The VDA machines where the Session Recording Agent is installed records the following warning event in the Event log:
Event ID: 3031
Source: Citrix Session Recording Agent
Message: Exception caught while running record policy query. IIS setting for Session Recording doesn't allow HTTP connections from Session Recording Agent.
--- Exception Details ---
Type: System.Net.WebException
Message: The remote server returned an error: (403) Forbidden.
Stack trace:
Server stack trace:
at System.Runtime.Remoting.
at System.Runtime.Remoting.
at System.Runtime.Remoting.
Exception rethrown at [0]:
at System.Runtime.Remoting.
at System.Runtime.Remoting.
at SmAudBroker.RecordPolicy.
at SmAudAgent.MetaDataQuerier.
at SmAudAgent.MetaDataQuerier.
Apart from this event, we may also see error logged in the event logs (either with HTTP 403 (Forbidden) or HTTP 401 Unauthorized.
Event ID : 3027
Source: Session Recording Agent
Message: Exception caught while sending poll message to Session Recording Broker.
--- Exception Details ---
Type: System.Net.WebException
Message: The remote server returned an error: (403) Forbidden.
Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.
Access to the Session Recording broker server was too restrictive.
Adding Everyone group to the "Access this computer from the network" policy on the Session Recording Broker Server resolved the issue.
Note: This policy might be configured at the Domain level. If so, you will have to edit the policy from a Domain Controller and then run gpupdate /force on the Session Recording Broker server and validate that the Everyone group is listed as part of this policy.
Users may notice that when launching their ICA sessions, they no longer see the Session Recording Notification message and the administrators do not see the Sessions being recorded.
As per Microsoft documentation, the default values are:
Everyone
Administrators
Users
Backup Operators
You can have more accounts listed here, but these are the minimum accounts required.
Refer to https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/access-this-computer-from-the-network for more information.