Here's the scenario.XenApp 6.5 Advanced on 2008 R2 SP1 Server- HF06 (but also happens under HF05)ActivClient 7.0.2 MiddlewareUsers access the environment using Smart Card or RSA authentication via a Netscaler/StoreFront portal. I have two servers in particular which have a higher smart card auth load due to an internally published PowerBuilder app. Hello Joshua,Definitely get a case opened so Citrix Support can take a look at those dumps. SvcHost.exe is a service host surrogate (basically a container process in which to run a process as a service). So much will really depend on exactly which service is crashing and for what reason.Scardhook's presence in the memory space itself is not indicative of root cause. Like many of Citrix's hooking DLLs it is loaded in the process space of all processes executing on the server.
The purpose is to capture calls appropriate to a SmartCard transaction and then to remote that down an ICA virtual channel to the client endpoint which will have the actual Smartcard itself attached. Since we cannot anticipate what application or service will execute a call for a SmartCard the hook loads in all of them.Hope this helps. I was able to capture a user-mode dump during the crash.
I ran!analyze -v against it in WinDbg and it came back with the following:Microsoft ® Windows Debugger Version 6.12.0002.633 AMD64Copyright © Microsoft Corporation. Are you running the latest ActivClient hotfix? I believe it's 7.0.2.436.Hi, I'm running 7.0.2.406 but I have a case open with ActivIdentity, and their support is telling me it's not ActivClient related. I had them examine the ActivClient logs and the svchost dumps and they found nothing to indicate that it's their libraries causing the problem.I'm still wondering if the issue is related to the Certificate Propagation Service (certprop.dll) which is a Microsoft library mentioned in the stack trace. I had already applied the hotfix perbut perhaps there's a similar but different issue going on here.
I'm trying to see if I can get a case opened with Microsoft support but not sure we have any credits available to do so. Josh,Just an FYI, we are on the same platform as you (AC version 7.0.2.430) and are having continual Smart Card service failures daily.Typically, we find Event ID 7011 in the Windows Event logs to indicate such failures.We also experience issues where only three processes are left, CSRSS.EXE, LogonUI.exe, and Winlogon.exe. When this happens, session counts will increase on the server because Citrix thinks the user load is acceptable, but Windows is keeping the sessions. Session ID's increment upwards (we've seen it hit 60's), and users get a 'Welcome Screen of Death' where the system just freezes at the welcome screen. We believe it's something to do w/the users removing their smart cards without first locking their system but still having a hard time corroborating this.Resolution to the above is to restart the smart card removal service, and other smart card services. Also terminating the three processes above for every session ID that a user is not actively using.
For example, you may see three processes tied to session id 70, but there is no session ID 70 on the user list.These issues do not occur on our non-smart card servers, using the same PVS image. Ran into a similar issue with SVCHOST, what resolved it was setting the Certificate Propagation Service to Run in its Own svchost Process.Sc config CertPropSvc type= ownThanks for the feedback Ryan.
Were you ever able to isolate what in the smart card process was causing svchost to fail? I have a ticket open with Citrix and their engineers are looking into the issue. They did suggest Sc config CertPropSvc type= ownas a potential workaround. One issue that they're having is that can't reproduce the same behavior that we're experiencing. We have been unable to link the issue to a specific function, account, or end user action.