So here is our situation. For years we have had a Virtual Printer on our Xenapp Servers, and worked no problem with Cisco Amp. When someone prints to this virtual printer, after printing is completed, a Batch File is called that has a wscript in it.
What is happening, since December 8th, is that the Cisco Amp is reporting the wscript as an exploit prevention, which I understand why it would do it.
Here's the thing - It does not do it for all users. Only a handful!
If I stop the cisco amp service and have them do it again, they are fine and everything works. I then can turn back on the Cisco Amp service, and the user is fine for the rest of the day, even if they log off and back onto the citrix server. However, the next day, the same problem arises. This happens on all of our citrix servers (we have 6 of them load balanced).
Any idea why this started on December 8th with no changes made to the policy or update to Cisco Amp, and, why is it only happening to a few users, and not all of them?
Any help would be appreciated!
