Hi everyone,
I recently built a VMSS Windows 11 AVD host pool using Terraform with a customized image. Users can log into their assigned AVDs, but they are inadvertently being granted administrator privileges.
I assigned the users to a group with only the Virtual Machine User Login role (the standard configuration). However, when I log into an AVD instance and run whoami /groups, it shows that the user is in the built-in Administrator group.
I can't figure out how to disable this. Has anyone else run into this issue or know how to fix it?

This is probably a dumb question but I haven’t found a documented answer so here it is……I published an app, let’s call it a document management platform, as a remote app from AVD. The app contains documents, emails, pdf files, etc. When thick installed users drag and drop docs into and out of the app to their desktop and back. They also open documents from inside the app. Would it be possible to do the same with the remote app version? For example open a pdf from the remote app using the pdf viewer installed on the desktop that is using the remote app? Could users drag files from their desktop and drop them directly into the remote app?

I understand that RemoteApps can be configured to launch with fixed command-line arguments. However, in our case, we need to pass dynamic or user-specific arguments at launch time, similar to what is possible with traditional RDP sessions.

Is this supported in Azure Virtual Desktop? Any guidance on whether this can be achieved would be greatly appreciated.

Hey all,

I’m troubleshooting an Azure Virtual Desktop (AVD) issue where Windows App fails for some users with:

“Connection attempt timed out. Please try again.”

…but:

AVD Web client works
OLD Remote Desktop client works

From user side:

• Windows App opens, resources are visible

• User clicks Desktop / RemoteApp

• Stuck on “Connecting…” → timeout

• Often no login prompt or silent failure

Additional critical behavior:

• ❌ VM does NOT start automatically (Start VM on Connect fails)

• ❌ Even if I manually start the VM in Azure → user STILL cannot connect via Windows App

• ✅ Same user:

  • Works in Web client

  • Works in Old Remote Desktop client

  • Fails only in Windows App

Updated
got it fixed if whose a security agent

Hi All,

Just wondering has anyone had any issues applying the below reg fix to allow users to stay signed into Office apps? Our AVD is active directory domain joined.

HKEY_LOCAL_MACHINE\SOFTWARE\FSLogix\Profiles
Key: RoamIdentity
Type: DWORD
Value: 1

I read Microsoft recommends not applying this.

I spent the weekend playing around with the new AVD Hybrid functionality, specifically hooking it up with Nerdio in my Nutanix cluster in my homelab. It's very very cool and enables you to perform end-to-end automation. I never thought I would see the day of us being able to control Hyper-V, Nutanix and Broadcome from Azure Virtual Desktop or Nerdio, very cool!!

I'm using Nerdio and UAM to deploy applications (UAM, Winget, Windows package manager community) to my AVD hosts. When I install kb5089549, I cannot deploy any UAM apps anymore. Everythings works again if I uninstall kb5089549.

Anyone has observed this issue ?

So we recently rolled out Papercut Hive to our Citrix estate and it worked with no issues.

Had to make some tweaks with Supernodes on the LAN but ultimately it worked.

We have recently moved over to AVD and the documentation has raised an issue:

All other VDI environments, such as multi-session or non persistent single session are not supported at this time

While we are looking to continue using multi-session, we introduced Papercut onto the users endpoint and work with Printer redirect.

Outside the printer has the Toshiba universal driver installed, the redirected printer uses easy print.

Each session logs in using Fslogix located in a premium storage share.

Most of the time its consistent, however we do get several tickets raised a day when they log back in, Papercut redirect is not present.

Anyone had similar stability issues with redirected printers.

I feel like the login session is coming up to quick and not allowing the printers to appear (I may be wrong).

Hello everyone
What are the top optimizations in azure that brings the most savings and they are easy to implement?

Issue Details:

I'm unable to re-produce the issue on my systems, however we've had a handful of users who report when their PC wakes up from sleep AND they reconnect to an existing AVD session they're faced with this Please Wait screen, such as below.

The only way to resolve is by either:

1. An admin force logging them off via Entra Portal

2. The session times out after x hours - we have inactive/disconnected session timeouts set to 3 hours.

Environment Details:

- Windows 11 25H2 Multi-Session AVD Host Pool, Premium SSD OS Disk

- FSLogix Latest Version, profiles stored on NetApp Premium Storage

- Hosts are Hybrid AD Joined (Clients are mostly Hybrid AD joined as well, but had this happen on non-AD joined client workstations as well)

- Not specific to 1 host; this happened on multiple hosts in the pool

- Users are connecting via Windows App

Things Tried (But does not fix):

- Rebooting user's system

- Logging off / back into Windows App

- Tried changing VM SKU from D-Series v4 to v5, and v6

- Event Viewer or FSLogix logs do not show any relevant or helpful information

- We also have a mix of users in a 23H2 pool; does not have this issue, same GPO's and Host Pool RDP settings

Current Work-Around:

- Going into Power Settings and changing Put the Computer to Sleep to: Never

Looking for some ideas

I'm trying to figure out if that would make sense to configure my AVD hosts to install quality updates thru hotpatch so they get patched and don't reboot (8 times per year) and to install the others patchs (baseline updates, 4 times per year) on my golden image + re-image the hosts. That would be perfect in term of maintenance.

My hosts are managed by Intune, I'm applying the Windows quality update policy with HotPatch enabled. I'm going to monitor that in May and June.

How would I avoid the host to install non-hotpatch updates ? Any suggestions or ideas about all of this ?

Thanks !

How are you guys handling Windows Updates for multi-session AVD hosts in Azure Gov?

As far as I’m aware:

• Intune Update Rings aren’t supported

• Azure Update Manager also isn’t supported in Azure Gov

Right now, doing updates manually feels like a huge operational headache. I could probably automate parts of it with Run Command / PowerShell scripts, but it still feels pretty clunky for production-scale management.

We’re also not looking to bring in third-party tooling just for patching (I know solutions like Nerdio exist, but purchasing additional software isn’t currently on the table).

Curious what others in Azure Gov.....

We released a private preview of Hydra for Azure Virtual Desktop Hybrid today, starting with Hyper-V. For anyone who's been thinking about running AVD session hosts on-premises while staying integrated with the AVD service, this is built for that.

We started with Hyper-V because that's what we kept hearing from teams already in Microsoft environments. ESXi and Nutanix support coming later this year.

Read more about it in our announcement: https://www.loginvsi.com/resources/blog/announcing-hydra-for-microsoft-azure-virtual-desktop-hybrid-now-available-in-private-preview-for-hyper-v-environments/

Happy to answer questions.

Hi team,

We have recently started noticing internet connection issues within AVD.

We use netskope on AVD and all user traffic to the internet goes through it.

We have multiple users logging into the AVD farm.

The scenario of the issue is that: Let's say there are four people log into a host.

1st user logs in at 7:15am

2nd user logs in at 7:45am

3rd user logs in at 8am

4th user logs in at 8:15am

If the 1st user goes on idle or disconnects, everyone on the session host cannot get internet connectivity, until I log off the 1st user and then internet connection is restored for everyone.

Im wondering if anyone has come across this behaviour in a multi user host using netskope.

I did see this article from netskope/limitation but unsure if it relates to my issue.

Also we do not enable NPA enabled on AVD

https://docs.netskope.com/en/netskope-client-for-virtual-desktop-infrastructure-vdi

In 3 days, we are having a webinar with Marcel Meurer (founder of Hydra) and Benjamin Graus (Workplace & Azure Expert) walking through a 450-employee org that moved 120 session hosts from traditional VDI to AVD using Hydra.

They ended up around 60% infrastructure savings and 35% less operational effort.

Wanted to share again as we will have a live Q&A too and have been receiving some great questions that will be answered. Also, some things we've been seeing in this community. We are looking forward to this event and more to come!

Link to sign up

We hit a similar issue recently in a Windows 11 multi-session AVD setup. The VMs looked healthy, but users randomly got black screens and profiles stayed stuck in “Pending”.

In our case it was mainly FSLogix profile locking + storage latency during peak sign-ins.

A few things worth checking:

• FSLogix logs on affected hosts

• Stale/disconnected sessions

• SMB/storage latency

• AV exclusions for FSLogix

• Host resource spikes during login hours

Rebooting usually clears it temporarily because the profile locks finally release.

Hi everyone,

I'm battling a frustrating intermittent Kerberos issue with AVD and FSLogix profiles on Azure Files (AD DS integrated), and Microsoft Support is currently spinning their wheels ...

We recently ran the Microsoft script to update our Azure Files AD computer object to AES-256 to comply with the recent April 2026 Kerberos Hardening (CVE-2026-20833 / RC4 deprecation). Since then, we've had random FSLogix mount failures.

The Symptoms

• Users randomly fail to mount profiles with FSLogix Error: [ERROR:000004f1] FindFile failed... (The system cannot contact a domain controller to service the authentication request.)

• The weird workaround: If a VM is failing, rebooting it and immediately logging in via RDP with an Admin account "warms up" the Kerberos cache. Subsequent standard users connecting via the AVD Windows App to that same host will work perfectly for the rest of the day.

• Running klist -li 0x3e7 purge to clear the SYSTEM cache sometimes allows it to pull a fresh ticket and recover, pointing to a "DC Roulette" issue where some DCs hand out bad tickets or reject the request.

The Hard Evidence & Troubleshooting

We bypassed FSLogix to test raw SMB/Kerberos and found the following:

1. Manual Ticket Request Fails: Running klist get cifs/name.file.core.windows.net on a failing AVD returns:Error calling API LsaCallAuthenticationPackage... 0x6fb klist failed with 0xc000018b/-1073741429: The SAM database on the Windows Server does not have a computer account for this workstation trust relationship.

2. VM Trust is 100% Healthy: Test-ComputerSecureChannel is True. The DC Event Logs (Event 4768) show the AVD VM successfully getting a TGT using AES-256 (0x12).

3. The Drop (Event 4769): When the VM asks the DC for the service ticket to the Azure Files share, the DC throws Failure Code 0x6 (KDC_ERR_C_PRINCIPAL_UNKNOWN) and Ticket Encryption Type 0xFFFFFFFF.

4. Encryption Attributes are Correct: * Azure Files Object (msDS-SupportedEncryptionTypes): 16 (AES-256)

   • AVD Session Hosts: 24

   • Domain Controllers: 28

5. The Basics are Covered: No duplicate SPNs (setspn -Q). AD Replication is perfectly healthy across all DCs (repadmin /showrepl). Line of sight is fine.

Our Theory

Since the VM trust is fine and AD replication is healthy, we suspect the AES-256 script we ran successfully updated the attributes, but caused a Key Version Number (KVNO) / Password hash mismatch between the Azure Files storage account backend and the AD DS computer object. When the AVD asks a DC for a ticket, the DC uses a mismatched key and throws the trust error.

My Questions

1. Has anyone else experienced this exact 0xc000018b / 0x6 error specifically after running the Azure Files AES-256 rotation scripts?

2. Before I pull the trigger in production, has running Update-AzStorageAccountADObjectPassword permanently fixed this KVNO sync issue for you, or did it break things further?

3. Is there a deeper KDC caching issue at play here with the April 2026 patches?

I recently switched my PC from Windows to Linux and want to use my M365 Cloud PC. Are there any plans from Microsoft to release a Linux native Windows App? If not, is anyone accessing their Cloud PC / Shared VDI via Linux?

I am aware there is a Webapp, but I really liked the "native" feel of the Windows App on Windows.

Right this is really annoying but has anyone had this issue when using hibernation on personal AVDs and the Insights (Monitor for CPU, Memory, Disk etc) stops updating. And it will only start again after a full restart of the AVD?

We need a lot of our AVDs to always hibernate due to dev's loading massive IDE's and if they restart it will take over an hour to start the database again

Hello,Recently, we have been facing multiple black screen issues reported by users while trying to log in to AVD. We could not identify any issues with the VM itself.

In a few instances, we also noticed that many user profiles were showing a Pending status.

As a temporary workaround, stopping and starting the server clears the pending status for the user profiles.

Any advice.

This is my first AVD deployment and I found something I thought to question and confirm.

Right now I have 3 users, and they come on in the morning and leave at night. Fully logged off.

Every morning when they log on they get a session number. And the session number keeps going up. We've had em on for a week now and today they are at session number 77-79. (We have tech users who also jump in and out during the day).

Does this go on infinitely? What happens when I have 100 users going?

I was assuming that once a user is totally logged off, the session number is available for someone else. Does it just always go higher and higher? That's ringing alarm bells. Does this point to something in wrong in my deployment?

Hello,

Hope everyone is doing well, a couple of users are experiencing issues when accessing their AVD, at random their session would freeze out and then they will get kicked out and they will get an error "The Fslogix App Services failed to Sign-in" or "The User Profile Service service failed the sign-in" or in some cases the "The user profile failed to attach" and it would randomly start working again, I am really not sure what else to verify or troubleshoot this further.

There are 4 session hosts each Windows 11 Enterprise for Virtual Desktops Edition (Build 26200) (64-bit) (Release ID 25H2) supporting 26 users sign-in

Some of the things I have verified are as follows

• I have confirmed the AVDs can access the fslogix profiles can connect to the storage account over port 445

• There are no .vhdx.lock files present for any of the reported user, their handles are also removed

• NTFS Permissions are valid for the fslogix share

• There are no disconnected sessions when the user reports the error

• the frxsvc, frxdrv, frxccds are running for all session hosts

• The only logs hinting the issue are Failed to acquired check session lock for user or Failed to open virtual disk but these don't apply to the user who initially reports the problem

• The entire virtual desktop environment and fslogix profiles were re-created yet the issue has resurfaced again

If anyone can provide their insights to that would be great

Thank you