• Client Connection failures are logged in Citrix Director For Application Probe. The issue was reproducible all the time.
• The application launch works fine when the same probe account is used to launch applications via Receiver for web. 
• The issue is not seen for Desktop Probe using the same probe account

Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.

Disable Logon Banner via GPO or Registry:

1. To disable logon banner via GPO. remove the message/text in these fields and update the policy

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security options:

Interactive Logon: Message Text for users attempting to logon 
Interactive Logon: Message Title for users attempting to logon

Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on

2. To Disable logon banner via registry, delete the values under:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\winlogon\

There you have two String values: LegalNoticeCaption , LegalNoticeText
 

---

Problem Cause

In the CDF traces, we  saw the Error,"ctx::CCtxRdpProtocolConnection::AuthenticateClientToSession: RDP Core error 0xd0000225",""
after the logon banner is presented. Since acknowledging the logon banner needs user input and for Probe agent session the input is not received due to no manual intervention, the session logs a logon failure.

Receiver CDF Traces


418964,4,2021/04/16 13:02:26:22609,10176,9908,Unknown,-1,HPC_Errors,***,0,AddError,1,Error,"Shutdown error queued: Status message for broken host or client received.",""
418980,0,2021/04/16 13:02:26:23417,7988,6500,Unknown,-1,wfcrun,1530,WFEngineStatusCallback,3,Information,"WFEngineStatusCallback : Close not in progress.  Inc messages in progress.",""
418981,0,2021/04/16 13:02:26:23417,7988,6500,Unknown,-1,wfcrun,1583,WFEngineStatusCallback,1,Information,"WFEngineStatusCallback : CLIENT_STATUS_CONNECTION_BROKEN_HOST | CLIENT_STATUS_CONNECTION_BROKEN_CLIENT case.",""
418982,0,2021/04/16 
418983,0,2021/04/16 13:02:26:23417,7988,6500,Unknown,-1,wfcrun,1600,WFEngineStatusCallback,3,Failure,"WFEngineStatusCallback : Session terminated because session logon failed.",""


VDA CDF Traces

163530: 163524,3,2021/04/16 13:00:24:76949,12576,2252,svchost.exe(TermService),0,Rpm,WtsProtocolLogonErrorRedirector,274,ctx::CWtsProtocolLogonErrorRedirector::RedirectStatus,14,Information,"ctx::CWtsProtocolLogonErrorRedirector::RedirectStatus: Session Id 19, Message [Please wait for the Local Session Manager]",""

166160,3,2021/04/16 13:00:24:90534,444,2252,svchost.exe(TermService),0,Rpm,WtsProtocolLogonErrorRedirector,359,ctx::CWtsProtocolLogonErrorRedirector::RedirectMessage,14,Information,"ctx::CWtsProtocolLogonErrorRedirector::RedirectMessage: Session ID 19, Caption [Attention Network Users], Message [This is a proprietary system and NOT for public or personal use.  All work products, communications (including but not limited to e-mail, xxx), files, data or information created, inputted or accessed on this system are and shall become the sole property of the company. This system may be monitored and recorded by the company at any time.

166162,3,2021/04/16 13:00:24:90534,444,2252,svchost.exe(TermService),0,LogonErrorRedirector,LogonErrorNPRedirector,456,ctx::LogonErrorNPRedirector::HandleMessageUI,9,Error,"ctx::LogonErrorNPRedirector::HandleMessageUI: Named pipe client is not connected yet. returns E_FAIL.",""

166164,3,2021/04/16 13:00:24:90535,444,2252,svchost.exe(TermService),0,Rpm,WtsProtocolLogonErrorRedirector,369,ctx::CWtsProtocolLogonErrorRedirector::RedirectMessage,9,Error,"ctx::CWtsProtocolLogonErrorRedirector::RedirectMessage: logon error receiver returned HRESULT 0x80004005",""

222582,8,2021/04/16 13:02:26:07127,6980,4,System,0,wdica, ,180,AppendTerminate,3,Information,"PACKET_TERMINATE sent to client. Connection Id: 23. Terminate Reason: 0x1",""

223031,3,2021/04/16 13:02:27:08351,4228,2252,svchost.exe(TermService),0,Rpm,CommandChannel,377,ctx::CCommandChannel::CommandChannelThreadWorker,13,Information,"Connection object is NOT in CONNECTED state, presumably can't break - let's wait for the connected state to break it...",""

223159,6,2021/04/16 13:02:27:08688,12720,5340,BrokerAgent.exe,0,BrokerAgent,,0,,5,EntryExit,"=========>>>>> StackManager.NotifySessionEvent(8ed9e7d2-248c-4bf8-9840-205880f629b1): Enter(SessionEvent:SESSION_EVENT_TERMINATE, SessionReasonCode:SESSION_EVENT_REASON_CONNECTION_FAILURE, rdsCalId:0)",""

228690,3,2021/04/16 13:03:10:80659,10444,2252,svchost.exe(TermService),0,Rpm,CtxRdpProtocolConnection,698,ctx::CCtxRdpProtocolConnection::AuthenticateClientToSession,9,Error,"ctx::CCtxRdpProtocolConnection::AuthenticateClientToSession: RDP Core error 0xd0000225",""


Probe Agent logs

Probe Agent logs are saved at C:\Program Files (x86)\Citrix\Citrix Probe Agent

2021-04-16 13:04:24,601 [4] INFO ProbeEndPoint.Log - ICA download passed. Adding stage result
2021-04-16 13:04:24,601 [4] INFO ProbeEndPoint.Log - ICA Launch failed. Adding stage failure