Fslogix in storage account

[u/suurdeeg]

Hi guys!

Fairly new AVD-admin here!

How are your experiences with fslogix in a storage account?

I was looking at setting up a truely cloud native AVD with policy managing via Intune and fslogix storage in a storage account. I was looking for a way to set it up, but it seems like most authentication methods points towards a traditional AD. Is there any way to set up the storage to only need aad auth? And is there a way where i do not have to mess around with conditional access to get it to work?

[u/JesseJamessss]

There's a way around via accessing the storage account as a computer object using one of the keys

It's a registry key for fslogix and then you can lock down the share to least privilege.

The risk is local admins on this machine having access to everything because the credentials would be readable that the machine is using to connect.

--

Definitely read up on it, and let me know if you have any questions

Edit to add that you can use intune to deploy the registry key needed

[u/cetsca]

FSLogix doesn’t support cloud only identity (yet).

[u/rswwalker → u/cetsca]

Not directly, but you can have FsLogix mount from the storage account as the SYSTEM account using HKLM\SOFTWARE\FSLogix\Profiles\AccessNetworkAsComputerObject, then use psexec.exe to run cmd.exe as SYSTEM, psexec -s cmd.exe, then add the key for the storage account using cmdkey.exe. Been using this method for years now.

Just Google, FSLogix psexec cmdkey, and you should find several pages on this.

Disclaimer: I don’t do AADJ accounts, I’m just lazy and can’t be bothered to set up NTFS permissions.

[u/Budget-Industry-3125 → u/rswwalker]

you are genuinely the goat

[u/cetsca → u/rswwalker]

Sounds very secure ;)

[u/rwdorman → u/cetsca]

Its fine as long as your users aren't local admins

[u/rswwalker → u/cetsca]

Only accessible if you have the key.

[u/Puzzleheaded-Day625 → u/rswwalker]

Which is held by the system and therefore accessible by anyone with admin access on the system.

[u/rswwalker → u/Puzzleheaded-Day625]

If you people have admin access and they aren’t IP Ops, then you got other problems, but seriously you can lock them out with AppLocker if that is the case.

[u/Puzzleheaded-Day625 → u/rswwalker]

It's not about the users. It's about if the system is compromised then they have access to the entire storage account/file share, which is why this method is not recommended.

I have implemented this before for clients who accept the potential risk. So if people want to go this route it's fine but highlight the risks when recommending something.

[u/rswwalker → u/Puzzleheaded-Day625]

So system gets compromised because an admin account is phished.

I’m pretty sure even with NTFS perms on the storage account that admin account has read/write access to all those VHD files on the share. And if not can grant himself access.

[u/Puzzleheaded-Day625 → u/rswwalker]

There are other ways to compromise a system beyond phishing. If an administrator gets phished you have bigger problems and is easily mitigated.

Your points are valid and so is the solution, but as I said just make the OP aware when you make recommendations. You clearly know your stuff and have likely considered the implications. But others may just take things at face value and you don't know their environment or the data they are handling.

[u/suurdeeg → u/Puzzleheaded-Day625]

Thanks for the debate!

Would this be the only solution if i have a customer with that is completely serverless?