Citrix user sessions are held open by ccSvcHst.exe during log off
DWORD
32 bit OS:
HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\AdministratorOnly\General\
CloseUserLogFile=1
64 bit OS:
HKEY_LOCAL_MACHINE\SOFTWARE\[Wow6432Node\]Symantec\Symantec Endpoint Protection\AV\AdministratorOnly\General\
CloseUserLogFile=1
Ref:
https://support.symantec.com/en_US/article.TECH210170.html
32 bit OS:
HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\AdministratorOnly\General\
CloseUserLogFile=1
64 bit OS:
HKEY_LOCAL_MACHINE\SOFTWARE\[Wow6432Node\]Symantec\Symantec Endpoint Protection\AV\AdministratorOnly\General\
CloseUserLogFile=1
Ref:
https://support.symantec.com/en_US/article.TECH210170.html