This message was deleted.
# citrix-vads
Slackbot
02/24/2022, 8:51 PMThis message was deleted.
r
Ray Davis
02/24/2022, 8:52 PMStorefront should tell you what's going on in events.
Ray Davis
02/24/2022, 8:53 PMIt appears from what you said, those vda have the FAS GPO? Are the persistent machines aware of the FAS server?
r
Ryan Chaney
02/24/2022, 8:56 PMyes, and it has been working for months. Just this week we have seen the iss
Ryan Chaney
02/24/2022, 8:56 PMissue
r
Ray Davis
02/24/2022, 8:57 PMCan you Launch it internally?
r
Ryan Chaney
02/24/2022, 8:58 PMyup, we can launch it internally with no issues, but that store isnt setup for FAS. We only use it for external to skip the double log in
r
Ray Davis
02/24/2022, 8:59 PMOn the vda does it show a list of messages for the deny?
r
Ryan Chaney
02/24/2022, 9:06 PMjust a sec, ill grab the actual event
r
Ray Davis
02/24/2022, 9:06 PMCool
m
Mike Streetz (O_P)
02/24/2022, 10:14 PMdid your cert expire?
Mike Streetz (O_P)
02/24/2022, 10:14 PMI guess that depends on how many months it’s been working for, if the answer is 24 then…
r
Ryan Chaney
02/25/2022, 2:13 PMOn the VDA It shows an S104 Identity Assertion Logon Failed. Failed to connect to the FAS Usercredentialservice Error:access denied
Ryan Chaney
02/25/2022, 2:13 PMThe oddest part to me is that it is only not working for a handful of machines
c
c4rm0
02/25/2022, 2:24 PMany time i have seen the access denied error it has been an issue with the certificate on the domain controller or the user / VDA isnt allowed permissions on the FAS default_rule
c4rm0
02/25/2022, 2:25 PMhave a look at this blog is good for basic FAS troubleshooting https://www.citrix.com/blogs/2019/04/24/troubleshooting-the-federated-authentication-service/https://www.citrix.com/blogs/2019/04/24/troubleshooting-the-federated-authentication-service/
r
Ryan Chaney
02/25/2022, 2:30 PMyea, pretty sure I have that article memorized at this point, lol
Ryan Chaney
02/25/2022, 2:32 PMI have verified that Domain Users and Domain Computers are both set to allow on the default rule.
c
c4rm0
02/25/2022, 2:34 PMchecked the FAS GPO has applied to the VDA and the FAS servers are in the correct order ?
c4rm0
02/25/2022, 2:34 PMHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\Authentication\UserCredentialService\Addresses
r
Ryan Chaney
02/25/2022, 2:36 PMyep, verified via gpresult, and the registry
Ryan Chaney
02/25/2022, 2:37 PMAuthorization cert is valid until 2/2/23
c
c4rm0
02/25/2022, 3:17 PMCitrix Registrationauthority cert ?
4 Views