When Domain Pass-through is configured, the following is seen in the event log for the StoreFront:

Log Name:   Application
Source:         Citrix Broker Service
Date:             2/8/2017 7:31:58 AM
Event ID:      2100
Task Category: None
Level:         Warning
Keywords:     
User:               NETWORK SERVICE
Computer:      VDA name
Description:
The Citrix Broker Service failed to validate a user's credentials on an XML service.
 
Verify the trust relationships between your domains.

Error details:

User:  ''

Error: 'AccessDenied'

Message: 'ID only credentials received but TrustRequestsSentToTheXmlServicePort=false'

Stack Trace: ''

1. Run the following commandlets on the Delivery Controller:

      asnp Citrix*
      Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true

2. Run Get-BrokerSite and look for “TrustRequestsSentToTheXmlServicePort”  and verify that the trusts are set to True.

Problem Cause

The XenDesktop Controller does not trust the XML.