Get-FasServer has empty fields.Unable to retrieve users FAS certificate using Get-FasUserCertifcate

Get-FasServer has empty fields.Unable to retrieve users FAS certificate using Get-FasUserCertifcate

book

Article ID: CTX482386

calendar_today

Updated On:

Description

Using the command 'Get-FasServer' have empty fields and we are unable to retrieve FAS server details. 
You can use the command 'Get-FasServer -localhost' as a workaround 

PowerShell error occurs for the command admin@FAS.fqdn.net' Get-FasUserCertificate -address FAS.fqdn.net -UserPrincipalName '.

Error below. 
PS C:\windows\system32> Get-FasUserCertificate -address FAS.fqdn.net -UserPrincipalName admin@FAS.fqdn.net
Get-FasUserCertificate : Unknown server: 'FAS.fqdn.net'
At line:1 char:1
+ Get-FasUserCertificate -address admin@FAS.fqdn.net -UserPrincipalN ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   + CategoryInfo         : ObjectNotFound: ( FAS.fqdn.net:String) [Get-FasUserCertificate], Exception
   + FullyQualifiedErrorId : The address was not found in the FAS GPO. Add the server to the GPO, or turn off checking
against the GPO with Set-FasAdministrationPolicy,Citrix.Authentication.FederatedAuthenticationService.PowerShell
 .GetFasUserCertificateCommand

Resolution

  1. Confirm if FQDN of FAS server is in the GPO - You can confirm this by checking the registry on the FAS server.  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\Authentication\UserCredentialService\Addresses
  2. Trailing white space GPO for FAS FQDN can cause this issue.
  • Incorrect - A blank space after the FQDN
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\Authentication\UserCredentialService\Addresses] "Address1"="FAS.fqdn.net "
 
  • ​​​​​​​Correct - No blank space after the FQDN
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\Authentication\UserCredentialService\Addresses] "Address1"="FAS.fqdn.net"

Problem Cause

FAS server FQDN supplied in the address wasn't in the registry of the machine the command was run on.
If FAS FQDN is present, check for trailing spaces for FAS servers FQDN in GPO pushed