Environment

• EDR Sensor: All Supported Versions
• Microsoft Windows 10
• Citrix Non-Persistent VDI

Symptoms

• Login times with the sensor are delayed
• Procmon events for cb.exe show citrix hooked into the process

Cause

Resolution

Keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\cb.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\CtxHook\AppInit_Dlls\cb.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\CtxHook64\AppInit_Dlls\cb.exe
Value Name: Flag
Type: REG_DWORD
Value: 0

Additional Notes

• The CtxHook64 key does not exist on Windows 2008 R2 or higher and it is not required.
• Due to architectural differences in hashing for 7.x sensors, login delays may continue. A fix is estimated for the 7.2.1 sensor

Related Content