Client for 32-bit Windows Administrator's Guide - Citrix Knowledge ...

50 Client for 32-bit Windows Administrator’s Guide Go to Document CenterUsers of Program Neighborhood can select the Enable session reliability option intheir application or connection settings. Enabling or disabling Enable sessionreliability at the client overrides the session reliability settings for the server farm.Users of Program Neighborhood Agent and the Web Client cannot override theserver settings for session reliability.To enable session reliability in Program Neighborhood, select Enable sessionreliability on the Options tab of the Settings for the application set.SSPI/Kerberos Security for Pass-Through AuthenticationRather than sending user passwords over the network, pass-through authenticationnow leverages Kerberos authentication in combination with Security SupportProvider Interface (SSPI) security exchange mechanisms. Kerberos is an industrystandardnetwork authentication protocol built into Microsoft Windows operatingsystems.Kerberos logon offers security-minded users the convenience of pass-throughauthentication combined with secret-key cryptography and data integrity providedby industry-standard network security solutions. With Kerberos logon, the Clientdoes not need to handle the password and thus prevents Trojan horse-style attackson the client device to gain access to users' passwords.Users can log on to the client device with any authentication method, for example abiometric authenticator such as a fingerprint reader, and still access publishedresources without further authentication.System requirements. Kerberos logon requires MetaFrame Presentation Server 3.0or later, MetaFrame Presentation Server Clients for 32-bit Windows 8.x or later, andworks only between clients and servers that belong to the same or to trustedWindows 2000 or Windows 2003 domains. Servers must also be trusted fordelegation, an option you configure through the Active Directory Users andComputers management tool.Kerberos logon is not available in the following circumstances:• Connections for which you select any of the following options in TerminalServices Configuration:• On the General tab, the Use standard Windows authentication option• On the Logon Settings tab, the Always use the following logoninformation option or the Always prompt for password option• Connections you route through the Secure Gateway for MetaFramePresentation Server• If the server running MetaFrame Presentation Server requires smart card logon• If the authenticated user account requires a smart card for interactive logon