Citrix Workspace Freezes When Launching CDK: The Real Fixes

If your service writers come in at 7:30 AM and Citrix Workspace just shows a spinning logo while CDK refuses to launch, you have ten minutes before the first customer is at the counter. Here is the order we work through, in priority of how often each one is the actual culprit.

1. Reset the Citrix Workspace cache

The single most common fix. Close Workspace from the system tray. Delete the contents of %LOCALAPPDATA%\Citrix\SelfService and %APPDATA%\ICAClient\Cache. Relaunch. About 60 percent of "frozen Citrix" tickets resolve here.

2. Check the Workspace agent version

CDK publishes a minimum supported Workspace version. If a Windows feature update silently rolled the workstation forward, or your endpoint manager pushed an unsigned Workspace build, the StoreFront handshake quietly fails. Confirm the version against CDK's published matrix and reinstall the matching MSI if it drifted.

3. Validate StoreFront DNS resolution

From an elevated PowerShell on the affected workstation: Resolve-DnsName cdkstore.yourdealer.com. If it returns nothing, or if it returns an external IP when you expect an internal one, your split-DNS is broken. Restart the DNS Client service or check the local hosts file for stale overrides from a former MSP.

4. Look at the receiver self-service log

Workspace writes to %LOCALAPPDATA%\Citrix\SelfService\Logs. Open the most recent log and search for "401" or "403". A 401 almost always means the user's domain password expired overnight. A 403 means the user is no longer in the right Active Directory group. Both are five-minute fixes once you know which it is.

5. Test from a known-good workstation

If a parts counter machine right next to the affected one launches CDK fine, you have a workstation problem, not a CDK problem. Stop chasing the vendor and start chasing the endpoint.

6. Check the proxy and SSL inspection

Many dealerships running FortiGate or Palo Alto edges have SSL inspection enabled. CDK's certificate-pinned StoreFront will silently fail when the firewall re-signs the cert. Add CDK's StoreFront FQDNs to the SSL inspection bypass list. This one bites every dealer that adds a new firewall.

7. Then call CDK

If all of the above is clean, open a P1 case with CDK and include: workstation hostname, user account, Workspace version, time of failure, and a fresh ICA file from StoreFront. You will get to a real engineer faster.

If you want this checklist run automatically every morning before staff log in, that is the kind of monitoring we put in place during onboarding.