An unusual issue on Citrix multi-session VDAs:
Applications initially work normally. Another user logs on to the same session host, and suddenly certain applications can no longer be launched in existing sessions.
❌ Applications are unexpectedly blocked
❌ Different behavior on identically configured VDAs
❌ The issue appears random
❌ Logging on again may change the behavior
🔍 Root cause: WEM Application Security + Windows AppLocker
Citrix WEM can assign application security rules on a per-user basis.
Windows AppLocker, however, uses a machine-wide policy.
If enforcement mode Overwrite is enabled in WEM, another user’s logon can replace the existing AppLocker policy.
If the new policy lacks previously present allow rules, applications are suddenly blocked, including for users who are already logged on.
🛠️ My troubleshooting approach
First, I check AppLocker events on the affected VDA:
* Event ID 8004 – EXE/DLL blocked
* Event ID 8007 – script/MSI blocked
* Event ID 8001 – AppLocker policy applied
Then I export the effective AppLocker rules:
Get-AppLockerPolicy -Effective -Xml
Comparing the rules before and after another user’s logon is particularly revealing.
In the WEM Agent logs, I look for:
AgentHostProxyService.ProcessAppLockerRules()
and:
Mode Overwrite will be applied
✅ The solution
In WEM Application Security, change Rule Enforcement Mode from Overwrite to Merge.
This combines rules for different users instead of replacing the existing policy at each logon.
Important: first check existing AppLocker rules for unintended permissions. Merge must not inadvertently allow applications.
💡 My takeaway
When applications on a Citrix session host are suddenly blocked, the cause does not have to lie with the application itself.
Sometimes another user’s logon is enough to change the effective security policy.
Multi-session operation and machine-wide security policies are a combination that must be considered when working with WEM.
