Carl Webster Accessibility Statement

Carl Webster is committed to facilitating the accessibility and usability of its website,, for everyone. Carl Webster aims to comply with all applicable standards, including the World Wide Web Consortium’s Web Content Accessibility Guidelines 2.0 up to Level AA (WCAG 2.0 AA). Carl Webster is proud of the efforts that we have completed and that are in-progress to ensure that our website is accessible to everyone.

If you experience any difficulty in accessing any part of this website, please feel free to email us at and we will work with you to provide the information or service you seek through an alternate communication method that is accessible for you consistent with applicable law (for example, through telephone support).

  • New Script: Get-BrokerInvalidAccounts for Event ID Error 505 Citrix ConfigSync Service

    There you are minding your own business when you (for once) look at the event logs on your delivery controllers. Much to your dismay, what do you see? Hundreds if not thousands of errors in the Application event log coming from the Citrix ConfigSync Service. What’s up with that? What’s going on?

    Updated 16-May-2019

    I want to thank all the members of the Citrix Community that helped test the script and provide feedback to improve it.

    Figure 1
    Figure 1

    What this error is telling you is that some Active Directory (AD) account was removed from AD without first being removed from some resource or association in Citrix Virtual Apps and Desktops (CVAD).

    <sarcasm> As you can see from the text in the error event, Citrix tells you exactly what account is causing the error and what resource or association the account was connected to. NOT!

    You can enable verbose logging to receive more information by creating the following registry value.

    HKLM:\SOFTWARE\Citrix\DesktopServer\LHC -Name EnableCssTraceMode -PropertyType DWORD -Value 1

    Once that is created, you can find a report located in C:\Windows\ServiceProfiles\NetworkService\AppData\Loca\Temp\CitrixBrokerConfigSyncReport.html.

    The report gives you a wealth of information. NOT!

    Figure 2
    Figure 2

    At least it tells you the user account (before it resolves into an orphaned SID), in this case, LABADDOMAIN\TestUser1. But WHERE do I find this invalid account used? Is it assigned to a desktop, a delivery group, a published desktop, a published application, an application group, was it manually added (via PowerShell) as an included or excluded user to some assignment or entitlement policy?

    Update 16-May-2019: From CTA Andy McCullough, if you want the name cache updated immediately, run the following two cmdlets:

    Update-BrokerNameCache -Machines
    Update-BrokerNameCache -Users


    Those questions are what this script is designed to address.

    I looked at all the Get-Broker* cmdlets to see which ones have a computer, security group, or user account associated in some way. I found the following list:

    • Get-BrokerAccessPolicyRule ExcludedUsers IncludedUsers
    • Get-BrokerAppAssignmentPolicy RuleExcludedUser IncludedUser
    • Get-BrokerAppEntitlementPolicyRule ExcludedUsers IncludedUsers
    • Get-BrokerApplication AssociatedUserNames
    • Get-BrokerApplicationGroup AssociatedUserNames
    • Get-BrokerAssignmentPolicyRule ExcludedUsers IncludedUsers
    • Get-BrokerEntitlementPolicyRule ExcludedUsers IncludedUsers
    • Get-BrokerMachine AssociatedUserNames (MachineName, to verify computer account still exists in AD)
    • Get-BrokerSessionLinger AssociatedUserNames
    • Get-BrokerSessionPreLaunch AssociatedUserNames
    • Get-BrokerUser Name

    I am sure I missed something somewhere. If you know of something that should be added to the list, please let me know.

    I don’t think Get-BrokerUser should be in the list. Get-BrokerUser should be self-healing. As invalid accounts are removed from the various entities and associations, the invalid BrokerUser account should be automatically removed.

    Here is the script in action.

    Finding invalid accounts.

    Figure 3
    Figure 3

    The CSV file with invalid accounts.

    Figure 4
    Figure 4

    What the CSV tells you is:

    1. Which cmdlet showed the invalid account,
    2. The invalid account’s name or SID,
    3. The account type (UserOrGroup or Computer),
    4. The cmdlet’s property that contains the invalid account, and finally,
    5. The name of the entity where you can find the invalid account.

    You can use that information to find the invalid account in the GUI and remove it. The others, like excluded users, you can only remove using PowerShell.

    The script when it finds no invalid accounts.

    Figure 5
    Figure 5

    The CSV file with no invalid accounts.

    Figure 6
    Figure 6

    I am already working on V2 of this script that will add the option to remove the invalid accounts. V2 will also support -WhatIf and -Confirm and will also log all actions taken.

    Once the invalid accounts are removed, you will see two events (503 and 504) in the application event log from the Citrix ConfigSync Service and all is well in your CVAD Site (as far as invalid accounts are concerned).

    Figure 7
    Figure 7
    Figure 8
    Figure 8

    Please let me know if there is anything else that should be included in this script.

    If you would like to test V2 of the script with the option to remove invalid accounts, send me an email.

    You can always find the most current script by going to



    About Carl Webster

    Carl Webster is an independent consultant specializing in Citrix, Active Directory, and technical documentation. Carl (aka “Webster”) serves the broader Citrix community by writing articles (see and by being the most active person in the Citrix Zone on Experts Exchange. Webster has a long history in the IT industry beginning with mainframes in 1977, PCs and application development in 1986, and network engineering in 2001. He has worked with Citrix products since 1990 with the premiere of their first product – the MULTIUSER OS/2.

    View all posts by Carl Webster

    2 Responses to “New Script: Get-BrokerInvalidAccounts for Event ID Error 505 Citrix ConfigSync Service”

    1. Stan Mitterling Says:

      I have been tasked with getting a list of all users that are assigned to all of the Delivery Groups. We have a mixture of users assigned and AD groups assigned. I was wondering if you had a script( I looked and saw the static users) but that really does not do what i need. My perfect script would be to pull the names out and then query AD and if it is a user output the name, if it is AD group, then pull out all of the names from that group and then output the names.

      Any help or suggestions would be helpful


    Leave a Reply