CVAD 2507 - Office 365 Application activation fails on Windows 2025 using Smart Card
Article ID: CTX695789
Updated On:
Description
On authenticating any Office 365 application with a smart card, the user is prompted to select a smart card and then select a certificate.
Upon selecting the certificate, a message appears stating "No certificate detected"
The issue is not seen in RDP or when the Office 365 application is launched in a browser.
Environment
"This software application is provided to you as is with no representations, warranties or conditions of any kind. You may use and distribute it at your own risk. CITRIX DISCLAIMS ALL WARRANTIES WHATSOEVER, EXPRESS, IMPLIED, WRITTEN, ORAL OR STATUTORY, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT. Without limiting the generality of the foregoing, you acknowledge and agree that: (a) the software application may exhibit errors, design flaws or other problems, possibly resulting in loss of data or damage to property; (b) it may not be possible to make the software application fully functional; and (c) Citrix may, without notice or liability to you, cease to make available the current version and/or any future versions of the software application. In no event should the software application be used to support ultra-hazardous activities, including but not limited to life support or blasting activities. NEITHER CITRIX NOR ITS AFFILIATES OR AGENTS WILL BE LIABLE, UNDER BREACH OF CONTRACT OR ANY OTHER THEORY OF LIABILITY, FOR ANY DAMAGES WHATSOEVER ARISING FROM USE OF THE SOFTWARE APPLICATION, INCLUDING WITHOUT LIMITATION DIRECT, SPECIAL, INCIDENTAL, PUNITIVE, CONSEQUENTIAL OR OTHER DAMAGES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. You agree to indemnify and defend Citrix against any and all claims arising from your use, modification or distribution of the software application."
Cause
CDF trace shows this error
VerifyServiceIsRunning:OpenService: failed with last error: 0005","
Microsoft.AAD.BrokerPlugin.exe is unable to query if the smart card service is running.
There is a missing privilege that prevents Microsoft.AAD.BrokerPlugin.exe from successfully calling the ScOpenService Win32 function.
Resolution
There may be missing privileges for Application Packages (AC) for the Citrix Smart Card Service (CtxSmartCardSvc) .
Check Permissions using this command.
sc sdshow CtxSmartCardSvc
Expected output on a Windows 11 VDI .
D:(A;;CCLCSWLOCRRC;;;AC)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
It may be that A;;CCLCSWLOCRRC;;;AC is missing .
If so, then set the Permissions for Application Packages (AC) for CtxSmartCardSvc with the command sc sdset.
e.g
sc sdset CtxSmartCardSvc D:(A;;CCLCSWLOCRRC;;;AC)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Below example is from Windows 2025. A;;CCLCSWLOCRRC;;;AC is missing and is added with sc sdset
Issue/Introduction
M365 Apps activation wizard cannot read the smart card certificate during logon.
Additional Information
The missing permissions may be due to a language pack installed as part of the OS.
This may prevent permissions from being added during the VDA installation.
