Citrix XenApp 7.6 Logon Slow – Long Black Screen Phase

Update 2015-04-28: Citrix provides the limited release hotfix ICATS760WX64009 that fixes this issue. More information below.

During the research for my session about the XenApp 7.6 logon process, to be presented at Citrix Synergy and BriForum London, I noticed that the logon to my XenApp 7.6 lab server was taking a bit long. Longer, in fact, than the combined durations of the main logon phases user profile loading, group policy processing, logon script execution and shell startup. Much longer. Also much longer than on an otherwise similar XenApp 6.5 machine.

Examining uberAgent’s brand-new logon process performance dashboard I found a 10 second gap:

After the user profile has been loaded and group policy has been processed, which are both finished after three seconds, nothing happens for about ten seconds. Finally, at 13 seconds into the login is the Userinit process started which ultimately loads the shell, Explorer.exe. During most of that time the end user is presented with a black screen, getting no feedback as to what might or might not be happening as you can see in this video:

I experiemented a lot trying to find the root cause of the prolonged black screen phase, disabling all kinds of redirection, printer mapping, even IPv6. None of that fundamentally changed the duration of the black screen phase. Then I had the idea to log in via RDP (for which you have to make the user a member of the group Direct Access Users on the XenApp machine):

Now, that is a lot faster! RDP logons are finished in less than 4 seconds compared to around 14 seconds for ICA logons.

Digging around some more I stumbled upon CTX135782 which suggests setting the following registry value:

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Logon
Value: DisableStatus
Type: REG_DWORD
Data: 1

The effect was immediate, bringing the ICA logon from 14 seconds down to around 5.

Happy End?

Not quite. With DisableStatus set to 1, every time I logged on the LogonUI.exe process crashed due to a fault in the module CtxWinlogonProv.dll. Events like the following were logged:

Faulting application name: LogonUI.exe, version: 6.3.9600.16384, time stamp: 0x5215f6c5
Faulting module name: CtxWinlogonProv.dll_unloaded, version: 7.6.0.5018, time stamp: 0x541cfd05
Exception code: 0xc0000005
Fault offset: 0x00000000000019e1
Faulting process id: 0x1e2c
Faulting application start time: 0x01d080da8b0d6ae2
Faulting application path: C:\Windows\system32\LogonUI.exe
Faulting module path: CtxWinlogonProv.dll
Report Id: cb285960-eccd-11e4-80c0-00155d001b10
Faulting package full name: 
Faulting package-relative application ID: 

CtxWinlogonProv.dll, also called CitrixRemoteLogonFilter, is registered as a credential provider filter via the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{3571A91D-713C-427c-AA0C-BBF4F618A819}. When that key is renamed or deleted LogonUI.exe does not try to load CtxWinlogonProv.dll and consequently does not crash any more while logons are still fast.

However, since I do not know what the consequences of disabling the registration of CtxWinlogonProv.dll are I cannot really recommend that approach. Ultimately Citrix are the only ones who can truly fix this.

Update 2015-04-28: a Hotfix

Shortly after the initial publication of this article Shane Kleinert pointed me to limited release hotfix ICATS760WX64009 (CTX142036) which seems to be available for server OS (i.e. XenApp) only. As he explains in the comments below Shane had noticed similar issues at customer sites and found CTX142036 in spite of the more than vague problem description.

I am happy to report that CTX142036 fixed this long black screen phase issue on my machines, too. So this story does have a happy end, after all!