Scenario: A NetScaler environment uses two-factor authentication and the second authentication method is AD. A user logs in to the environment but does NOT receive access to the resources that the…

The correct answer is C. Use the cat aaad.debug command. See the full explanation below for the reasoning.

Question

Scenario: A NetScaler environment uses two-factor authentication and the second authentication method is AD. A user logs in to the environment but does NOT receive access to the resources that the user should have access to. How can an engineer determine the AD authentication issue on the NetScaler?

Options

ACheck NSlogs.
BUse nsconmsg.
CUse the cat aaad.debug command.
DCheck the authorization configuration.

How the community answered

(18 responses)

A
11% (2)
B
6% (1)
C
78% (14)
D
6% (1)

Community Discussion

Jovan I.Jun 17, 2026

The correct answer is C, use the cat aaad.debug command. When authentication goes through but authorization is still blocking resources, the aaad.debug file is where the NetScaler AAA subsystem writes its step-by-step trace of what happened during the login sequence, including which LDAP groups got returned from AD, how they were matched against session policies, and where the chain broke. Options A and B are not useless tools in general, but ns.log gives you broad system events and nsconmsg is more useful for performance counters and real-time stats, neither of which gives you the granular per-user auth trace you need here. Option D is a reasonable thing to check eventually, but if you go straight to reviewing authorization config without first reading aaad.debug, you are guessing at the root cause instead of reading the evidence, and in a two-factor setup the aaad.debug output will tell you whether the second factor even completed and what group extraction looked like before any authorization policy was even evaluated.

Hiroshi T.Jun 20, 2026

Solid breakdown, though worth noting per the Citrix ADC AAA troubleshooting documentation that you need to confirm the AAA log level is set to DEBUG before invoking the file, otherwise aaad.debug will exist but contain only sparse output that misses the group extraction detail Jovan described.

Orla P.Jun 2, 2026

Which file streams live AAA auth events directly to your terminal screen?

Hiroshi T.Jun 14, 2026

The aaad.debug file is the go-to source for real-time authentication and authorization diagnostics on NetScaler, and running "cat /tmp/aaad.debug" (or tailing it) gives you a live trace of exactly where the LDAP/AD bind or group extraction fails. My question is, do you understand why nsconmsg and NSLogs are not the right first stop here, and what specific entries in aaad.debug would tell you whether the failure is at the bind stage versus the group membership lookup stage?

Yusuf A.Jun 26, 2026

So aaad.debug shows live AD auth attempts, right, what exactly gets logged there?

Full 1Y0-A28 Practice