Advanced Authentication establishes virtual channel between the VD provider (Citrix or VMware) and the client OS. The Device Service or Windows Client credential provider work with the VD provider to access local hardware from the shared service environment. Data gets transmitted and received through this channel. If the virtual desktop provider server restricts virtual channels, then the Device Service and SSO authentication would fail.
When Virtual Desktop Authentication Agent is in use and Device Service or Windows Client is used for device based authentication to get access to VD provider then the Virtual Channel Policy needs to be configured.
To allow virtual channel from Advanced Authentication on the Citrix studio:
Launch Citrix Studio.
Navigate to Policies.
Choose an existing policy that is specific to Advanced Authentication or create a new Policy.
Select Virtual channel allow list and click Edit policy.
Deselect Use default value.
Select Enabled and specify one of the following path:
For Device Service 32 and 64 bit executables:
AAFDEVS,C:\Program Files (x86)\NetIQ\Device Service\DeviceService.exe,C:\Program Files\NetIQ\Device Service\DeviceService.exe
For Windows client:
AAFCORE,C:\Windows\System32\winlogon.exe
Click OK.
Apply the changes to policy.
NOTE:After configuring the policy, it is required to restart Virtual Desktop Authentication Agent rather than disconnecting to validate settings the virtual channel policy applies.