Citrix XenApp servers experience slow response and performance, which is more noticeable when users try to log on to the servers. At some point the performance of the servers is affected, resulting in issues with logon and requiring the server to be restarted. This issue is more noticeable on mid to large Citrix XenApp infrastructures.
The users logged on to this server experience slower performance over time and may not be able to logon until the servers affected are restarted. Restarting the Trend Micro services on the affected server can be considered as a temporary workaround as it causes the servers to function normally for some time.

Caution! Refer to the Disclaimer at the end of this article before using Registry Editor.
Trend Micro has provided a registry fix for this issue. Create the following registry on all the affected servers:

Add new DWORD Value ​as:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TmFilter\Parameters] "DisableCtProcCheck"=dword:00000001
This registry key avoids the matching of PID for the .tmp file in the close table. In this case, VSAPI deletes the entry from the close table and that resolves the performance issue related to searching.
The purpose of the key DisableCtProcCheck=1 is to disable the close table searching.

Problem Cause

This issue mainly occurs on the Windows Remote Logging mechanism and Citrix XenApp installations.
When VSAPI scans an open for write file, it creates an entry in its internal close table for tracking. The remote logging environment usually creates a lot of *.tmp files. When VSAPI scans those files, it creates many entries in its close table.
In some occurrences the PID cannot match the *.tmp file while VSAPI tries to delete the entry in its close table after scanning. Therefore, a lot of entries are left in the table and that causes significant performance issues (too many entries in the close table causes the search to be very slow).