Complete the following steps to troubleshoot issues that arise when joining a StoreFront server to a group.

1. Validate that all machines are on the same version of Storefront.
   Open the StoreFront MMC > Help > About Citrix StoreFront > Version.

2. Confirm that all StoreFront servers have the same date and time, and are also in the same time zone.

3. Use Telnet from each of the StoreFront servers to confirm that all StoreFront servers are listening on port 808. For more information see CTX101810 - Communication Ports Used by Citrix Technologies.

4. Confirm that each StoreFront server can resolve the other server’s host name by using the Ping command or disable NetBios on the NIC of each StoreFront server.

5.  Open the MMC > File > Add & Remove Snap-In > Local Users and Groups > Groups > Administrator > Properties > Members and confirm the NT SERVICE\CitrixConfigurationReplication and NT Service\CitrixClusterService accounts are included in the local Administrators group on the StoreFront server.
   Note: The NT Service\CitrixClusterService will only show up once you initialize the Add Server process.

6. User Joining the StoreFront servers must hold the sesecurityprivilege rights to create self-signed certificates. 
   Open the Run window > type secpol.msc > Local Policies > User Rights Assignment > Manage auditing and security log and confirm that the local administrator is listed under the security setting column.

7. To prevent any other Group Policies from interfering with StoreFront’s ability to join the servers to a group, it is recommended to temporarily move all the StoreFront servers to an Organizational Unit configured to block inheritance until the all servers are joined successfully.
   For more information regarding moving Active Directory objects refer to - Moving an Object to a Different OU or Container.

Other Scenarios

1. If you get the error 1 on Event Viewer, reporting “No private key contained in the certificate with thumbprint: ######....” do the following:
   1. On the primary StoreFront server open the MMC > File > Add/Remove Snap-in > Certificates > Computer Account > Citrix Delivery Services > Certificates.
   2. Find the certificate that matches the thumbprint specified in the error.
   3. Export it including the private key.
   4. Import it on the server that you are joining to the group.
   5. Attempt to join the server again.