WEM Archive – Deyda Consulting Blog

Finding in the Wild | Citrix WEM – Backup Available, Restore Impossible

An uncomfortable scenario in Citrix Workspace Environment Management: The WEM configuration was backed up correctly before the upgrade. After the update, an older configuration set needs to be restored. But the restore suddenly fails. ❌ Unable to restore.

An uncomfortable scenario in Citrix Workspace Environment Management:

The WEM configuration was backed up correctly before the upgrade. After the update, an older configuration set needs to be restored.

But the restore suddenly fails.

❌ Unable to restore. Try again later.
❌ Upload reports invalid content
❌ The backup was created with an older WEM version
❌ Importing it again produces the same result

🔍 Root cause – WEM-54462

Citrix documents a compatibility issue between older WEM configuration backups and the new schema.

In particular, this affects:

* Backups created before WEM 2.44 (schema 2605 or earlier)
* Restores into WEM 2.44 or later (schema 2606 or later)

Backups already created with schema 2606 or later, however, can be restored normally.

The problem is therefore not necessarily a corrupted backup file, but the processing of older backup formats.

🛠️ My troubleshooting approach

First, I check the origin of the backup and the version of the target environment.

Next, I check:

1. Is the JSON file syntactically valid?
2. Was the backup created before or after the schema change?
3. Can a current backup be restored?
4. Does the error occur during upload or only during restore?

This helps distinguish a corrupted backup from a version incompatibility.

✅ A safe migration strategy

My preferred approach:

1. Preserve the original backup unchanged.
2. Also document the existing WEM configuration.
3. Test restoration only in an isolated test environment.
4. Request the official Citrix Support workaround for an older backup.
5. After a successful migration, create a new backup using the current schema.
6. Validate the restore and configuration assignments before moving to production.

Important: do not manually change the JSON structure or apply untested schema modifications in production.

🛠️ Citrix Support workaround

Citrix tracks the issue as WEM-54462 and explicitly directs customers to technical support for the corresponding workaround script.

There is no generally applicable, publicly documented script for this.

💡 My takeaway

A successfully created backup is not proof that restoration will work.

For WEM upgrades in particular, migration planning must include both an export and a tested restore.

Backup successful ≠ restore guaranteed.

Finding in the Wild | Citrix WEM – When One User Blocks Other Users’ Applications

An unusual issue on Citrix multi-session VDAs: Applications initially work normally. Another user logs on to the same session host, and suddenly certain applications can no longer be launched in existing sessions. ❌ Applications are unexpectedly blocked ❌

An unusual issue on Citrix multi-session VDAs:

Applications initially work normally. Another user logs on to the same session host, and suddenly certain applications can no longer be launched in existing sessions.

❌ Applications are unexpectedly blocked
❌ Different behavior on identically configured VDAs
❌ The issue appears random
❌ Logging on again may change the behavior

🔍 Root cause: WEM Application Security + Windows AppLocker

Citrix WEM can assign application security rules on a per-user basis.

Windows AppLocker, however, uses a machine-wide policy.

If enforcement mode Overwrite is enabled in WEM, another user’s logon can replace the existing AppLocker policy.

If the new policy lacks previously present allow rules, applications are suddenly blocked, including for users who are already logged on.

🛠️ My troubleshooting approach

First, I check AppLocker events on the affected VDA:

* Event ID 8004 – EXE/DLL blocked
* Event ID 8007 – script/MSI blocked
* Event ID 8001 – AppLocker policy applied

Then I export the effective AppLocker rules:

Get-AppLockerPolicy -Effective -Xml

Comparing the rules before and after another user’s logon is particularly revealing.

In the WEM Agent logs, I look for:

AgentHostProxyService.ProcessAppLockerRules()

and:

Mode Overwrite will be applied

✅ The solution

In WEM Application Security, change Rule Enforcement Mode from Overwrite to Merge.

This combines rules for different users instead of replacing the existing policy at each logon.

Important: first check existing AppLocker rules for unintended permissions. Merge must not inadvertently allow applications.

💡 My takeaway

When applications on a Citrix session host are suddenly blocked, the cause does not have to lie with the application itself.

Sometimes another user’s logon is enough to change the effective security policy.

Multi-session operation and machine-wide security policies are a combination that must be considered when working with WEM.

Installing Workspace Environment Management

Workspace Environment Management optimizes Citrix workers for the best possible performance (user density, logon time and application response time).

WEM is subject to the Current Release Lifecycle (Additional Component) and therefore there is no LTSR version of WEM available.

To use WEM, you must have an active Customer Success Services (CSS) for one of the following licenses:

Citrix Virtual Apps Advanced
Citrix Virtual Apps Premium
Citrix Virtual Apps and Desktops Advanced
Citrix Virtual Apps and Desktops Premium
Citrix Workspace Premium
Citrix Workspace Premium Plus

Technical Overview

Workspace Environment Management (WEM) is based on the following architecture:

WEM Administration Console – Part 1 (Actions, Filters & Assignments)

Current version is Workspace Environment Management 2206.

Known problems

When VUEMRSAV.exe is used to display results on actions applied through an action group for the current user, the Applied Actions tab may display the wrong source of actions. [WEM – 20002]

WEM Administration Console – Part 2 (System Optimization, Policies & Profiles and Security)

Current version is Workspace Environment Management 2206.

In the following I will give an insight into the menu items System Optimization, Policies & Profiles and Security.

System Optimization

These settings are used to reduce resource usage on the host. They are used to free up resources and make them available for other applications, thereby increasing the user density per host.

While the System Optimization settings are machine-based and apply to all user sessions of a machine, the Process Optimization under CPU Management is user-based.

That is, when a process triggers CPU Spike Protection in user A’s session, the event is recorded and limited for user A only. When user B starts the same process, the behavior of process optimization is determined only by process triggers in user B’s session.