SideBySide errors - Citrix XenApp client v11.2 requires Visual C++ Redistributable?

When upgrading Windows XP machines to v11.2 of the client I’ve noticed lots of SideBySide (so, Visual C++) errors in their system event log.  The odd thing is, everything appears to work fine, applications launch okay but cause these errors each time they do. 

This issue is mentioned in the release notes of the v10.2 client and appears to still be the case with v11.2.  This was seen connecting to a MPS 4.0 farm, I assume its not about the farm version though.

I can’t find what the actual problems caused by these errors might be, though the Citrix forums mention printing issues.

Anyway, installation of the Visual C++ Redistributable SP1 (x86 and x64) fixed the issue and the errors stopped.  I’ve added this as a pre-requisite to the script that rolls out Citrix 11.2 clients to PCs now.

These are the errors it caused…

Event Type:    Error
Event Source:    SideBySide
Event Category:    None
Event ID:    59
Description:
Generate Activation Context failed for C:\Program Files\Citrix\ICA Client\MFC80.DLL. Reference error message: The operation completed successfully.

Event Type:    Error
Event Source:    SideBySide
Event Category:    None
Event ID:    58
Description:
Syntax error in manifest or policy file "C:\Program Files\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST" on line 5.

Event Type:    Error
Event Source:    SideBySide
Event Category:    None
Event ID:    34
Description:
Component identity found in manifest does not match the identity of the component requested

Pass-through Authentication woes

Passthrough authentication is a great feature of the XenApp Agent and Web Interface – users don’t like having to type the same password three times when they log on and anything that makes it easier for them to use Citrix means they’re less likely to find ingenious ways of avoiding it and so is good for us admins.
I found though that users fall into two categories – those who think auto logging in is a mission critical feature that they need to work and those that absolutely insist on explicit credentials (probably because they use some nasty shared login to get into Windows.
Anyway, I’ve found that both on Presentation Server 4.0 and XenApp 6 beta there are several things that can doom passthrough to either not work at all, or look like its going to work and then display a second Windows Logon box when you actually launch an app.
These are some of the elephant traps that can scupper passthrough:
Client Problems

1. Generally, on a client with malfunctioning passthrough look in Task Manager at the running processes. If SSONSVR.exe is not in the list there is a problem with that client and it might need a reinstall. Make sure you
2. SSONSVR.exe can fail to start on computers using Intel Credentials Manager – see the fix here.
3. There is an ADM installed on clients from v10 – it will be at:
   C:\Program files\Citrix\ICA client\Configuration\icaclient.adm
   You can import this ADM into Active Directory for the OU containing your client PCs and configure it to allow single sign on using these instructions from Citrix. This will mean less messing about with appserv.ini files.
4. Some people report you can’t easily use passthrough from a published desktop if using the v11.0 client. Update to the latest client, v11.2 is now available.
5. Especially if not using the above ADM, check your appserve.ini (in C:\Users\%username%\AppData\Roaming\ICAClient, or c:\documents and settings\%username%\application data\icaclient\, or c:\Program files\citrix\ica client\) for the following line. It needs to be present and on and needs a reboot to take effect.
   SSOnUserSetting=On
6. Check the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\PNAgent. It should have EnablePassThrough set on and a Server URL (which might well begin http://…) and so look something like this:
   
7. I saw a report on a forum post that a client installed pointed to a web interface server with passthrough disabled will never be able to use SSO (single sign on) unless the client is reinstalled, even if its been enabled on the server subsequently. You also need to reinstall if you chose not to use passthrough when you installed the client.
8. v10.1 and v10.2 of the client might need modification or switches to be able to use SSO – see this for more details. I had success with a v10.2 client installed with the following switch (obviously put in the right path for your client):
   msiexec /i c:\ica32pkg.msi enable_sso=YES
   
9. One problem we saw was that pass-through (without Kerberos) can fail if a client has logged on before the network was ready.  If you boot the PC, leave it on the CTRL-ALT-DEL screen for about 60 seconds, and then log in, it might work.  If this is the case, configure the group policy setting to wait for the network before logon (confirmed on Windows 7).

Server Problems

1. Obviously your Web Interface server should be configured to allow Passthrough under Authentication Methods. Use Kerberos only, especially if you are not using HTTPS. You could try specifying the domains allowed explicitly, that can have an effect.
2. Check in Terminal Services (or RDS…) Configuration and the properties of the ICA protocol. Make sure “Always prompt for password” is not checked.
3. Some people have reported on XenApp 5 that they need to install the XAE500W2K8042 hotfix if they are not using Kerberos. I say they should be using Kerberos!
4. On a Windows Server 2008 (or R2) server you have to make a group policy change here (I’ve not found the ADM was needed):
   Computer Configuration\Policies\Administrative Templates\System\Credentials Delegation\
   Double click “Allow Delegating Default Credentials”. Set it to Enabled and click Show. Add in a list of all your Web Interface servers. On the server do a “gpupdate /force” and reboot.

Resources:

• Troubleshooting: http://support.citrix.com/article/CTX076838
• Using the ADM: http://support.citrix.com/article/CTX112957