Configure proxy authentication
Verified with Citrix Workspace App 26.3.10 — updated on July 10, 2026
Supported on: All Citrix Workspace supported platforms
Path in the GPO console
Computer Configuration\Administrative Templates\Citrix Components\Citrix Workspace\Network routing\Proxy Description
Use this policy to control the authentication mechanisms that the client uses when connecting to a proxy server. Authenticating proxy servers can be used to monitor data traffic in large network deployments. In general, authentication is handled by the operating system but in some scenarios, the user may be provided with a specific user name and password. To prevent the user from being specifically prompted for these credentials, clear the "Prompt user for credentials" check box. This will force the client to attempt an anonymous connection. Alternatively, you can configure the client to connect using credentials passed to it by the Web Interface server, or these can be explicitly specified via Group Policy using the "Explicit user name" and "Explicit password" options. Troubleshooting: In general NTLM proxy authentication will be performed under the control of the Domain Controller, and cannot be controlled by the client. Both client and proxy will need to be configured with the appropriate domain level trust relations. Proxy authentication cannot be linked to the pass-through authentication feature of the client. In general, the proxy password will be unrelated to user's passwords.
Registry
HKLM
Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure proxy authentication
; State: Enabled
; Supported on: All Citrix Workspace supported platforms
[HKEY_LOCAL_MACHINE\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy]
"ProxyAuthenticationPrompt"=dword:00000001
"ProxyAuthenticationBasic"=dword:00000001
"ProxyAuthenticationNTLM"=dword:00000001
"ProxyUsername"=""
"ProxyPassword"=""More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure proxy authentication
# State: Enabled
# Supported on: All Citrix Workspace supported platforms
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ProxyAuthenticationPrompt' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ProxyAuthenticationBasic' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ProxyAuthenticationNTLM' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ProxyUsername' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'ProxyPassword' -Value '' -Type StringIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure proxy authentication
# State: Enabled
# Supported on: All Citrix Workspace supported platforms
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy' -Name 'ProxyAuthenticationPrompt' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy' -Name 'ProxyAuthenticationBasic' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy' -Name 'ProxyAuthenticationNTLM' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy' -Name 'ProxyUsername' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy' -Name 'ProxyPassword' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure proxy authentication
# State: Enabled
# Supported on: All Citrix Workspace supported platforms
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ProxyAuthenticationPrompt' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ProxyAuthenticationBasic' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ProxyAuthenticationNTLM' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ProxyUsername' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'ProxyPassword' -Value '' -Type StringSCCM scripts
# Exported from gporais.com
# Policy: Configure proxy authentication
# State: Enabled
# Supported on: All Citrix Workspace supported platforms
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure proxy authentication
# State: Enabled
# Supported on: All Citrix Workspace supported platforms
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy' -Name 'ProxyAuthenticationPrompt' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy' -Name 'ProxyAuthenticationBasic' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy' -Name 'ProxyAuthenticationNTLM' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy' -Name 'ProxyUsername' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy' -Name 'ProxyPassword' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure proxy authentication
# State: Enabled
# Supported on: All Citrix Workspace supported platforms
$path = 'HKLM:\Software\Policies\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ProxyAuthenticationPrompt' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ProxyAuthenticationBasic' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ProxyAuthenticationNTLM' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ProxyUsername' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'ProxyPassword' -Value '' -Type StringBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.