Cannot launch published app if user is not in "Power Users" group?!?

[fboniforti]

Hello all!
I'm using the latest ICA Client for Windows and I'm trying to launch a published application from our Win2k/WinXP clients. What is happening is that the application doesn't start until I put the user into the local "Power Users" group.
Where is the problem which causes this behaviour? I don't want my users to be in *any* of the local machine groups, they have to be unprivileged. Now, is there any way to get that published app working without having to put the domain users into that local group?

Thank you very much!
Cheers.

 

[JCDugas]

Are you getting an error message?

 

[fboniforti]

Actually not. I'm just getting the usual window that says "Checking credentials..." and after a while it disappears without putting out any other windows and/or error messages.
Can you help me further?

Thanks...

 

[JCDugas]

Have you check permissions on the MSLicensing reg key?

HKLM\Software\Microsoft\MSLicensing

Give users full control on this key and subsequent ones.

 

[fboniforti]

Well, before I proceed, I'd like to talk about this with you.
I've noticed that on the MSLicensing Key there are "Power Users" and "Users" Local Groups enabled in "Read" and some other *special* permissions.
First, I put my user only with "Read" permissions, but the application still didn't start.
Afterwards I put my user with the same *special* permissions the "Power Users" Local Group has: THE APPLICATION NOW RUNS!
So, I'm finally asking: is there any way to get *every* Domain User automatically enabled to use the Published Application *without* having to put him or her into the "Power Users" Local Group?

Thank you again.

 

[JCDugas]

Match the Power Users Group permissions and the Users Group?

 

[enigma99]

Have you checked your Citrix Connection Configuration utility?
Go to Start-Citrix-MetaframeXP and open the Citrix Connection Configuration.
You will see the ica-tcp and rdp-tcp protocols.
Click on the ica-tcp protocol and go to the security drop down menu. I would suggest adding (just to test out) "authenticated users" group for User Access and Guest Access.

Once you do that, make sure they have permission to the actual application in your CMC.
That should do it.

Hope that helps.

 

[fboniforti]

Mmhhh... thanks for your suggestion, but as I took the time to try it out, I noticed that the group which contains all the users that have access to that specific published application are already in the Permissions of the ICA-TCP protocol, with "Full Control".

Sad...