Symptoms
LogonServer environment variable contains \\\\* instead of the logon server name when launching a published application using Program Neighborhood Agent with pass-through authentication and Single Sign-on in a Domain environment.
Cause
The “Trust computer for delegation” check box is enabled in Active Directory Users and Computers management console.
Note: The “Trust computer for delegation” check box may be enabled by the administrator if the user is prompted to enter credentials when opening published applications. This credential prompt may occur because the "Use Kerberos authentication to connect to servers" check box is enabled in the "Pass-through method settings" section on the "Authentication Methods" page for the Program Neighborhood Agent config.xml file.
Troubleshooting
1. Publish a desktop on the MetaFrame server.
2. Connect to the published desktop:
a. Click Start.
b. Select Run.
c. Type CMD in the “open” text box.
3. Type echo %LogonServer% at the command prompt.
a. The LogonServer variable will be set to \\\\*.
4. Disconnect from the published desktop.
5. Open the Active Directory Users and Computers management console.
a. Open the Computers folder
b. Right-click the MetaFrame server and select Properties.
c. Take note of the “Trust computer for delegation” check box – this checkbox will be enabled.
Note: If the user is prompted for credentials when connecting to published application the LogonServer variable will display the correct logon server name even if the “Trust computer for delegation” check box is enabled.
Workaround
Clear the “Trust computer for delegation” check box and reboot the MetaFrame server.
When you reconnect, the LogonServer variable will display the correct logon server name.
Status
This issue will be addressed in the next major release of Presentation Server.
