A while ago, I wrote a blog about the error message ‘Application can’t be started… (Instant Passthru could not be resolved)’ that we encountered when launching a published application from our Ivanti Workspace Control managed session. Recently, we received the same message again, but this time the cause was different.
Application can’t be started… (Instant Passthru could not be resolved)
Shortly after a relatively simple task—upgrading an outdated version of Citrix Workspace App (CWA) from 1912 LTSR to the slightly newer 2203 LTSR—we encountered some inexplicable issues that made it impossible to launch Citrix Published Apps via SelfService.exe.
The environment consists of a Citrix Virtual Apps and Desktops session host, equipped with an Ivanti Workspace Control managed user session.
After some investigation, we discovered that SelfService.exe creates a Cache.xml file in the user profile at %LocalAppData%\Citrix\SelfService, which contains all the necessary information to successfully launch a Citrix Published App. In our case, this Cache.xml file was either not created or not fully created.
When we gave our Ivanti Workspace Control session a refresh, the Cache.xml was often created suddenly. In the IWC Trace Log, we noticed that IWC was interacting with the SelfService.exe process. This at least gave us a good starting point for further investigation.
The question then was why this wasn’t happening. Let’s first describe step by step how the process should work:
- ssonsrv starts and contacts the configured store: https://StoreFrontFQDN/Citrix/Intern/Discovery
- This automatically authenticates the users to the store using Windows credentials (or some other means like certificates).
- ssonsrv itself isn’t generating the cache file. It is only responsible for logging the user into CWA.
- After this, we can run Selfservice.exe with the arguments –init –poll –exit to generate the cache file.
If we run the caching commands before ssonsrv authenticates the user, it is bound to fail because the user hasn’t been authenticated to the store yet.
Initially, we thought it was a timing issue, that SelfService.exe was being started too early. After reading the Citrix support article below, we decided to adjust the values of InitialRefreshMinMs and InitialRefreshMaxMs.
Unfortunately, this did not produce the desired result; the outcome was far from consistent.
One of the points we found in the Workspace Control Administration Guide was the SelfServicePoll parameter, which allowed us to influence the SelfService.exe process. By setting the registry key, it is possible to deviate from the default behavior and start SelfService.exe with the parameter -ipoll instead of the default parameter -poll.
Key:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\RES\Workspace Manager\SelfServicePoll Type:REG_SZ Value:NoAlthough it seemed to provide an improvement, unafortunately, it was not a definitive solution for the random behavior we observed.
We then tested various scenarios: the first user after a restart, the second user on a server, a new session on a server where it suddenly worked, and every time we thought, ‘This is the cause, and that is the solution,’ we managed to come up with a scenario where it failed again. In concrete terms, we didn’t have a truly robust solution that worked well in all cases.
On the Ivanti support pages, we came across two articles stating, ‘Receiver.exe and SelfService.exe are meant as system processes and not as managed applications. These are started from the Run key. With the Workspace Control Shell, the execution of the Run key is blocked by default. In this scenario, make sure that there is a managed application. For Citrix Workspace App, the command line is “C:\Program Files (x86)\Citrix\ICA Client\concentr.exe” /startup.
HOWTO: Troubleshoot issues with starting Citrix Published Applications
Ultimately, we suspected that the cause lay in the process ‘IWC %ProgramFiles(x86)%\Citrix\ICA Client\SelfServicePlugin\SelfService.exe -init -ipoll -exit’, which was started for each user during logon. In each unique user session, we needed to start the process ‘C:\Program Files (x86)\Citrix\ICA Client\Concentr.exe /startup’, ensuring that all the necessary dependent processes were started correctly and that SelfService.exe wasn’t executed multiple times or launched before the CWA logged in the user.
After we adjusted our logon task from ‘%ProgramFiles(x86)%\Citrix\ICA Client\SelfServicePlugin\SelfService.exe -init -ipoll -exit’ to ‘C:\Program Files (x86)\Citrix\ICA Client\Concentr.exe /startup’, everything indeed started working as intended. Immediately after a user logs onto the server, the Cache.xml file is correctly created, which is necessary for launching published applications via SelfService.exe.
Also keep in mind that starting from version 2203 LTSR, SelfService is no longer installed automatically, but you need to deliberately add it using ADDLOCAL=SelfService.
And for completeness, thanks to Hugo Koop for all the research he has done on this.