Hi guys, has anyone here successfully gotten Enhanced Domain Passthrough for Single Sign-On up and running? I've configured the settings according to the Citrix documentation, and I can also log in using Single Sign-On on the client's Workspace app. However, when I launch a desktop, the session gets stuck at the login screen. Does anyone know what's missing here? It seems the Citrix documentation isn't complete in this regard.

What's your OS build, VDA, CWA version? (Including CU version)

OS (Client): Windows 11 23H2 OS (VDA): Windows Server 24H2 VDA: 2507 LTSR CU1 CWA: 2603.10

Step-by-step checklist: 1. Client: Credential Guard Run

msinfo32

, check “Virtualization-based Security services running”. If “Credential Guard” is listed, this is the most likely cause (enabled by default on Win11 22H2+ Enterprise). Disable via Device Guard GPO or registry

HKLM\SYSTEM\CurrentControlSet\Control\Lsa

>

LsaCfgFlags = 0

, then reboot. 2. VDA: credential delegation GPO: Computer Configuration > Administrative Templates > System > Credentials Delegation > “Remote host allows delegation of non-exportable credentials” = Enabled. Reboot the VDA. Verify with

gpresult /h

that the policy actually applied. 3. VDA: is ctxauth.dll loaded into lsass.exe On the VDA:

tasklist /m ctxauth.dll

. If no result, enable GPO: Computer Configuration > Administrative Templates > System > Local Security Authority > “Allow Custom SSPs and APs to be loaded into LSASS” = Enabled. Reboot. (CTX694923, relevant on Server 2025.) 4. Citrix policy In Studio/WEM: “Enhanced domain pass-through for single sign on” = Enabled and assigned to the correct Delivery Group. Confirm on the VDA via Citrix Group Policy Modeling or the VDA registry. 5. Client: line of sight to DC From the client:

nltest /dsgetdc:yourdomain

and

klist get host/vda-name.domain

. If Kerberos cannot obtain a ticket, session SSO will not work (VPN/firewall often blocks 88/tcp).

Did all of that settings...unfortunately, didn't work for me...got the same error again. Stuck in the blue logon screen.

🤷‍♂️… raise a support ticket with Citrix Support 🤷‍♂️