused by incorrect permissions on the key...

 

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess

 

and that the way to fix the problem is just to delete the whole key.  I tried to delete this key when loading the NTUSER.MAN hive into Regedit, but I could NOT get it to delete, despite taking ownership, adding permissions, swearing a lot.  I had to log in again into the profile from which the mandatory profile was originally made, then delete the key from regedit in there, which allowed me to delete.  I then re-created my mandatory profile following the usual steps.

 

However, now when I log in as my test user, the Start Menu does open, but one half of the start menu is missing.  The tiles are gone - the only side of the start menu that remains is the A-Z apps list on the left side.

 

So, I know that my problem is related to the DeviceAccess key, but deleting it isn't the fix.  I've tried just setting read permissions to Authenticated Users to the key, rather than deleting the key, but I'm then back to the original problem - Start Menu doesn't open at all.

[smarsha612 | 12]

On ‎1‎/‎31‎/‎2018 at 8:55 AM, gwynll said:

Fixed it now.

 

In the steps I took above - giving permissions to Authenticated Users to that reg key - it doesn't work if I give Read - I have to give Full Control.  I had to do this whilst logged in as the user (not while loading the hive in Regedit).  But I figured that it is OK to give full control since the standard mandatory profile instructions say to give Full control to the whole hive anyway.

 

Now I'm on to the next challenge, getting the Start Menu layout XML working - which I'm having trouble at the moment.  But I'll open another thread if I need help with that.

 

Thanks.

Nice work, I was fighting with the same thing and this worked for me.

Scott