FSLogix Biggest Issue Azure Virtual Desktop

[@mosksky]

Thanks!

[@AzureAcademy]

Thank you for your support!

[@sergiorivas1857]

Just a quick question. I have a upcoming project where we are building a RDS server rather than WVD/AVD. Would I be able to follow the same steps and do the redirection.xml on the RDS server?

[@AzureAcademy]

Yes FSLogix is the same in RDS or AVD but you will also need licenses to run it in RDS

[@JakeKemme]

Thanks for the great video describing the options and differences. We ended up going with Azure AD Kerberos since it seemed to balance configurability and security well. However, we're seeing that sessions lasting longer than 10 hours have their FSLogix profile disconnected from azure storage due to the kerberos ticket expiring. Be sure to take extra actions (run a scheduled script to refresh ticket, disconnect/ log off idle users) to prevent this from happening to avoid profile saving and loading issues. Any other ideas to mitigate this?

[@AzureAcademy]

First off…I haven’t run into that issue. Please contact support to make them aware of this…I don’t think that should happen there might be an Active Directory setting causing it. Can you also share a link to the script you are using to get a new ticket so others can benefit?

[@rightysahu3881]

Thanks for sharing info. Just a quick query- azure Blob setup done with fslogix but all login users can modify other users profile data. How to isolate user profiles ? Usres are cloud only (No DC).

[@AzureAcademy]

In blob there is no way to isolate which is why the best practice, better performance and security is to use SMB with Azure Files Shares then you can do this what I showed in the video

[@JonahSUI]

Is there a way to do CRUD operations on a user's files in the FSLogix profile as an Azure admin? Would like to automatically create config files within each new FSLogix profile that gets created!

[@AzureAcademy]

Yes, To perform CRUD operations on FSLogix user profile shares, you can follow these general steps: ### Create 1. **Set up FSLogix Profile Containers**: Install FSLogix and configure profile containers 2. **Configure Storage**: Set up an SMB file share with NTFS and share-level permissions 3. **Registry Settings**: Add necessary registry settings for FSLogix 4. **Create Profile Container**: Specify the location for the containers and ensure they are correctly attached ### Read 1. **Verify Configuration**: Check the registry settings and ensure the profile container is correctly attached 2. **List Redirects**: Use the `frx list-redirects` command to list the profile containers ### Update 1. **Modify Registry Settings**: Adjust registry settings if needed 2. **Resize Containers**: Change the size of the profile container if necessary 3. **Update Storage**: Modify the storage location or settings as required ### Delete 1. **Remove Registry Entries**: Delete the relevant registry entries for the profile container 2. **Delete Profile Container**: Remove the profile container from the storage location 3. **Clean Up**: Ensure all references to the profile container are removed.

[@JonahSUI]

@@AzureAcademy Hi Dean! Maybe I can clarify my question. I am trying to access the files within the user's VHDX disk image itself. So far, I haven't found a way for an admin to add a file to a new user's files after their FSLogix profile is created.

[@AzureAcademy]

To do that you have to mount the vhd when it is not in use, the access the file system and add or remove what you need, then unmount This can all be done as a script as well

[@JonahSUI]

@@AzureAcademy Thank you!

[@AzureAcademy]

Anytime!

[@jadan2000]

hello. I currently use AVD for one of my clients. Their AVD was already built before they started working with me. They have The Fslogix profile disks sitting on a file server ( Azure VM) instead of azure file storage. Which, in your opinion is the better option between Azure file storage or a vm file server?

[@AzureAcademy]

Azure Files Shares are INFINITELY BETTER vs VMs with a file server role. VMs cost more, You have to manage the OS, disks, performance etc yourself, Setup and manage your own backup and DR to protect the profiles etc. Azure Files does all that for you…and it costs less.

[@samaelambrona3036]

Hello Dean, Great video showing all the options. I have one doubt though. In the part of the Azure AD joined vm. You run a script with a key taken from the storage account however, this key rotates from time to time. Do you need to run the script every time the key rotates, or the key is only used once? Best regards

[@AzureAcademy]

there are two account keys, and if the key you are using rotates, you would need to re-run the script. Remember this is not a long-term solution, but rather a way to use a cloud only set up until the product team comes out with a product feature or solution.

[@niranmanandhar8517]

Great work and yes would like to know the about cloud cache. Is it correct best practice if we were to enable cloud cache would be to create two separaate profile and 365 containers and keep it separate?.

[@AzureAcademy]

Thanks for letting me know, stay tuned!

[@WernerHart-v9c]

Big thanks for the helpfull info. How can we control the include/exclude groups for FSLogix in the 100% Cloud setup for AAD users and groups only?

[@AzureAcademy]

Everyone is allowed by default to use FSLogix, if they have permissions to log onto the VM. I generally exclude admins so they still get in to troubleshoot if there’s a problem. You can run this on a cloud joined VM by Either as a deployment script as part of your build process or a powershell script deployed from Intune after they are built are 2 easy ways to go.

[@WernerHart-v9c]

Hi Dean, i am running into a showblocker of the cloud only setup. After importing the FSLogix ADMX into Intune and creating a new "Device configuration" it is always presented as "Not applicable". I figured out that it is a topic of the Multi User Win11. It works fine Single user Win 11. But most Device configurations (also the existing ones for Autopilot machines) are not applicable for Multi User OS. Do you have any idea about this issue? thanks and best regards - Werner

[@AzureAcademy]

I haven’t had that issue with my multisession VMs. But when I did my device assignment I did it to all devices. I don’t think this is an issue because the FSLogix settings will only impact VMs with FSLogix installed, and that’s my AVD VMs…make sense

[@marshalexander99]

Great video Dean. How does FSLogix work in the scenario where profiles need to be on multiple storage accounts? I'm thinking here a scenario whereby you host an AVD environment but need to keep the data for each customer in their own storage account.

[@AzureAcademy]

There is NO scenario I can think of why you would need to keep each users data in their own storage account. The proper permissions on the Azure Files Shares isolate each user to their own folder on the share so they can’t see or do anything with anyone else’s learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions#recommended-acls If you still think you need that, please share details and help me understand the scenario. Then I can help find you a way to do it

[@marshalexander99]

@@AzureAcademyit was more to group customers together for billing purposes. We have an application customers currently access via citrix and have no ability to easily chargeback for storage costs. By having each customer in their own storage account (some customers have 2 users, others have 20 for example) they can be accurately billed for app storage usage and profile usage, and also allows all data for one customer to be easily exported in the event of a GDPR/Subject access request/Offboarding process. Hopefully I've explained the requirement a bit more clearly now

[@AzureAcademy]

Then you are aligning a single file share to a host pool…which is a best practice And since you can’t tag a file share you have to do costing at the storage account level So you need 1 storage account with 1 file share per customer…makes sense

[@malcolmwalker2852]

Great Work Dean.

[@AzureAcademy]

Thanks Malcolm!

[@ctxshekhar7979]

Hi Dean - I have a AVD environment as all the sessions hosts are AD DS domain joined. I am using the fslogix for the profile management. Once the user login to the AVD Session host and when he opens the outlook/teams or any office 365 apps it prompts for the password. This happens every time no matter which ever the session host he connects. When we remove the fslogix GPO object the SSO works as the office365 wont prompt for the password. FYI, the same fslogix GPO settings works for the Hybrid AD Joined AVD setup. Can you please help here what could be the issue ?

[@AzureAcademy]

The issue may be your FSLogix redirections.xml file excluding outlook…remove it try again and let me know

[@OS-qh7ww]

Thanks for sharing your knowledge! It was definitely worth it, looking forward to the next Cloud Cache episode.

[@AzureAcademy]

Thanks for watching…here ya go! kzbin.info/www/bejne/eJC1Y3WfarikjNEsi=fb9znK5FeEIZ6AGK

[@osuperfly]

Hi Dean, I tried Intune ADMX import and realized that my policy won’t work with AVD Windows 10 MultiSession VMs. Is that right?

[@AzureAcademy]

Intune just started supporting multisession VMs but it seems that all Intune policies which are more user centric do not get applied the way you expect to a multisession computer. So you can force it to work if you apply to all devices…but be careful what you apply to all devices

[@BuggageandGlitchage]

Wow, this is going down the rabbit hole. I always use your az-140 videos to set up my FSLogix which seem to work perfectly, am I missing a trick?

[@AzureAcademy]

Not really…much the same info just updated some of the methods and redirection info

[@alozborne]

Would love to see a video on the nuances of combining traditional folder redirection with fslogix containers and OneDrive. I would love to be able to redirect Documents, Desktop, and Downloads to an Azure File share, have the rest of the profile reside in an fslogix container, yet still give users access to the OneDrive app (no syncing) within the AVD session. I tried this, but folder redirection and the OneDrive app don't play well together. Ended up having to scrap the plan to use folder redirection. I prefer to use traditional folder redirection for Documents, Desktop, and Downloads as restores require first restoring the fslogix container, mounting that (and praying that it's healthy), and then finally pulling files out of it.

[@AzureAcademy]

A few options here: when I use OneDrive I setup my user profile and OneDrive to be the same place. C:\users\dean\desktop is in the FSLogix profile. But I redirect it to c:\users\Dean\onedrive\Desktop This can be done by right clicking on the desktop folder, properties, location tab Change the location path. This way most of my profile data is in OneDrive and syncs across my devices You can also execute this with a REGEDIT script Does this sound like what you are trying to do

[@SteveTurnbull666]

Would be good to see recommendations on how to stop onedrive from filling up profile containers. Storage sense isn’t the answer since vms are mostly not running 24/7 for even the 1 day policy to kick in since it runs randomly. How do people keep onedrive in check ?

[@AzureAcademy]

Storage sense isn’t supported on multisession anyway… for OneDrive I usually have a bunch of group policies that I use to limit the amount of space someone can download as well as used files on demand and known folder redirection’s, which limits one drive to the minimum‘s then I can also use the redirection’s XML file to take the rest out of my profile Than anything that they download during their session is on the local computer not the profile

[@SteveTurnbull666]

@@AzureAcademy that is one way but in multi session you then run the risk of running out of local disk space if many users are downloading onedrive files and crashing the machine. Machines cost money in azure so we tend to run them with minimal amounts of disk space on c:. All onedrive really needs is a purge policy which would be to define a period of time when files that have not been accessed in the profile container are set back to online mode which is essentially just an attrib flag. Then the profile container compaction option could do the rest at logoff, but to my knowledge no such policy exists

[@AzureAcademy]

That purge policy is what storage sense does…unfortunately it is not supported or recommended on windows multi-session today Disk is not the most expensive part of a VM, powering it on and running IS. So I suggest rethinking your strategy ☺️ the normal VM disk size for the Azure marketplace images is 127GB if you are using VHDLocations with FSLogix, then EVERYTHING in the profile is written to the file share and has NO Impact on local disk, including OneDrive. However, if you are using Cloud Cache and redirections you are impacting the C:\ drive. So you have to pick your poison. Then use OneDrive policy and redirections to limit impact and also consider the user experience. Example: OneDrive files on demand is great for saving space BUT it means the user needs to download that same spreadsheet each time they log in…which takes a second or 2 longer…is that ok to save a little space?

[@lillilblurkin]

Great Video! Appreciate all the awesome content. This is a great 15 min refresher on doing things right. Today we use ADDS with Azure Premium Files. Have found this to be a very simple solution. We then use GPO templates to export for all of our clients with all the FSlogix settings that we need. Most likely we will migrate all these to Intune soon but still cant pull the trigger on full AAD implementation.

[@AzureAcademy]

Thanks! Why the hesitation of full Azure AD Join VMs?

[@lillilblurkin]

@@AzureAcademy I guess from an AVD perspective it just seems like its not fully baked yet. I definitely agree that AAD Kerberos is cool and a unique way to make things happen but definitely seems like some security concerns still. I have no doubt that Microsoft will have this completely revamped before too much longer. Also what is the secret to getting a fast track engineer to help us out? We have been trying to go through our partnership to get a fast track engineer like you engaged with our team. We are an MSP moving our entire customer base from on prem VMware to Azure. We are currently working on fully automating AVD with ADO and Bicep! Your videos have greatly helped with that process! So thank you for all you do.

[@AzureAcademy]

FastTrack engages with customers through nominations Click here for details www.microsoft.com/azure/partners/fasttrack-for-azure

[@Twikkilol]

Thank you so much! I was really looking for 100% cloud solution.

[@AzureAcademy]

You are welcome!

[@alozborne]

One thing that's not clear in this video is that, by disabling "default share-level permissions" when using a hybrid Azure AD + AD DS authentication setup, Domain Admin accounts won't have access to the Azure File share. That's because, despite adding the NTFS permissions as per your video, Domain Admins are not synced to Azure AD when using AD Connect. The only way I have found to grant Domain Admins FC access to Azure File shares is to enable "default share-level permissions" and then configure NTFS root permissions as per your video

[@AzureAcademy]

That is interesting, I don’t remember admins not having access to the share with default share permissions. Is this in the docs? You are 100% right that domain admins are not synced by default

[@alozborne]

@@AzureAcademy I replied, but KZbin removed the reply I guess because I included a link? Anyways, this excerpt from the pertinent document ("Assign share-level permissions") explains: "... If you intend to use a specific Azure AD user or group to access Azure file share resources, that identity must be a hybrid identity that exists in both on-premises AD DS and Azure AD"

[@AzureAcademy]

Right, except the admin group over the share needs to be the share elevated contributor so they can set the NTFS permissions in windows I use a domain admin account for that And I have that account synced into Azure AD And I use default share permissions and it all works

[@alozborne]

@@AzureAcademy Yes, but when AD Connect first came out, Microsoft advised not to sync Domain Admin accounts to Azure AD for security reasons. To be honest, it's annoying to have to administer Azure Files using another account. I'm a little torn about what's the best approach... When setting NTFS root permissions, I mount the share using the storage key, then dismount it and remove the storage key too. It's cumbersome, but hopefully the most secure approach.

[@AzureAcademy]

That’s how I do it too then I JOIN the storage account to AD, add NTFS permissions then remove the key

[@srinivast.p.9301]

Thnx for the knowledge share,definitely worth the watch,waiting for next Cloud Cache.

[@AzureAcademy]

Thanks for letting me know! Stay tuned!

[@mmiltenburg]

Your way of explaining things is favourite to me: fast 😁 Some people take forever😂

[@AzureAcademy]

Awesome, I agree some videos are WAAAAAY too long 👍 I hope you subscribed for more ☺️

[@mosksky]

TY Dean!!! definitely cloud cache :)

[@AzureAcademy]

Cool, thanks for letting me know Len! Stay Tuned!

[@SteveTurnbull666]

Search index with fslogix - completely broken on windows 11 multi session. Would be good to see videos on actual known issues too which have no fix

[@AzureAcademy]

I’m not aware of search indexing being broken…? Broken how? Interesting idea on the video too!

[@SteveTurnbull666]

@@AzureAcademy yes been broken since at least December 2022. Windows 10 multi session is ok, it’s broken on windows 11 Multi session and windows server 2022 I believe. There are a few online forums about it and MS have been testing private fixes for the last couple of months. It pretty much blocks a production windows 11 multi session right now unless you don’t need the search index working

[@AzureAcademy]

I haven’t really found search indexing to be a production stopping feature for customers… what makes you think it is?

[@SteveTurnbull666]

@@AzureAcademy without it working you get a horrible message on windows11 when you click on the start button that says search indexing is off, also it means none of the search options are available In outlook and they are greyed out which is a major issue for our users

[@AzureAcademy]

I don’t experience either of those issues with my Windows 11 Multi-Session VMs! Did you build them from a custom image?

[@kal_the_pal]

why do your videos always force CC? I have to manually toggle it off every single time. Just for your channel. It’s frustrating.

[@AzureAcademy]

It’s because I set the videos to auto caption…it’s the way to activate the translations into 100+ languages so people can watch the video and understand in their own language…a lot of non-English folks watch my videos too…sorry for your inconvenience 🤷🏼‍♂️

[@kal_the_pal]

@@AzureAcademy people can take care of themselves and are more than capable to set up global CC settings on youtube. You’re actually helping no one and just inconveniencing your viewers. I have never experienced this with a channel. No need to be snarky. Why don’t you poll your viewers and find out how wrong you are.

[@AzureAcademy]

Interesting perspective Kal. many people have thanked me for having it enabled, you are the first person in over 2.8M views to complain about it…

[@kal_the_pal]

@@AzureAcademy I just don’t see the logic behind it. Once you enable CC on any video on youtube, the setting is automatically applied on every video you watch thereafter. The opposite should also be true. When I turn off CC on any video the setting is applied to every video after. But not for your channel. You’re the CC saviour nobody asked for. It’s unnecessary. I have never experienced this with any other channels I watch. So not many youtubers do this. Put up an impartial poll and prove me wrong. Or don’t. Either way, I’m obviously watching many of your videos and enjoying the content otherwise. I wouldn’t care to express my frustration if I didn’t.

[@AzureAcademy]

I do appreciate the feedback, Of course I could be wrong here, but I appreciate your input, and you are right, People who spend a lot of time on KZbin definitely know to press C if they want the captions, and someone included them. I just found that many people commented that they appreciated them being on, especially since the auto translate feature became a thing, but I Will put up a poll and see how people feel about it…Thanks Again! ☺️

[@Mkt6040]

Since FSLogix was acquired by Microsoft, I don’t think they have done a great job with its integration when it comes to ease of setting it up and ironing out the issues that your traditional RDS have had such as roaming/FSLogix corrupt profile issues, corrupt outlook OSTs and Teams profiles. I have open cases with Microsoft on these issues. AVD without FSLogix profiles is the best user and admin experience (how a PaaS or SaaS solution should be). I long for the day it would work as “advertised” and the setup would be simple and part of the host pool and VM deployment wizard (replace these scripts, manual permission set up and registry key changes with GUI check boxes). I have cloud only set up with blob storage (CCD locations).

[@AzureAcademy]

Gotta say…your wounds may be self inflicted with FSLogix. Blob storage with cloud cache is not the best performing option, SMB is far better. I have deployed and configured hundreds of customers covering almost 100,000 users around the globe…it absolutely works as advertised. Are there issues with a profile here or there becoming corrupt…YES but as a whole, when it’s setup correctly, works amazingly well.

[@gbaity]

Cloud cache

[@AzureAcademy]

You got it, stay tuned!

[@diegomartinez447]

Cloud Cache!

[@AzureAcademy]

Thanks for sharing, stay tuned!

[@kmajors]

Cloud Cache

[@AzureAcademy]

great, Stay Tuned!

[@stormlight1553]

!!! CLOUD CACHE

[@AzureAcademy]

Thanks for letting mess know! Stay tuned!

[@pacifier316]

CLOUD CACHE

[@AzureAcademy]

Working on it, Stay Tuned

[@deo-max9229]

I am building a house. How did you know?😅

[@AzureAcademy]

LOL Spy Satellites, I'm always watching 😉🤣

[@worldofhemu]

Cloud cache

[@AzureAcademy]

Awesome, stay tuned!

[@sophware]

Cloud Cache

[@AzureAcademy]

Thanks! Stay tuned