This message was deleted.
# citrix-vads
Slackbot
11/13/2023, 8:16 AMThis message was deleted.
r
Rob Zylowski
11/13/2023, 1:01 PMDo you only have a single domain? I have seen that error when cross domain authentication is not configured. Check your fas gpos make sure the order matches and that there are no spaces in the lines with server names.
f
Frederic ATLAN
11/13/2023, 1:38 PMHello Rob,
Yes it's a single domain and for the moment there is only one FAS and one CA and the name is correct (same GPO applied on OUs containing FAS, SF and VDAs).
The thing i cannot reproduce to compare in a lab for the moment is that the root CA has still a sha1 signature i don't if there can be an impact.
r
Rob Zylowski
11/13/2023, 1:45 PMIf you arent getting an error on the domain controller where the logon is happening then thats probably not an isuse but im not sure about that. You do have a domain controller or Kerberos client authentication certificate on your domain controllers that includes smartcard logon in Enhanced Key Usage
f
Frederic ATLAN
11/13/2023, 1:48 PMYes the customer has several certificates for his AD server including one with this usage.
r
Rob Zylowski
11/13/2023, 1:51 PMOk our FAS engineers dont think the root CA using SHA1 would be an issue
Rob Zylowski
11/13/2023, 1:52 PMf
Frederic ATLAN
11/13/2023, 1:53 PMunfortunately already tried and no issue CRL vas sucessfully verified from the VDA. I've also set the key in prevention but no more success !
r
Rob Zylowski
11/13/2023, 1:54 PMBTW there is a gpo to always prompt for password you should ensure you dont have that set
Rob Zylowski
11/13/2023, 1:56 PMAnd you said you get no errors on the VDA event logs
Rob Zylowski
11/13/2023, 2:00 PMamong many possible errors on the vda you could see something like this if the domain controller is not trusting the FAS certificate
Rob Zylowski
11/13/2023, 2:01 PMThere woudl also be an error on the domain controller
f
Frederic ATLAN
11/13/2023, 2:02 PMI've asked the customer to double check as he has lots of GPOs.
Yes i already had this kind of errors for others customer but it's not the case for the moment. The problem is that i don't know which additionnal logs to activate
r
Rob Zylowski
11/13/2023, 2:02 PMall of the fas loggin is in the even viewer
Rob Zylowski
11/13/2023, 2:02 PMthe only other logging is the kerberos stuff on the VDA which it sounds like you jave done
Rob Zylowski
11/13/2023, 2:04 PMif you really dont see errors on the vda event logs then I woudl think the gpo to rpomtp for password is the culprit but you should be able to see that in the RSOP
Rob Zylowski
11/13/2023, 2:04 PMit is hard to look through the audit logs of course because there are so many entries
f
Frederic ATLAN
11/13/2023, 2:05 PMYes i hope, i'll keep you informed. I've also found that we can activate capi2 logs to investigate about CA issues.
r
Rob Zylowski
11/13/2023, 2:09 PMGood Luck FAS can be quick and easy or take a long time to get going. Sounds like your in the later.
f
Frederic ATLAN
11/13/2023, 2:14 PMYes thank you for you help, i really appreciate.
Frederic ATLAN
11/15/2023, 4:15 PMHello Rob, little update:
My customer has tried with published desktop instead of published app and he got the prompt for login password. So I've asked to check further the presence of the GPO for "always prompt" and i'm waiting for his feedback.
In parallel, he also found an article interesting but not necessarly relevant in our case: https://support.citrix.com/article/CTX479236/fas-information-about-microsoft-kb-kb5014754cve202234691-cve202226931-and-cve202226923
I share it here for the information.
Frederic ATLAN
11/29/2023, 10:35 AMLittle update,
still the issue with the GPO disabled, so next step is to investigate in CAPI logs.
2 Views