Sessionwright for Citrix® environments
An AI admin agent for Citrix Virtual Apps and Desktops and Citrix DaaS
Health checks, VDA registration, drift alerts and NetScaler® exposure, each backed by evidence. You approve; it acts and logs.
Rule CVAD-VDA-REG-03
High37 machines in delivery group Finance-W11 are unregistered
- Registration
- Unregistered (37 of 120)
- Since
- 2026-10-15 06:42 UTC
- Common cause
- Controller list mismatch after image update
- Users affected
- 0 sessions, 214 assigned users
Proposed fix: Restart the Citrix Desktop Service on 37 machines with no sessions
T1The jobs it takes off your plate
Every finding names the rule that produced it, what was observed, what was expected, and the vendor documentation behind it.
The daily health check
Delivery Controllers, site database, hypervisor connections, catalogs and delivery groups, checked every morning against a written standard instead of a tired eye.
Unregistered VDAs, triaged
Finds unregistered machines, groups them by likely cause and proposes the least disruptive fix, starting with machines that have no sessions.
Image and VDA version drift
Catalogs on stale images, mixed VDA versions inside a delivery group, and machines that never picked up the last update.
Licensing that changed under you
File-based licensing stopped working on April 15, 2026. On-premises license servers now activate through the License Activation Service and must upload usage regularly. Sessionwright checks activation and upload status before it becomes an outage. Source: Citrix docs: License Activation Service
StoreFront and Cloud Connector health
Store and Gateway configuration, certificate expiry, and Cloud Connector status for Citrix DaaS sites.
The gateway in front of it all
Build and CVE exposure for every NetScaler appliance, and approval-gated HA upgrades through Nightpatch.
Works with documented interfaces only
No scraping, no undocumented endpoints, no binary patching. Read-only roles first.
| Platform | How Sessionwright reads it |
|---|---|
| Citrix Virtual Apps and Desktops (on-premises) | Broker PowerShell SDK through allow-listed scripts, run as a service account with the Read Only Administrator role |
| Citrix DaaS | Citrix Cloud REST APIs with a read-only API client |
| Monitoring data | Citrix Monitor OData for sessions, logons and machine history |
| NetScaler ADC and Gateway | NITRO REST API with a dedicated user bound to a show-and-stat command policy |
Ask about your own site, not the internet
Chat answers from your environment's findings and evidence, through Claude Code or Claude Desktop on your own seats, or the runner's web console with your own API key.
- Why did 37 Finance machines go unregistered this morning?
- Which delivery groups still run an older VDA version?
- What changed on the Finance catalog since last Tuesday?
- Plan the NetScaler upgrade for Saturday night.
Nothing changes until someone signs
Low-risk actions, like restarting the desktop service on a machine with no sessions, need one approval. Disruptive ones, like an image update or a reboot with users on it, need a Change Approver, a change window, a backup and a rollback. Every step lands in a hash-chained audit log.
Start with a fixed-price, read-only assessment
The fee is credited in full toward Advisor or Operator if you continue within 60 days. Design partners get 50% off.
- Drop-in Assessment: Citrix + NetScalerOne site, up to 1,000 users, up to 2 HA pairs
- $4,500
- AdvisorRead-only agent and chat. It watches, explains and drafts plans. It does not change anything.
- from $750/mo
- OperatorEverything in Advisor, plus approve-to-execute: plan, dry-run, approve, execute, verify, roll back.
- from $1,500/mo
Questions
Does it work with on-premises Citrix Virtual Apps and Desktops, or only Citrix DaaS?
Both. On-premises sites are read through the Broker PowerShell SDK from a runner inside your network. Citrix DaaS sites are read through the Citrix Cloud REST APIs.
What permissions does it need?
For the assessment and the Advisor plan, read-only: the Citrix Read Only Administrator role, a read-only Citrix Cloud API client and a NetScaler user limited to show and stat commands. Write permissions are separate, scoped and only added when you enable an action tier.
Does it replace our monitoring tools?
No. Monitoring tools tell you something is wrong. Sessionwright explains the finding, proposes the fix and, once you approve, carries it out with rollback. It works alongside what you already run.
Is Sessionwright affiliated with Citrix or Cloud Software Group?
No. Sessionwright is independent. It uses Citrix's documented APIs, and it works with your Citrix products; it is not endorsed by Cloud Software Group.
Help shape the Citrix agent
We are onboarding a small number of Citrix and NetScaler design partners: free or half-price assessments in exchange for regular feedback.