In moving a Citrix-based application from one server to another, I discovered in testing that users who were not in the local Windows Administrators group on the Citrix server were no longer able to connect to an ODBC System Data Source Name (DSN) when presented with the connection dialog box.
Though a box similar to the one below (except populated with Data Sources) did appear with all expected Data Sources present, the users received an error when selecting a Data Source and clicking OK.
Though permissions for ODBC Data Sources can be set using Group Policy, when that is done, a user would not have been able to even see the list in the Data Source Administrator.
I discovered that the NTFS permissions on the folder containing the Oracle ODBC driver (in this case, C:\oracle\product\11.2.0\client_1) had been changed not to inherit from the parent folder. As a result, the local Users group was absent from the Access Control List.
By reapplying the inheritance to the folder in question and its subfolders, I was able to restore access to the ODBC System DSN to the application users.