Title
Configuring Single-on for Web Interface using the 10.x Citrix client


Symptom
The 10.x ICA Client for Win32 allows administrators to make use of a provided GPO template file, called icaclient.adm, to modify some settings that were previously modified in appsrv.ini file (e.g. single sign-on through Web Interface). The administrator no longer needs to manually add the parameter “EnableSSONThruICAFile=ON” to the appsrv.ini as this will now be accomplished this with the icaclient.adm file.

==============================================================
Note: A truncated version of the appsrv.ini file will be copied to the user profile by default. Please ignore as this behavior is expected.
==============================================================

The icaclient.adm file is available when you download the icaweb.cab file and extract it. It is also available when you install the ICA client. The default located for the icaclient.adm file is \Program files\Citrix\ICA client\configuration folder

Resolution
1. From a machine with the 10.x client installed, open the Group Policy Object Editor by executing “gpedit.msc” at the run line
2. In the Group policy Editor, right click -Administrative TemplatesAdd/Remove Templates
3. Browse to C:\Program Files\Citrix\ICA Client\Configuration and add the icaclient.adm



4. Expand Computer ConfigurationAdministrative TemplatesCitrix Components Presentation Server ClientUser Authentication. On the right pane select Local User name and password. Right click and enable the policy for pass-through authentication. This policy will be applied to all users logging on to this workstation.

To apply GPO settings on a per user basis, then configure the settings under User Configuration. Expand user ConfigurationAdministrative TemplatesCitrix Components.




5. Run GPupdate on the workstation to apply the policy immediately
6. Check task manager on the workstation and verify the process ssonsvr.exe is running


Additional Information
Group policy settings are configured on each individual client machine or in can be done in Active Directory Users and Computers for large environments.