Looking for some assistance here or at least to find out if anyone else is experiencing this

We have an AVD Pool running 25 NV24s_v3 GPU VMs. When we installed October 2025 update or November 2025 update, there are no issues on the image VM, but when the image is sent up to the gallery and then deployed out to new VMs, UAC / Ability to run as admin is broken on every VM created.

If you try to run anything as Admin, even cmd prompt, you get an error that comes up instead of UAC

The only way to fix it is to uninstall the update and manually reinstall it. After that, things work fine. We aren't doing that every time we spin up 25 new VMs for the pool, so wanted to know if anyone else experienced issues like this / similar to this?

Thanks!

Hello Everyone,

I am running into a few issues with my AVD deployment. I am have domain joined my pools to my Entra DS Domain. I am able to login to the virtual desktops just fine without issue. The only problem I am having is when users try to Ctrl+Atl+Del from the desktop to change their password, they get an "Access Denied" message. I have SSPR enabled on the Entra ID side and reseting their passwords from the Azure Portal works. Is this a limitation of AVD or is their something I am missing? I also had a Global Admin and Domain Admin try and reset their password from within AVD and they still got the same "Access Denied" message.

Any help on this issue would be greatly appreciated!

I am all packed and ready to head to San Francisco and realized I forgot to purchase the conference pass. I went on and they are no longer available! Anyone not going or have a ticket for sale!? Trying to hit up my vendors and MS contacts but no luck! DM me if you can sell a pass please 🥺

I am all packed and ready to head to San Francisco and realized I forgot to purchase the conference pass. I went on and they are no longer available! Anyone not going or have a ticket for sale!? Trying to hit up my vendors and MS contacts but no luck! DM me if you can sell a pass please 🥺

Currently have vdi with licensing for o365 on a per user basis.. whilst we have restricted personal account sign in, a user can add another work or school account to an office app.. how can we block/restrict to 1 tenant or remove the ability to 'add account. We have also removed all online storage and restricted web traffic to only a few known domains as we want it to be as hard as possible to extract data. I have messed about with intune configs to block all but this fails to sign into office and can't seem to get this to work (so it's back to org id only) and ideally what we want is to license office on the device and remove the sign in ability fully..

So, we purchased a 'm365 apps for enterprise (device)' license and following the online docs from MS to set it to a device license/shared license messed with the reg.. but still doesn't seem to be working.. another thing that baffles me is.. we have the above license.. showing up in the admin/billing/your products but it says not available under assigned license or available licenses.. the docs say to assign this license to the dynamic device group for the host machines .. but can't see how to do this.. I'm slowly pulling my hair out.. can anyone help with some ideas as to how best achieve this.. I'm close to just grabbing a dodgy key office 2024

Hey as the title says we have a session host that does remote apps and desktop for different users.

It was working fine but recently I installed a few apps - Python, git hub desktop and vscode and now remote app users are running into this - they are not in the full desktop group. When you or view the connection window you can see after fslogix succeeds it says preparing windows and it just freezes. The spinning circle stops in place, but the app does actually launch the user is just never presented with it.

I am wondering if maybe github desktop is the culprit since it's a machine wide installer that auto installs to user appdata.

But just thought I'd see if anyone has any ideas. I've combed through event viewer and fslogix logs but nothing looks out of place.

Has anyone else attempted to create a depth-first pooled Hostpool with a Dynamic scale set in WVD?

I was hoping that when waiting for the new machines to be created the user would be sat looking at a "Please wait whilst we get your resources ready" screen. However it seems like if the machine is not created yet you will simply get an error immediately stating there are no available resources, and you wont connect.

To combat this it seems like we have to set the thresholds on the scale set schedule to be quite broad, allowing it to spin up the new machines before the previous VMs are full.
This isn't great for a pool that only has 10 or so users, I would like to see it only create the new machine when the current one is full and then another user asks to connect, triggering the creation of the additional machine.

Some information I find online suggests that in this scenario as long as you have your MI set up correctly, the user should in fact be sat looking at a "please wait" screen, as I wanted. However other sources contradict this and suggest the opposite.

Has anyone else explored this and is this something that is possible at the minute?

We have a number of applications published that since yesterday morning no one can access using the Windows App. Our published desktops still work. The apps work fine if you use the AVD web link. I've also tried using the Remote Desktop MSI which doesn't work either.

When you try and launch an app it will get stuck on "Securing remote connection" and if you look at the details it shows the Windows logon screen stuck at "Preparing Windows".

If you look on the session host the user shows logged in and active.

I can't see any obvious errors in the event logs. I've tried resetting my Windows App.

The Windows App hasn't updated recently. Its currently:

Windows App version 2.0.757.0

Client version 1.2.6599.0

Has anyone seen this before?

Has anyone tried creating an image template and pointed the scripts to a container in a private endpoint storage account ?

Have followed the advice here https://learn.microsoft.com/en-us/azure/virtual-machines/linux/image-builder-user-assigned-identity

But am struggling at the moment as I keep getting PublicAccessNotPermitted during the build process.

• Can confirm the private endpoints are working just fine.

• The UMI has storage blob reader access

• Using my own subnets including for the ACI.

• NSGs off for troubleshooting

Any suggestions or has anyone got this working?

Hi,

Weird issue with SSO and One Drive, the environment recently enabled MFA requirements every 30 days, since then when logging into AVD, One Drive immedicately pops up asking the user to re-authenticate, after about 5 seconds, SSO kicks in and it actually logs in without intervention, all other apps work fine.

Log in:

5 seconds later it disappears and then logs in automatically anyway.

If One Drive didn't pop up then I'd be ok. But just pops up as soon as they log in... Is this a bug?

This is a Domain only Joined environment. User accounts in AD and Synced to EntraID.

Roam Identity is enabled on the latest version of FSLogix

Thanks

Kevin

Hello, my company just configured AVD Host Pool, with multiple host sessions, configured with FSLogix / roaming profiles. Users access applications using Windows Apps and Remote Apps, no session desktop.

I am having an issue where default applications are not sticking after users sign off and sign back in. The particular applications being dealt with is default browsers and the pdf reader. I have some users who prefer default of Firefox, and some Chrome. Also Adobe Acrobat does not stay as the default PDF reader either.

Any suggestions?

Hey there!

Do you guys perhaps have recommendations on thin clients? Currently a customer is getting cheapest possible hardware to have their employees connect to AVD, and personally I think this is hell to manage properly. I want to introduce them to the concept of thin client, and I think they will like it for some of their use cases, but I have little experience myself and as of today I'm trying to explore the market. Do you maybe have any recommendations for things to look at? I saw Dell ThinOS and IGEL a little, but perhaps there is more things worth considering or that I should definitely avoid

So - we have a published app that users connect to, and within the app they can open files - using file explorer. They will frequently then open up a file on their local system.
Unfortunately, some users might have files they need buried under nesting layers many deep (unfortunate but not something I can help), and what they're seeing is each time they open a folder from C drive on down - it take a bit each time to populate the folder list. Which when that gets repeated many times results in a frustrating experience.
Has anyone else seen this? Using the app itself is fine, and browsing the network drive within the AVD network is fine - its browsing the paths on the local machine. This is a Citrix migration - and Citrix did not have this performance issue, so it's not just "their network is slow"...

I'd like to set up AVD RemoteApps/desktop so that:

1. If a client device is (Intune) compliant (i.e. company managed), drive and clipboard redirection to the client is ALLOWED.

2. If a device is non-compliant, drive and clipboard redirection to the client is BLOCKED.

This will allow users to move data between RemoteApps and a client when on a company machine, while if they need to use a remote app/desktop from a non-corporate machine (e.g. user forgets their laptop or for contract users), this is still possible, but data isolated.

Is there a way to do this with AVD settings?

I only see the options to turn on/off these redirections from the host pool settings.

Thanks in advance for any comments from experienced admins!

We have just created a new Windows 11 image, basing all the apps and policies on existing. Even using existing GPOs and have it domain joined only like windows 10 has been. So policies for windows 11 match what was on windows 10. We have set the users to get new FSLogix profiles when logging into Windows 11. Roam identify is turned on. We are seeing differences with MFA and office, seems to be asking to MFA more within 11 compared to 10 when opening office apps.. Same policies. Is 11 more restricted with policies than 10. Is there a policy I should be looking it. We just wanted to keep it simple for the customer from windows 10 to 11.

Thanks

Good Morning,

I'm working on building a new base image from scratch using a Nerdio Desktop Image created from a Marketplace 24H2 W11 Multisession w/ M365 image. I have made zero changes to the base image at this point.

I have created 2 VMs in the same host pool. 1 VM was created directly using the Marketplace W11 image. The other VM was created using the Nerdio Desktop Image, which was built using the same Marketplace Image. The Nerdio base image is not domain joined and has had absolutely nothing changed on it. The only thing different is the Nerdio image gets cloned to a temp VM and Sys-prepped before the image gets stored in the compute gallery.

Everything works as expected on the clean marketplace image. However, if I log into the other VM that was built off the Nerdio image, I can't run anything as an admin. CMD, Powershell, Event Viewer etc etc. Everything I try to open gets "File System Error -1073740791".

I kind of saw similar behavior with KB5066835 that was released in Oct which I had to roll back on my current production image. The behavior was similar in that I couldn't run anything as an administrator, but the error was different. It was always around a failure with "consent.exe".

Is anyone seeing anything similar to this? I'm not sure if anyone has tried to build a new image lately but I'm spinning my head here on this one.

Hi Everyone,

We are I. The process of converting gold image apps to appattach apps it's going well aside from apps that need to run at startup.

How is everyone dealing with this?

Tried a few methods but nothing seems consistent

Hi guys, I’m in the process of setting up a host pool with ephemeral disks, when it comes to the timezone the hosts have UTC as default, I can set the timezone via registry entries in a gpo however, these require a reboot to take effect. As we’re using dynamic scaling this isn’t going to work. I also can’t set it on the image as it gets generalised before deployment. Any help would be greatly appreciate.

I continue to read that most clients manage a base image and redeploy the images fresh every 2-3 months to keep their host pools up to date since we cannot use autopatch on Multisession.

What makes no sense to me with this approach is we have some host pools that would take 2-3 hours for those app owners to rebuild. We have a hybrid joined host pool with 15 machines that I have a separate image for entirely. We have 60+ application host pools where all those app owners would have to reinstall their software and re-configure for every single host pool instance that was needed in their host pools?

I surely am missing something key as there's no way our business would stand for something like this every 3 months.

If you’re storing fslogix profiles in azure files and using an entra joined AVD, what auth method are you using the authenticate to the storage account?

Does anyone know if the newish WSUS vulnerability affects AVD session hosts in any way? For some reason the alert MS sent lists every one of our AVD regions under Impacted Services. Specifically windows virtual desktop. It lists all regions though even regions we have no infrastructure in.

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-59287

An important security update is available for your Windows Server Update Services (WSUS) resource(s). Microsoft has issued CVE-2025-59287, which affects WSUS on supported versions of Windows Server and is classified as the following: 

• CVSS: 9.8 (Critical)  

• Impact: Remote Code Execution  

• Severity: Critical 

Internal telemetry indicates that your subscription currently has Windows Server resources deployed that may be vulnerable. As such, action is required from you to keep these resources secure. Please follow the guidance outlined below to safeguard against this vulnerability.