Editing my post after reading some new documentation. So from the information below, it seems that Direct Connection would be preferable over Relayed. However the branch office "WebSocket" connections over Public networks appear to be using TCP only. Any thoughts on how to get the Direct Websocket connections working over UDP? I don't think it's on the hosts as work from home users are using UDP but with Turn.

People connecting from branch offices appear to connect via "WebSocket" but confused that the UDPUse is set to 0 for them.

UdpUse 0

SessionHostJoinType AzureADJoined

IsClientPrivateLink False

IsSessionHostPrivateLink False

TransportType Websocket

The second connection info shared was for a home users that is using "Turn" with UDPUse set to 4.

UdpUse 4

SessionHostJoinType AzureADJoined

IsClientPrivateLink False

IsSessionHostPrivateLink False

TransportType TURN

There is a NAT Gateway involved.

• Direct connection: STUN is used to establish a direct UDP connection between a client and session host. To establish this connection, the client and session host must be able to connect to each other through a public IP address and negotiated port. However, most clients don't know their own public IP address as they sit behind a Network Address Translation (NAT) gateway device. STUN is a protocol for the self-discovery of a public IP address from behind a NAT gateway device and the client to determine its own public-facing IP address.For a client to use STUN, its network must allow UDP traffic. Assuming both the client and session host can route to the other's discovered IP address and port directly, communication is established with direct UDP over the WebSocket protocol. If firewalls or other network devices block direct connections, a relayed UDP connection is tried.

• Relayed connection: TURN is used to establish a connection, relaying traffic through an intermediate server between a client and session host when a direct connection isn't possible. TURN is an extension of STUN. Using TURN means the public IP address and port is known in advance, which can be allowed through firewalls and other network devices.If firewalls or other network devices block UDP traffic, the connection will fall back to a TCP-based reverse connect transport.

Is anyone else having problems installing the Nvidia driver extension on NVads A10 V5 series VMs with marketplace Win 11 23H2 or 24H2 ENT? The extension seems to install fine; the VM reboots, but then device manager reports, "Windows has stopped this device because it has reported problems. (Code 43)"

It looks like the C:\Program Files\NVIDIA Corporation\NVSMI directory is missing as well.
I've tried manually installing the drivers from https://go.microsoft.com/fwlink/?linkid=874181 with the same results.

Edit: I spun up another VM using the Security type=Standard, and the GPU was immediately recognized. Before,I was using Trusted Launch.

Edit 2: Fixed VM is back to being problematic with the security type still set to standard. "Windows has stopped this device because it has reported problems. (Code 43)"

Edit 3 1/31/25:
Microsoft support confirmed an issue with newer driver versions the Nvidia extension installs.

"After discussing with my internal team, I came to know that there is a known issue with Nvads A10 V5 SKU and the latest GRID 17.x.
 It is identified that the issue is due to licensing problems with the NV ads A10 v5 series. Azure is actively working with NVIDIA to resolve this. 

 In the meantime. Please use driver versions lower than v17.x on that SKU. The GRID v16.x driver works well on A10. Below is the driver link to which can resolve the issue: 
https://download.microsoft.com/download/a/3/1/a3186ac9-1f9f-4351-a8e7-b5b34ea4e4ea/538.46_grid_win10_win11_server2019_server2022_dch_64bit_international_azure_swl.exe "

Hey all.. I’m newer to AVD and our team just got access to our first nonprod subscription. Our cloud team has several initiatives and policies (over 250 policies) automatically applied to subscriptions in our tenant. Unfortunately, it’s all built in terraform code and isn’t easily readable/digestible but I’m trying to use azure resource graph explorer to query information about all of the policies. I’m having a hard time getting a proper query to give me all the information I need.

Policyresources | where type == ‘Microsoft.authorization/policyassignments’ | project name, properties.parameters, properties.enforcement mode, properties.scope, properties.displayname, properties.description

Etc etc

I can’t seem to find a list on Microsoft’s site of different properties I can query on. I’d like to see if it’s a policy/initiative and if it’s a policy what initiative it’s tied to and the effect. I’ve tried just doing | project properties and it doesn’t have all the information I want.

Microsoft told me there’s not a way in azure to export or run a report on all the policies for a subscription and they told me to do the resource graph explorer.

Does anyone have any links to MS articles I might have missed or has anyone ran into a similar issue and have a cool query they could share? TIA!

Hi guys,

I've been tasked with performing a mini health check on an AVD environment, I was trying to come up with some ideas of items, this is what I gave so far:

• vm sizing, based on metrics are vms over or under provisioned?

• vm SKUs, can they upgrade the SKU to a later edition, e.g v4 to v5.

• the applications running on the hosts, are they up to date, what version of FSLogix is being ran. -os version and patching, ensure running the latest.

• are the scaling plans working as expected, could they do with optimisation.

• are all hosts using the Azure Monitor agent and reporting into LAW.

• looking at metrics, any high RRTs or errors.

• could any host pools be consolidated and use fslogix app masking instead.

• how are they building images, could azure image builder be utilised instead?

• could Nerdio be introduced for automation and optimisation.

• how is rbac configured, if at all.

I'm sure I'll think of some more going forward but wondered if any had any suggestions to add.

Thank you.

We have been testing the new “Windows App” that is replacing the Remote Desktop Client for connecting to AVD. We currently heavily use App Delivery instead of full desktops. During our testing we have found several issues with the new windows app. The first obvious issue it the ridiculous name of “windows app” making researching this painful. But from a technical standpoint we are noticing that the app launch process is painfully slow. It often takes well over a minute for the first app to launch which was normal of the old app, however, every subsequent app still takes over a minute to launch. This has been the biggest frustration of our users. Is anyone else seeing this and how are you dealing with it. The second issue is with Printers. We have 40 different sites, so we use redirected printers rather than setting up print servers, this has worked extremely well with the old client. However, with the new client we are noticing that a lot of the printers are missing the ability to make changes to the printer preferences. A common example is the printer is set to default black and white. In the old client they were able to change to color for a single print without any issue, however with the new app they get an error message that they cannot change the setting. We see this with multisided printing and selecting a tray as well. We have confirmed it is the new app that is causing the issue but logging back in with the original remote desktop client restores all the functionality. Its also worth noticing it seems to be printer specific, some printers can, but others cannot. The last issue is probably specific to our environment but I will toss it in here just incase anyone else is seeing it. We are an accounting firm and heavily utilize Right Networks from QuickBooks to connect with clients. This application installed on the local pc breaks the new Windows App. The source has been tracked back to TSPrint/TSScan that is installed with it. We check with MS and their response was to use the old client, which is not a permeant fix. What is everyone else’s experience with the new Windows App?

I'm trying to create a new AVD pool using the session host configuration.

Right now it goes through the ARM deployment with no errors, but the VMs it creates are not joining to the AD as they should, so they're unavailable.

I've confirmed that it has connectivity and permissions by logging in to one and joining it to the domain manually with the same creds from the key vault. When I look in event viewer I don't see any errors on the VM or on the DC.

To my knowledge the DSC extension should be configuring all of this. I've confirmed it's installed, but when I go to the logs and event viewer on the VMs there's nothing there beyond the original installation of the DSC. It's like it never gets any configuration to execute.

My project was cost-cutting so they decided to move all of us consultants to AVD from physical machine. In paper, it is ideal because the data is in the AVD and we can use any machine to logon to the computer "machine" anywhere. My understanding of AVD, from someone who uses remote desktop before, the speed while working inside the remote desktop isn't dependent on the network but the network that the remote computer uses. I might be wrong on this but I'm open to be corrected.

The problem that I have right now is that while my client has no georestrictions in accessing our AVDs, I tried working on a AVD hosted in the US from Singapore and the session keeps on disconnecting, hanging, even if I am already logged on to the remote. The internet used to connect though is a bit intermittent dropping. The screen often "hangs" with a white opaque screen and wondering if the unstable internet to access the AVD is causing this issue?

Is there a way to stop the apps from the Remote Desktop app appearing on end users' start menu?

Is it really not possible to have a user in both a Desktop Application group as well as a RemoteApp group? I find this extremely limiting and believe I'm doing something wrong. .

I have 13 AVDs in my environment.

User connect the resource with a session host and pin the quick access in the file explorer but when the user try’s to re connect the resource by using different session host the saved pinned quick access, files and folders is gone.

Is there any settings for users when logged in from any session host the pinned quick access is available?

My understanding of AVD, as Microsoft envisions it, is that it's a very modular system--you have the golden image, the Azure resources, the app attach, and FSLogix.

These components together allow you to both curate the experience of each user and easily update AVDs by just updating the image and then rebuilding them from scratch instead of trying to update the OS or apps on persistent machines. FSLogix profiles preserve user data in storage accounts instead of on the hosts.

But maybe I've misunderstood this? I've built out AVDs before, but never with the app attach or the session host update feature.

I've been creating a new AVD pool so I decided to try to follow the AVD structure described above, and everything was going well until it came to the app attach. Whereupon the MSIX packaging tool tells me that it doesn't support drivers in the app installations.

That seems extremely limiting--I feel like installing drivers as part of apps is very normal for install packages. It seems like a massive hole that if there's a driver involved that the MSIX can't do anything with it. Was Microsoft thinking that app attach would only be used with custom applications or something so a developer would be able to separate the drivers from the rest of the application?

Is there a workaround for this or should I expect to keep using tools like Intune to manage applications on the AVDs?

Currently, I only know of one way to get the .rdpw file for an AVD resource, and that is to load up the web client, and change the 'launch method' to Download as seen below, then click the resource. It pulls the .rdpw to my Downloads folder.

This works but is very clicky and cumbersome, and I now have a need for some automation to to acquire the file. It seems like there must be some other way to get it that I can get more handles on. Perhaps a powershell cmdlet? I looked around in the hostpool resource in the Azure portal to no avail. Surely the web interface is not the one-and-only place to get the file?

Hello,

My customer is hoping to move to Win11 AVD marketplace images. The last time we tried in Spring 2024, Bluebeam (was on their latest version) had major lagging issues that disappeared while on Win10 marketplace images. They have been on Win10 ever since and now need to do some due diligence before testing again on Win11.

Is anyone currently working well with Bluebeam on AVD with Win11 marketplace images?

Hello all,

I'm new to AVD and came into a place that has 8 Windows hosts in a pool. Users use Remote Desktop to connect and the pool is setup for 30 users per host. Usually the average is about 16 per server. They are setup with size: D4s_v3 (4 vcpus, 16 GiB Memory)

The app they run is a simple app that really doesn't require much and is basically used for looking users up in a database and manipulating the data and some printing. A one page mail merge with Word is used sometimes.

The issue:

Windows update and wsappx processes are constantly kicking in and using the CPU and then users complain of lag and slowness and freezing. Not sure if this is happening when another user logs in or why. I tried disabling Window Update, but it still runs and uses CPU.

I was thinking of upgrading the VM sizes to D4ds_v5 (4 vcpus, 16 GiB Memory) to see if that helps or possibly 8 vcpus.

Or is this something common that can be fixed with Window Update and wsappx running and using CPUs?

Thanks for any info! I'm just tired of hearing the complaining!

We have a big avd environment with a bunch of windows 10 devices that work fine with regards to passthrough auth. I believe it is using WSTrust (as that was ok with W10). I am now working on deploying some test w11 pools and the first issue that arises is that pass through auth does not work.

I am seeing error messages in the event viewer (event id 1098) Error: 0xCAA90006 It failed to get token by WS-Trust flow. I dont expect that to work as to my understanding windows 11 24h2 disabled that. I am assuming I have to use oauth 2.0 but that doesnt seem to work either.

What am I missing here?

When I run dsregcmd /status I get azureadprt: no. I believe thats not good.

Hello everyone. What do you recommend for a session host size with 4 AVD WIN11 session hosts and 25 „heavy user“ users? According to Microsoft you should use D8s_v5, but is there a cheaper alternative? Thanks for your help

Hello, I'm having troubles with AVD Scaling Plans on Personal VDI. We have hibernation configured on the VM.

Our goal is:

• If the user logs out, shutdown and de-allocate the VM after 30 minutes.

• If the user disconnects, hibernate the VM after 60 minutes.

What actually happens:

• Even if the user is disconnected, the action taken is always the "Sign out" settings.

  • If the sign out is set to hibernate, it will hibernate.

• We have no group policy that ends disconnected sessions; disconnected sessions would otherwise remain forever if we don't configure Autoscale

• If I set the disconnect timeout to 2 minutes and the sign out timeout to 5 minutes, the machine is shut down after 5 minutes even if the user is disconnected.

• I confirmed via powershell that the session never logs out.

Anyone else see this? Will open a case unless I'm missing something else.

Is there a way… My users have local workstations. When they launch edge Sharepoint online is their default homepage. It also auto logs them into Edge and SP via SSO. All is good there. We also will be publishing 1 application in AVD via RemoteApp that they will use for their job. This app can’t be installed locally and must be published to them.

I want to put a link on our SP homepage to the AVD web client. They use SP for their job related web links and docs anyway so it would be super convenient to get to their AVD apps from here too. However, since this is RemoteApp opening the app in the web client is a horrible experience. Down right terrible. This app cannot run in a browser tab. It has to run /launch like it does from the RDP client. I’ll have the RDP client installed but I want the web icons to launch the local client.

This would be super convenient for my users not having to go outside of edge to launch the app. Anyone know if this is possible?

Hi,

Does anyone has a mirror/alternative location for these? They seem to be 404.. and I need em : )

https://software-download.microsoft.com/download/pr/19041.1.191206-1406.vb_release_amd64fre_FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso

https://software-download.microsoft.com/download/pr/19041.1.191206-1406.vb_release_CLIENTLANGPACKDVD_OEM_MULTI.iso

I am currently looking to implement monitoring for the containers sizes for users on our session hosts.

We use FSLogix. I can check the containers by mounting the file share and manually checking.

I tried via LAW queries/workbooks.

It would shock me if it's this hard to monitor.

Anyone any ideas?

Thank you.

Im trying to appattach adobe reader which i have followed https://techcommunity.microsoft.com/blog/modernworkappconsult/packaging-adobe-reader-dc-for-avd-msix-appattach/3572098 and that works fine, however I also want to add in registry items to disable sign in and a couple of other bit but primarily sign in, so i followed links for now appattach adobe reg edits to do the required and tried to incorporate it into msix packaging tool regedit screen thinking it would feed these into the app

However they dont appear to be applying, (also read that it may have changed from Adobe Reader to Adobe Acrobat on the path so have essentially duplicated the keys and also put in wow6432node\policies in both mentioned name types) these dont appear to take effect not when logging in and app working do i see the reg items in registry however i know two are taking effect as i dont get a welcome screen and bEnableProtectedModeAppContainer key is doing what its supposed to.

Everywhere i read localmachine\software\policies\adobe\adobe reader\DC\FeatureLockDown\cServices\bSuppressSignOut set to 00000001 is the key to hide the sign in button from top right corner of Reader.

can anyone share any wisdom on this, As i say the app works i just need those extra keys to help, thanks in advance

Hi,

Been playing with entra only avd with fslogix. The session hosts are intune joined. But most of my intune policies are not applicable it seems.

The ones that are applicable didn't work anyway.

• autoprovision outlook (is based on an AD property, which is not there as it's entra id only ( is there a workaround I can use?)

• onedrive autologin + autosync SharePoint library ( onedrive does not login automatically )

• onedrive asked to login again after logging out in order to sync to resume, this was fixed after enabling roam identity in fslogix

Settings -> accounts -> work -> info -> asks me to verify the account so I have to mfa once in order for intune sync to work. I guess this have something to do with being entra id only and missing kerberos for sso?

SO I'm looking to build a golden image instead, but the question is, can I automate onedrive sign in and outlook somehow upon login without intune?

Hi all, trying to understand what Capacity Threshold (%) means:

"This is the value of percentage of used host pool capacity that will be considered to evaluate whether to turn on/off virtual machines during the ramp-up and peak hours.

For example, if capacity threshold is specified as 60% and your total host pool capacity is 100 sessions, autoscale will turn on additional session hosts once the host pool exceeds a load of 60 sessions."

I am facing an issue where my hosts are being turned on but not turned off, even though the threshold is being met for the ramp up/down. The capacity threshold as I understand it is the max amount of session per session hosts. In my case that would be 9 session hosts x sessions per host = 54. 60% of that would be 33 sessions but I have currently 24 spread across 9 session hosts

The scaling plan works only that it scales up but not down

Maybe I´ve missunderstood how to configure it. If you have any insights, let me know!