Posted on

Citrix XenDesktop VDA’s not registering

Today I walked in on an odd issue with XenDesktop. The Delievery Controllers were showing each of the VDA’s as “Not Registered”

The environment is currently as follows:

  • XenDesktop 4 with Multiple Active Directory Forests.
  • Forest 1 is Windows 2003 located in local data centre
  • Forest 2 is Windows 2008 with the PDC located on a remote WAN site, the are local write-able domain controllers located within the local data centre
  • There is a domain level trust between the child domains
  • There are DNS stub zones for the other domains on each of the domain controllers
  • Desktop Delievery Controllers are located in the local data centre and are members of Forest 1
  • XenDesktop VDA’s are located in the local data centre but the machines are members of Forest 2
  • The NTLM authentication happens via the domain trust.

    • After viewing the trusty event viewer on the Delievery Controller you might see the following:

    Event ID: 1309
    The delivery controller failed to broker a connection for user ‘[email protected]’ to desktop group ‘Desktop Group’. The assigned virtual desktop ‘‘ for the user is not available.

    This may be because the desktop is not connected to a controller, another user is already using the desktop, or it may still be initializing.

    Moving across to the desktop event log you see the following:

    Event ID: 1221
    The Citrix Desktop Service cannot connect to the delivery controller ‘http://controller.fqdn:8080/Citrix/CdsController/IRegistrar’ (IP Address ‘10.10.10.10’)

    Check that the system clock is in sync between this machine and the delivery controller. If this does not resolve the problem, please refer to Citrix Knowledge Base article CTX117248 for further information.

    Error Details:
    Exception ‘Fail worker callback using SPN HOST/machine.domain.com and IP address 10.10.10.10’ of type ‘System.ServiceModel.FaultException`1[Citrix.Cds.Protocol.Controller.Fault]’.

    Event ID: 1246
    The Citrix Desktop Service has detected that the delivery controller controller.fqdn (IP Address 10.10.10.10) cannot connect to the Service. One possible reason for this is that the ‘Access this computer from the network’ security policy does not allow the delivery controller server identity to access this machine.

    Please check that a local or group policy is not set incorrectly to disallow access from the delivery controller servers.

    Event ID: 1208
    The Citrix Desktop Service’s connection to the Citrix Desktop Delivery Controller Service was terminated. The Citrix Desktop Delivery Controller Service is running on server ‘controller.fqdn’.

    Check that there is no active firewall blocking the controller communicating with this machine.

    Please refer to Citrix Knowledge Base article CTX117248 for further information.

    Error details:
    Keep-alive request was rejected.

    After some troubleshooting with the AD team it turns out that the domain controller for Forest 2 at the local data centre had stop replicating and was no longer accepting requests for Directory Services. Other services on the local DC were working as expected and even an LDAP bind was working inbound to the box but outbound (return) communications were not. Once the Directory Services service was restarted authentication started to flow again which in turn allowed the VDAs to register again.

    A good article on how NTLM authenication works with multi domains can be found here.