Citrix client can only start one session at a time

Overview

The Citrix ICA client can use Single Sign-On (SSO). If you enable this option, your Launcher will only be able to start one session. Any subsequent sessions will redirect to the existing session instead of opening a new one. From the point of view of the Launcher, new sessions simply do not start, and we will time out looking for them.

Identifying the Problem

You may see this manifest with various errors in the Launcher logs, but this is the most common one:

[INFORMATION] [Handler @4:27:11 PM]: UserSession ... Connection Event Received
Event Type ConnectionFailed.
[WARNING] Connector connection failed. User session Id: '...', extra information: 
'Timeout. Process was not able to establish connection'

The specific behavior is that the first session run via wfcrun32.exe (the Citrix default ICA handler) works fine. All additional sessions terminate quickly and silently. When the initial session terminates normally, the next session will work. There is no obvious error message anywhere from Citrix. We have no trouble downloading the ICA file and no trouble starting the program. It just ends (and deletes the ICA file when it ends).

For security purposes, it is normal for wfcrun32.exe to delete the ICA file when it finishes. So you will be unable to see the ICA file for the offending session. However, you can see in the Launcher log that we are downloading the ICA file and trying to launch it.

Understanding the Root Cause

This issue occurs because Single Sign-On (SSO) is enabled in the Citrix client. The second session doesn’t work because the first session is associated with the Launcher’s user account, and any additional sessions from the Launcher’s account will redirect to the existing session. For Login Enterprise, where we want multiple concurrent sessions on the Launcher using different accounts, you must disable SSO in the Citrix client configuration.

Solution

To see if SSO is enabled on the Launcher machine, right-click the Citrix Workspace icon in the system tray, go to Advanced Preferences > Configuration checker > SSON Checker > Run.

If enabled and you have most checkmarks, uninstall and reinstall the Citrix Workspace client with SSO explicitly disabled (CitrixWorkspaceApp.exe ENABLE_SSON=No). Reboot after installation and verify that Citrix SSO is truly disabled (through the Configuration checker) before running a Test.

Additional Troubleshooting Steps

You may have a group Policy that enforces SSO as well. For instance, we have found this registry key, which was set through a GPO. You need to set it to “false” to disable SSO (and reboot).

Computer\HKEY_CURRENT_USER\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Logon\Local Credentials\EnableSSOnThruICAFile REG_SZ

However, we do not have specific information about all the ways this could be happening. Please contact Citrix support and/or your domain administrator for more information about how to disable SSO for the Citrix client.

Second Possible Cause

If your Delivery Group runs out of running machines, you can see a similar behavior: a new session flashes “Powering On…” in the Workspace Launcher before immediately closing. If you only have one working machine, you will see that your second and subsequent sessions quickly fail. Double-check your Delivery Group as well.