How to protect RDP and bypass Citrix

[CoryL]

I have several Citrix servers that I publish applications for my users. I have a few admins that log on to administer the servers via RDP. I installed Duo to force MFA for the administrators which works great. But my applications started failing when users were attempting to launch them. Citrix uses RDP as well. Anyway to bypass Duo for the Citrix applications and leave it for the RDP for the admins? Thanks!

[raphka]

Hi CoryL, Welcome to the Duo community!

I believe Citrix, like Duo uses a custom credential provider added to Windows logon.

Installing Duo disables all other unsupported credential providers to prevent them being used to bypass Duo. This in turn is likely breaking your Citrix users ability to launch their apps.

You can whitelist other credential providers in Duo to allow them to work as per the article below:
https://help.duo.com/s/article/4041

However it is important to note that any user, including your Admins who log in using the Citrix credential provider will bypass Duo for Windows Logon. The protection will still work for plain RDP or console logins.