A Citrix Administrator gives permissions to team members to access their own admin partition. One member cannot use aaad.debug from the CLI, despite full permissions on the partition. What could be the cause?

• A. The team member is NOT using the CLI correctly.
• B. The team member needs to troubleshoot the issue from the GUI.
• C. The team member does NOT have shell access by design.
• D. The team member does NOT have permission to use the CLI.

Answer: (C)

In Citrix, being allowed to access and operate inside an admin partition is separate from having access to the system’s shell (the CLI). Some actions, especially debug or low-level commands like aaad.debug, run in the shell and require shell access. Even with full partition permissions, a user can be blocked from the CLI if they don’t have shell access by design. That’s why the command won’t run for this team member—their role doesn’t include shell access, not because they lack partition permissions or because there’s a CLI usage error.

So the root cause is the design-level lack of shell access for that user. If you need them to run such commands, you’d have to grant appropriate shell access (or have someone with shell privileges run the command). The issue isn’t about GUI troubleshooting or misusing the CLI; it’s about the separate shell access permission.