Enable ICA File Signing
Verified with Citrix Workspace App 26.3.10 — updated on July 10, 2026
Supported on: ADMX Migrator encountered a policy that does not have a supportedOn value.
Path in the GPO console
Computer Configuration\Administrative Templates\Citrix Components Description
Use this policy to enable and configure ICA File Signing.
Registry
HKLM
Software\Policies\Citrix\ICA Client\ICA File Signing This policy sets several registry values:
version Enabled:
version = 1 Disabled:
version = (deleted) enabled Enabled:
enabled = 1 Disabled:
enabled = (deleted) citrixparam1 Unsigned Parameters Enabled:
citrixparam1 = Border Disabled:
citrixparam1 = (deleted) citrixparam2 Unsigned Parameters Enabled:
citrixparam2 = BackgroundColor Disabled:
citrixparam2 = (deleted) citrixparam3 Unsigned Parameters Enabled:
citrixparam3 = TextColor Disabled:
citrixparam3 = (deleted) citrixparam4 Unsigned Parameters Enabled:
citrixparam4 = DesiredColor Disabled:
citrixparam4 = (deleted) citrixparam5 Unsigned Parameters Enabled:
citrixparam5 = Client-Type Disabled:
citrixparam5 = (deleted) citrixparam6 Unsigned Parameters Enabled:
citrixparam6 = EnableIPCSessionControl Disabled:
citrixparam6 = (deleted) citrixparam7 Unsigned Parameters Enabled:
citrixparam7 = IconIndex Disabled:
citrixparam7 = (deleted) citrixparam8 Unsigned Parameters Enabled:
citrixparam8 = IconPath Disabled:
citrixparam8 = (deleted) citrixparam9 Unsigned Parameters Enabled:
citrixparam9 = TransportDriver Disabled:
citrixparam9 = (deleted) citrixparam10 Unsigned Parameters Enabled:
citrixparam10 = DesiredHRes Disabled:
citrixparam10 = (deleted) citrixparam11 Unsigned Parameters Enabled:
citrixparam11 = DesiredVRes Disabled:
citrixparam11 = (deleted) citrixparam12 Unsigned Parameters Enabled:
citrixparam12 = ScalingMode Disabled:
citrixparam12 = (deleted) citrixparam13 Unsigned Parameters Enabled:
citrixparam13 = TWIMode Disabled:
citrixparam13 = (deleted) citrixparam14 Unsigned Parameters Enabled:
citrixparam14 = ConnectionBar Disabled:
citrixparam14 = (deleted) citrixparam15 Unsigned Parameters Enabled:
citrixparam15 = RTWIMode Disabled:
citrixparam15 = (deleted) disableCheckForTrustedLaunchers Unsigned Parameters Enabled:
disableCheckForTrustedLaunchers = 0 Disabled:
disableCheckForTrustedLaunchers = (deleted) Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Enable ICA File Signing
; State: Enabled
; Supported on: ADMX Migrator encountered a policy that does not have a supportedOn value.
[HKEY_LOCAL_MACHINE\Software\Policies\Citrix\ICA Client\ICA File Signing]
"version"=dword:00000001
"enabled"=dword:00000001
"promptUser"=dword:00000000
"disableCheckForTrustedLaunchers"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters]
"citrixparam1"="Border"
"citrixparam2"="BackgroundColor"
"citrixparam3"="TextColor"
"citrixparam4"="DesiredColor"
"citrixparam5"="Client-Type"
"citrixparam6"="EnableIPCSessionControl"
"citrixparam7"="IconIndex"
"citrixparam8"="IconPath"
"citrixparam9"="TransportDriver"
"citrixparam10"="DesiredHRes"
"citrixparam11"="DesiredVRes"
"citrixparam12"="ScalingMode"
"citrixparam13"="TWIMode"
"citrixparam14"="ConnectionBar"
"citrixparam15"="RTWIMode"
"disableCheckForTrustedLaunchers"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Policies\Citrix\ICA Client\ICA File Signing\Trusted Certificates]
; List values: enter one value per line in the builder UI.More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Enable ICA File Signing
# State: Enabled
# Supported on: ADMX Migrator encountered a policy that does not have a supportedOn value.
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'version' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'enabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'promptUser' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'disableCheckForTrustedLaunchers' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'citrixparam1' -Value 'Border' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam2' -Value 'BackgroundColor' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam3' -Value 'TextColor' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam4' -Value 'DesiredColor' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam5' -Value 'Client-Type' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam6' -Value 'EnableIPCSessionControl' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam7' -Value 'IconIndex' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam8' -Value 'IconPath' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam9' -Value 'TransportDriver' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam10' -Value 'DesiredHRes' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam11' -Value 'DesiredVRes' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam12' -Value 'ScalingMode' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam13' -Value 'TWIMode' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam14' -Value 'ConnectionBar' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam15' -Value 'RTWIMode' -Type String
Set-ItemProperty -Path $path -Name 'disableCheckForTrustedLaunchers' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Trusted Certificates'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Intune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Enable ICA File Signing
# State: Enabled
# Supported on: ADMX Migrator encountered a policy that does not have a supportedOn value.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Trusted Certificates: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing' -Name 'version' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing' -Name 'enabled' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam1' -Expected 'Border' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam2' -Expected 'BackgroundColor' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam3' -Expected 'TextColor' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam4' -Expected 'DesiredColor' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam5' -Expected 'Client-Type' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam6' -Expected 'EnableIPCSessionControl' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam7' -Expected 'IconIndex' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam8' -Expected 'IconPath' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam9' -Expected 'TransportDriver' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam10' -Expected 'DesiredHRes' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam11' -Expected 'DesiredVRes' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam12' -Expected 'ScalingMode' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam13' -Expected 'TWIMode' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam14' -Expected 'ConnectionBar' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam15' -Expected 'RTWIMode' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'disableCheckForTrustedLaunchers' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing' -Name 'promptUser' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing' -Name 'disableCheckForTrustedLaunchers' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Enable ICA File Signing
# State: Enabled
# Supported on: ADMX Migrator encountered a policy that does not have a supportedOn value.
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'version' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'enabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'promptUser' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'disableCheckForTrustedLaunchers' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'citrixparam1' -Value 'Border' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam2' -Value 'BackgroundColor' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam3' -Value 'TextColor' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam4' -Value 'DesiredColor' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam5' -Value 'Client-Type' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam6' -Value 'EnableIPCSessionControl' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam7' -Value 'IconIndex' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam8' -Value 'IconPath' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam9' -Value 'TransportDriver' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam10' -Value 'DesiredHRes' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam11' -Value 'DesiredVRes' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam12' -Value 'ScalingMode' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam13' -Value 'TWIMode' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam14' -Value 'ConnectionBar' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam15' -Value 'RTWIMode' -Type String
Set-ItemProperty -Path $path -Name 'disableCheckForTrustedLaunchers' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Trusted Certificates'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.SCCM scripts
# Exported from gporais.com
# Policy: Enable ICA File Signing
# State: Enabled
# Supported on: ADMX Migrator encountered a policy that does not have a supportedOn value.
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Enable ICA File Signing
# State: Enabled
# Supported on: ADMX Migrator encountered a policy that does not have a supportedOn value.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Trusted Certificates: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing' -Name 'version' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing' -Name 'enabled' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam1' -Expected 'Border' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam2' -Expected 'BackgroundColor' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam3' -Expected 'TextColor' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam4' -Expected 'DesiredColor' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam5' -Expected 'Client-Type' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam6' -Expected 'EnableIPCSessionControl' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam7' -Expected 'IconIndex' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam8' -Expected 'IconPath' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam9' -Expected 'TransportDriver' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam10' -Expected 'DesiredHRes' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam11' -Expected 'DesiredVRes' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam12' -Expected 'ScalingMode' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam13' -Expected 'TWIMode' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam14' -Expected 'ConnectionBar' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'citrixparam15' -Expected 'RTWIMode' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters' -Name 'disableCheckForTrustedLaunchers' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing' -Name 'promptUser' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing' -Name 'disableCheckForTrustedLaunchers' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Enable ICA File Signing
# State: Enabled
# Supported on: ADMX Migrator encountered a policy that does not have a supportedOn value.
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'version' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'enabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'promptUser' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'disableCheckForTrustedLaunchers' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Unsigned Parameters'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'citrixparam1' -Value 'Border' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam2' -Value 'BackgroundColor' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam3' -Value 'TextColor' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam4' -Value 'DesiredColor' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam5' -Value 'Client-Type' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam6' -Value 'EnableIPCSessionControl' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam7' -Value 'IconIndex' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam8' -Value 'IconPath' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam9' -Value 'TransportDriver' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam10' -Value 'DesiredHRes' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam11' -Value 'DesiredVRes' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam12' -Value 'ScalingMode' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam13' -Value 'TWIMode' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam14' -Value 'ConnectionBar' -Type String
Set-ItemProperty -Path $path -Name 'citrixparam15' -Value 'RTWIMode' -Type String
Set-ItemProperty -Path $path -Name 'disableCheckForTrustedLaunchers' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\ICA File Signing\Trusted Certificates'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.