Applications that were previously accessible become blocked on multi-session Virtual Delivery Agents (VDAs), often after another user logs on to the same Session Host.

Administrators may observe the following:

• Application launches are denied unexpectedly.
• The issue occurs intermittently and may affect only certain Session Hosts.
• Different users experience different application access on the same server.
• Effective AppLocker policies change following user logons or policy refreshes.

Because Windows AppLocker is a machine-wide security policy, the resulting policy is applied to the entire server and affects all users currently logged on.

If a newly logged-on user receives a policy set that does not contain certain application allow rules present in the previous policy, those rules are removed from the effective AppLocker configuration.
As a result:
1. WEM replaces the existing AppLocker policy.
2. Previously available allow rules may be removed.
3. AppLocker enforcement remains active.
4. Applications that no longer match an allow rule are blocked.
Because AppLocker operates as a default-deny technology once enabled, any executable, script, MSI, packaged app, or DLL not explicitly allowed by the effective policy may be denied execution.

This behavior is expected due to the architectural design of AppLocker.

WEM Application Security assignments can be targeted to individual users or groups. However, Windows AppLocker policies are applied at the computer level and are shared by all users on the system.

On a multi-session VDA:

• Multiple users may be logged on simultaneously.
• Different users may receive different WEM Application Security assignments.
• Each WEM policy refresh can replace the effective AppLocker policy when Overwrite mode is used.

The resulting AppLocker policy can become dependent on which user's policy was applied most recently, making application access appear inconsistent across user sessions.

Recommended: Change Rule Enforcement to Merge

Configure WEM Application Security to use Merge instead of Overwrite.

Using Overwrite mode in environments where different users receive different Application Security assignments can lead to unexpected application blocks as users log on and refresh policies.

For multi-session VDAs, Merge mode is generally the preferred configuration because it minimizes policy volatility and preserves application access across user sessions.

Citrix WEM policies are not functioning properly on all servers

Some applications are showing as restricted on certain servers even though they are allowed and working on others

The collected logs showed that the WEM Agent was configured to apply AppLocker policies using Overwrite mode.
When a user logs on, WEM generates and applies an AppLocker policy XML based on the Application Security assignments applicable to that user

AgentHostProxyService.ProcessAppLockerRules() : Mode Overwrite will be applied.

Starting process AppLocker policy for the user 1( 'S-1-5-21*)

Starting process AppLocker policy for the user 2( 'S-1-5-21*)

Starting process AppLocker policy for the user 3( 'S-1-5-21*)

Starting process AppLocker policy for the user 4( 'S-1-5-21*)

user -1: HAS rule (XML length 18164)

user -2: HAS rule (XML length 16506)

user -3: HAS rule (XML length 16506)

user -4: NO rule (XML length 16502)  - overwrites machine policy without allow rule