Last updated:
During Citrix upgrades, I check not only VDA registration and session launch but also the entire authentication chain.
Citrix Federated Authentication Service (FAS) has an interesting change introduced in version 2511 that is easy to overlook in mixed environments.
The symptoms:
❌ Users can sign in to StoreFront
❌ The published desktop starts, but Windows SSO fails
❌ Certificate templates and CA configuration look correct
❌ Not all VDAs behave the same way
🔍 What is behind this?
With FAS 2511, Citrix introduced the new V2 ticket format.
The key difference:
Previously (V1):
The VDA needs the FAS server addresses through the familiar registry/GPO configuration.
New (V2):
The FAS address is supplied directly in the ticket.
For VDAs running version 2511 or later, this eliminates the separate FAS address list.
⚠️ The crucial point:
In a mixed Citrix environment with older and newer VDAs, the existing FAS configuration must not simply be removed.
Older VDAs still need the FAS server addresses.
🛠️ My investigation process:
1. Compare FAS and VDA versions.
2. Check whether the FAS server addresses are still configured on older VDAs.
3. Examine Application Event 204 on the FAS server. It identifies whether V1 or V2 tickets are being used.
4. Only then investigate certificates, CA templates and permissions.
💡 My takeaway:
Not every FAS SSO issue originates at the certification authority.
FAS V2 simplifies the architecture, but only if every participating VDA supports the new ticket format.
For LTSR migrations and mixed VDA versions in particular, the FAS ticket version therefore belongs on my troubleshooting checklist.
