Saturday, March 2, 2013

XenDesktop 5.6 and XenApp 6.5 throws the error: “The Group Policy Client service failed the login. Access is denied.”

Problem

I was recently asked by a client to look into an issue where he had a specific user who would receive the following error when launching any Citrix XenApp 6.5 published applications:

image

The Group Policy Client service failed the login.

Access is denied.

image

They would also receive the same error when launching a XenDesktop 5.6 desktop:

image

The Group Policy Client service failed the login.

Access is denied.

image

I also tried to directly remote desktop using the RDC client to the XenApp 6.5 server and confirmed that I would receive the same error.

Solution

Note that through my research on the web, there appears to be various steps that can remedy this issue but the ones that worked for me are as follows:

1. Log onto a domain controller, open Active Directory Users and Computers open the properties of the user’s account

2. Navigate to the Profile tab and remove the Profile path settings:

imageimage

3. Log onto the Citrix XenApp server and delete the user’s profile:

imageimage

4. Do the same for the XenDesktops that have the user’s profile created locally (or you can alternatively just refresh the desktop catalog).

5. Go to the file server hosting the user’s roaming profile and rename the folder.

Once a new profile has been created for the user, proceed with copying any settings from the old server into the newly created profile.

2 comments:

Jonathan Andrus said...

Any idea how to fix this error when you're using CUPM?

Lee said...

+1 for the Workaround, unfortunately a fix is a little harder to find/troubleshoot. It's clearly profile related, the user profiles i've seen are between 2-10MB instead of the usual 40-50MB. I've read that it can be Flash\Java related but so far haven't been able to prove it.

Jonathan, just delete the Citrix profile, clear all profiles from the servers - if you haven't set UPM to remove them automatically - and then have the user log on again.