Deploy Citrix Secure Access™ client for user access

Last published : Sep 03, 2026
NetScaler Gateway comes with the following plug-ins for user access:
  • Citrix Secure Access client for Windows
  • Citrix Secure Access client for Mac
When users log on to NetScaler Gateway for the first time, they download and install the Citrix Secure Access client from a webpage. Users log on by clicking the NetScaler Gateway icon in the notification area on a Windows-based computer. On a macOS X computer, users can log on from the Dock or the Applications menu. If you upgrade NetScaler Gateway to a new software version, the Citrix Secure Access client updates automatically on the user device.
Related information
VPN configuration on a NetScaler Gateway appliance

Deploy the Citrix Secure Access client by using the MSI installer package

You can deploy the Citrix Secure Access client by using a Microsoft Active Directory infrastructure or a standard third-party MSI deployment tool, such as Windows Server Update Services. If you use a tool that supports Windows Installer packages, you can deploy the packages with any tool that supports MSI files. Then, you use your deployment tool to deploy and install the software on the appropriate user devices.

Advantages of using a centralized deployment tool

  • Ability to adhere to security requirements. For example, you can install user software without enabling software installation privileges for non-administrative users.
  • Control over software versions. You can deploy an updated version of the software to all users simultaneously.
  • Scalability. A centralized deployment strategy easily scales to support more users.
  • Positive user experience. You can deploy, test, and troubleshoot installation-related issues without involving users in this process.
Citrix® recommends this option when administrative control over the installation of user software is preferred and access to user devices is readily available.
For more information, see Deploying the Citrix Secure Access client from Active Directory.

Determine which software plug-in to deploy

If your NetScaler Gateway deployment does not require any software plug-in on user devices, your deployment is considered to provide clientless access. In this scenario, users need only a Web browser to access network resources. However, certain features require the plug-in software on the user’s device.