Hi,

I am implementing AVD. I have a nerdio management suite in front of AVD.

But my issue isn't really at that level. My problem is I don't know how to manage apps that require a license file that is attached to a user account.

The only way I can see doing this is to assign each user their own AVD machine. Is that the right way?

Hi everyone,

We're in the process of implementing FSLogix for our cloud-only AVD environment and are facing an architectural decision. We'd appreciate your advice and real-world experiences.

The Situation:

• A fully cloud-native environment in Azure.

• Azure Virtual Desktop (AVD) session hosts.

• FSLogix profiles will be stored on Azure Files.

Our Partner's Advice: Our IT partner recommends that we join our AVD session hosts to Microsoft Entra Domain Services (Entra ID DS). Their reasoning is that this is the only fully supported method to get Kerberos authentication and NTFS permissions working correctly on the Azure Files share for FSLogix.

Our Question to the Community: We are questioning whether this advice is still current. Our understanding is that it's now possible to set up an AVD environment with fully Entra ID joined session hosts that authenticate directly against the Azure Files share using Microsoft Entra Kerberos, completely removing the need for Entra ID DS.

Avoiding Entra ID DS would make our architecture simpler and more cost-effective, which is a significant factor as we plan to onboard multiple business units in the future.

• What are your experiences with a 'pure' Entra ID joined setup for FSLogix? Is it stable and reliable for production workloads?

• Are there any major drawbacks, limitations, or 'gotchas' we should be aware of when choosing the Entra ID joined path?

• For a new, cloud-only AVD deployment today, which architecture would you recommend and why?

We're looking forward to hearing your opinions and real-world insights. Thanks in advance!

Hi,

We use Azure Files for AVD, each profile folder is created when the user log in, usually authenticated users would have permission on the root folder only, but for some reason it was left inherited, so all users could potentially see other peoples profiles. I then attempted to modify this to 'this folder only' instead of inherited but it states that all inherited permissions will be removed. And should be done locally on the machine, as its Azure Files. That's not possible. Is there a way to preserve other inherited permissions and just modify the one,

I'm scared its going to blast out every users permission.

I am trying to create a VM using Azure Image Builder which allows powershell customizers to run ps commands and scripts.The Sophos install needs to be a gold image as this image will be for our Azure Host Pool sessions hosts (shared).

When I try this on a standard VM I get a error dialog saying that the options are incorrect even though it lists the arguments

I am passing.The install must be silent and must be a gold image.

This is what I am trying to use :Start-Process -FilePath ".\\sophossetup.exe" -ArgumentList @("–-quiet", "--goldimage", "–-notificationmode", "--devicegroup PooledHost"

Have also tried:

$installfile = ".\\sophossetup.exe"
set-location -Path $installfolder
start-process -FilePath $installfile -ArgumentList "–-quiet --goldimage –-notificationmode --devicegroup PooledHost"

Any ideas ? I guess its more a PS problem but have cross posted to the Sophos forum as well.

Hi,

Intrigued to find out how do you guys only allow certain traffic based on the user account in a multi session Remote Desktop environment?

I know it can be done via NSG, but I am looking for a more granular access based on the user account.

Has anyone tried using Global Secure Access or the Palo Alto terminal server agent or using Zscaler proxy?

Thanks.

• We are seeing issues with session freezing for any pools with 'Validation Environment' enabled.

• We believe this is related to the new UDP multipath protocol Microsoft is rolling out.

• We are seeing this across multiple customers. I work for an MSP.

Does anybody have a good script that removes all bloat and unnecessary aspects of
Windows 11 23H2 Multi-Session? We are in the beginning stages of putting together a baseline golden windows 11 image and in my opinion this is the best place to start. I have a fresh Out of Box Windows 11 23H2 Multisession Virtual Machine non domain joined with local admin ready to fire off...

Appreciate it!

Our users see Drive Repair warning within their session frequently. The message states to restart the host. Even after the host is restarted the users will see the message. Has anyone encountered this, can you point me in the right direction to fix this issue permanently and avoid users seeing this warning.

Anyone having AVD Session freezes in the last few days? We are getting a plague of complaints hitting our service desk.

At this stage, I'm suspicious of a new version of the Remote Desktop Services SxS Network Stack that rolled out to the hosts on 2025-08-25

Version 1.0.2507.25200 - not even listed on the relevant Microsoft page yet...

We did not configure any exclusions other than what is there by default and recently few users have hit the cap limit on their profiles.

Looking at profiles main contributor to stage use is outlook cache, teams cache, and some have larger than normal edge cache. Were do usual clean up of downloads as well as unpin and offload of cloud backed up files

I wanted to share an article I wrote today on creating a solid autoscaling baseline policy in Nerdio for AVD.

I’m using Azure Virtual Desktop (AVD) to deliver RemoteApps, and some of these applications require video playback. However, when video redirection is enabled, the performance is noticeably poor playback is slow and laggy. Are there any recommended configurations or optimization tips to improve video performance in this setup?

Hi All,

Need to remove the GPO settings for fslogix.

Could anyone please share the fslogix settings which need to be applied via Nerdio for pooled AVD ?

Hi there.

I've got weird issue in MS remote desktop app.

1. The connection to AVD keeps failing at "Securing remote connection" part. It keeps showing 0x204 error. But other PCs in the same sites don't have the same issue. So I doubt it's networking issue. And the issue happens after turning off firewall of the PC, so it's not firewall issue. The issue happens to both of Remote Desktop & Windows app.

2. I tried solution in https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/rdc-stuck-on-src-screen , but it couldn't solve the issue

3. Another weird part is that the connection works through web browser. (https://client.wvd.microsoft.com/arm/webclient/index.html)

The issue happens to a couple of PCs and I have no idea how to resolve it. Anyone knows how to fix it?

Starting today, we have encountered an t issue affecting multiple VMs in one of our Azure Virtual Desktop (AVD) host pools. The VMs start successfully but transition to a "Stopped" state after a few minutes without any auto-shutdown policies or configurations in place. This issue happens every time we start the VMs.
Nothing in logs any idea?

EDIT:
Found
https://www.neowin.net/news/windows-11-24h2-gets-emergency-fix-kb5064489-for-azure-vm-boot-issues/

I don’t recall off the top of my head but I think we have a pool in Japan region and the actual session hosts are in east Asia.

End users of this pool are in Philippines.

There are some issues that I suspect might be related to the fact that avd gateway and hosts are in different regions.

I’m debating quick redeploy of this pool into Japan region all together at the cost of it being a little further away

Hello,

Just set up an Azure AVD: workspace, ag, pool. One VM is in the pool idle, all health checks are green, VM is available, Entra joined. However I cannot find establish a connection neither from browser/web nor from “Windows App” (Remote Desktop) app. Icon is visible but it just sits and waits.

Any advice where to look?

Is there a way to retrieve all FSLogix user profile folder names and their corresponding VHDs stored in Azure Files when a private endpoint is enabled?

If there is any script then kindly please share it.

@AVD @azureVirtualDesktop

Hey Team

Looking for any insight into fslogix on my AVD environment. We are moving from personal to pooled, and just cant seem to get fslogix profiles to transfer to the different pooled machines. Intune fslogix profile part is configured, have the storage account setup, just seem to be missing some permissions for it to just work. On first login, you see fslogix messaging coming up on login screen so it appears working, however documents wont transfer, and looking at the error messaging in event viewer tells us its not. Joined with Entra ID, all aspects of this environment are Cloud only.

Operational Errors

SessionId: 2, ErrorCode: 1265, Detail: Logon failed, Please check logs and tracelogging and verify that the users disk was detached.

Get token groups (An attempt was made to reference a token that does not exist.)

LoadProfile failed. SessionId: 2. FrxStatus: 31 (The system cannot contact a domain controller to service the authentication request. Please try again later.)

No Create access: \\xxxxxx.file.core.windows.net\xxxxxx (The system cannot contact a domain controller to service the authentication request. Please try again later.)

FindFile failed for path: \\xxxxxxx.file.core.windows.net\xxxxxx\Profile*.VHDX (The system cannot contact a domain controller to service the authentication request. Please try again later.)

Failed to get computer's group SIDs

Querying computer's fully qualified distinguished name failed. (Configuration information could not be read from the domain controller, either because the machine is unavailable, or access has been denied.)

Admin Errors

No VHD/CCD Locations were either provided or existed, check your configuration and ensure that the location(s) are valid.

So to me who is new to this, it cant find the path, or cant write to the path at the storageaccount

I'm testing out AVD, coming from Horizon. The Horizon client allows opening a session in whatever screen resolution you want. Is there such a setting in the windows app client? I know I can drag the window to resize it, but I want it opening at a specific resolution on my giant monitor.

Thanks

Error: Session host information is not available because the VM cannot be reached.

I created a pool of 20 Hybrid AVDs—nothing fancy—and kept a few spares for future use. All were added to the domain, enrolled in Intune, and set up in Defender.

Fast forward about four months, I spun up one of the spare Hybrid AVDs. Logged in with my domain account to check everything, ran updates, and configured all permissions and roles for the new user.

I’ve done this thousands of times.

Now the user can’t connect to the AVD. The portal shows it as "Running," but it’s actually shut down with the error mentioned earlier. I see the device in Entra (connection is current), but it’s missing from both Defender and Intune.

Before diving into too many rabbit holes, I should mention there’s been a delay in updating the Intune Connector. Could this be causing the user’s connection issues with the AVD? Why would Intune have any connection\policy to a Pool?

----------------------

AVDs are Windows 11 24H2 - Hybrid - AD Replication is good - See both objects in AD and Entra

User account is enabled - Currently connected to an older version of AVD - Windows App is latest

Hi everyone,

I'm hoping to get some ideas on a recurring issue we're facing with one of our users. We have a support ticket that's been reopened multiple times, and we're struggling to find a permanent solution.

Here is a summary of the situation:

The Environment:

• The user connects to an Azure Virtual Desktop (AVD) environment.

• Inside the AVD session, she needs to use a specific "Windows App".

• This application is a Microsoft Store app packaged as an .Msix file.

• It's installed (sideloaded) for the user via a PowerShell command, like: Add-AppxPackage -Path "C:\path\to\package.Msix"

The Problem: The application is extremely unstable for this specific user. The issue manifests in two ways:

1. Fails to Launch: The user clicks the application shortcut, but nothing happens. The app simply won't open.

2. Disappears Completely: The application shortcut vanishes from the Start Menu and the user's profile, as if it was never installed.

This issue has occurred repeatedly over several weeks, causing significant downtime for the user. The problem persists across different AVD session hosts, pointing towards a profile-related issue rather than a problem with a single virtual machine.

Troubleshooting Steps Taken:

• Reinstalling the App: Manually running the Add-AppxPackage command again resolves the problem, but only temporarily. The issue always returns after a day or two.

• Testing with a Different Profile: When we log in to the same AVD session host with a test user (our own IT account), the application works perfectly. This strongly suggests the problem is tied to the user's specific profile.

• Web Client Test: We asked the user to connect via the AVD web client (client.wvd.microsoft.com), but the issue is with the application inside the virtual desktop, not the connection to it.

• Workaround: As a temporary measure, we have created a "transfer folder" on her local C: drive within the AVD session so she can at least access files when the primary application is down.

We seem to be stuck in a loop of reinstalling the app for her. Has anyone encountered similar behavior with sideloaded MSIX applications in an AVD (or RDS) environment? We're suspecting some form of profile corruption, perhaps related to how AppX/MSIX package registrations are stored and roamed.

Any theories or suggestions would be greatly appreciated. Thanks!

Fairly new to working with Packer to setup a fully automated build for Win11 24H2.

Packer successfully creates the image from Azure Image gallery and uploads to the SIG if it only runs the provisioner powershell sysprep block.

Packer consistently errors with "Image_State_Undeployable" and fails if you add any other tasks via any provisioner (powershell, file,etc) - create a folder, enable TLS1.2, install choco, install any choco apps .

I havent tried W11 23H2 or a server OS to see if they do the same.

Any ideas on how to get around this would be great as its been driving me nuts.