CVAD 2511 Current • 2407 LTSR • LAS Deadline April 15 2026

Citrix CVAD
Deep Dive 2026

Citrix Virtual Apps and Desktops complete reference: version matrix with LTSR guidance, MCS vs PVS decision framework, HDX protocol tuning, WEM 2511 features, NetScaler ADC, and the LAS licensing deadline you cannot miss.

🚨 CRITICAL β€” Citrix License Advantage Service (LAS) Deadline: April 15, 2026
Citrix LAS (formerly Software Maintenance / Customer Success Services) renewals must be processed by April 15, 2026 or licenses enter a grace period and eventually go dark. This affects all on-prem perpetual license holders. Contact your Citrix partner immediately if you haven't renewed. After grace period: Delivery Controllers stop brokering sessions. Citrix CTX139887 β†—
// Version Matrix

CVAD Version Matrix β€” Current (2026)

Citrix uses YY.MM naming. LTSR (Long Term Service Release) = 5-year lifecycle with Cumulative Updates. CR (Current Release) = 6-month lifecycle, latest features. Citrix Lifecycle β†—

ReleaseVersionReleasedEOL / Support EndTypeNotes
2511 Latest CR24.11.0Nov 2025May 2026CRWEM 2511 new features, Linux VDA 2511, HDX adaptive transport improvements, Citrix DaaS Next-Gen updates, App Layering improvements.
2507 (2408 CU2)24.07.0Aug 2025Feb 2026CRLTSR 2407 CU2 released concurrently. Multi-session GPU improvements, Secure Browser Service updates.
2407 LTSR LTSR β˜…24.07.0Jul 2024Jul 2029LTSRRecommended for enterprises. 5-year lifecycle. CU2 available. HDX Thinwire progressive build-to-lossless, WEM 2407, StoreFront 2407 stability. Most enterprises standardize here.
2203 LTSR22.03.0Mar 2022Mar 2027LTSRPrevious LTSR. Still supported until 2027 but upgrade to 2407 LTSR strongly recommended. CU6 is the latest.
1912 LTSR19.12.0Dec 2019Dec 2024 ⚠EOLEOL Dec 2024. Migrate immediately. No security patches. CVEs unpatched.
CVAD 7.x and olderβ€”β€”EOLEOLUnsupported. Upgrade path: 7.x β†’ 2203 LTSR β†’ 2407 LTSR.
VDI Guy Recommendation: Standard enterprises β†’ 2407 LTSR (5-year lifecycle, CU2 available, stable for production). DevOps/cloud-first β†’ 2511 CR (latest WEM, Linux VDA, cloud features). Never skip LTSR without a tested rollback plan. Always upgrade VDA before Delivery Controller.
// Architecture Components

CVAD Core Architecture 2026

πŸŽ›οΈ Delivery Controller (DDC)

Central broker. Authenticates users, routes sessions, manages power state, communicates with hypervisor via SDK. Stateless β€” deploy 2+ for HA. Requires SQL Server for site database.

4+ vCPU Β· 8–16 GB RAM Β· WinSrv 2022
πŸ–₯️ Virtual Delivery Agent (VDA)

Agent in every desktop or RDSH VM. Registers with DDC. Manages HDX sessions, USB, printing, clipboard, SSO. Separate VDA versions for Desktop OS vs Server OS. Must match DDC version Β±1.

Silent: XenDesktopVdaSetup.exe /quiet /noreboot /components VDA
🌐 NetScaler ADC / Gateway

Load balancer + secure remote access gateway. Handles ICA proxy, SmartAccess/SmartControl policies, multi-factor auth (RADIUS/SAML). HDX Insight for session analytics. VPX (virtual) or MPX (hardware).

VPX 200: 2 vCPU Β· 4 GB RAM Β· 200 Mbps
πŸͺ StoreFront

On-prem app/desktop aggregator. Serves Receiver/Workspace App. Aggregates published resources from multiple CVAD sites and Citrix DaaS. Load balance behind NetScaler. Min 2 for HA. SSL required.

4 vCPU Β· 8 GB RAM Β· WinSrv 2022
🎯 WEM (Workspace Env Mgr)

Policy engine replacing complex logon scripts and GPOs. Manages CPU/memory optimization, app security (AppLocker policies), user environment (drives, printers, env vars), condition-based delivery.

WEM Service (cloud) or on-prem WEM Infrastructure Server
πŸ’» Citrix Profile Management (UPM)

On-prem profile solution. Streams profile on-demand vs FSLogix container approach. Supports folder redirection, profile exclusion, large file handling. Works alongside FSLogix for Office containers.

Agent bundled with VDA Β· Configure via GPO / ADMX

CVAD Network Ports

PortProtocolFlowPurpose
1494TCPClient β†’ VDA (internal)ICA protocol β€” primary session transport (internal)
2598TCPClient β†’ VDA (internal)CGP (Session Reliability) β€” reconnect without re-auth
443TCPClient β†’ NetScalerSecure ICA proxy, StoreFront HTTPS, Workspace App
UDP 443UDPClient β†’ NetScalerEDT (Enlightened Data Transport) β€” QUIC-based, preferred
80/443TCPClient β†’ StoreFrontStoreFront app enumeration (always HTTPS in prod)
80TCPVDA β†’ DDCVDA registration (use TLS/443 in secure environments)
389/636TCPDDC β†’ DCLDAP / LDAPS for Active Directory
1433TCPDDC β†’ SQLSQL Server site database (always AlwaysOn AG in prod)
// Provisioning Technology

MCS vs PVS β€” Decision Framework 2026

Machine Catalog type is the most consequential architectural decision in CVAD. Wrong choice = years of operational pain. Choose based on scale, storage, and operational skills.

FactorMCS (Machine Creation Services)PVS (Provisioning Services)
How it worksHypervisor snapshot-based. Creates full VMs from master image snapshot. Stores delta disks on local/shared storage.Network boot via PXE. Streams OS image from PVS vDisk. RAM-cache absorbs writes. VMs are diskless.
Storage requirementStorage per VM (delta) β€” typically 10–20 GB/VM on SAN/NFS/vSAN. IOPS spike at logon storm.Central vDisk store (shared). VMs boot from network. RAM cache (write-back) absorbs IOPS. Very low per-VM storage.
ComplexityLower β€” no separate infrastructure. Fully managed by CVAD Studio. Citrix manages everything.Higher β€” separate PVS servers (2+ for HA), vDisk management, RAM cache config, network boot config.
Scale recommendation1–2,000 VMs. Above 2k: storage IOPS becomes challenging during boot storms.500–50,000+ VMs. PVS scales extremely well with proper RAM cache sizing. Traditional choice for large enterprises.
Image updatesUpdate master image β†’ Create snapshot β†’ Apply to catalog (rolling reboot). Studio manages.Update vDisk β†’ Test version β†’ Promote β†’ Rolling reboot. vDisk versioning built in. More control.
Non-persistent supportMCS I/O Optimization (write-back cache to RAM+disk). Reduces storage IOPS.RAM cache with overflow to disk. Superior IOPS isolation. BDM (Boot Device Manager) replaces PXE.
Cloud supportFull support β€” Azure, AWS, GCP, Nutanix, vSphere. MCS is the only choice for cloud.On-prem only (vSphere, Hyper-V, XenServer). Not supported on cloud hypervisors natively.
VDI Guy verdict 2026βœ… Default choice for <2,000 VMs, cloud, or new deployments.βœ… Large on-prem (>2,000 VMs), existing PVS infra, ultra-low storage IOPS requirement.

MCS I/O Optimization (MCSIO) Config

# MCS I/O Optimization β€” GPO path:
# Citrix > Virtual Desktop Agent > MCS IOO
# Or via Studio Catalog settings

# Key registry (set during VDA install or via GPO):
# HKLM\SOFTWARE\Citrix\MCSIODrv
WriteCacheSize = 256         # MB RAM write cache
WriteCacheDisk = 1024        # MB disk overflow
EnableWriteBackCache = 1     # Required for non-persistent

# Command line: Enable MCSIO at catalog creation
New-BrokerCatalog -Name "Pool1" `
  -MachinesArePhysical $false `
  -MinimumFunctionalLevel L7_20 `
  -ProvisioningType MCS `
  -SessionSupport MultiSession

PVS RAM Cache Sizing Guide

# PVS Write-Back Cache (WBC) β€” key settings
# PVS Console > vDisk > Properties > Cache

Cache type options:
  1 = Cache on device RAM with overflow to disk  ← Recommended
  2 = Cache on device disk
  3 = Cache on server (avoid β€” network overhead)
  5 = Cache in device RAM (no overflow β€” risky)

# RAM cache sizing rule of thumb:
# Task worker: 512 MB–1 GB
# Knowledge worker: 1–2 GB
# Power user: 2–4 GB

# Disk overflow: 10–20 GB per VM on local SSD
# Never put PVS overflow on SAN β€” defeats purpose
// HDX Protocol

HDX β€” Adaptive Transport, Thinwire & EDT Tuning

HDX is the Citrix protocol umbrella covering display (Thinwire), transport (EDT/ICA), audio, and USB. EDT (Enlightened Data Transport β€” QUIC-based UDP) is the modern transport in 2026.

HDX FeaturePolicy PathRecommended SettingNotes
EDT (UDP Transport)HDX Adaptive TransportPreferred (not Diagnostic)EDT = QUIC-based UDP. Better WAN performance, packet loss recovery. Preferred = use EDT, fall back to TCP if blocked.
Thinwire Progressive DisplayUse video codec for compressionUse when preferredUses H.264 for moving regions, lossless for static text. Best bandwidth efficiency. Requires H.264 capable VDA.
BCR (Browser Content Redirection)Browser Content RedirectionEnabled + URL whitelistRenders Chrome/Edge content on client CPU (not VDA). Massive bandwidth savings for video-heavy sites. Requires Citrix Workspace App on client.
Visual QualityVisual qualityMedium (default)High/Very High = much more bandwidth. Use Medium unless users complain. Always-lossless for finance/compliance.
Frame Rate CapTarget frame rate30 FPS general / 60 FPS GPU60 FPS roughly doubles bandwidth per session. Reserve for GPU desktops only.
Audio Over UDPAudio over UDPEnabledReal-time audio via UDP β€” far better voice quality than TCP ICA audio.
Session ReliabilitySession reliabilityEnabled (port 2598)Reconnects on network drop without re-auth. Critical for WAN/VPN users. Default timeout: 3 minutes.
HDX 3D ProMachine Catalog GPU settingEnable for GPU VDAsRequired for GPU-accelerated desktops. Uses H.264 hardware encode (NVIDIA or AMD). Separate VDA install parameter.

EDT Bandwidth Estimates

User TypeAvg BWPeak
Task worker100–300 Kbps800 Kbps
Knowledge worker400 Kbps–1.5 Mbps3 Mbps
Power user (video)1.5–4 Mbps8 Mbps
BCR enabled60–80% reductionfor video sites

HDX Monitor (PowerShell)

# Check active session HDX stats:
# Citrix Director: Monitor > HDX channel data

# PowerShell β€” session details:
Add-PSSnapin Citrix*
$sessions = Get-BrokerSession -Filter {SessionState -eq 'Active'}
$sessions | Select UserName, Protocol,
  EstablishmentTime, ClientAddress |
  Format-Table -AutoSize

# NetScaler: HDX Insight dashboard
# nscommand: show ica sessions
// WEM 2511

Workspace Environment Manager (WEM) 2511

WEM is the replacement for logon scripts, GPP (Group Policy Preferences), and basic profile management. In 2511 it adds significant profile container and security capabilities.

WEM 2511 New Features

  • β–ΈProfile Management β€” integration with FSLogix profile containers (hybrid UPM + FSLogix config)
  • β–ΈCPU Spike Protection v3 β€” improved algorithm, per-app CPU throttle thresholds
  • β–ΈAppLocker policy management via WEM console (replaces raw AppLocker GPOs)
  • β–ΈCondition engine improvements: new OOBE/first logon conditions for provisioned machines
  • β–ΈWEM Service (Cloud) β€” no WEM infrastructure server required for Citrix DaaS
  • β–ΈTransformer (kiosk mode) improvements β€” URL whitelist, auto-logon enhancements

WEM Key Configuration Areas

FeatureUse CaseNotes
ActionsDrive map, printer, app shortcut, reg key, env varCondition-based delivery
Filters / ConditionsAD Group, OU, client IP, client name, timeGranular targeting
CPU MgmtSpike protection, CPU affinityPrevents runaway processes
Memory MgmtWorking set optimizationFrees RAM from idle apps
Profile MgmtUPM config, FSLogix integration2511: FSLogix hybrid
// StoreFront Configuration

StoreFront 2026 β€” HA, SSL & Workspace Integration

StoreFront HA Architecture

# Minimum StoreFront HA setup:
# 2x StoreFront servers behind NetScaler LB
# All servers in same Server Group
# Config replication: automatic (P2P sync)

# StoreFront server sync:
# Citrix StoreFront > Server Group > Add Server

# NetScaler LB VIP:
add lb vserver SF_VIP HTTP 10.x.x.100 80
add lb vserver SF_VIP_SSL SSL 10.x.x.100 443
bind lb vserver SF_VIP -policyName ns_adv_xpath_sf
bind ssl vserver SF_VIP_SSL -certkeyName star_corp_com

# Store URL format:
# https://storefront.corp.com/Citrix/Store/auth/
# Redirect HTTP β†’ HTTPS always

StoreFront vs Citrix Workspace

FeatureStoreFrontCitrix Workspace
HostingOn-premCloud SaaS
CustomizationFull brandingLimited
Data sovereigntyFull controlCitrix cloud
AggregationMultiple sitesMultiple sites + SaaS apps
HA responsibilityAdmin managedCitrix managed
2026 recommendedOn-prem regulated orgsDaaS / cloud-first
// NetScaler ADC

NetScaler ADC β€” Gateway & Load Balancer Configuration

ICA Proxy Configuration

# NetScaler Gateway ICA Proxy
# Path: Traffic Management > Load Balancing > VS

# Enable ICA proxy on Gateway vServer:
set vpn vserver GATEWAY_VIP -icaOnly OFF
set vpn sessionaction ICA_Proxy `
  -defaultAuthorizationAction ALLOW `
  -transparentInterception OFF `
  -SSO ON `
  -icaProxy ON

# EDT (UDP) for HDX Adaptive Transport:
# Traffic Policy: set ns-profile for EDT
# Ensure UDP 443 open at firewall toward NetScaler

# Verify EDT active (from Director):
# Monitor > Sessions > Protocol column = UDP

StoreFront LB Config (Key Points)

# NetScaler LB for StoreFront HA
# Monitor type: STOREFRONT
add lb monitor SF_Monitor STOREFRONT `
  -storename Store `
  -storefrontaccttype ActiveDirectory

# Service group for SF servers:
add servicegroup SG_SF HTTP
bind servicegroup SG_SF 10.x.x.11 80
bind servicegroup SG_SF 10.x.x.12 80
bind lb vserver SF_VIP SG_SF

# SSL cert binding (wildcard recommended):
bind ssl vserver SF_VIP -certkeyName star.corp.com

# HTTPS redirect:
add responder action redir_https redirect \
  '"https://" + HTTP.REQ.HOSTNAME + HTTP.REQ.URL'
add responder policy redir_http_to_https TRUE redir_https
// Sizing Reference

CVAD VM & Infrastructure Sizing 2026

Component / User TypevCPURAMDiskScale / DensityNotes
Task Worker (published app)0.25 vCPU1–2 GBN/A (RDSH)50–60/RDSH VMRDSH VM: 16–24 vCPU / 64–128 GB. Single app delivery.
Knowledge Worker (VDI)24–6 GB60 GB80–120/hostOffice 365, Teams, browser. MCS non-persistent.
Power User (VDI)48–16 GB80 GB40–60/hostDeveloper, analyst. Persistent preferred.
GPU (HDX 3D Pro)4–816–32 GB120 GBGPU limited (6–12/GPU)CAD/3D. NVIDIA vPC or vWS profile. HDX 3D Pro license.
Delivery Controller4+8–16 GB80 GB1 per 5,000 CCUMin 2 HA. SQL AlwaysOn for site DB. WinSrv 2022.
NetScaler VPX (Gateway)2–44–8 GB120 GBVPX 1000: 1 Gbps, 5K SSL TPSDeploy HA pair (active-passive). VPX 200 for <500 users.
StoreFront48 GB80 GB2 min (HA)Behind NetScaler LB. WinSrv 2022.
// ⚠ Licensing β€” LAS Deadline

Citrix Licensing β€” LAS Deadline & License Models

🚨 LAS (License Advantage Service) Deadline: April 15, 2026
Customers on perpetual licenses with expired LAS lose the right to use new versions AND enter a 30-day grace period on existing licenses after which the license server stops issuing sessions. This is not a new policy β€” it is being actively enforced in 2026. Contact your Citrix partner to assess status. Reference: CTX139887
EditionIncludesModelBest For
CVAD Premium (formerly Platinum)All components incl. HDX 3D Pro, App Layering, LAS, AnalyticsCCU or Named Β· SubscriptionEnterprise with GPU, analytics needs. Full feature set.
CVAD Advanced PlusVDA, DDC, StoreFront, NetScaler Gateway Std, WEM, UPMCCU Β· SubscriptionStandard enterprise VDI. Most common.
CVAD StandardVDA + DDC only. No HDX 3D Pro, no App Layering.CCU Β· SubscriptionSmall deployments, budget constrained.
Citrix DaaSCloud DDC (no on-prem CS), all VDA types, NetScaler Cloud GatewayNamed User/Device Β· MonthlyEliminate on-prem Delivery Controller overhead.
Perpetual + LAS ⚠Legacy perpetual licensesPerpetual + annual LAS maintenanceRenew LAS by April 15 2026 or sessions stop. Migrate to subscription recommended.

Check License Status

# Citrix Licensing Manager (web):
# https://[license-server]:8083

# PowerShell:
Get-LicCertificateInfo -AdminAddress https://lic:8083
Get-LicInventory -AdminAddress https://lic:8083

# Check LAS expiry specifically:
# Licenses show "Subscription Advantage Date"
# If date < today: EXPIRED β€” renew immediately

# Quick check all allocated licenses:
asnp Citrix.*
Get-BrokerController | Select DNSName, State
Get-LicInventory | Select PldName, LicensesInUse, LicensesAvailable

License Server HA

# Citrix License Server β€” HA best practices:
# No native clustering β€” use VM HA (vSphere/Hyper-V)
# Take VM snapshots before updates
# Keep license files backed up: 
#   C:\Program Files\Citrix\Licensing\MyFiles\

# DDC license server redundancy:
# Configure 2+ license servers in Studio
# Studio > Settings > Licensing > Server list

# License grace period: 30 days if license server
# unreachable. After grace: new sessions rejected.
# Plan: snapshot restore < 15 min RTO for license server
// Troubleshooting

Common CVAD Issues & Fixes

SymptomLikely CauseDiagnosticFix
VDA stuck "Unregistered"Firewall port 80 DDC↔VDA, DNS resolution, wrong controller listBroker Agent logs: Event Viewer > Citrix Delivery Services; ping DDC from VDAOpen TCP 80 or 443 (TLS) VDAβ†’DDC. Verify ListOfDDCs registry on VDA. Set FQDN not IP.
Cannot launch session (1030 error)ICA file sent but port 1494/2598 blocked, SSL cert issue on SFCheck .ica file download; test netcat to VDA:1494 from clientOpen 1494/2598 client→VDA. Verify NetScaler SSL cert validity. Check StoreFront HTTPS binding.
EDT not active (poor WAN perf)UDP 443 blocked at firewall/VPN, policy not appliedDirector > Sessions: Protocol column shows "TCP" not "UDP"Open UDP 443 toward NetScaler. Verify "HDX Adaptive Transport = Preferred" policy applies to session.
Slow logon (>30s)UPM/FSLogix mount, slow GPO, WEM processing timeWEM Admin Console > Monitor > Reports > Logon; gpresult /hEnable WEM logon monitoring. Async DEM/WEM actions. FSLogix <15 GB VHDX. Baseline all GPO extensions.
MCS catalog update failsMaster image snapshot issue, vCenter permission, storage spaceStudio Tasks view; CVAD event log on DDCVerify vCenter permissions for DDC service account. Check storage free space (>20% headroom). Re-snapshot master.
License error (ICA-0x10000)License server unreachable, expired LAS, insufficient CCUhttps://[licserver]:8083; Get-LicInventoryCheck LAS expiry first. Verify DDC β†’ license server TCP 27000. Add more licenses if CCU exhausted.
// Related Pages

Continue the Deep Dive