PVS Archive – Deyda Consulting Blog

Finding in the Wild | PVS + Secure Boot – A Small CU2 Feature That Could Become Important in 2026

Citrix Provisioning 2507.1 LTSR CU2 is here. Among the usual fixes is a change that I find much more interesting for PVS environments than the version number suggests: 👉 Support for Microsoft Windows UEFI CA 2023 Why is

Citrix Provisioning 2507.1 LTSR CU2 is here.

Among the usual fixes is a change that I find much more interesting for PVS environments than the version number suggests:

👉 Support for Microsoft Windows UEFI CA 2023

Why is this important?

Microsoft is currently renewing the certificate chain behind UEFI Secure Boot. Some existing Secure Boot certificates date back to 2011, and Microsoft is gradually migrating Windows to the new 2023 certificates.

This is exactly where it becomes interesting for Citrix PVS.

PVS must understand the new Secure Boot world

With PVS 2507.1 LTSR CU2, Citrix now supports Secure Boot with images signed using the new Windows UEFI CA 2023 certificate.

Initially, this sounds like a small compatibility fix.

But it is not necessarily.

Anyone familiar with PVS knows:

💥 If the boot chain is wrong, there is no Citrix session.

We are no longer discussing logon duration, profiles or HDX performance.

The target simply does not boot.

Another interesting change

When a target device starts, PVS now automatically detects whether the system booted using:

BIOS or UEFI

This information is saved in the device record and is also available through farm telemetry.

I find this particularly useful in larger or long-established PVS farms.

Different firmware and boot configurations are surprisingly common there.

What would I check now?

Anyone using PVS + Windows 11 or Windows Server 2025 + Secure Boot should definitely keep CU2 on their radar.

Before a rollout, I would test in particular:

👉 Secure Boot + Windows UEFI CA 2023
👉 Target device boot
👉 PXE / BDM
👉 Existing vDisks
👉 Hypervisor firmware / UEFI configuration
👉 Boot after promoting a vDisk version
👉 Failover to a second PVS server

With changes like these:

The vDisk has worked for years is no guarantee that the future Secure Boot chain will also work.

My takeaway

For me, PVS 2507.1 CU2 is therefore more than just:

Another cumulative update with a few bug fixes.

Support for Windows UEFI CA 2023 is a classic future-readiness topic.

Microsoft is changing the Secure Boot trust chain.

Citrix is following suit with PVS.

And once a target fails to start after a Windows/Secure Boot update, an inconspicuous release-note entry suddenly becomes an important feature. 😎

Finding in the Wild | Citrix PVS – A VMware Tools Update Disables the Master Image

An apparently straightforward VMware Tools update on a Citrix PVS master image, and suddenly the network connection is gone. The problem: the virtual machine uses a VMXNET3 network adapter that also carries the PVS streaming traffic. ❌ The

An apparently straightforward VMware Tools update on a Citrix PVS master image, and suddenly the network connection is gone.

The problem: the virtual machine uses a VMXNET3 network adapter that also carries the PVS streaming traffic.

❌ The symptoms

– The VMware Tools update starts normally.
– During installation, the VMXNET3 driver is updated.
– The network connection is interrupted.
– The PVS target loses access to its streamed vDisk.
– The update fails or the system becomes unresponsive.

🔍 Root cause

Citrix PVS depends on a continuous network connection to the vDisk.

VMware Tools updates the VMXNET3 network driver, among other components. If that driver is reinitialized during active PVS streaming, the target may lose its connection to the Provisioning Server.

The result: a driver update interrupts the very connection through which the operating system receives its data.

🛠️ My solution: a temporary second network adapter

Instead of performing the update over the active VMXNET3 adapter, I use an additional E1000E adapter.

1. Create a new PVS maintenance version.
2. Add an E1000E network adapter in VMware.
3. Register the E1000E adapter’s MAC address in the PVS console.
4. Boot the master image through the E1000E adapter.
5. Update VMware Tools, including the VMXNET3 driver.
6. Shut down the system and restore the original VMXNET3 configuration.
7. Change the MAC address back in PVS and remove the E1000E adapter.
8. Start the master image again and validate streaming.

✅ The result

During the update, PVS streaming runs through the temporary E1000E adapter.

The VMXNET3 driver can be updated without reinitializing the streaming adapter currently in use.

After the update, the system runs through VMXNET3 again.

💡 My takeaway

In a conventional VM, updating a network driver is usually routine.

With Citrix PVS, the same operation can effectively disconnect the running operating system from its own disk.

Sometimes a second network adapter is the decisive difference between a failed update and successful maintenance.

Citrix Virtual Apps and Desktops & WEM 2003 is released

The new current releases of Citrix Virtual Apps and Desktops, Workspace Environament Management & Citrix Provisioning are now available. They contains many new features compared to the last LTSR.

Citrix Virtual Apps and Desktops 7 1912 LTSR is out now

The new Long Term Service Release of Citrix Virtual Apps and Desktops is now available. It contains many new features compared to the last Current Release and of course more regarding the last LTSR.

New Features

The following new features have been added compared to the last current release.