SUA-SDK, CSH crashes on Citrix XenApp system
We have got many issues reported for SUA SDK, where the korn/ C shell crashes.
While the C shell crashes just after launching the korn shell crashes as soon we run command like clear.
With further investigation, we had found that generally this is because of some anti-virus or Citrix software which inject some code into every process during start-up assuming them to be proper Win32 process. SUA processes we know behave a little different than other Windows processes especially during start up so this looks to be a feasible possibility.
Uninstalling XenApp citrix application does resolves the issue but this was not feasible solution on most of the scenarios.
Hence with further troubleshooting / research and investigation we noticed that there were two citrix drivers were interfering with SUA: rskcore.sys and ctxpidmn.sys
From the crash dumps we could see ctxpidmn.dll queuing which was coming from ctxpidmn.sys (Citrix driver pool allocation). To fix ctxpidmn.sys, follow the steps as per https://support.citrix.com/article/CTX132820
Run regedit.
Add following registry key.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ctxpidmn
Type: String
Name: UviProcessExcludes
Value: csh ==>For C shell
Separate with colon if necessary for other commands. e.g.) vi;csh;yacc;clear
Reboot server to enable the setting.
Rskcore.sys, is a core part of Citrix Edgesight which is a monitoring agent for citrix. Unfortunately, there was no registry option or any other option available to exclude SUA processes and hence this driver needs to be removed.
- You may prefer any option of your choice to remove this drivers.
- Alternatively, the driver may also be removed using the autoruns.exe tool from sysinternal. https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
- Once the above step is done, the system needs to be rebooted.
With this the SUA works and users can launch C shell. Run the clear command from Korn shell. The steps discussed are based out of testing and alternate workaround.