1. Disabling KSP on the VDA via Registry

While the global switch is on the FAS Server (Set-FasServer -KspRemoting $false), you can override this behavior on specific VDAs using the registry. This forces the VDA to fall back to the legacy CSP pair for remoting cryptographic operations.

Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartCard

• Value Name: CryptographicRedirectionDisable

• Type: DWORD

• Value: 1 (Disabled) / 0 (Enabled - Default)

Note: Setting this to 1 disables the modern "Fast Smart Card" and KSP-based redirection, forcing the VDA to use the legacy CSP hooks. This is the primary "kill switch" for KSP remoting on a per-VDA basis.

2. FAS V2 Ticketing Considerations

In the 2507/2511 versions, Citrix introduced FAS V2 Ticketing. This changes how the VDA discovers FAS servers.

• If your VDA is version 2507+, it no longer strictly relies on the GPO-based FAS server list if V2 ticketing is active.

• However, the KSP vs. CSP logic still respects the VDA's local cryptographic provider capabilities. If you disable the cryptographic redirection via the registry key above, the VDA will signal the FAS server to provide a CSP-compatible response during the session logon.

3. To confirm which provider is being used within an active session on the VDA, you can use the certutil command.

• Log into a FAS-enabled session on a 2507 VDA.

• Open Command Prompt and run:

  certutil -user -store My
  

   

• Look for the Provider field in the output for the current user's logon certificate:

  • KSP (New): Citrix Smart Card Key Storage Provider

  • CSP (Legacy): Citrix Smart Card Crypto Provider

This article describes how Key Storage Provider (KSP) Remoting behavior can be controlled at the Citrix Virtual Delivery Agent (VDA) level in environments using Citrix Federated Authentication Service (FAS) 2507 and later, especially when enabling TLS 1.3. It provides a mechanism to disable modern KSP-based redirection and enforce legacy Cryptographic Service Provider (CSP) behavior for compatibility with applications that do not function correctly with KSP.