Unable to launch published Studio

Last Updated on October 12, 2021

Normally, Citrix Studio can be easily published and launched from a store either using Receiver for Web or Workspace App/Receiver. With this article I want to emphasize on a particular scenario where you may be unable to launch published Citrix studio because MMC Snap-In lockdown (restriction) is in effect.

That span-in restriction is implemented with the help of a GPO setting called Restrict users to the explicitly permitted list of snap-ins, which can be found atUser Configuration/Policies/Administrative Templates/Windows Components/Microsoft Management Console.

What this means is that “restrict all snap-ins to be added to Microsoft Management Console (MMC) and only allow snap-ins that are explicitly permitted by enabling their own GPO settings. To do that, go to User Configuration/Policies/Administrative Templates/Windows Components/Microsoft Management Console/Restricted/Permitted and enable the setting related to the snap-in you want to allow to be added to MMC.

Now, with “Restrict users to the explicitly permitted list of snap-ins” enabled, a user would be unable to launch published Studio. Two errors, one after another, are supposed to show up:

• The snap-in below, referenced in this document, has been restricted by policy. Contact your administrator for details. Studio. Once you click on OK, another error message will surface.

• The snap-in below, referenced in this document, has been restricted by policy. Contact your administrator for details. Folder.

Before we begin to fix this, I would like to thank Terence Luk for writing about this issue and providing the solution that seem to work until 7.15 LTSR or maybe higher versions but for me at least, it doesn’t fully resolve the problem with 1912 LTSR or maybe higher versions.

Unfortunately, Citrix Studio snap-in GPO setting is not available under “Restricted/Permitted snap-ins” directory that’s why we have to take the help of Group policy preference registry item.

1. On a Delivery Controller, open Registry Editor (Run/Regedit.msc) and go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\
2. You would see a list of GUIDs related to every snap-in that is available on the Delivery Controller. Search through the list and find a GUID that has ApplicationBase set to C:\Program Files\Citrix\Desktop Studio\.
3. For me, it is FX:{147C3FB4-2709-47cd-8745-7EA822341189}. Copy the GUID somewhere safe. We will need this later.

4. Now find a GUID for snap-in that has NameString set to Folder. For me, it is {C96401CC-0E17-11D3-885B-00C04F72C717}. Copy it somewhere safe. We will need this later.

5. Edit a group policy and go to User Configuration/Preferences/Windows Settings/Registry. Right click, select New/Registry Item.

6. New Registry properties window will open up. Fill/Modify values as described below. Click Apply and OK. In Key Path, replace the GUID at the end of the path with the GUID of your Citrix Studio. Setting the value of Restrict_Run to 0 explicitly enables Citrix Studio snap-in.
   • Action: Update
   • Hive: HKEY_CURRENT_USER
   • Key Path: Software\Policies\Microsoft\MMC\FX:{147C3FB4-2709-47cd-8745-7EA822341189}
   • Value name: Restrict_Run
   • Value type: REG_DWORD
   • Value date: 0

7. Additionally, configure item-level targeting in Common tab if you wish to apply this registry change only to a particular user, group, OU, etc. I am targeting a certain security group that has Read Only Administrator role assigned to it in Studio. In method 3 of my “How to Change Date and Time in a Citrix Session” article, I have explained how to configure Item-level targeting.

8. Repeat the same process for Folder snap-in. Replace the GUID at the end of Key Path with the GUID of your Folder snap-in. Again, configure item-level targeting if required.
   • Action: Update
   • Hive: HKEY_CURRENT_USER
   • Key Path: Software\Policies\Microsoft\MMC\{C96401CC-0E17-11D3-885B-00C04F72C717}
   • Value name: Restrict_Run
   • Value type: REG_DWORD
   • Value date: 0

9. Now you should have at least 2 Registry items. Close the GPO editor, wait for the GPO to sync to other delivery controllers and try opening Citrix Studio. It should work this time.