Citrix VDI Black Screen Due to Antivirus Scanning on Profile Storage

Products

• Endpoint Security Complete
• Endpoint Protection

Issue/Introduction

Intermittent black screen issues during Citrix VDI logon often stem from resource contention on the central server hosting user profiles. This article provides troubleshooting steps and exclusion recommendations to resolve performance bottlenecks caused by real-time Antivirus scanning of user profile paths.

Environment

• Citrix Virtual Apps and Desktops (formerly XenDesktop)
• User Profile Management (UPM) or FSLogix
• Symantec Endpoint Security (SES/SEP)

Cause

Real-time Antivirus scanning of user profile folders during logon and logoff creates significant Disk I/O and CPU contention. When the Antivirus scanner holds a lock on critical profile files (e.g., NTUSER.DAT) while the profile manager attempts to mount them, the VDI session hangs, resulting in a "Black Screen" or significantly delayed logon. This issue is often exacerbated in high-density VDI environments or following security definition updates that initiate background scanning tasks.

Resolution

To resolve this issue, implement the following exclusion and configuration changes:

1. Configure Profile Storage Exclusions: Exclude the central profile storage path (e.g., \\####\path\to\profiles) from real-time antivirus scanning on the profile server.
2. Add Citrix Infrastructure Exclusions: Ensure the following paths are excluded from real-time scanning:
   1. Citrix Program Files directories.
   2. Citrix Configuration Database.
   3. Provisioning Services (PVS) cache files.
   4. Windows Pagefile and Print Spooler folders.
3. Optimize Auto-Protect Policy: Disable "Network Scanning" in the Auto-Protect policy to prevent redundant scanning of remote files.
4. Review Resource Utilization: Monitor CPU Ready time and Disk Latency on session hosts. If contention persists, consider increasing vCPU and RAM allocations to accommodate the combined overhead of user sessions and security software.

Additional Information

• For best practices regarding Citrix and terminal server configurations for Endpoint Protection, review official technical documentation.
• If the issue persists after implementing these exclusions, contact support via the Contact Broadcom Support article.