To access SBU, users must authenticate and maintain:  

• A valid, unexpired common access card (CAC)
• A functional and approved card reader that recognizes their CAC
• The latest Department of Defense (DoD) root certificates 
• The latest version of Citrix Workspace for the operating system (OS) of their personal device
• The .ICA filetype associated with the required software in the OS

Note: The Remote Access team cannot assist users unless these prerequisites have been met. Remote Access support is limited. Therefore, its team members have no purview or insight over personal device configurations and/or local network settings. 

To authenticate with your CAC, it must first be affiliated with your User account in Active Directory. This is typically an automated process via the Universal Login Reader Tool (ULRT), when logging into physical SBU terminal.

Note: If you are unable to visit a location with an SBU terminal to complete this process, utilize the “CAC LEAP” instructions

• New employee that has not authenticated to SBU with issued CAC
• Issued a new CAC due to change of employee type (gov or contractor) or issued by a different agency

Note: If you are able to authenticate successfully at an SBU terminal on-site, your CAC is likely associated with your account

Your PIV number should be 16 digits long. This includes a DODID number followed by 6 digits. Please reference the “CAC LEAP” documentation to obtain the PIV information from your CAC. If you cannot locate your PIV information, refer to your local certificates store.

1. Check the expiration date on your physical CAC
2. Navigate to the Control Panel > Internet Options > “Content” Tab > Certificates
3. Validate the expiration date of your certificates

• SCM SCR3310v2 
• Belkin F1DN005U

Note: The NGA PITD office currently issues the Belkin F1DN005U.

To request or replace (NGA-issued) card readers, please contact the ESC to submit a request to the PITD Office.

If you aren’t prompted for a CAC pin when accessing a mydesktop site, this typically means your CAC isn’t being recognized by the card reader. This issue can be related to the card reader or the operating system.
Users will often be routed to a page requesting their Username/Password/RSA token. Additionally, users may experience errors when attempting to access other public key infrastructure (PKI) protected resources that are not managed by Remote Access such as RocketChat . For more information, please refer to the “Card Reader Troubleshooting” documentation.

You will need to install and maintain:

• The most recent version of Citrix Workspace (applicable to your OS) from the Citrix website
• The most recent version of InstallRoot from the DoD Cyber Exchange Public website or militarycac.com 

Citrix Workspace is the client-side software that allows you to interact with the virtual desktop infrastructure (VDI) desktop. It is required to open the .ICA file that is downloaded when you launch your assigned desktop from StoreFront.

Please see the “Citrix Workspace Client” documentation for installation steps.

Note: If you have Citrix Receiver installed, you must uninstall it prior to installing Citrix Workspace.

• Navigate to Control Panel > Programs and Features
• Applications are listed alphabetically, either  “Citrix Workspace” or “Citrix Receiver”  (deprecated) will appear
• The latest versions can be found at: https://www.citrix.com/downloads/workspace-app  

When you click the desktop at Citrix StoreFront, an .ica file is downloaded. You may either notice this in your browser downloads or toward the bottoms of the browser window. Depending on your browser configuration, this file may not open automatically. Be sure to validate that .ica files have a default app associated with “Citrix Connection Manager” in your OS. Please reference the “Citrix Workspace Client” document for assistance with these configurations.

InstallRoot automates the installation of DoD certificates on your personal device, and establishes the necessary certificate chain of trust so you can reach the mydesktop sites.

Please reference the “InstallRoot” documentation. Install Root 5.5 can be found at: https://public.cyber.mil/pki-pke/tools-configuration-files/  or : https://militarycac.com/dodcerts.htm 

Please reference vendor documentation for your OS.

Note: If you are utilizing a company-issued device, you may require administrative privileges. Please consult your company IT support.

Main: https://mydesktop.nga.mil/ 
St. Louis: https://mydesktopwest.nga.mil/ 

Call the ESC to validate that your account isn’t locked out or that you have a hung session.

Your CAC isn’t being recognized by the card reader. Please refer to the “Card Reader Troubleshooting” documentation for additional assistance.

Please consult your Internet Service Provider.

• Workforce Support Center – East  571-557-1111 | WorkforceSupportCenterEast@nga.mil
• Workforce Support Center – West 314-676-9151 | WorkForceSupportCtrW@nga.mil