You might se the error Access is denied when some users start a published application or desktop from XenApp.
This issue can be seen on users who are member of an extended number of groups, there is not a specific number because it depends on the current number of users on the XenApp server.
You could lower the number of groups the users is a member of, or as a workaround you can increase the Kerboros MaxTokenSize.
On your XenApp server(s) create a dword value under HKLMSystemCurrentControlSetControlLsaKerberosParameters and set the value 48000 (Decimal).
The servers must be restarted before the change will work.
