Publishing a Citrix application for users is a straight-forward task. But one common error I have observed that people commit is when it comes to setting up the all the required permissions for users. When new applications are published on an existing Citrix server, adminstrators tend to forget to set the necessary ICA permissions for the users.

Normally to logon to any Windows server, users have to be given permission to logon by making them member of the Remote Desktop Users group.  On a Citrix server there are two different types of Terminal Services connections created during installation.

1. RDP-Tcp connection for administrators to logon to manage the server remotely.

2 . ICA-Tcp for users to be able to logon to the server and launch the application.

Apart from assigning permission for a published application on the Citrix Access Management console, setting permission on ICA-Tcp for Citrix users is one of the important, but often a missed task. A user without permission to logon via ICA-Tcp connection on a Citrix server will encounter an error when he/she attempts to launch a published application.

To resolve this, logon to the Citrix server where the applicaiton is published.

Go to Start > Program Files > Administrative Tools > Terminal Services Configuration.

Under connections Right-click ‘ICA-Tcp’  and go to properties.

Go to the Permissions tab and add the user with atleast the following special permissions

1. Query Information

2. Logon

3. Message

4. Connect

Note that this permission has to be set for each and every user on each and every Citrix server where the application is published. Therefore it is best to control these kind of permissions using domain groups to make administration easy.