Admins may find a large number of Audit Failures in the Windows Security Event log for Picashell.exe causing the “Service Host: Windows Event Log” to significantly increase in system resource usage. These errors may overwhelm the Security event log and produce in the range of several hundred to several thousand audit failure events a second.

To resolve this issue ensure that the following three citrix policies are disabled.

• Remote the combo box
This setting determines the types of combo boxes you can display in sessions on mobile devices. To display the device-native combo box control, set this policy setting to Allowed. When this setting is allowed, a user can change a Citrix Receiver for iOS session setting to use the Windows combo box.

• Automatic Keyboard Display
This setting enables or disables the automatic display of the keyboard on mobile device screens.

• Unicode Keyboard Mapping (or EnableKlMap registry flag)
This setting enables or disables dynamic keyboard layout synchronization, Input Method Editor (IME), Unicode keyboard layout mapping, and hides or shows the keyboard layout switch notification dialog message.

---

Problem Cause

Using Microsoft UI Automation to get focus change notification causes this issue.  Citrix is working with Microsoft to address the issue. 

Admins may see an increase in the amount of system resources being used by Service Host: Windows Event Log