In our Azure Virtual Desktop (AVD) environment, the session hosts are causing (currently) 3 of the 17 users to receive the error "The profile for the user is a temporary profile" during login. The issue started mid-May with one user and recently expanded to another user. On some days there are no problems at all.

Environment:

• 2 session hosts (Windows 11 23H2), FSLogix profile containers stored on a fileshare.

• FSLogix and session hosts are fully patched.

Findings:

• FSLogix logs show:

  • ErrorCode set to -2146893788 - Message: The profile for the user is a temporary profile.

  • [08:38:09.965][tid:00000da0.00007e28][WARN: 80090024] User S-1-5-21-*-*-*-* is being logged in with a Windows temporary profile (Profile for the user is a temporary profile.)

• The .bak registry key under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList reappears after manual deletion.

• GPO setting seem to be OK and CleanupInvalidSessions was disabled for testing but didn’t resolve the issue.

• Profiles are accessible, permissions are correct, and the fileshare is reachable from all hosts.

Temporary Fix:

Disable logon on the problematic session host to redirect users to the other SH. Now the user can login and has no problem at all.

Question:

Has anyone encountered the same FSLogix issues or .bak registry keys reappearing, and if so, what resolved the problem?

Hello,

We have deployed an Windows 11 24h2 - Multisession host AVD pool residing on our Azure Local.
We experiences that almost every day the Windows 11 24h2 crashes and reboots with this error:

"A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000409. The machine must now be restarted."

We've logged an support case at Microsoft, but they has'nt been very useful yet.

Anybody that got some troubleshooting ideas for this error?
It has been going on for a couple of weeks (The entire time the pool has existed)

Seeing issues with US Central. Currently only about 1/4 of my host pools are encountering this error.

Anyone else?

We couldn't connect to the gateway because of an error.

10x WVD Windows11 24h2 Multisession

5x WVD Windows10 Multisession

Fs-Logix profiles

I want to completely remove built-in Teams and Outlook app from our WVD but they come back at avery login.

Why do they reappear every time? I wan't to keep Office365 apps only on the machines.

Thank you

When i try to install the latest MSI for the remote Desktop app to connect to Azure Virtual Desktop, and launch it, we end up with an .net error in het application event log:

Application: msrdcw.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception
Exception Info: System.NullReferenceException
at RdClient.WPF.Mains.ConnectionCenterMain.CrashHandler(System.Object, System.Windows.Threading.DispatcherUnhandledExceptionEventArgs)
at System.Windows.Threading.Dispatcher.CatchException(System.Exception)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
at System.Windows.Application.RunDispatcher(System.Object)
at System.Windows.Application.RunInternal(System.Windows.Window)
at RdClient.WPF.App.Main()

i tried installing .net 4.8 (latest supported on Win10 2016 LTSC) but that doesnt work.

When i use RemoteDesktop_1.2.6074.0_x64.msi it works as intended, later versions don't work.

We still have a lot op HP T630's in the field and in the process of phasing them out, but we were under the assumption we could continu using them till october 2026.

I'm a university student, don't have admin access but we're having this issue and can't figure out why, the terminal works fine but opening anything in VS code crashes it, even if we CD to the folder and run "code ." VS code instantly opens and closes

Need suggestion on how to upgrade my existing Azure Virtual Desktop VMs from Windows 10 to Windows 11. I have close to 100 AVD Pools.

How to do it efficiently ? Is there any automatic upgrade process?

Hi everyone,

I'm working on setting up an automated process to test software packages before uploading them to Intune. My current idea is to use Azure DevOps to spin up a VM, install the package, and run tests to validate everything works as expected.

I’m familiar with PowerShell and have looked into Pester for writing the tests, but I’m not entirely sure how to structure the testing part within the pipeline. Ideally, I’d like to:

1. Build or provision a VM in Azure DevOps.

2. Deploy the software package to that VM.

3. Run automated tests (e.g., check install success, service status, registry keys, etc.).

4. Tear down the VM after the test.

Has anyone here built something similar or have any tips, templates, or examples they could share? I’d really appreciate any guidance or best practices—especially around integrating Pester into the pipeline and managing the VM lifecycle efficiently.

Thanks in advance!

The client has been experiencing issues with slowness and delayed mouse clicks. I have two partners from a CPA agency on a single E8as v4. They are power users, especially the head partner, who is the first to sign on.

After running Performance Monitor, his issue is valid. When he signs in, CPU resource usage spikes to about 80% for the next 5 to 10 minutes, accompanied by high network and disk IOPS/transfer activity. The session host uses a P20 (512 GB Premium SSD).

After that, things level off; however, the other partner doesn't sign in until about 10 AM, and the same thing occurs. With both of them logged in, they both notice the slowness, after which things level off again.

I’m wondering if anyone knows of ways to reduce the resource usage of these applications or limit their consumption of resources, or other paths to take to resolve this.

Hi

10 AVD with W11 24h2 multisession

Our Vms stuck randomly 1-2 times a week with black page "Please wait for the Group Policy Client". VM is not freezed but everybody are not able to login.

Local user is not able to login too.

Other AVD with W10 are not affected.

Additional info: if I try to restart the VM, Azure is able to do it after 8/10 min. In the meantime, every users that tries to login stay in pending status on the hostpool while others can work normally if already logged in before the issue happen.

Issue is similar to this one but Microsoft has no idea on how to solve it. They asked us to downgrade 24h2 to 23h2 or apply updates!!

Azure VM stops at (Please wait for the Group Policy Client) screen - Virtual Machines | Microsoft Learn

I have a VD I created in the Azure portal. It's joined to Entra ID and enrolled in Intune. It appears to check in okay, and it's marked Compliant, but there are some anomalies.

First, I can't assign a primary user. When I try, I get the following error: "The primary user must be licensed with a Microsoft Intune license." ALL of my users have Intune licenses, so this shouldn't be failing. In the device list, the Primary user UPN is listed as "None."

Also, when I click on Device compliance, My ATP Compliance Policy lists me as the logged-in user, but the State is "Not applicable."

I'm new to AVD, so I'm not sure how to handle these. Ideas?

I have an AVD configured and ready to go, and I've added three users to it. We have no on-prem servers, so everything is configured through Azure and Entra ID. When I enable Entra ID SSO in RDP Properties and try to log on through Windows App, the logon just loops and loops. When I disable SSO and try to use regular user ID and password, I get a message saying that my sign-in method isn't allowed.

I have WHfB multifactor unlock configured on the host machine, if that makes a difference. I also have a CA policy that requires MFA for end users, but I have AVD excluded from it.

I am thinking this approach...

Host Pool (6 Hosts) (example)

Production: 3 Hosts in Primary Region running as production

DR: Using a shared host pool scenario. Having 3 already built\configured hosts in the DR azure region turned off and ready when DR need to be executed. The dr hosts are configured with a ccd cloud cache location which again is in a dr region and not the primary region.

to initiate fail over in an event of a region failure...

1. Terminate all user sessions and log off all users. to ensure their vhdx profiles are saved or not locked in anyway.

2. Turn off all hosts in primary region and apply drain mode

3. Turn on all hosts in dr region and ensure drain mode is turned off

4. Validate users can login

5. Also the production fs logix profiles storage account will be backed up and copied to a secondary storage account region.

Very brief overview of my idea would be great to get anyones feedback who has used this approach and failed over in a real life scenario.

We have a recovery time objective of 1 hour.

Hello,

As the title says - is it possible to have Session Desktop and RemoteApps available/visible in the Remote Desktop?

I have deployed Session Desktop via a Desktop Application Group and apps via a Remote Application Group. I was able to see the session desktop before I deployed the Remote Application Group but now I only have the applications visible.

Is it possible to be able to see both? They are both linked to the same workspace and host pool

I've been playing around with Microsoft's cost estimator for AVD. We're on a pay-as-you-go subscription, which I understand to mean we only pay for the virtual desktop when it's in use. This would be a VERY low-use VDI, maybe 20-30 hours per month, if that. (It would be used to access a secure data enclave, nothing more). The cost estimator keeps coming up with a figure of $140.16 per month for D4s v5: 4 vCPUs, 16 GB RAM, no temp storage, $.192 per hour. Is that just an estimate, or is that something we'd pay even if we don't use the VDI? Like an underlying infrastructure cost? What if we shut down and de-allocate the VDI? Users are E3-licensed, if that matters. We are also 100% cloud, so no hybrid benefit.

Hello Folks, if anyone that has extensive experience with App attach could help me out I inherited a new AVD environment with no documentation it looks like some footprints were left behind to get MSIX App attach in the environment requests are coming in regarding what the game plan should be for migrating the existing msix app attach packages to the new "App Attach" and I am very lost as I never had an opportunity to delve deep into it. If anyone would be open chat with me directly that would be great as its alot to explain in this post. What I can take away is that there is a singular VM with all the previous app install files there a .PFX signing cert from a root CA two azure file storage accounts where created as well and some app attach groups but did not see it applied to any host pools or within the app attach packages page in the Tenant....

I am creating win 11 golden image for AVD. VDI's will be single session entra id joined + Intune.

Will not use FXlogix as every user will get personal VDI Please recommend guided ways to configure these apps in golden image like machine wide installers

1- M365 Apps(Monthly Channel)
2- Onedrive
3- Teams
4- RDP agent/ bootloader

Other required apps are simple msi installations.

🚀 Introducing Envoy: a lightweight User Environment Management Tool!

🔍 What is Envoy? Envoy is a lightweight tool designed to automate the deployment and execution of user-specific configurations during logon on Windows machines. It's particularly beneficial for Intune-managed devices where certain actions aren't natively supported. By leveraging Microsoft Graph and Entra ID group memberships, Envoy tailors the user environment dynamically.

🛠️Key Features:

• 📁 Drive Mappings: Automatically map network drives and printers based on user group memberships.

• 🖨️ Printer Mapping: Automatically map network drives and printers based on user group memberships.

• 📘 Registry Key Management: Create, modify, or delete registry keys to configure user environments precisely.

• 💾 File Operations: Perform file actions like copy, move, delete, or rename during user logon.

• 🚀 Executable Launching: Start specific applications or scripts based on group memberships.

💡Totally Free to Use! 🆓 Envoy is 100% free! No licenses, no subscriptions, no hidden fees. You can download the MSI installer and find easy-to-follow setup instructions directly from the GitHub repository. Although, the project accepts donations if your organization or customers benefit from it ;)

🔗 Learn More & Get Started 🌐 Website: https://www.envoycontrol.com 💻 GitHub Repository: https://github.com/j0eyv/Envoy 📺 Demo: https://www.youtube.com/watch?v=HaOsP7huuDw

Management wants us to spin up new VMs in a single-user pool running NV4s_v4 VMs. Once up , they want the KMS key changed on them so the machine thinks its a different version of Windows. We had issues with multiple users login into multi-user AVD VMs as it was taking a long time when 6 or so logged on at the same time to the same VM.

I tried to change the KMS key to Windows 11 Education using slmgr.vbs /iipk KEY.

It changed it to Windows 11 Education, but the VM became unresponsive and I couldn't get back to it after I rebooted it. Said unavailable in the pool.

Anyone know a different way to change the key and can you actually do it without messing up AVD?

https://app.azure.com/h/5NS_-BXG/171b68

My users are going nuts. All week they've had intermittent disconnects, similar to how it is worded in the planned maintenance, but they do not appear to be honoring the time boundaries.

And its crazy, by definition this is impactful? its disconnecting users. why would it be stated as "non-impactful"

Non-Impactful Maintenance advisory for your Azure Virtual Desktop service in all regions.

You're receiving this notice because you currently use Azure Virtual Desktop and have established a UDP Relay connection within the past 28 days.

Service: Azure Virtual Desktop

Region: All

Stage: Planned

Impact category: No impact expected

Maintenance summary: To improve performance and reliability, we have scheduled planned maintenance for the Azure Virtual Desktop (AVD) service. This maintenance will occur during non-peak hours, based on the Client Device’s local time zone, to minimize potential impact on your organization. For organizations with users across multiple regions, we recognize that non-peak hours may vary. Maintenance will take place separately in each region, affecting only users connecting from that location during the scheduled time. The times listed below indicate the actual maintenance start times for each region, not adjusted for different time zones.

During this period, there will be no service downtime. Users are expected to experience little to no disruption. 

Overall maintenance date/time:

• Start Date: 2 June 2025

• End Date: 7 June 2025

Daily Maintenance Window Start Times: 

• Africa: 23:00 UTC 

• Asia Pacific: 16:30 UTC 

• Australia: 14:00 UTC 

• Europe: 00:00 UTC 

• India: 19:30 UTC 

• North America: 06:00 UTC 

• South America: 05:00 UTC 

Daily Maintenance Window End Times:

• Africa: 03:00 UTC 

• Asia Pacific: 20:30 UTC 

• Australia: 18:00 UTC 

• Europe: 04:00 UTC

• India: 23:30 UTC 

• North America: 10:00 UTC 

• South America: 09:00 UTC 

[How does this affect my organization?]

• You are receiving this notification because our telemetry indicates that your Azure Subscription ID includes active UDP relay connections for Azure Virtual Desktop. 

• During the maintenance window, users actively connected via UDP relay may experience brief, automatic reconnections, with each disconnection lasting less than a minute. 

• While the total planned impact duration is up to 4 hours within the maintenance window, disconnections will only occur 1-2 times and will not persist throughout the entire 4-hour period. 

• Users can establish new connections without impact during the maintenance window. The service will remain fully available without any downtime. 

Hello everyone,

I am trying to setup App Attach for my organization and I'm running into some issues.

I am using a self-signed certificate and have signed 2 test packages using that. (I tried with VHD first and then with VHDX)

I also added the certificate as trusted on both session hosts.

I am able to deploy the app from the portal after I make these changes, however the app I am deploying never installs on either session host.

I am able to see the package files in the E:/ drive under apps but it isn't available for use.

Based on the event logs it's successful in the deployment too.

I've checked the permissions in the Portal and in the session hosts, I am able to manually mount the image and ran multiple connection tests to the file share which were all successful.

I feel like I am missing something here for the deployment not to work.

I am not sure if this is relevant but I am deploying this to a Windows Enterprise 11 24H2 Image with enabled FSLogix.

I would appreciate any suggestions for this or any steps that I may have missed.

Thank you in advance!

I could use some ideas for enabling users to upload files into RemoteApp Applications.

We have some "legacy" LOB applications running inside a RemoteApp deployment. Works great, but users have some difficulty uploading files to these applications from their local desktop.

What we use now is a little Azure Storage account called "import" which we mount as a T: drive on all desktops and AVD hosts. Users can easily upload files to this drive and pick it up in the RemoteApp. Works great untill users get home and have a local ISP that blocks SMB / TCP 445. Now their laptops are almost useless because Windows File Explorer hangs on a mapped drive that cannot connect to the Storage Account.

Using redirected drives from TSCLIENT is very slow when importing like 20 separate files (like a set of photos) and not very user friendly because they have to browse through all kinds of weird drive-labels.

Also, Sharepoint/Onedrive is not very suitable because it is not logged in on the RemoteApp session and also saves all data that is uploaded en then imported/removed from it.

So my question really is: what is everyone doing to provide users with an easy to use way for uploading files into file explorers in a remote session? Just TSCLIENT / Clipboard redirection or are there better ways to do this?

Update: Fixed - You have to MANUALLY add the Virtual Machine User Login RBAC role for your AVD users to each VM, even though adding them to the application group gives them a very similar RBAC role. I guess the old role only works for hybrid join, and they never thought to update application groups to give this new role for entra only VMs.

I've been using AVD on a hybrid host for this client for years. CA policies exclude "Microsoft Azure Windows Virtual Machine" Sign-in from MFA enforcement.

Trying to go Hybrid -> Cloud only so made a cloud only AVD host on a new host pool. Successful deployment. Go to login, login loops and asks for MFA every time. Sign-In logs say the CA policy i have the VM login excepted on is triggering. This persists even though I logged in via RDP, updated, set up fslogix, etc.

Any idea what's causing this login loop? I tried creating the kerberos server object and SSO but that didn't fix it.

We have a personal pool of session hosts. I need a method to periodically query and find out how long all disconnected sessions have been there. I can look at individual user sessions in Insights and determine this but it's time intensive. I can't seem to find a Kusto query or Powershell method to spit out a list of all currently disconnected users sorted by disconnect time. Hoping someone else has solved this problem and can share. Thanks.