On all PVS servers:
1. In the registry setting, locate HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\ProvisioningServices.
2. Create a DWORD named “DomainSelectOption”.
3. In the DomainSelectOption DWORD, set one of the following values (in decimal format) for the desired search approach:
0 – The default search. This method searches the user’s domain followed by administrative group domains.
1 – Search in the user’s domain and in the administrative group domain, followed by other trusted domains within a user’s domain.
2 – Obsolete.
3 – Search in the user’s domain followed by administrative group domains. The groups that are discovered are further enumerated over the parent’s domain.
4 – Search the user’s domain and in the administrative group domain, followed by other trusted domains within a user’s domain. The groups that are discovered are further enumerated over the parent’s domain.
5 - Search the user’s group membership from token groups in the user’s domain and in the administrative group domain.
6 - Search the user’s group membership from token groups in the user’s domain and in the administrative group domain, followed by other trusted domains within a user’s domain.
7 - Search the user’s group membership directly from authorization groups.
8 - Search the user’s group membership directly as “Member Of” groups.
Problem Cause
For some AD environments containing configurations with complex nested groups and domains with many trust associations, the default method might be unable to find the user’s expected administrative memberships.
To resolve such scenarios, use one of the registry setting to change the search approach.