Can't Login To Published App

[ryanropp]

When I use the ica client to open a publish application, the login opens up and I get the error message about not being able to login because of permissions and I have to be a member of the remote desktop users group. I can login fine to the shared desktop with the same credentials. I checked the published app settings and added the account to the users. Is there something else I'm missing? Why can I login to the shared desktop through ica but not a published app?

I'm using metaframe xpa 1.0 feature release 3 running on windows 2003 with svc pack 1.

Thanks,
Ryan

 

[njuser]

Are you logging in as an admin? Anyway, there is a local group called "Remote Desktop Users", any user or group who need access to your metaframe server need to be in that group.

 

[ryanropp]

I can login to my shared desktop through ica just fine with the same user and yes it is the admin user.

 

[ncc1701capt]

Ryan -
did you ever get a resolution to this? i'm having the same problem & Citrix says it is a Microsof TS licensing problem. I have found that my Citrix server is set up for Per Device licensing & my TS licensing server is Per User. I'm thinking if I can change the Citrix server to per user, that may help. Problem is, i don't know how to do that. do you?

 

[ncc1701capt]

I may have found something!!! I'm using Pres Server 4, so I don't know if this will work for other versions, but here goes:
Go to the properties of the published application in Management Console.
Go to the Users portion of the app properties & add the Remote Desktop Users group to the access list.

For some reason, this worked for me - don't know if this is the final solution, but time will tell.

 

[ryanropp]

I tried that with no luck. How are you getting to the app? Through ica or http?

Ryan

 

[ncc1701capt]

Straight ICA. I did try this on my old Metaframe XP 1.0 farm with no luck, so I guess this only works for Pres Server 4 (or perhaps 3). At any rate, I haven't had the issue since I tried this. Another thing I did that may have helped was to edit the Default Domain Policy for my Active Directory (AD Users & Computers > Properties of Domain > Group Policy Tab) & added the "Administrators" and "Remote Desktop Users" groups to the "Allow Logon Through Terminal Services" policy under Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. To force the group policy update, go to a command prompt & type
gpudate /force <ENTER>
It may take a little time for the Group Policy to update throughout the entire AD. Good luck!