Last updated:
This week, while investigating a Citrix issue, I came across some interesting behavior.
The starting point:
Windows 11 with Citrix VDA 2507 LTSR CU2 in a Remote PC Access scenario.
After installing the VDA, internet access through Microsoft Edge became unreliable.
The curious part:
✅ Network adapter active
✅ Windows Firewall was not the cause
❌ Edge could no longer reliably reach external websites
❌ Downgrading the VDA did not help
Access worked again only after completely uninstalling the Citrix VDA.
🔍 Where was the cause?
Not in the conventional network stack, but in a Citrix HDX hook:
CtxWebAuthnHook.dll
This hook is part of Citrix WebAuthn integration and supports the corresponding authentication scenarios.
The affected environment also used a proxy auto-configuration (PAC) file.
This particular combination apparently caused a conflict between the Citrix hook and Microsoft Edge.
🛠️ What was the solution?
The decisive clue was the process-specific hook configuration for:
CtxWebAuthnHook\msedge.exe
After removing the corresponding registry entry, internet access worked again.
The VDA could remain installed.
⚠️ Important: this is a targeted workaround for the affected configuration. Before changing Citrix hooks, assess potential effects on WebAuthn and FIDO2 authentication.
💡 My learning from this finding:
If browser issues suddenly appear after a VDA installation, do not limit your investigation to DNS, firewall, proxy or the network adapter.
The Citrix API hooking configuration can also affect individual applications.
In environments using PAC files, WebAuthn and FIDO2 in particular, it is worth examining the loaded Citrix hooks.
A working network stack does not automatically mean the browser can communicate without issues.
