Skip to main content

When enabling Kerberos Domain Pass-through Authentication Support for ProfileDisk

Glen Porter
  • Created:
  • Updated:

 

Problem:

ProfileDisk does not get attached when logging in using domain pass-through authentication but works fine if logging in via RDP.  For example, when using IWA+Kerberos through Citrix StoreFront. It is possible to see a black screen when this issue occurs.

Also, the following messages could show up in lwl_cred_mgr.txt file:

  • Failed to acquire user token. Error: 1326 => Username or passwords is incorrect
  • Detected programmatic logon, ignoring.

 

Possible Resolution(s):

  1. There are a few options to address this going forward. One option involves using a common location for the ProfileDisks, adding a registry entry and share permissions as outlined in (Option 1)
  2. Additional option involves using a service account and "CAC method" as outlined in (Option2)

 

Option 1

Use Computer Permissions, Domain Computers Group (preferred)

Requires 6.8.5 or higher.

Change location for ProfileDisks to a common location:

  • Modify the ProfileDisk path under Administration and make sure to update and download ClientSettings.xml similar too: 
    • From: \\server\share\%username%\Profiledisk\%username%.vhdx  but use a common path for all ProfileDisks
    • To: \\server\share\Profiledisk\%username%.vhdx

  • Switch ProfileDisk mode:

    • Open your Computer Group Policy for ProfileUnity.

    • Under Computer Configuration > Administrative Templates > Classic Administrative Templates >Liquidware Labs > ProfileUnity under BOTH 32 and 64 Bit sections:
      Set "ProfileDisk System Mount Unmount" to “Enabled”.
  • Set "Domain Computers" group to have access to create/read/modify/execute on the share and folder that contains the ProfileDisk VHDX files.  See this document for details.

Enable Logon Notification Events for SmartCard-based logons:

  • On the master image or pushed to persistent machines via a GPO and rebooted, we need to verify or create the following registry value if it doesn't exist:
    Key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
    Type: DWORD
    Value: SmartCardLogonNotify
    Data: 1
    (Reference: https://support.citrix.com/article/CTX131223)

 

Option 2

Use a Domain Service Account

There are some extra configuration steps to take when working with ProfileDisk VHDX+Kerberos pass-through.  ProfileUnity As a Service will need to be setup, CAC Authentication must be enabled in the ProfileUnity Computer GPO and a registry value added to the image/machine.

Change location for ProfileDisks to a common location:

  • Modify the ProfileDisk path under Administration and make sure to update and download ClientSettings.xml similar too: 
    • From: \\server\share\%username%\Profiledisk\%username%.vhdx  but use a common path for all ProfileDisks
    • To: \\server\share\Profiledisk\%username%.vhdx

1. Create a Service Account to use for process

  1. In AD create an account to use as the service account for this process or use an existing account
  2. Make sure the service account has full control on the share where the vhd ProfileDisks are to be stored.
  3. In ProfileUnity Console> Navigate to Administration on top right and scroll down to ProfileUnity Tools Section
  4. Add relevant account info and deploy/download the service .creds file to the share or netlogon folder where the ProfileUnity client tools (ini path) reside.  If the password for this account expires or changes you will need to repeat this process.
  5. Ensure that startup.exe in that same path of the creds file gets executed by the pool/machines on boot as a startup script in the ProfileUnity Computer GPO - it does not need to be re-run on the master image unless you're using Instant Clones in Horizon View.

 

2. To enable CAC authentication:

  1. Open your Computer Group Policy for ProfileUnity.
  2. Under Computer Configuration > Administrative Templates > Classic Administrative Templates >Liquidware Labs > ProfileUnity under BOTH 32 and 64 Bit sections:
    Set "ProfileDisk VHD CAC support" to “Enabled”.

3. Set the Domain Service Account to have access to create/read/modify/execute on the share and folder that contains the ProfileDisk VHDX files. See this document for details.

4. Enable Logon Notification Events for SmartCard-based logons:

  • On the master image or pushed to persistent machines via a GPO and rebooted, we need to verify or create the following registry value if it doesn't exist:
    Key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
    Type: DWORD
    Value: SmartCardLogonNotify
    Data: 1
    (Reference: https://support.citrix.com/article/CTX131223)

 

Product: ProfileUnity

Product Version: 6.8.4 R2 HF1 and newer

 

 

 

Related articles