FAS question. I have environment that is migrating VDAs from server 2016 to server 2022. Looks like FAS doesn't work on 2022 vda, works fine on server 2016. On 2022 i'm getting logon or password incorect and in the system event viewer it says "The following error was returned from the certificate validation process: A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider". From what i'm reading it sounds like security hardening on the newer OS, and server 2016 was just more lenient. This article says i need to run some certutil commands to get the CA cert in the NTAuth store. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX575105 this process is new for me and doesn't seem very highly documented. Anyone else run into this?

From my notes: saw this on Win10 machines: System event log: eventid 9 The client has failed to validate the domain controller certificate for servername.law.firm. The following error was returned from the certificate validation process: A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. . Resolution The CA that issued the user cert is not in the NTAuth Enterprise store; it may appear in the "Trusted Cert Authorities"; red herring. Run this on VDA: Certutil -viewstore -ent NTAuth You should not see your CA listed. I had to fix on MCS master image: NTAuth Store | Richard M. Hicks Consulting, Inc.

gotcha, in my case the CA cert isn't in the trusted root store either, which i thought was weird...but even after manually importing it on the VDA, still getting that same eventid 9 error. So i guess just need to run that NTAuth command then. Seeing that it is a global change, just want to make sure i'm not going to mess anything else up

I has a customer that alos had an issue being able to update the ntauth store cache. Each vm has a cache of those settings. It had to do wiht a GPO restricting access to the certificate.

interesting, thanks. Yeah, when i view the NTAuth store on the CA/Domain controllers i see the NTAuth store has the CA cert there...but VDA doesn't

How are you looking for it are you using this command Pasting this content here is blocked by your administrator.

using that exact command, "certutil -viewstore -enterprise NTAuth"....actually just ran this on server 2016 and it shows the correct CA cert, but running it on server 2022 shows NO certs....interesting....folllowing the breadcrumbs here

run certutil -enterprise -addstore NTAuth <CA files> to add your CA intermediate cert to NTAUTH store on VDA

running the -addstore command on the 2022 VDA added the CA cert to the NTAuth store locally....this corrected the FAS issue, and it works now. So apparently there is some sort of sync issue, where these 2022 servers can't sync the certs locally