No More Syncing Users: 5 Steps to FSLogix 100% Cloud

[@bunce44]

Kudos for raising the security qualifications. Also worth noting that windows Cred Man is also generally considered easy to compromise by red-teamers, and becoming recommended practice to disable as part of Cyber hardening practices..

[@AzureAcademy]

Good point…that’s why the product teams are still working towards an Azure AD Native solution

[@StormInc67]

Happy to see FSLogix is now also has the all Cloud option, really would like to see the Cloud GPO functionality as we use a lot of them on our AVD's. I can't even move to the Cloud completly without GPO's. Great video again!

[@AzureAcademy]

Cloud GPO video will be ready next week, stay tuned!

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@EnvyAnker2393]

Love your videos. Love the low key joke about Cloud (FF) while setting things up in the cloud.

[@AzureAcademy]

LOL Thanks!

[@leexu2073]

Hey, I did all of this and nothing is showing up on the Network tab, my enterprise is only using Azure Active Directory without any Domain controllers. Am I doing something wrong or is there extra things I need to configure?

[@AzureAcademy]

You are probably not running the Command properly, Watch this 👉 kzbin.info/www/bejne/r3vUhX2eZ7martE at 11:45 I talk about the cloud only method

[@leexu2073]

​ @AzureAcademy I went back and set NTFS permissions and used the Powershell "run command" on the operations tab with your 100%cloud scripts and it Worked! I cannot thank you enough, I am an intern with absolutely no certifications and through your videos, I have learned so much about Virtual desktops.

[@AzureAcademy]

Awesome, that’s why I do this…thanks! 👍👍

[@kennethbenjamin2593]

Regarding security concerns, the SYSTEM account already has potential access all the user profiles on the local system, plus the ability to do anything needed to gain access to the user's data. I'm not sure that this opens up any new risks. Getting rid of AD seems like a big security and reliability win that offsets any potential risks with this approach. I'd be interested to hear if anyone sees something I'm missing here.

[@AzureAcademy]

Due to the multiple groups that could have different levels of admin roles like local server admins vs. Azure admins, vs. Azure AD admins and how permissions are granted this method MIGHT give more access then folks should have…which is why I brought it up. But good thought!

[@ShadiQadamani]

You Rock!!

[@AzureAcademy]

👍☺️👍 thanks!

[@davelee212]

What would happen if a user was to attempt to browse the file share by it's UNC path? Would they be able to browse the file share and potentially see/download/mount other users FSLogix VHD(x) files? Or is it only administrators and system processes that can access the creds in Credential Manager? OK - just read Marcel's blog post - he confirms that normal users can't see others stuff. So that's good. Seems like a pretty good solution! also... Cloud GPO :)

[@AzureAcademy]

They would be prompted for credentials…which they wouldn’t have. The only valid creds are the storage account key. Look for the cloud GPO video next week

[@Whyleys1-of3tb]

Really great videos, I noticed something you recommended in the "mistakes" video, if you exclude OSTs from the virtual disks, does this mess with Outlook indexing and searching, I am sure this used to be a problem maybe not so much now?

[@AzureAcademy]

OST files are a toss up. If you have HUGE OST files, because you allow such long retention of your emails AND you need regular access to the OST files…you may be better off using the Office profiles with the OST and the outlook indexing and searching. But in general, I don’t suggest it in AVD

[@alvinabraham777]

Thanks for this video. I wish I could actually see this work in the video. I saw Marcelos blog before and followed it step by step. It never creates the profile in the share. So i always get "FindFile failed for path", "No Create Access......"the parameter is incorrect"

[@AzureAcademy]

Are your session hosts on windows 11 22h2? Marcel has an extra reg key that you need to add so the creds don’t disappear

[@footballsuperstar1290]

@@AzureAcademy I have same issue using Windows 10 Multi session 21h2

[@AzureAcademy]

strange...I haven't had that experience...what does the FSLogix logs show?

[@alvinabraham777]

its 21H2 I statyed away fro 22H2 because of sysprep issues.

[@AzureAcademy]

got it

[@clementevitale8135]

What amazing content! Dean you rock!

[@AzureAcademy]

Thanks for watching!

[@shanethepayne]

Cloud GPO! Thanks for your videos. Top shelf!

[@AzureAcademy]

Thanks for watching, the Cloud GPO video will be ready next week, stay tuned!

[@OldBanHammer]

Another great video. Thank you. I have been thinking about how to go all cloud AVD with FSLogix for a while. I would love to see a video on cloud GPOs. Also, we now have a problem I am looking for a solution for. I have a fileshare in a azure storage account that is getting massive. To trim costs, we are going through it manually to clean out profiles for terminated users. Do you have a solution you can recommend to automate this process of removing profiles that have not been used for say 120 days?

[@AzureAcademy]

Thanks for watching, and glad I could help. On the clean up, I do not. There are too many variables that different customers think about to nail it down. Best thing I recommend is that you create a script with your criteria and run that when you do your profile maintenance.

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@JakeLD22]

Great video man! I just have one thing to add: CLOUD GPO! Thank you!

[@AzureAcademy]

Will be this Tuesday

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@phatadam123]

CLOUD GPO HEART YOU

[@AzureAcademy]

Here ya go 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c

[@fbifido2]

/* LogWriter("Disable Windows Defender Credential Guard (only needed for Windows 11 22H2)") */ - can you say why this is needed? - can the Windows Defender Best Practices for FSLogix be implemented into this script as well?

[@AzureAcademy]

the extra RegKey is needed on Win 11 22H2 because of a bug in Credential Guard that deletes the entry from Credential manager. a fix is in the works. Yes you can also use Defender best practices with this...and there are also several defender AV exclusions you should include as well...read this 👉learn.microsoft.com/en-us/azure/architecture/example-scenario/wvd/windows-virtual-desktop-fslogix#antivirus-exclusions

[@tomhickling1]

Also remember to securely store your script that contains the storage account access key - you don't want that getting out .

[@AzureAcademy]

Great point

[@ahmadl-zahrani2993]

Great Vid as always Dean! Will this work for a normal file share? like Azure stack hci /AvD deployment multi session? full Azure AD authentication

[@AzureAcademy]

If by normal you mean Azure files standard…YES. In Azure stack…not sure, I don’t have a stack environment to test…but I think so. Demo I showed was in Azure AD Join.

[@ahmadl-zahrani2993]

@@AzureAcademy No i meant On-prem file share 😃

[@ahmadl-zahrani2993]

​@@AzureAcademy Us younglings in the HCI space, would like to be masters some day.

[@AzureAcademy]

You can’t use this exact method to an on prem share because there isn’t an access key…however if you granted permissions to the computers instead of the users and users the access as computer object reg key I think it could work

[@AzureAcademy]

Is that a request for HCI videos? If so…tell me what you want to learn?

[@MatthewHulme-mm2vm]

I am getting an error in event viewer - fxlogix - Failed to get computer's group SIDs , Querying computer's fully qualified distinguished name failed. (Configuration information could not be read from the domain controller, either because the machine is unavailable, or access has been denied.) - at the stage where i input the reg keys , share works and can get to it.

[@AzureAcademy]

Which join type are your hosts using? Also are your users synced from Active Directory to the cloud Or are you using cloud only users? Do you have line of sight to your domain controller Are you using Entra ID Kerberos?

[@callsfromthebeyond6237]

Great video dean! Just so I'm clear, for traditional DC scenarios the users do not need to be synced with ADConnect anymore? Also, does this solution remove the need to run the AZFiles Hybrid module to join the storage account to a domain? What about the 'Storage File Data SMB Share Contributor' RBAC role? is that gone too with this update? I've messed with machine-based auth in the past with mixed results, largely due to the authentication method and RBAC requirements.

[@AzureAcademy]

If you use this method you don’t give permissions in the storage account, The access key does it for you. You don’t join the storage account to the domain And you don’t sync users HOWEVER, I haven’t tried this in an AD managed environment. But since you already have to sync users…I would generally recommend managing FSLogix the traditional way too. But you can try it and let me know

[@danielboring2243]

Cloud GPO +1 Thanks for the great content! :)

[@AzureAcademy]

Thanks for watching, the Cloud GPO video will be ready next week

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@yoyojonathan]

Dean, my only concern if we rotate the storage key .. from time to time this method will definitely will create another opportunity to keep it up to date in the registry.

[@AzureAcademy]

Yes…and rotating the keys is a good practice…so you can run the updates script on your existing session hosts or build from the updated script

[@tabaniz]

I was looking for this solution. Thanks.😊 Question: can this method be used for cloud only and ad-sync users. What would be the best solution if we have ad sync users and only a couple cloud only users? Do I have to add first part of the script for automation or once I have the golden image and I can run that once with the registry keys and that should do the trick.. Thanks

[@AzureAcademy]

You’re welcome! Answers: you would only use this for cloud users. Synced users will use Entra ID Kerberos or AD Authentication. And YES you can use both methods at once…but on different shares. You can add the script into your image but I generally discourage that so you can use your image with more solutions

[@tabaniz]

@@AzureAcademy Thank you. God bless you

[@AzureAcademy]

Amen!

[@nickhill3960]

This is interesting! Some of our clients only have Azure ADDS to be able to use FSLogix. So even though the File share is loaded as the computer account, this doesn't let the user on the computer browse to it/have full access? FSLogix uses the System account rather than user context?

[@AzureAcademy]

No…in general users access the file share in the user context. The method I showed in this video changes the default behavior to access in the system context

[@mloskot]

Thanks for the very helpful video. I've got one issue to report: at 3:18 the video shows the HKEY_LOCAL_MACHINE\SOFTWARE\FSLogix\Profiles with Enabled key of type of REG_SZ. This is incorrect and the VM will flood events about errors reading the FSLogix configuration from the registry (observable with Event Viewer on session host VM). Replacing it with Enabled of DWORD type fixes the problem.

[@AzureAcademy]

according to the docs...the REG_SZ is NOT correct...good catch, it should be a DWORD. The REAL question here is...how did that happen? I set up my environments with the GPO or Intune Policies 😲😲 I will have to go back and check...thanks again! learn.microsoft.com/en-us/fslogix/tutorial-configure-profile-containers#profile-container-configuration

[@mloskot]

@@AzureAcademy I have also been wondering how that slipped through :) Even though, this video is a ground breaker!

[@AzureAcademy]

Thanks!

[@nishanthkumar4436]

Thanks a lot for providing this insight...We would like to see cloud gpo as well

[@AzureAcademy]

will be uploaded next week, stay tuned!

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@nishanthkumar4436]

@@AzureAcademy another interesting feature.

[@AzureAcademy]

👍👍

[@timothyhodge4328]

Why not use Azure AD Auth for the computer with System Managed Identity? Then no credentials needed in the mount code. And can be automated with Azure Policy / IAM / Dynamic Device Group.

[@AzureAcademy]

I don’t think that will work…but if you can try it and make it work…I’ll make a video on it and give you the credit! ☺️

[@alozborne]

If you incorporate the storage key credentials, using Credential Manager, on your golden image and then image your AVD session hosts from that golden image, will the storage key credentials persistent on the session hosts?

[@AzureAcademy]

The only reason I wouldn’t use that approach is that it locks your golden image to a single pool and file share. I prefer to use one golden image for everything, and then customize at the time of deployment for that workload, but your approach could definitely work too

[@jakechrysochou6666]

Hi hope you could help, when logging into the workspace via AVD, I seem to get into a loopback issue with 2FA and no connection

[@AzureAcademy]

There are so many things that might be wrong in that case I suggest opening a support ticket so they can look at the authentication packets

[@1979benmitchell]

Is there an easy method for configuring these settings via InTune vs 3rd party tool or using CustomScript Extension when the Host deploys?

[@AzureAcademy]

Custom script extension is just a way to run PowerShell or a cmd script…so yes you can easily do that

[@ImMarkyB]

CloudGPO - yes please!

[@AzureAcademy]

the Cloud GPO video will be ready next week,

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@LThibx]

Great video and content!. I have it almost working. From PS window or Cmd window as System from my RMM, I can access the share with dir, and can create files with echo and such. When I attempt to login as a user I get 3 FSLogix errors: Can't load Users Profile, Reason Initialized to Empty State, The process cannot access the file because another process has locked a portion of the file. Doing Ctrl+Shift+Esc to access Task Manager, then Cmd prompt (my user context). I try to dir the share and get the user name or password is incorrect. If I access thru Explorer, I get prompted for User Name & Password. What did I miss?

[@AzureAcademy]

Did you enable the policy to allow FSLogix to run as computer account?

[@matthewhulme7902]

followed guide - same error in event viewer under fxlogix - Failed to get computer's group SIDs, Querying computer's fully qualified distinguished name failed. (Configuration information could not be read from the domain controller, either because the machine is unavailable, or access has been denied.) - can anyone help? i have put the reg keys in, rebooted machine, windows 10 enterprise multisession - latest version

[@AzureAcademy]

Which reg keys are you talking about? Which join type are your hosts using? Are the users cloud only or synced

[@NeilEvanLorca]

Good day, Dean! I was wondering if there was a feature or solution in AVD that would automatically alert administrators by email, SMS, etc. when an FSLogix VHD/VHDx user disk is about to be full. I'm trying to write the script while looking into Azure Automation and Azure Monitor but unable to build one. I would be grateful if you could offer the finest advice or any other services we could use to make it possible.

[@AzureAcademy]

There is no way to alert from the Azure level if a .vhd in a file share is getting full. My preferred approach is to use dynamic disks and make the disk size very large, this way I don’t have to do maintenance except on a few disks who near the limit. Also the cost of FSLogix depends on the file share you have. If Azure files premium, the cost comes from the size of the file share, not the disks. What do you have?

[@DeskInTheCloud]

Cloud GPO pls. Great content as always!!

[@AzureAcademy]

Cloud GPO video will be ready next week, stay tuned, thanks for watching

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@mrbuckmeister]

Could you do it with managed identity and skip the need to use the storage account key and credential manager?

[@AzureAcademy]

No, FSLogix doesn’t speak Azure yet so a managed ID doesn’t translate from the users

[@hakanerbas5088]

Great tutorial Dean. Thanks first of all for that. I followed everything as you explained it. After a user logs in to the AVD, a profile is also created on the share, however I cannot include the share in the user profile. It keeps asking for credentials. I created the script with the credential manager on system context, and included the key for Win11. Can you maybe tell me what I am missing here? Thanks in advance.

[@AzureAcademy]

The issue is user context i explain it and show in exact step by step multiple ways to execute this correctly 👉 kzbin.info/www/bejne/r3vUhX2eZ7martE and go to Time 11:45 for the 100% cloud info Please let me know you are successful

[@hakanerbas5088]

as i said, i followed everything exactly as you described :). did it once in the portal with "run command", and once with "psexec -s". unfortunately it still doesn't work for me...@@AzureAcademy

[@AzureAcademy]

Then you are missing something 🥰 seriously…if you did the process correctly, then you should be able to log on with an admin account, then use PSExec to elevate your cmd. And check for the key…if it is not there you missed something in the process

[@otakuguild5603]

I tried your exact steps but my fslogix profile is not getting created. When i checked logs it said cannot access the path. So from my avd machine I tries to access the file share using smb path but got access error. I did add the creds in creds manager in the avd session host using local admin. Do you know what might have gone wrong?

[@AzureAcademy]

You are probably not running the Command in the system context Watch this for the EXACT steps at about 11 minutes kzbin.info/www/bejne/eJC1Y3WfarikjNEsi=DO6kr7O-t3OWwqio

[@michaelpietrzak2067]

Could this technique be used for MSIX appattach so I would no longer need to join storage to my local AD, add permissions etc etc?

[@AzureAcademy]

Yes, you could do this for MSIX App Attach as well. If I remember, that’s just the session, hosts that need access to the file share

[@rogierbanis]

Awesome. Cloud GPO +1

[@AzureAcademy]

Thanks for watching, the Cloud GPO video will be ready next week

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@Jonathan_Steel-blue]

Hello thanks for the tutorial but i got a problem : When i connect with a user to the session host no profil has been created to the SMB File Share. I hope you could help me !!

[@AzureAcademy]

Watch my latest video for the possible issues and fixes you need kzbin.info/www/bejne/oqelmn-gbNR0fZY

[@fbifido2]

@2:14 - can Cred Manager be locked down? is there any power tool app to password protect a windows app/feature? can the SMB share be private ($) or/and can we use private endpoint?

[@AzureAcademy]

Yes you can use private endpoint with FSLogix file share, as far as I know the credential manager has 2 layers, user and computer The user layer is locked down per user and the computer is secured by SYSTEM rights, which is beyond normal Admin. Just like running the script to set all this up, needs to be run in the SYSTEM context, not a user or admin. As for a tool to lock down credential manager…none that I know of. AND since a local admin CAN elevate to SYSTEM if they know how…this is why I warned you in the video about considering IF you should use this method because your local admins COULD access the file share and the profiles

[@fbifido2]

@@AzureAcademy is it possible for Cred manager use the TPM chip to store and access the keys, every time it's needed, and what is shown in cred manager is an encrypted key?

[@AzureAcademy]

Not that I know of.

[@uzairahmed09]

I did everything as per the instructions, but it is not working for me.

[@AzureAcademy]

Make sure you are running the Command in the computer system context Watch this for how at 11:45 kzbin.info/www/bejne/r3vUhX2eZ7martEsi=JlAsxoFpGliuG022

[@uzairahmed09]

@@AzureAcademy Thanks a lot, It worked like a charm.

[@AzureAcademy]

Awesome

[@amende8372]

CloudGPO

[@AzureAcademy]

You got it

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@prashanthpachhi321]

Hi. I tried the same steps as illustrated here but Fx logix profiles are not getting created in storage account

[@AzureAcademy]

The issue is that you are running the script as a user not running the script as SYSTEM. To run as SYSTEM you can either run it as a custom script extension or in the VM run Command blade powershell script or run it with sysinternsls PSExec.exe

[@shehzadamir11]

@azureacademy i have tried the tutorial but stuck in two issues. One credential manager deletes the credentials after restart and second after adding credentials still machine can't able to access the file share. I have tried to add file share by using mount script it successfully adds it and i can access it. The only difference is mount script has new-psdrive command extra, do you think i am missing something. Testing environment is AVD joined to Azure Ad and win10 muti session host.

[@AzureAcademy]

In Marcel’s blog he mentioned windows version 22H2 needing another reg key for LsaCfgFlags which will fix the credential manager

[@shehzadamir11]

@@AzureAcademy update: troubleshooted the issue with Marcel. The script which is provided has small correction which Marcel will do. The other catch is to run the script as system context i was running the script in user context. To run the script is system context one option can be to leverage run command from the portal.

[@AzureAcademy]

Oh…yeah needs to be in system context otherwise it registers the creds as YOU instead of the computer

[@maryvacherweill8505]

I got this to work - once. I am having to run the script multiple times per day. Why is it not persisting? I have a brand new host pool, session host, workspace, applications group, etc. and new fslogix/storage. We are all in the cloud: no AD DS, no Kerberos, no syncing; ONLY Entra ID authentication. But of course I can't deploy it like this. I don't care about being able to see a mounted drive (although when I DO see it as admin, it indicates "disconnected" even though it worked). What am I doing wrong?

[@AzureAcademy]

I believe the answer is in how you are running the script. You are not in the system context. I show multiple ways to do this here: kzbin.info/www/bejne/r3vUhX2eZ7martEsi=npJK-SOQsWHoJAvy at 11:45

[@maryvacherweill8505]

@@AzureAcademy I ensured I ran the script yesterday using psexe.exe. All worked well in the afternoon through multiple logins of both admin and standard users. Today, after powering up the session host again, I get "The User Profile Service service failed the sign-in. User profile cannot be loaded." I can't seem to find the reason.

[@AzureAcademy]

Is there anything in the windows event viewer? Also is there anything in the Azure Files activity logs for the login failure?

[@maryvacherweill8505]

@@AzureAcademy nothing in Azure Files activity logs. Event Viewer indicates Error 1508 "Windows was unable to load the registry. This problem is often caused by insufficient memory or insufficient security rights." and "The configuration registry database is corrupt." (for every user tried), but when the script is run all works.

[@AzureAcademy]

after you reboot, when people can’t log in, RDP in with an admin account. Then check the credential manager like I showed…is the correct entry for the file share present?

[@shijinm345]

Could you please make a video of setting up fslogix using AAD Kerberos for AD synced users...

[@AzureAcademy]

Already done 👉 kzbin.info/www/bejne/qabZdXtjrrN_bpo

[@shijinm345]

@@AzureAcademy Missed this... Thanks!!

[@AzureAcademy]

Cool

[@alozborne]

What if the storage account was not AD joined but, instead of using a storage key, you cached an Azure AD user account credentials via Credential Manager for each user and then mapped a drive to the fslogix Azure File share using those cached Azure AD user account credentials?

[@AzureAcademy]

Wouldn’t work. The Azure AD user has no rights in the file share so mapping the permissions to credential manager wouldn’t work. And in order to make it work you need Azure AD Kerberos…which requires synced users

[@alozborne]

@@AzureAcademy I didn't mention it but I meant that you could first use the "Connect" PS script with the storage key to mount a drive to the Azure File share, then add Azure AD user/group permissions at the root as needed. Then, the rest of what I mentioned before. I'll need to read up more on the need for syncing for Azure AD kerberos auth, thanks for that detail.

[@AzureAcademy]

Here is my video on Azure AD Kerberos kzbin.info/www/bejne/qabZdXtjrrN_bpo

[@PageyTube]

Hi, can this method be used if your AVD VMs are Azure AD joined, but your users are on-prem syncd? Or do i need to use the Kerberos method?

[@AzureAcademy]

Yes you can do this with Azure AD joined VMs and Synced Users

[@TriumphAventura]

What if the users are cloud sync´ed but you still want to do a VM on a dmz where there is no connectivity to the on-prem domain controller?

[@AzureAcademy]

Without a domain controller the VMs must be Azure AD Joined and the users will function as cloud only users. YES this will work ☺️

[@TriumphAventura]

well thank you sir! love your content@@AzureAcademy

[@AzureAcademy]

Thanks! Very Appreciated 😁

[@tadmazik1024]

I don't think this method works. I read the guide from the source blog. Of course I can get this to work from an interactive user, but from SYSTEM it does not work. You can't at the Azure Files IAM level assign an AAD computer object (machine account) the "Storage File Data SMB Share Contributor" role. To do something like that, you'd need to set "default share-level permissions" which requires an AD source, which is the entire point of trying to cloud-native.

[@AzureAcademy]

Many have told me about this issue…turns out that they were NOT executing the script in the system context. Watch this starting at 11:45 for the right ways kzbin.info/www/bejne/r3vUhX2eZ7martEsi=v1JMaUOQvk1vxrPu

[@remoernst9225]

Hey nice video! I tried your steps manual with an local administrator on my avd session host. Created the registry entries + credential to cred. manager. When i log in with an user over AVD the profiles won't be created. Any idea?

[@AzureAcademy]

I believe the issue is that you are not running the Command with the proper elevated permissions watch this for the exact steps kzbin.info/www/bejne/r3vUhX2eZ7martEsi=V9WHVXiojak9awDf at 11:45

[@remoernst9225]

@@AzureAcademy The real problem was that the storage account key was not added in the system context. Like you said ;) Executed the script on the VM via Azure and it worked. Thank you so much!

[@AzureAcademy]

Awesome!

[@fbifido2]

can you limit the access to the share via allowing only the FSLogix services? if so, how?

[@AzureAcademy]

Not that I know of because of the system context, and that FSLogix works at the OS level. That’s why at the end I said the product team is still working on Azure AD improvements

[@fll-cloud]

The User Profile Disk did not appear in File Share. Do I need to wait for couple of hours to reflect?

[@AzureAcademy]

No, if it worked the profile would show up right away. Check the cmdkey for the storage account credentials…remember they should be in the system account. I show multiple ways to do this process in this video 👉 kzbin.info/www/bejne/r3vUhX2eZ7martEsi=AFQ10p6Su_APu--f

[@fll-cloud]

@@AzureAcademy I was able to sync the Azure Files but after that I was not able to access to session host. DomainTrustCheck and DomainJoinedCheck Failed in Health Status.

[@AzureAcademy]

Usually that is because the passwords are out of sync update the password in powershell and try again

[@DamianFrino]

Thanks!!! Cloud GPO +1

[@AzureAcademy]

Thanks for watching, the Cloud GPO video will be ready next week, stay tuned!

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@footballsuperstar1290]

I am just getting: "FindFile failed for path", "No Create Access......"the parameter is incorrect" . This is for Windows 10 Multi session 21h2. Anyways around this?

[@AzureAcademy]

I haven’t run into that error…check to be sure the credential manager still has the data in it Also have you looked at the FSLogix logs or is that where you saw this error message?

[@footballsuperstar1290]

@@AzureAcademy Thanks, I have checked and yes , still there. I can browse to the share without username and password prompt.. Error message from fslogix is: [ERROR:00000057] FindFile failed for path: \\acwwfslogix.file.core.windows.net\fslogixuserprofiles\AVDTES2_S-1-12-1-772530151-1232695167-1584538045-2811400153\Profile*.VHDX (The parameter is incorrect.) [10:32:56.832][tid:00000c60.000012dc][INFO] Configuration setting not found: SOFTWARE\FSLogix\Profiles\VHDNamePattern. Using default: Profile_%username% [10:32:56.847][tid:00000c60.000012dc][ERROR:00000057] No Create access: \\acwwfslogix.file.core.windows.net\fslogixuserprofiles\AVDTES2_S-1-12-1-772530151-1232695167-1584538045-2811400153-test (The parameter is incorrect.) [10:32:56.847][tid:00000c60.000012dc][INFO] Status set to 6: Cannot retrieve virtual disk location

[@fadijeji]

@@AzureAcademyI got the same errors and these errors came from the Fslogix profile log. I have the same error and the credential manager clears the credentials after logoff estart. I used Windows 10 versions 22H2 and 22H1 and also I tried the LsaCfgFlags registry but it did not work. I have also tried to change the storage account network setting and that solved the issue of failing to find the path. but I still get "the parameter is incorrect" or "Username and password incorrect", knowing I can map the Fslogix drive using the key without issue on the session

[@AzureAcademy]

Did the creds in credential manager disappear?

[@AzureAcademy]

I haven’t scene or heard of that issue happening outside of windows 11 22h2, and the LSACfgFlags regkey fixes it…not sure what’s up with that. I’d suggest contacting support

[@domannicette]

Cloud GPO :)

[@AzureAcademy]

Thanks, should be done by next week

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@jlou65535]

Great video John ! Cloud GPOs could be nice to have ;) One day FSLogix could be stored Blob storage ;)

[@AzureAcademy]

Thanks for watching ☺️. Yes you can use blob storage as well, but it doesn’t scale in performance like SMB file shares.

[@jlou65535]

​@@AzureAcademy Was not aware of that ;)

[@AzureAcademy]

👍👍

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@shajihyder3454]

Dean, thanks for the great video, I tried doing exactly as you have explained in the Video but for some reason, when I login as a regular user, it is not able to create a FSlogix profile for me so what I did was open File Explorer and try to browse to the FSLogix Storage Account and it asking me to put in the credentials. I am not sure if I am missing anything but I RDPd to the Server as a local admin, setup all the Registry Keys and also Saved the Credentials under Windows Credentials and logged off as local admin and used the Remote Destkop (AVD) app to login but it is not creating the FSLogix Profile for me, Am I missing anything?

[@shajihyder3454]

I have also found Marcel's blog and added the registry keys so it doesn't forget the credentials and it is still not working

[@AzureAcademy]

Marcel has a note in his blog for anyone using version 22 H2 there is another registry key for LSACFGflags you need to enter, which will stop the credential manager from wiping out your creds

[@shajihyder3454]

@Azure Academy yes, tried that as well and didn't work

[@AzureAcademy]

What version of windows are you using?

[@shajihyder3454]

@@AzureAcademy windows 11 multisession 22h2 fen 2

[@vcaicedo]

Cloud GPO or Intune?

[@AzureAcademy]

Find out tomorrow at 9 am EST

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@footballsuperstar1290]

Does this work for Pooled session hosts?

[@AzureAcademy]

Yes it does, that’s what I showed in the video

[@footballsuperstar1290]

@@AzureAcademy Thanks for the advice

[@AzureAcademy]

anytime!

[@stbeckma]

Cloud GPO +1

[@AzureAcademy]

Stay tuned, Thanks for watching, the Cloud GPO video will be ready next week

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@TechWorld-vd1oe]

CLOUD GPO

[@AzureAcademy]

kzbin.info/www/bejne/p5m9fKuAm5J8o7csi=5k59SqlcxLlG6X6a let me know what you think

[@otakuguild5603]

Cloud/GPO

[@AzureAcademy]

Next week…stay tuned

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@varishwartripathi3885]

Cloud GPO

[@AzureAcademy]

Thanks!

[@iammagic15]

Cloud gpo 😁

[@AzureAcademy]

Thanks for watching, the Cloud GPO video will be ready next week, stay tuned!

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@MrXaviat]

CloudGPO :)

[@AzureAcademy]

Thanks for watching, the Cloud GPO video will be ready next week

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@tabaniz]

Cloud gpo

[@AzureAcademy]

Here ya go! kzbin.info/www/bejne/p5m9fKuAm5J8o7csi=1Ofuh5FeKyKVu48s

[@BuggageandGlitchage]

Cloud GPO please!

[@AzureAcademy]

Thanks for watching, the Cloud GPO video will be ready next week

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@BuggageandGlitchage]

@@AzureAcademy what a Legend! I’ll check it out right away.

[@AzureAcademy]

What did you think?

[@BuggageandGlitchage]

@@AzureAcademy I showed it my InTune colleague and it blew her away. It’s on our roadmap to start migrating policies over. At the moment we’re focusing on moving away from the MMA and and over to the AMA agent. Might be a good idea for a video as it’s a little tricky with the data collection rules.

[@falkonwickentower3909]

Cloud GPO

[@AzureAcademy]

Thanks!

[@GiovannyBermudez-tt6xb]

CLOUD GPO

[@AzureAcademy]

Here ya go kzbin.info/www/bejne/i3qblZ-BnduCopIsi=gCihKO4BbL80d6yO

[@footballsuperstar1290]

CloudGPO

[@AzureAcademy]

Thanks for watching, Will be ready by next week

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@royzuniga4368]

Cloud GPO

[@AzureAcademy]

Next week, stay tuned

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@ctxshekhar7979]

CloudGPO

[@AzureAcademy]

Working on it, thanks

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@felixcruz5945]

Cloud GPO

[@AzureAcademy]

the Cloud GPO video will be ready next week,

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@fcarloschicao]

Cloud GPO

[@AzureAcademy]

Thanks for watching, the Cloud GPO video will be ready next week

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@vaibby100]

Cloud GPO

[@AzureAcademy]

Thanks for watching, the Cloud GPO video will be ready next week

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️

[@fbifido2]

CLOUD GPO

[@AzureAcademy]

Next week, stay tuned

[@AzureAcademy]

Here is the video I promised on Cloud GPOs 👉 kzbin.info/www/bejne/p5m9fKuAm5J8o7c Let me know what you think ☺️