Your users fix their own Citrix problems in seconds. Your helpdesk sees why a session is slow, in one click.
SSS is a small, fast web portal for Citrix Virtual Apps and Desktops (CVAD). Users sign in with their Windows account and see only their own sessions: how good each one is (traffic lights), what ran before (history), and a Log off button that works. The helpdesk gets the deep view on top: logon waterfall, performance graphs, profile analysis with advice, and control over processes. No agent, no database, no client software, one IIS application.
Demo data, light and dark mode
Status: beta. Tested end to end on Citrix Virtual Apps and Desktops 2203, 2402, 2507 and 2607 (LTSR) test sites (single Delivery Controller). Several Delivery Controllers and several web servers are implemented (docs) but not yet verified on a real site. Try it without Citrix: the built-in demo mode needs only the .NET SDK.
A frozen application, a slow desktop, a session left open on another machine: today that is a ticket. With SSS the user opens one page and sees what is going on.
- All own sessions at a glance: desktops and apps, active or disconnected, where they run, since when, from which device.
- Session quality with traffic lights, split into Your device & network (latency, bandwidth) and Datacenter & VDA (logon time, server load), with a plain-language tip ("High latency: check Wi-Fi, VPN or the distance to the datacenter"). Colours always come with a symbol and a word.
- History of the last hour, day, week or month: what was running, how long, how good it was.
- Log off a frozen session, all disconnected ones, or everything, with a confirmation. There is deliberately no "disconnect" button.
- Own sessions only, guaranteed on the server (see Security). Filter, sort, CSV export, light and dark mode, phone friendly, keyboard and screen-reader friendly, in English, Deutsch, Français, Español and 中文.
- Optional link to StoreFront to start the desktop again.
Members of an AD group get a Helpdesk tab and an Expert view with everything Citrix knows, without opening Director and without a remote session.
Logon waterfall and performance graphs; profile type, size, folder tree and findings
- Find a user or list all live sessions of the farm; open any user's sessions and history.
- Log off sessions (with a mandatory or optional reason) and send a message to a session ("please save your work, the server restarts").
- Performance data and graphs over time: ICA round-trip time, available bandwidth, datacenter latency, with values on hover, plus connection history and failure or disconnect reasons.
- Logon waterfall: where the logon time goes (brokering, HDX connection, authentication, group policies, logon scripts, profile load, shell). The slowest step is highlighted, time Citrix does not itemize is shown as such.
- Profile analysis, read on the VDA: local, roaming, Citrix Profile Management or FSLogix; container and folder size; a TreeSize-like folder tree and the largest files; folder redirection; FSLogix and UPM settings and exclusions; and findings with advice (container nearly full, Outlook or Teams caches, personal data in the profile, missing exclusions, leftover local profiles, ...).
- End applications and processes of a session through a restricted endpoint on the VDAs (off by default).
- "Copy support info" puts the key facts of a session into the clipboard for a ticket.
- Status page with live health checks instead of digging through event logs; audit trail of every search, view, log-off, message and process action.
| Light and fast | ASP.NET Core running inside IIS. No database, no agent, nothing to install on clients, no cloud. Warm PowerShell workers keep the Citrix SDK loaded. Runs next to Web Studio on the same server. |
| Secure by design | The identity comes only from IIS Windows authentication. Every action is checked again on the server and again in the worker, so a user cannot touch a session that is not theirs. CSRF protection, strict content security policy, rate limits, no third-party packages. Threat model. |
| Simple to run | One service account (gMSA), one script: install.ps1. Test-SssSetup.ps1 checks the wiring and prints the fix for every finding. Updates roll back by themselves if the new version does not answer. |
| Ready for bigger sites | Several Delivery Controllers with failover, several web servers behind a load balancer (health probe, shared key ring), audit trail, versioning policy, English and German documentation. |
Try the demo (about two minutes, no Citrix needed):
git clone https://github.com/ITCMA/SSS.git && cd SSS
ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://localhost:5080 dotnet run --project src/Sss.WebOpen http://localhost:5080 and add ?shot=profile or ?shot=processes to the address to see the expert dialogs. Requires the .NET 10 SDK.
Install on your Citrix site: download the zip from the releases, then follow the set-up guide: prepare a service account, run install.ps1, check with Test-SssSetup.ps1 and Test-SssCitrix.ps1. What the server needs is listed in the requirements.
- The user identity comes only from IIS Windows authentication, never from request parameters.
- Every log-off, message and process action is re-checked server-side against the caller's own live sessions before anything is sent to Citrix; foreign or unknown ids are rejected and audited.
- Anti-forgery token, per-user rate limits, strict CSP and security headers, no inline scripts, no
innerHTML. - The helpdesk is a separate set of endpoints behind an AD group; everything it does is audited.
- Process control uses a restricted JEA endpoint with three commands and shows exactly what it can and cannot do (docs).
- Details and how to report a problem: SECURITY.md, threat model.
| Set-up guide | from nothing to a working SSS: service account, installation, connection, helpdesk |
| Requirements | software, accounts, Citrix, ports |
| Configuration reference | every option with default and meaning |
| Permissions at a glance | who needs which right, where and why |
| Operations | update, health probe, status page, audit trail, troubleshooting |
| Applications, processes and profiles | the JEA endpoint on the VDAs, setup, security |
| Several controllers and servers | failover, load balancer, Kerberos alias, Monitor over HTTPS |
| Data sources | where the data comes from and how quality is rated |
| Architecture | components and request flows |
| Versioning and compatibility, Changelog | what is stable, how to update |
| Threat model, Security policy | what SSS protects and how to report problems |
| Contributing | development, tests, screenshots |
- Citrix provider: live sessions and log-off via Broker SDK (warm Windows PowerShell 5.1 workers), history via Monitor OData
- Tested on CVAD 2203, 2402, 2507 and 2607 (single Delivery Controller)
- Helpdesk role (AD group): search, farm overview, log off with reason, message to a session, audit
- Expert view with charts, logon waterfall, profile analysis, support info, StoreFront link, status page, setup check
- End single processes of a session (JEA endpoint on the VDAs)
- IIS installer with automatic rollback, release builds via GitHub Actions
- Verify several controllers and several web servers on a real site
- Polite "close" of an application (needs a helper inside the user's session)
- Stricter custom Citrix role for the service account (how to derive it)
- Citrix Cloud (DaaS) backend
- 1.0 after a public beta period
Citrix is a trademark of Cloud Software Group, Inc. This project is independent and not affiliated with or endorsed by it.