• XenApp/XenDesktop: Application launch gets stuck at “Connection Established. Negotiating Capabilities” for a few minute and then closes out.
• In Citrix Studio  the session is found in Prelogon State.
• Csrss.exe and winlogon.exe get created for that session till the time it is stuck at “Connection Established. Negotiating Capabilities” and then once the windows disappears, winlogon.exe and csrss.exe for that session also close out.
• In CDF Trace collected from VDA side  ConnectionFailure's are seen.

52719,1,2018/07/05 11:26:07:36798,2860,1740,1,BrokerAgent,,0,,5,EntryExit,"=========>>>>> StackManager.NotifySessionEvent(09b84615-b5bc-4235-b19e-9a18192ea3ad): Enter(SessionEvent:SESSION_EVENT_TERMINATE, SessionReasonCode:SESSION_EVENT_REASON_CONNECTION_FAILURE, rdsCalId:0)","" 

52745,1,2018/07/05 11:26:07:39686,3880,1740,1,DirectorVdaPlugin,,0,,5,EntryExit,"OnPrepareSession: [SessionKey=09b84615-b5bc-4235-b19e-9a18192ea3ad, TerminateReasonCode=ConnectionFailure]","" 

• In the Application Event logs  Error 4005: The Windows logon process has unexpectedly terminated is logged.

Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.

You don’t have to entirely disable System Center Endpoint Protection'sRealtime scanning all together.
Only outgoing files scanning need to be disabled and and "monitor only incoming files" needs to be selected.
These are the settings that were configured to fix the issue,

---

Problem Cause

 Procmon logs need to be collected on the VDA while reproducing the issue.

From the Procmon logs it was confirmed that Microsoft's Windows Defender DLL's and Citrix Hooks got loaded in winlogon. The Version of MsMpEng.exewhich caused the issue is 4.10.0.209.0. 

System Center Endpoint Protection Real-Time scanning was causing the issue. In this case it is advised to work with Microsoft to investigate this further.

XenApp/XenDesktop: Application Launch Gets Stuck At “Connection Established. Negotiating Capabilities” For A Few Minutes Minute And Then Closes Out.