Citrix® Health Check Checklist: 45 Checks for CVAD and DaaS
By Sessionwright EngineeringPublished Updated 8 min read
A useful Citrix health check is a list of specific questions, each with a command that answers it and a known-good result. This checklist covers Citrix Virtual Apps and Desktops (CVAD), Citrix DaaS and NetScaler Gateway. Every row says what to check, how to check it, and what "good" looks like. All checks are read-only.
Before you start: the built-in tools
- Citrix Scout (CVAD) runs health checks against Delivery Controllers, VDAs, StoreFront and License Servers. The site checks use the Environment Test Service and can take up to an hour on large sites (Citrix docs).
- Cloud Health Check (DaaS) checks VDAs, StoreFront and Profile Management. Run it from a domain-joined machine, never a Cloud Connector (Citrix docs).
- Web Studio > Home > Test site checks database health, connectivity, delegated administration, registration state and more (Citrix docs).
- Citrix Health Assistant troubleshoots unregistered VDAs (Citrix docs).
For a quick Citrix health check PowerShell script on CVAD, this read-only loop prints any FMA service on any Controller that isn't OK. It uses -AdminAddress, a common Citrix SDK parameter (Citrix SDK):
$cmds = 'Get-BrokerServiceStatus','Get-ConfigServiceStatus','Get-LogServiceStatus',
'Get-MonitorServiceStatus','Get-HypServiceStatus','Get-ProvServiceStatus',
'Get-AcctServiceStatus','Get-AdminServiceStatus'
foreach ($ddc in (Get-BrokerController).DNSName) {
foreach ($c in $cmds) {
$s = & $c -AdminAddress $ddc
if ($s.ServiceStatus -ne 'OK') { '{0} {1}: {2}' -f $ddc, $c, $s.ServiceStatus }
}
}
Site, Delivery Controllers and SQL (CVAD)
| # | Check | How | Good looks like |
|---|---|---|---|
| 1 | Controller state and version | Get-BrokerController | Select DNSName, State, ControllerVersion, LastActivityTime (SDK) |
All Active, at least two Controllers, one ControllerVersion. Scout flags failed or mixed-version Controllers |
| 2 | FMA services | The loop above | No output. PendingFailure means the database connection was lost (SDK) |
| 3 | Site DB connection | Test-BrokerDBConnection (Get-BrokerDBConnection) (SDK) |
OK |
| 4 | Site test | Web Studio > Home > Test site, or Start-EnvTestTask -TestSuiteId Infrastructure (SDK) |
No failed tests |
| 5 | Delivery group capacity | Get-BrokerDesktopGroup | Select Name, Enabled, InMaintenanceMode, DesktopsAvailable, DesktopsUnregistered, DesktopsFaulted, Sessions (SDK) |
No group in maintenance by accident; unregistered/faulted = 0; headroom in DesktopsAvailable |
| 6 | Hypervisor connections | Get-BrokerHypervisorConnection | Select Name, State, IsReady, FaultState (SDK) |
On, True, None |
| 7 | Local Host Cache | (Get-BrokerSite).LocalHostCacheEnabled (Citrix docs) |
True. Each Controller has RAM for LocalDB (about 1.2 GB) plus the secondary broker (up to 1 GB); no more than 10,000 VDAs per zone |
Cloud Connectors (DaaS)
| # | Check | How | Good looks like |
|---|---|---|---|
| 8 | Redundancy | Citrix Cloud > Resource Locations | At least two Connectors per resource location; Citrix recommends N+1 (Citrix docs) |
| 9 | Health and alerts | Monitor > Infrastructure Monitoring | Every Connector reachable, no rows with errors (Citrix docs) |
| 10 | Hourly connectivity check | Application log, events 10005/10006 | None recent (Citrix docs) |
| 11 | Clock | Events 10004/10103 ClockOutOfSyncError |
None |
| 12 | Version and update schedule | Resource Locations: current vs target version | Current = target; update schedule set outside business hours (Citrix docs) |
| 13 | Outbound connectivity | Start > Citrix > Citrix Cloud Services Connectivity Test Tool | All tests pass (Citrix docs) |
VDAs and images
| # | Check | How | Good looks like |
|---|---|---|---|
| 14 | Unregistered VDAs | Get-BrokerMachine -RegistrationState Unregistered, grouped by LastDeregistrationReason |
Zero powered-on, or each one explained (our guide) |
| 15 | Fault states | Get-BrokerMachine -FaultState StuckOnBoot (also FailedToStart) (SDK) |
None |
| 16 | Forgotten maintenance mode | Get-BrokerMachine -InMaintenanceMode $true |
Each one has an owner and a reason |
| 17 | Version drift | Get-BrokerMachine -MaxRecordCount 10000 | Group-Object AgentVersion (the default is 250 records) |
Few versions, none below the catalog functional level (Citrix docs) |
| 18 | VDA health checks | DaaS: Studio > Search > Run Health Check (VDA 2109+) (Citrix docs); CVAD: Scout | No issues in the report |
StoreFront
| # | Check | How | Good looks like |
|---|---|---|---|
| 19 | Base URL | Get-STFDeployment (HostbaseUrl) (SDK) |
HTTPS, and the FQDN is in the certificate's CN or SAN (Citrix docs) |
| 20 | Certificate | IIS binding, or Scout/Cloud Health Check | Chain complete, not expiring within 30 days |
| 21 | Server group sync | StoreFront console > Server Group, or Get-STFServerGroupConfiguration (SDK) |
Every member synchronized (Citrix docs) |
| 22 | Controllers per store | Get-STFStoreService | % { Get-STFStoreFarm -StoreService $_ } (SDK) |
Servers lists current Controllers/Connectors only; TransportType isn't HTTP (see #41) |
| 23 | Services and AD | Scout/Cloud Health Check | Default Domain and Credential Wallet services running; AD reachable on 88, 389, 464 |
Licensing
| # | Check | How | Good looks like |
|---|---|---|---|
| 24 | LAS activation | Web Studio > Licensing | License Server 11.17.2 build 53100 or later, activated through LAS (Citrix docs; EOL notice) |
| 25 | Caching mode | Get-BrokerSite | Select LicenseServerName, LicensingGracePeriodActive, LicensingOutOfBoxGracePeriodActive, LicensingGraceHoursLeft; Get-BrokerController | Select DNSName, LicensingServerState, LicensingGraceState (SDK) |
Grace flags False; server state OK; grace state NotActive. In LAS, the License Server has 30 days to reconnect (Citrix docs) |
| 26 | Expiry and CSS | Web Studio Overview alerts; (Get-BrokerSite).LicensesWithExpiredSwm; Scout License Server checks |
No alerts, empty list, CSS date in the future, CITRIX vendor daemon running, clocks in sync |
NetScaler Gateway
| # | Check | How | Good looks like |
|---|---|---|---|
| 27 | Build | show ns version (CLI ref) |
At or above the fixed build in every current bulletin (checker, CVE hub), and not past end of life |
| 28 | HA pair | show ha node (CLI ref) |
Both nodes UP, one Primary, Sync ENABLED/SUCCESS, Propagation ENABLED (docs). AUTO DISABLED is expected during a mixed-version upgrade, not after it |
| 29 | Certificates | show ssl certKey; set ssl certKey <name> -expiryMonitor ENABLED -notificationPeriod 30 (CLI ref) |
Days to expiration above your renewal lead time; expiry monitor on |
| 30 | vServers | show vpn vserver, show lb vserver, show serviceGroup <name> (CLI ref) |
UP; service groups UP, not PARTIAL-UP |
| 31 | STA | show vpn vserver <name> |
Every STA UP, and the same list as StoreFront, to avoid launch failures (docs) |
| 32 | Time | show ntp status on both nodes |
Synced peers. NTP config doesn't propagate to the secondary (docs) |
Profiles: FSLogix and WEM
| # | Check | How | Good looks like |
|---|---|---|---|
| 33 | FSLogix version | Compare with the release notes Latest release (26.08, 3.26.826.17182 at time of writing). The release notes say customers must run the latest version | |
| 34 | FSLogix config and service | reg query HKLM\SOFTWARE\FSLogix\Profiles; FSLogix Apps Services (frxsvc) (Microsoft) |
Enabled=1, VHDLocations reachable, service running, no errors under Event Viewer > FSLogix or in C:\ProgramData\FSLogix\Logs (Microsoft) |
| 35 | FSLogix storage and AV | Share ACLs; AV exclusions | CREATOR OWNER Modify, subfolders and files only (Microsoft); exclusions per the prerequisites. See FSLogix troubleshooting |
| 36 | WEM | Administration > Agents; Citrix.WEM.Health.Check.Tool.exe (Citrix docs) |
Synchronization state Successful, agents online, health check clean (Citrix docs) |
Monitoring and Director
| # | Check | How | Good looks like |
|---|---|---|---|
| 37 | Alerts | Director > Alerts (Premium sites), with email or webhook targets (Citrix docs) | Alerts defined and delivered to a monitored mailbox |
| 38 | Probes | Director application and desktop probing via StoreFront (Citrix docs) | Key apps probed on a schedule; recent runs pass |
Security and patching
| # | Check | How | Good looks like |
|---|---|---|---|
| 39 | Lifecycle | Compare versions with the product matrix | No CR past EOL (CRs reach EOM 6 months and EOL 18 months after GA); LTSRs on a current CU |
| 40 | NetScaler bulletins | Bulletin fixed builds and CISA KEV against #27 | Every KEV-listed NetScaler CVE fixed |
| 41 | XML service TLS | netsh http show sslcert; HKLM\Software\Citrix\DesktopServer\XmlServicesEnableNonSsl (Citrix docs) |
A trusted cert bound on 443; value 0 (HTTP ignored) |
| 42 | Admins and changes | Get-AdminAdministrator; Get-LogHighLevelOperation -OperationType ConfigurationChange (SDK) |
Every admin is a current person or group; every change is explained |
Backup and DR
| # | Check | How | Good looks like |
|---|---|---|---|
| 43 | SQL | Backup jobs for the Site, Monitoring and Logging databases | Regular backups, restores tested; HA via AlwaysOn, mirroring or clustering (not SQL Express) (Citrix docs) |
| 44 | Site configuration | Web Studio Backup and Restore, or Backup-CvadAcToFile (Citrix docs) |
Recent backup, pinned before changes. MCS catalogs aren't covered (Citrix docs) |
| 45 | NetScaler | create system backup <name> -level full (CLI ref) |
A recent full backup copied off-box, not just in /var/ns_sys_backup |
FAQ
Is there an official Citrix health check tool?
Yes, several. Citrix Scout and Web Studio's Test site cover CVAD. Cloud Health Check and Studio's Run Health Check cover DaaS. Citrix Health Assistant handles unregistered VDAs, and WEM has its own health check tool. None of them covers NetScaler, FSLogix or your backups, which is why the list above exists.
Is there a Citrix health check PowerShell script?
Citrix ships cmdlets, not a single script. The loop above plus rows 1–7 and 14–17 make a read-only script. Start-EnvTestTask runs Citrix's own infrastructure tests from PowerShell.
How do you health check Citrix DaaS?
Citrix runs the control plane, so focus on what you own: Cloud Connectors (rows 8–13), VDAs, StoreFront, profiles and NetScaler Gateway. For DaaS PowerShell, use the Remote PowerShell SDK after Get-XdAuthentication (Citrix docs).
How often should you run a Citrix health check?
Run the PowerShell rows weekly, and the full list before and after every upgrade. Also run it whenever a new NetScaler bulletin lands.
Want a second pair of eyes?
The Sessionwright assessment runs this kind of check across your Citrix site and NetScaler Gateway. It is read-only, and an expert reviews the report before it reaches you. Sessionwright for Citrix is read-only by default too: every change it proposes waits for your approval and is logged (security model).
Sources
- Citrix docs: Citrix Scout health checks; Cloud Health Check; Run Health Check for VDAs; Web Studio home page (Test site); Director: Troubleshoot machines
- Citrix SDK: Get-BrokerController, Get-BrokerServiceStatus, Get-ConfigServiceStatus, Test-BrokerDBConnection, Get-BrokerDBConnection, Start-EnvTestTask, Get-BrokerDesktopGroup, Get-BrokerHypervisorConnection, Get-BrokerSite, Get-BrokerMachine, Get-AdminAdministrator, Get-LogHighLevelOperation; DaaS Remote PowerShell SDK
- Citrix docs: Local Host Cache; Databases; Backup and restore (Automated Configuration); Backup and restore configuration; Enable TLS on Delivery Controllers; VDA versions and functional levels
- Citrix Cloud docs: Cloud Connector system requirements; Technical details; Connector updates; Advanced connectivity checks; DaaS Infrastructure Monitoring
- StoreFront: Get-STFDeployment, Get-STFServerGroupConfiguration, Get-STFStoreFarm; Configure HTTPS; Server groups
- Licensing: CVAD License Activation Service; Licensing What's new (file-based EOL); License Activation Service; Citrix product lifecycle matrix
- NetScaler: CLI reference for show ns version, HA node, ssl certKey, vpn vserver, lb vserver, serviceGroup, ntp status, system backup; docs: Limiting failovers (HA output), Basic operations, Gateway with StoreFront
- Microsoft Learn (FSLogix): Release notes; Configuration settings; Events, logs and diagnostics; Storage permissions; Prerequisites
- Citrix WEM: WEM health check tool; Administration (agents)
- Director: Alerts and notifications; Probes
Want the whole estate checked, read-only?
The Drop-in Assessment runs checks like these across your Citrix site and NetScaler Gateway with read-only access, then ends with an expert-reviewed report and a 60-minute readout. $4,500 fixed price, one site, up to 1,000 users, up to 2 ha pairs.
Related guides
- Citrix VDA Unregistered: Troubleshooting for CVAD and DaaS
Citrix VDA stuck Unregistered? Read the deregistration reason first, then check ListOfDDCs, time, DNS, ports 80/443, versions and Cloud Connectors.
Citrix, NetScaler and Citrix Virtual Apps and Desktops are trademarks of Citrix Systems, Inc. and/or its affiliates. Microsoft and FSLogix are trademarks of the Microsoft group of companies. Sessionwright is not affiliated with or endorsed by Cloud Software Group, Citrix or Microsoft.