Single Sign On is dead & buried.. it was a tough product to deal with, but worked well *if* you got it going..  And since it is gone, the policy is gone with it..

Citrix also dropped the prompt for password policy, since Microsoft already provides the exact same policy.
https://support.citrix.com/article/CTX138924

They show you where the MS policy is for this..
Computer Configuration – Policies – Administrative Templates – Windows Components – Remotes Desktop Services – Remote Desktop Session Host – Security – Always prompt for password upon connection

Coralon

Coralon:

Thanks for your comment.  

The SSON aspect is working which is our problem.   Currently the signed-on user is automatically signed into the Citrix app using their credentials.   Unfortunately, the app has several predefined accounts which must be used to gain access.   We have disabled SSON and forced the user to sign in using the alternate credentials.   This has been working for us for many years using the older version of Citrix.

Now that we are in the process of upgrading our terminal servers to the newer version of Citrix, we are having issues with duplicating the setup we have now.

It's kind of goofy by some peoples standards, but it's what works for us.  

We need to use the logged in users' credentials to publish the app in Citrix Receiver.   Those which permission will see the app.   Then once the app is launched, we need to prompt the users to sign in with alternate cred's so they can use the predefined user accounts that are setup within the app.

Hope this makes sense.    

I understand that some of these settings can be set using Group Policy and have already tried using them, but so far without any luck.

Any help is greatly appreciated.

Ok.. now I see where you are going with this.   You are talking about the Receiver's SSON, not the server.. it's not a function of the VDA, it is purely a client option.

I do this myself.. I have my 4.5 client installed, and I manually sign on with differing accounts depending on what I need to do at any given moment.  The *easiest* way is to install the client *without* the AM & SSON options.. typically, just ENABLE_SSON=no.  http://docs.citrix.com/en-us/receiver/windows/4-3/receiver-windows-install-wrapper/receiver-windows-cfg-command-line-42.html

If you don't want to upgrade the client on your old servers, you can uninstall the 3.1 that it comes with and reinstall it, and again.. use the command line to turn off the SSON option.. I believe it uses the same option (its not supported anymore, so the documentation is a little tough to find.  

But, you can go through the configuration options for SSON, and undo them.. https://support.citrix.com/article/CTX133982  If you have Web Interface for your 6.5 servers, then the easiest thing to do is reconfigure them to refuse passthrough authentication and *only* accept username/password.

Coralon

if you don't like to disable SSOn completely, but for one app only, you may publish a script where uses have to input the username and password and call the app with "runas"

I've put in a support ticket with Citrix to see what they say....when they get me a resolution, I will reply to this thread for the benefit of others.

Thanks for the comments.

This is what we found as a workaround after considering the comments posted and after working with Citrix support for a week to find a solution to the problem.