SAFE PIV Login Instructions for Windows PC

Secure Access for Employees (SAFE) Requirements for Personal Computers

  • Operating Systems: Windows 7 or newer
  • Antivirus:  Symantec Endpoint v12 or newer
  • Internet Browsers: Internet Explorer 10 or newer (Edge is NOT supported.)
  • A PIV card reader

NOTE: Your PIV card/FTC Badge must be in the smart card reader to access the SAFE PIV page.


Install Citrix Access Client

1.    Install Citrix Receiver by going to and clicking the Download link. (Version will be whatever is the latest.)

2.    On the download screen, select  “Run.”

3.    On the Welcome screen, Select “Start.”

4.    Accept the license agreement, then click “Install.”

5.    At “Install Successful,” click on “Finish.”

Log into SAFE with PIV using Virtual Desktop Instance (VDI)

1.    Insert your PIV Card/FTC Badge into an external smart card reader slot from your PC. Windows 10 will recognize and install your credentials.

2.    Launch Internet Explorer (NOT Edge) from your PC and go to

3.    Select “Log in to SAFE with PIV.”

4.    Citrix will run a system check.

5.    IGNORE the message to download software.

6.    NOTE: If a CITRIX Scan permission request pops up click “Always.” This may only pop up for first time users.

7.    If the check seems to be “stuck,” hover your cursor over the browser icon in your taskbar. You will probably see the next screen hiding underneath.

8.    The browser will be directed to the Pre-Authentication page.

9.    Select “More choices.” There may be different names if you share the computer with another PIV user.

10.    Highlight the second option and click “OK.”

11.    When the ActivClient Login window appears, enter in your eight (8) digit PIN number and Click OK.

12.    The Post Authentication scan will run.

13.    The Citrix StoreFront page will be displayed.

14.    Click on “DESKTOPS” on the Citrix StoreFront page.

15.    On the DESKTOPS page, click the Win7-ST2 Icon

16.    A login Page will be displayed with the US Government Computer System message. Click OK

17.    Once at the Windows Login Page click Switch User

18.    On the Select Login page click <username> (affiliate) Smart card login Icon

19.    Once the Smart Card Login page appears, enter your PIV PIN in the PIN field and click the Arrow to log in.

20.    The VDI Desktop will appear upon successful login.

Testing SAFE Access to FTC Resources with VDI

Execute the following Steps to verify FTC Resource Access

1)    Access to FTC File Shares

2)    Click on the “My Computer” icon

3)    Verify all drives are accessible

4)    Start MS-Outlook and verify Exchange is accessible

a)    Start -> MS Outlook 2010

b)    Once Outlook is started verify that it is connected to exchange by looking at the bottom of the outlook window for “Connected to Microsoft Exchange.”

5)    Verify access to Intranet and Applications

a)    Open any Browser

b)    In the browser, access the FTC Intranet page


Access Denied Error

If you should get the error Access is Denied. Extraction from Client SSL Certificate failed:

1)    Remove your PIV card

2)    Close and reopen your browser and start the log-in process again.

If you still get the error,

Citrix Receiver may be out of date. Go back to page one and download the latest version.

You may also want to remove the stored certificates

1)    Open Internet Explorer.

2)    Click on the Gear icon (tools) near the top right corner of the window

3)    Click on the Content tab

4)    Select “Certificates.”

5)    Remove all certificates you see. (Say “Yes” to the message.)

6)    OK, OK, then close browser.