Неизвестная ошибка клиента 1110 citrix windows 10

Citrixology

I was pulled into to look at a problem for one of our customers with their Netscalers which stopped the user connections intermittently throwing a very “helpful” error message ” the connection to the desktop failed with status (unknown client error 1110).

The customer description was “it only started to happen a few weeks ago and these days it’s quite impossible to land a successful connection from the outside of our corporate network.”

I managed to get a couple of screenshots of error messages from the users and they appeared like below. When queried, the internal access via Storefront is working fine.

Looking at the error message, there are a multitude of reasons why you would get that, and I am outlining the common areas to check in such cases.

• Check if the Root certificates and intermediate certificates are available on the client devices. If frequently patched, the client will most probably have the latest and update Root CA’s from various public CAs. Check the IE’s / Other browsers’ certificate store to verify the Root and Intermediate CA SSL certs
• If using non-IE browsers for connectivity, switch over to IE to see if it connects. IE is the safest bet when it comes to connectivity to Citrix environments.
• Check for SSL ciphers attached to the NetScaler Gateway vServer. If high security ciphers are used, this issue may occur. Relax the cipher suites to see if that makes a difference. Again, if cipher suites are an issue, the problem will occur every single time when you connect and not sporadically.
• Check the STAs on the NetScaler and ensure that it matches with the STAs configured on the WI/Storefront. This is one of the most critical setting to check and probably the first one to check if the issue occurs only sporadically. There is a high possibility of an STA mismatch as it turned out to be in my case.
• Check the FW from the NetScaler to the VDA – As the title says ensure that the Citrix ports to the VDA are open from the Netscaler

Источник

Citrixology

I was pulled into to look at a problem for one of our customers with their Netscalers which stopped the user connections intermittently throwing a very “helpful” error message ” the connection to the desktop failed with status (unknown client error 1110).

The customer description was “it only started to happen a few weeks ago and these days it’s quite impossible to land a successful connection from the outside of our corporate network.”

I managed to get a couple of screenshots of error messages from the users and they appeared like below. When queried, the internal access via Storefront is working fine.

Looking at the error message, there are a multitude of reasons why you would get that, and I am outlining the common areas to check in such cases.

• Check if the Root certificates and intermediate certificates are available on the client devices. If frequently patched, the client will most probably have the latest and update Root CA’s from various public CAs. Check the IE’s / Other browsers’ certificate store to verify the Root and Intermediate CA SSL certs
• If using non-IE browsers for connectivity, switch over to IE to see if it connects. IE is the safest bet when it comes to connectivity to Citrix environments.
• Check for SSL ciphers attached to the NetScaler Gateway vServer. If high security ciphers are used, this issue may occur. Relax the cipher suites to see if that makes a difference. Again, if cipher suites are an issue, the problem will occur every single time when you connect and not sporadically.
• Check the STAs on the NetScaler and ensure that it matches with the STAs configured on the WI/Storefront. This is one of the most critical setting to check and probably the first one to check if the issue occurs only sporadically. There is a high possibility of an STA mismatch as it turned out to be in my case.
• Check the FW from the NetScaler to the VDA – As the title says ensure that the Citrix ports to the VDA are open from the Netscaler

Источник

Unknown client error 1110

Welcome to CloudConnect Technical Support

CCT-202006161 — Connection to Citrix Desktop fails with status «Unknown client error 0» or «Unknown client error 1110»

Modified on: Thu, Jun 25, 2020 at 4:12 PM

Problem Definition:

Attempting to connect to a Citrix desktop fails with status «Unknown client error 0» or «Unknown client error 1110». The client is using Citrix Receiver 4.9.x for Windows, and the Citrix desktop is using VDA 7.15 LTSR Cumulative Update 2.

Cause: The root cause of the connection failure is unknown. However, it can be remediated by workarounds described below.

Resolution:

1.) Upgrade the Citrix desktop’s VDA to 7.15 CU3. This can be done either manually, or through the DesktopConfig utility.

As CloudConnect recommends the use of Citrix Receiver 4.9.9 LTSR, this is the preferred solution.

— OR —

2.) Install and connect using the Workspace App as opposed to Receiver 4.9. To download the latest stable release , see: Workspace app for Windows Long Term Service Release

Additional Information:

Connectivity through the HTML client is unaffected by this issue, and the HTML client can be used as a quick workaround to connect to the Citrix desktop until one of the above resolutions has been employed.

Источник

Citrixology

I was pulled into to look at a problem for one of our customers with their Netscalers which stopped the user connections intermittently throwing a very “helpful” error message ” the connection to the desktop failed with status (unknown client error 1110).

The customer description was “it only started to happen a few weeks ago and these days it’s quite impossible to land a successful connection from the outside of our corporate network.”

I managed to get a couple of screenshots of error messages from the users and they appeared like below. When queried, the internal access via Storefront is working fine.

Looking at the error message, there are a multitude of reasons why you would get that, and I am outlining the common areas to check in such cases.

• Check if the Root certificates and intermediate certificates are available on the client devices. If frequently patched, the client will most probably have the latest and update Root CA’s from various public CAs. Check the IE’s / Other browsers’ certificate store to verify the Root and Intermediate CA SSL certs
• If using non-IE browsers for connectivity, switch over to IE to see if it connects. IE is the safest bet when it comes to connectivity to Citrix environments.
• Check for SSL ciphers attached to the NetScaler Gateway vServer. If high security ciphers are used, this issue may occur. Relax the cipher suites to see if that makes a difference. Again, if cipher suites are an issue, the problem will occur every single time when you connect and not sporadically.
• Check the STAs on the NetScaler and ensure that it matches with the STAs configured on the WI/Storefront. This is one of the most critical setting to check and probably the first one to check if the issue occurs only sporadically. There is a high possibility of an STA mismatch as it turned out to be in my case.
• Check the FW from the NetScaler to the VDA – As the title says ensure that the Citrix ports to the VDA are open from the Netscaler

Источник

Unknown client error 1110

Здравствуйте!

Меня зовут Михаил Усик!
Я инженер практик DevOps
и наполняю эту wiki,
решая разнообразные
задачи.
В своей работе я активно
использую как самые
современные практики DevOps,
так и проверенные временем
классические методы.

Я всегда готов помочь Вам
наладить IT-инфраструктуру
за скромное вознаграждение!!

При подключении клиентского компьютера с Windows XP и Citrix Receiver 4.2 (и более новыми) к опубликованным ресурсам возникают ошибки:

Обычно причин две.

Discussion

Здравствуйте, уважаемый Михаил! Есть ли возможность задружить клиент Citrix, работающий в WinXP, с сервером, который поддерживает только TLS 1.2? Например, если прописать а регистре XP поддержку TLS 1.2? Клиент 4.1, похоже TLS 1.2 не поддерживает. Есть надежда на 4.3, но не могу его найти.

День добрый, Дмитрий!
Вот тут: https://support.citrix.com/article/CTX232266 приведены минимальные версии Citrix Receiver, поддерживающие TLS 1.2.
Судя по всему вам нужен Citrix Receiver 4.2.100.
По поводу включения TLS 1.2 в Windows XP — первая же ссылка в гугле: https://www.google.com/search?client=ubuntu&channel=fs&q=TLS+1.2+windows+XP&ie=utf-8&oe=utf-8

Вероятно, Citrix Receiver 4.3 должен быть на исошнике Citrix Xendesktop 7.7 или 7.8. Из тех времен у меня сохранилися исошники 7.5, 7.6 и 7,9. Но там кажется версии Receiver 4.2 и 4.4

Михаил, спасибо огромное, что откликнулись!

Видимо, если что-то и может помочь в моем случае с XP, так это версия 4.2.100, та самая первая с TLS 1.2. Ее найти пока не могу, но нашел интересный ресурс со списком всех версий ресивера и ссылками на сохраненные дистрибутивы, хотя часть из них не открывается: https://www.app-v.be/citrix/citrix-clients-list/ (Надеюсь, не сочтете рекламой, на версию 4.2 там как раз битая ссылка, но 4.3.100 — рабочая).

Версия 4.3 пока работать отказывается и вылетает, она, вероятно, еще более новая для XP, чем 4.2, о чем вы изначально написали, но я нашел совет запустить Receiver Clean-up utility после установки предыдущих версий (а я еще ставил совсем старенькую 3.4), а также вручную удалить из регистра вот эту запись: HKEY_CLASSES_ROOTInstallerUpgradeCodes9B123F490B54521479D0EDD389BCACC1 (Нашел здесь: https://thatitblog.wordpress.com/2013/08/27/citrix-receiver-trickery-hdx-engine-has-stopped-working-configuration-manager-cannot-be-initialized/) После удаления записи (но без запуска утилиты очистки) версия 4.3 перестала вообще запускаться 🙂 Попробую утилиту очистки и переустановку ресивера.

Подскажите, пожалуйста, Вы пишите: “Citrix Receiver 4.3 должен быть на исошнике Citrix Xendesktop 7.7 или 7.8…” Это ведь не значит, что с более “свежими” серверами 4.3 работать не будет?

P.S.: Интересуюсь отнюдь не из праздного любопытства: в связи с известными событиями и нарастающей паникой наша организация перешла на удаленный режим работы, и мне пока пришлось реквизировать новенький ноутбук сына, который идеален для игр и поддерживает все современные навороты, но для офисной бюрократической работы он не очень удобен. Однако наша ИТ-служба развела руками на все вопросы о поддержке XP, хоть и оказалось, что не я один такой ископаемый, кто до сих пор дома сидит на XP 🙂

Я не могу ручаться за новейшие версии (я просто перестал админить цитрикс пару лет назад), но до определенного момента старые версии Citrix Receiver нормально работали с более новыми версиями серверов. Так как архитектура Citrix модульная — она допускает смешивание в одной инсталляции старые и новые компоненты. Например — вполне нормально удавалось смешивать в одной инсталляции старые WebInterface (5.4 если правильно помню) и Citrix SecureGateway (вместо Storefront и Netscaler) с новыми Citrix XenDesktop 7.6 — 7.15.
На моей памяти нормально работали старые версии клиентов времён XenDesktop 5.6 с новыми фермами Xendesktop 7.6.

поддержка XP, со стороны Citrix Receiver может упираться в версии компонентов .NET, установленные в XP. Я бы порекомендовал попытаться обновить .NET на машине до последней доступной версии. Какой именно — не знаю 🙂
Эксперименты, описанные в заметке, скорее всего я проводил году в 15-16. И уже на тот момент поддержка XP была завершена. Возможно, с тез пор что-то было сделано в части обратной совместимости — всё-таки Windows Embedded на базе XP поддерживалась дольше и на ней были тонкие клиенты с поддержкой протоколов Citrix…
Если вы работаете на старом ноуте, то ставьте на него linux — это максимально продлит ему жизнь 🙂 Под linux есть нормально работающий Citrix Receiver

Источник

http://i.imgur.com/abuvTin.png

About a week ago the Citrix Receiver installed on my PC stopped working. It was working prior without a problem. Since then I’ve tried literally everything I can think of to fix this problem without any luck

• I’ve enabled verbose logging of the Citrix Receiver through a registry edit but the output isn’t very helpful and the only line that is remotely error related is this: «[2016-08-24 16:39:42:413] [4836] [WindowsFindPrev.cpp:97] FindPrevInRegistry: Failed to open key [softwaremicrosoftwindowscurrentversioninstalleruserdatas-1-5-18products8efb6c7354395eb48a70e924572659b8installproperties] error 0x2 , Trying 64-bit.«

• I’ve run the Citrix Receiver Cleanup Utility and that hasn’t helped very much.

I understand that this particular error is extremely frustrating to many people because it’s so vague.

Has anybody tried anything to resolve this? My system is Windows 7 x64.

Edit: Isolate issue to Firefox. The Citrix Desktop launches successfully when I log into the StoreWeb on IE. Hmmm

This is a section of my latest eBook, but I figured that it could be more useful as a blog-section which people could reference if needed and also makes it easier for me to update when new stuff appers to give a simple resolution for known errors.

Cannot complete your request

After logging into the NetScaler Gateway and the enduser is redirected to the StoreFront page you get the error message “Cannot Complete your request”

You can also notice that you get an error in event viewer of the storefront server under Application and Services Logs -> Citrix Delivery Services. Where you get an error message of “None of the AG Call back service responded”

This is often the case if Storefront cannot talk back with the callback URL which is listed under Manage NetScaler Gateways à Edit NetScaler Gateway à Authentication Settings à Callback URL. Make sure that this URL is accessible from the Storefront server. If this is not possible because of network segmentation. You can deploy a dummy NetScaler Gateway VIP in the internal network.

If you notice that you have an error in Event viewer stating that “Citrix AGBasic Login request has failed”. That might be that there are different domains specified on the NetScaler session policy and under Storefront. If you have specified a domain name in Storefront under Manage Authentication à Pass-through from NetScaler Gateway à Configure trusted domains, this needs to be the same domain name in the session policy as well.

If you note that you have an error in Event viewer stating that Failed to run discovery this is most likely the case if you have not configured the use of a proper SSL certificate under the IIS administration console of the Storefront server.

Your logon has expired

If you are prompted for another authentication after logging into the NetScaler Gateway portal, when redirected to the Storefront portal, and then this error message appears.

You can also notice an error in event viewer of the storefront server under Application and Services Logs -> Citrix Delivery Services. That states, “A request was sent to service that was detected as passing through a gateway, but none of these matched the request.

This is typically the case if the NetScaler Gateway URL is configured wrongly. Since this URL needs to be the same as what the end-users are using, in case Storefront will not trust the incoming request and therefore ignore authentication attempts.

Unknown Client error 1110

This is a generic error which might occur in many different scenarios, but some key things to check to find the root cause of the issue.

· STA available on the NetScaler and marked as up? (This can be checked under NetScaler Gateway à Virtual Server à Published Applications à STA Server.

Cannot Start Desktop “COMPUTERNAME”

If you try launching an application or desktop and you get the error message cannot start Desktop/Application name after authenticating and getting the resources up

This might just be that the resource that we are trying to launch in currently unavailable or that something for instance is wrong with the VDA agents on that resource we are trying to launch.

We can also go into event viewer of Storefront to take a closer look at what kind of error is actually happening. Event viewer à Application and Services Logs -> Citrix Delivery Services. If we get an error message here stating “All the configured Secure Ticket authorities failed to respond”

This might be that we have an STA server that is down, in which Storefront tries to communicate with or that we have configured the wrong STA server under NetScaler Gateway appliances in Storefront. This can be checked under à Manage NetScaler Gateways à Edit NetScaler Gateway à Secure Ticket Authority.

Error: Login exceeds maximum allowed users

When logging in you get an error message stating that login exceeds maximum allowed users. This is typically the case if we did not place the virtual server in ICA-only mode. By default, the global AAA settings of NetScaler Gateway is set to allow maximum 5 users logging in using VPN at the same time. If we go and change the settings of the Virtual server to ICA-only mode, this error will go away.

Http/1.1 Internal Server Error 43531

After authenticating to the NetScaler Gateway portal you get a blank page with an error message stating Http/1.1 Internal Server Error 43531. This is typically the case if the Gateway cannot communicate with the Storefront web site. Which might just be a wrong URL in the session policy for instance.

Or this can also be that a client is not being applied a session policy, if we for instance have session policies in place based upon different criteria’s. If someone outside those criteria would get those error messages. The easiest way to get them access is to bind a session policy with the highest priority number with an expression of ns_true.

403 – Forbidden: Access is denied

After authenticating to the NetScaler Gateway portal, you get a default IIS error message stating “Access is denied”. This is typically the case if the session policy does not point directly to the receiver for web site on Storefront. After changing, the session policy to point to the direct URL this error message will go away.

In case of authentication failure attempt, a user will be given a generic error message of:

There are many ways to troubleshoot authentication failures, the simplest one is using the authentication dashboard in the NetScaler UI.

Which basically list the syslog events directly into the UI. Another way is using CLI. Log into the NetScaler appliance using an SSH client, type Shell and then type cat /tmp/aaad.debug

This will in real-time list out all AAA attempts happening against the NetScaler. Now by default the NetScaler does not list out detailed information whenever a user has an expired password or if their account is disabled. However, there is a feature which we can enabled which can give more detailed information back to the end user. This feature is called Enhanced Authentication Feedback

Which enabled under NetScaler Gateway à Global Settings à Change Authentication AAA settings.

NOTE: This setting is disabled by default, because it might reveal to much information to malicious hackers which try to do a brute force attack, to get information on which users are enabled and not.

It is also important that the aaad.debug command lists out different error codes when there is a failed authentication attempt.

For instance, if a user with a disabled account tries to authenticate.

Send reject with code Rejecting with error code 4011

Citrix has made a list which describes all these error codes and the meaning of them.

4001 Invalid credentials. Catch-all error from previous versions.

4002 Login not permitted. Catch-all error from previous versions.

4003 Server timeout

4004 System error

4005 Socket error talking to authentication server

4006 Bad (format) user passed to nsaaad

4007 Bad (format) password passed to nsaaad

4008 Password mismatch (when entering new password)

4009 User not found

4010 Restricted login hours

4011 Account disabled

4012 Password expired

4013 No dial-in permission (RADIUS specific)

4014 Error changing password

4015 Account locked

Now if a user tries to authenticate but is not bound to an authentication policy, for instance if we have multiple authentication policy for different groups, network segments and someone which fall outside of those policies try to authenticate they are presented with this error message.

The simplest way to fix this is to either define ns_true authentication policy which handles all other authentication attempts.

Now if an end-user tries to authenticate to start a Citrix Receiver session and is presented with this error message

This is typically the case if there is a session policy bound to the user which has a default authorization policy of DENY, this might be intended but if not, we should change it to ALLOW.

The connection to “virtual_desktop” failed with status (1110)

The connection to “virtual_desktop” failed with status (1110)

Connection Failed with status (1110)-

Some users reported that they were having issues when trying to connect to their XenDesktop 7.6 virtual machine through Netscaler Gateway. They received the following error “The connection to “virtual_desktop” failed with status (1110)”.

First step was to verify the STAs were correct on the StoreFront servers and Netscaler.

Open up the StoreFront Console and click on Netscaler Gateway.

Click on Secure Ticket Authority from the Actions Pane. Verify the STA’s are correct.

If you made any changes and there are more than 1 StoreFront Server in your StoreFront Group, you should propagate the changes to the other StoreFront Server.

Next I verified the Netscaler Gateway STA’s matched the STA’s that I had configured in StoreFront.

Next step was to try and reproduce the issue from a couple different workstations. I was only able to reproduce the issue on a couple Windows 7 and Windows 8 workstations connecting through Netscaler Gateway and not directly through Storefront.

I resolved the 1110 error by downloading and updating Root Certs on all the workstations that were getting 1110 errors.

Hopefully this helps anyone that is still getting these errors.

The connection to “virtual_desktop” failed with status (1110)

“Unable to access XenApp/XenDesktop with internet error: “The connection to “virtual_desktop” failed with status (1110)”.

To resolve this, change self-signed Root CA certificate common name from wildcard to regular one. The applications/desktop can be launched.”

Источник

Неизвестная ошибка клиента 1110 citrix windows 10

Неизвестная ошибка клиента 1110 citrix windows 10

Здравствуйте!

Меня зовут Михаил Усик!
Я системный администратор
и наполняю эту wiki,
решая разнообразные IT-задачки.

Я всегда готов помочь Вам
наладить IT-инфраструктуру
за скромное вознаграждение!!

При подключении клиентского компьютера с Windows XP и Citrix Receiver 4.2 (и более новыми) к опубликованным ресурсам возникают ошибки:

Discussion

Здравствуйте, уважаемый Михаил! Есть ли возможность задружить клиент Citrix, работающий в WinXP, с сервером, который поддерживает только TLS 1.2? Например, если прописать а регистре XP поддержку TLS 1.2? Клиент 4.1, похоже TLS 1.2 не поддерживает. Есть надежда на 4.3, но не могу его найти.

Вероятно, Citrix Receiver 4.3 должен быть на исошнике Citrix Xendesktop 7.7 или 7.8. Из тех времен у меня сохранилися исошники 7.5, 7.6 и 7,9. Но там кажется версии Receiver 4.2 и 4.4

Михаил, спасибо огромное, что откликнулись!

Версия 4.3 пока работать отказывается и вылетает, она, вероятно, еще более новая для XP, чем 4.2, о чем вы изначально написали, но я нашел совет запустить Receiver Clean-up utility после установки предыдущих версий (а я еще ставил совсем старенькую 3.4), а также вручную удалить из регистра вот эту запись: HKEY_CLASSES_ROOTInstallerUpgradeCodes9B123F490B54521479D0EDD389BCACC1 (Нашел здесь: https://thatitblog.wordpress.com/2013/08/27/citrix-receiver-trickery-hdx-engine-has-stopped-working-configuration-manager-cannot-be-initialized/) После удаления записи (но без запуска утилиты очистки) версия 4.3 перестала вообще запускаться 🙂 Попробую утилиту очистки и переустановку ресивера.

Подскажите, пожалуйста, Вы пишите: “Citrix Receiver 4.3 должен быть на исошнике Citrix Xendesktop 7.7 или 7.8…” Это ведь не значит, что с более “свежими” серверами 4.3 работать не будет?

P.S.: Интересуюсь отнюдь не из праздного любопытства: в связи с известными событиями и нарастающей паникой наша организация перешла на удаленный режим работы, и мне пока пришлось реквизировать новенький ноутбук сына, который идеален для игр и поддерживает все современные навороты, но для офисной бюрократической работы он не очень удобен. Однако наша ИТ-служба развела руками на все вопросы о поддержке XP, хоть и оказалось, что не я один такой ископаемый, кто до сих пор дома сидит на XP 🙂

Marius Sandbu – IT blog

Containing ramblings about Cloud, End-user computing, software defined datacenter and IT-security related information.

Troubleshooting ICA-proxy and authentication sessions NetScaler

This is a section of my latest eBook, but I figured that it could be more useful as a blog-section which people could reference if needed and also makes it easier for me to update when new stuff appers to give a simple resolution for known errors.

Cannot complete your request

After logging into the NetScaler Gateway and the enduser is redirected to the StoreFront page you get the error message “Cannot Complete your request”

This is often the case if Storefront cannot talk back with the callback URL which is listed under Manage NetScaler Gateways à Edit NetScaler Gateway à Authentication Settings à Callback URL. Make sure that this URL is accessible from the Storefront server. If this is not possible because of network segmentation. You can deploy a dummy NetScaler Gateway VIP in the internal network.

If you notice that you have an error in Event viewer stating that “Citrix AGBasic Login request has failed”. That might be that there are different domains specified on the NetScaler session policy and under Storefront. If you have specified a domain name in Storefront under Manage Authentication à Pass-through from NetScaler Gateway à Configure trusted domains, this needs to be the same domain name in the session policy as well.

If you note that you have an error in Event viewer stating that Failed to run discovery this is most likely the case if you have not configured the use of a proper SSL certificate under the IIS administration console of the Storefront server.

Your logon has expired

If you are prompted for another authentication after logging into the NetScaler Gateway portal, when redirected to the Storefront portal, and then this error message appears.

This is typically the case if the NetScaler Gateway URL is configured wrongly. Since this URL needs to be the same as what the end-users are using, in case Storefront will not trust the incoming request and therefore ignore authentication attempts.

Unknown Client error 1110

This is a generic error which might occur in many different scenarios, but some key things to check to find the root cause of the issue.

· STA available on the NetScaler and marked as up? (This can be checked under NetScaler Gateway à Virtual Server à Published Applications à STA Server.

Cannot Start Desktop “COMPUTERNAME”

If you try launching an application or desktop and you get the error message cannot start Desktop/Application name after authenticating and getting the resources up

This might just be that the resource that we are trying to launch in currently unavailable or that something for instance is wrong with the VDA agents on that resource we are trying to launch.

This might be that we have an STA server that is down, in which Storefront tries to communicate with or that we have configured the wrong STA server under NetScaler Gateway appliances in Storefront. This can be checked under à Manage NetScaler Gateways à Edit NetScaler Gateway à Secure Ticket Authority.

Error: Login exceeds maximum allowed users

When logging in you get an error message stating that login exceeds maximum allowed users. This is typically the case if we did not place the virtual server in ICA-only mode. By default, the global AAA settings of NetScaler Gateway is set to allow maximum 5 users logging in using VPN at the same time. If we go and change the settings of the Virtual server to ICA-only mode, this error will go away.

Http/1.1 Internal Server Error 43531

After authenticating to the NetScaler Gateway portal you get a blank page with an error message stating Http/1.1 Internal Server Error 43531. This is typically the case if the Gateway cannot communicate with the Storefront web site. Which might just be a wrong URL in the session policy for instance.

Or this can also be that a client is not being applied a session policy, if we for instance have session policies in place based upon different criteria’s. If someone outside those criteria would get those error messages. The easiest way to get them access is to bind a session policy with the highest priority number with an expression of ns_true.

403 – Forbidden: Access is denied

After authenticating to the NetScaler Gateway portal, you get a default IIS error message stating “Access is denied”. This is typically the case if the session policy does not point directly to the receiver for web site on Storefront. After changing, the session policy to point to the direct URL this error message will go away.

Authentication

In case of authentication failure attempt, a user will be given a generic error message of:

There are many ways to troubleshoot authentication failures, the simplest one is using the authentication dashboard in the NetScaler UI.

Which basically list the syslog events directly into the UI. Another way is using CLI. Log into the NetScaler appliance using an SSH client, type Shell and then type cat /tmp/aaad.debug

This will in real-time list out all AAA attempts happening against the NetScaler. Now by default the NetScaler does not list out detailed information whenever a user has an expired password or if their account is disabled. However, there is a feature which we can enabled which can give more detailed information back to the end user. This feature is called Enhanced Authentication Feedback

Which enabled under NetScaler Gateway à Global Settings à Change Authentication AAA settings.

NOTE: This setting is disabled by default, because it might reveal to much information to malicious hackers which try to do a brute force attack, to get information on which users are enabled and not.

It is also important that the aaad.debug command lists out different error codes when there is a failed authentication attempt.

For instance, if a user with a disabled account tries to authenticate.

Send reject with code Rejecting with error code 4011

Citrix has made a list which describes all these error codes and the meaning of them.

4001 Invalid credentials. Catch-all error from previous versions.

4002 Login not permitted. Catch-all error from previous versions.

4003 Server timeout

4005 Socket error talking to authentication server

4006 Bad (format) user passed to nsaaad

4007 Bad (format) password passed to nsaaad

4008 Password mismatch (when entering new password)

4009 User not found

4010 Restricted login hours

4011 Account disabled

4012 Password expired

4013 No dial-in permission (RADIUS specific)

4014 Error changing password

4015 Account locked

Now if a user tries to authenticate but is not bound to an authentication policy, for instance if we have multiple authentication policy for different groups, network segments and someone which fall outside of those policies try to authenticate they are presented with this error message.

The simplest way to fix this is to either define ns_true authentication policy which handles all other authentication attempts.

Now if an end-user tries to authenticate to start a Citrix Receiver session and is presented with this error message

This is typically the case if there is a session policy bound to the user which has a default authorization policy of DENY, this might be intended but if not, we should change it to ALLOW.

Может произойти сбой клиентов Citrix ICA, подключающегося сервера терминалов под управлением Windows Server 2008, установлен сервер Citrix презентации

Симптомы

Сервер терминалов под управлением Windows Server 2008 с установленным сервером презентации Citrix пользователей подключения клиентов Citrix ICA. Однако клиенты ICA может произойти сбой во время установки соединения.

Причина

Размер открытого ключа, использованного для шифрования терминалов клиентские лицензии служб (TS CAL) увеличивается от 512 байт до 2048 байт. Сервер терминалов не выполняет согласование с клиентами при использовании нового размера ключа. Таким образом может произойти сбой виртуального канала Citrix для предыдущих версий клиентов ICA.

Решение

Сведения об исправлении

Существует исправление от корпорации Майкрософт. Однако данное исправление предназначено для устранения только проблемы, описанной в этой статье. Применяйте данное исправление только в тех системах, которые имеют данную проблему. Это исправление может проходить дополнительное тестирование. Таким образом если вы не подвержены серьезно этой проблеме, рекомендуется дождаться следующего пакета обновления, содержащего это исправление.

Если исправление доступно для скачивания, имеется раздел «Пакет исправлений доступен для скачивания» в верхней части этой статьи базы знаний. Если этот раздел не отображается, обратитесь в службу поддержки для получения исправления.

Примечание. Если наблюдаются другие проблемы или необходимо устранить неполадки, вам может понадобиться создать отдельный запрос на обслуживание. Стандартная оплата за поддержку будет взиматься только за дополнительные вопросы и проблемы, которые не соответствуют требованиям конкретного исправления. Полный список телефонов поддержки и обслуживания клиентов корпорации Майкрософт или создать отдельный запрос на обслуживание посетите следующий веб-узел корпорации Майкрософт:

Примечание. В форме «Пакет исправлений доступен для скачивания» отображаются языки, для которых доступно исправление. Если нужный язык не отображается, значит исправление для данного языка отсутствует.

Предварительные условия

Для установки предварительные компоненты не требуются.

Необходимость перезагрузки

После установки исправления компьютер необходимо перезагрузить.

Сведения о замене исправлений

Это исправление не заменяет других исправлений.

Сведения о файлах

Английская версия данного исправления содержит атрибуты файла (или более поздние атрибуты файлов), приведенные в следующей таблице. Дата и время для этих файлов указаны в формате общего скоординированного времени (UTC). При просмотре сведений о файле, он преобразуется в локальное время. Чтобы узнать разницу между временем по Гринвичу и местным временем, откройте вкладку Часовой пояс элемента Дата и время в панели управления.

Неизвестная ошибка клиента 1110 citrix windows 10

Сообщения: 31
Благодарности:

Не, клиент ксен, а сервер MetaFrame Presentation 4 кажется

Вот что пишет, если через версию под сервер,

Сообщения: 75
Благодарности: 10

Сообщения: 31
Благодарности:

Сообщения: 25636
Благодарности: 4279

Сообщение оказалось полезным? Поблагодарите автора, нажав ссылку Полезное сообщение чуть ниже.

Сообщения: 31
Благодарности:

Сообщения: 25636
Благодарности: 4279

Сообщение оказалось полезным? Поблагодарите автора, нажав ссылку Полезное сообщение чуть ниже.

Сообщения: 31
Благодарности:

Сообщения: 25636
Благодарности: 4279

Сообщение оказалось полезным? Поблагодарите автора, нажав ссылку Полезное сообщение чуть ниже.

Неизвестная ошибка клиента 1110 citrix windows 10

All New Hotfixes for XenApp 5.0 for Windows Server 2003 x86/x64 and Windows Server 2008 x86/x64

Последняя версия: 5.0
Оф.сайт: Официальный сайт
По-русски: Форум Всего записей: 98 | Зарегистр. 08-12-2001 | Отправлено: 13:25 15-12-2001 | Исправлено: shrmn, 16:54 05-05-2012

Newbie Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору abgluck

Advanced Member Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору bootme
Клиент лучше бы обновить.
Вместо патча BackEnd.dll лучше использовать штатный алладиновский сетевой менеджер лицензий с тем же эмулем.
Попробуй пересоздать слушатель ICA-TCP и проверить что он привязан к внешнему интерфейсу. Всего записей: 1735 | Зарегистр. 23-09-2004 | Отправлено: 18:28 26-02-2009