I have a XenApp 5 farm, running under Win2k8 server. Sometimes a user's session will "hang", and when they attempt to connect to CITRIX after that, they'll see the standard authentication error "your smart card is blocked".
If the user sees this on their Win7 desktop login, it means they have to go to an administrator to get their card un-blocked. However, in the scenario described above, they can still use their smart card fine, and after clearing their "hung" session, can log into CITRIX again fine as well.
Any reason the remote connection to Windows would be telling the user their smart card is blocked, when it really isn't?