i think they're both needed to determine if it's a citrix session. Explain what's (not) happening during logon.