Hi All, Myself and @John Gallacher are seeing a strange issue with FAS. "Incorrect Username or Password" error when trying to launch a desktop/application. Works for majority of users but intermittent for a few and quite consistent on certain apps for certain users. We've enabled Kerberos logging and upon the failed login can see Security Kerberos Event ID 3: 0x19 KDC_ERR_PREAUTH_REQUIRED 0x18 KDC_ERR_PREAUTH_FAILED Consistently seeing 0x7 KDC_ERR_S_PRINCIPAL_UNKOWN but these are being logged frequently and outside of failed logon timestamp. Any suggestions or ideas?

Not an answer, but may help you narrow down the signal/noise. KCD_ERR_PREAUTH_REQUIRED is typically informational and not an error. It's there for fallback/compatibility. Add'l question, were the users who are impacted working previously and a seemingly no change event broke something? Single domain or trust involved?

One of my coworkers solved a Citrix FAS problem by removing Microsoft patches. I assume the April ones. I don’t have more details yet but it may help you.

do all your users have the same UPN? I’ve seen this happen when users log in via entra with email and that gets passed through to FAS which throws the password error because the email isn’t the UPN for the user