SSON does not work with passthrough authentication on Windows 11: "The username or password is incorrect. Try again"
Article ID: CTX697071
Updated On:
Description
Legacy passthrough authentication is used to logon Citrix Workspace App or Receiver for Web.
When user launches an application or desktop, SSON does not work and user received the error: "The username or password is incorrect. Try again"
Checking on the security logs on the VDA you can see the following event::
STATUS_LOGON_FAILURE 0xC000006D The attempted logon is invalid. This is either due to a bad username or authentication information.
STATUS_WRONG_PASSWORD 0xC000006A When trying to update a password, this return status indicates that the value provided as the current password is not correct.
Cause
By default, this policy is disabled on Windows 11 24H2 and higher.
Resolution
The Enable MPR notifications for the System or Configure the transmission of the user’s password in the content of MPR notifications sent by Winlogon policy in the Group Policy Object template must be enabled to support the domain pass-through (single sign-on) authentication feature on Windows 11:
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Logon Options
Policy setting: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon
Issue/Introduction
After upgrading Windows 11 clients to version 24H2 or higher, SSON to VDA does not work when using passthrough authentication.
SSON works correctly when authentication to CWA or Receiver for Web is with username / password.
Additional Information
https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/domain-passthrough-for-single-sign-on-legacy.html
