Session launch might fail with the following error on a endpoint device in a closed network if the Secure ICA file session launch policy is enabled.
Error: "Cannot Start App. Please contact your help desk."

Ensure there is connectivity to the following sites:
- cacerts.digicert.com
- ctldl.windowsupdate.com    *1

*1 You can suppress access to "ctldl.windowsupdate.com" by setting the following registry key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate]
Name: RootDirUrl
Type: REG_SZ
Data: share paths to retrieve CTLs
 

---

Problem Cause

The device needs connectivity to the following sites for the Secure ICA file session launch.
- cacerts.digicert.com
- ctldl.windowsupdate.com