Advanced Authentication establishes virtual channel from either Device Service or Windows client to the desktop virtualization server where applications to which user needs access are hosted. Data gets transmitted and received through this channel. If the desktop virtualization server does not identify or allow the virtual channel, then authentication fails.
To add virtual channel from Advanced Authentication to allow list on the Citrix server:
Navigate to Policies > VirtualChannels > Settings.
Select Virtual channel allow list and click Edit policy.
Deselect Use default value.
Select Enabled and specify one of the following path:
For Device Service 32 and 64 bit executables:
AAFDEVS,C:\Program Files (x86)\NetIQ\Device Service\DeviceService.exe,C:\Program Files\NetIQ\Device Service\DeviceService.exe
For Windows client:
AAFCORE,C:\Windows\System32\winlogon.exe
Click OK.
Apply the changes to policy.