When utilizing multi-session VDA with the Duo Security agent installed, users may close out the applications in an attempt to log off of the VDA but the LogonUI.exe process will hang. This will result in multiple Terminal Services sessions showing active with the same session number, but no user name. Each session will show the following five processes running:
Dwm.exe
CtxGfx.exe
Csrss.exe
Winlogon.exe
LogonUI.exe
Manually terminating the LogonUI.exe process will result in the session logging off as expected.
Duo support has confirmed that the installation of the agent is not supported on Citrix multi-session servers, and therefore must be removed.
Analysis of memory dumps from affected servers show that the Duo agent has a notification window open in the background, preventing the LogonUI.exe process thread from exiting as expected.