Tip for capturing custom Windows 10 multi-session image for WVD

Azure gives us a nifty feature for capturing images from virtual machines. The high-level process is as follows:

• Create the VM with Windows 10 multi-session
• Install apps and customize
• Snapshot the VM for future use
  
• Sysprep and generalize the image
• Capture the image
• The image is then available in the gallery for creating WVD host pools
  

You'll find the capture feature in the Overview of the VM. Note that the capture renders the VM unusable and you can check a box to automatically delete the VM. If you want to revert you will have to create a new VM and apply the snapshot.

That all sounds great so what is the problem? The problem is actually a well known issue with capturing custom Windows 10 images. If you allow the reference computer (often a Hyper-V VM) to connect to the internet then the device can connect to the Windows 10 Store and update the built-in apps. This can cause Sysprep to fail. 

Sysprep fails after you remove or update Microsoft Store apps that include built-in Windows images

The easy way around that is to remove the NIC from the VM so that this cannot happen. 

However what can we do in Azure? You can't remove the NIC as you wouldn't be able to access the VM in that case. 

This is the Sysprep error I was seeing on my Azure reference computer. 

SYSPRP Failed to remove staged package Microsoft.PPIProjection_10.0.18362.449_neutral_neutral_cw5n1h2txyewy: 0x80070002.[gle=0x00000002]

I needed to prevent internet access but still maintain network access. DNS to the rescue. Normally a VM inherits DNS settings from the virtual network. However you can configure a custom DNS server for any VM. If you configure a DNS server that doesn't exist then the VM will not be able to access the internet but you still retain network access.

Click on the network interface for the VM.

 

You'll find that in the Networking blade.

Configure the dummy DNS server. Remember you have to be quick. Do this as soon as the VM is created. This worked for me and I was able to successfully syprep and capture the image. 

I hope this helps. Until next time........

Managing Windows Virtual Desktops with Microsoft Endpoint Manager

Unsurprisingly, I have spent a lot of time recently deploying WVD solutions. In this blog post I want to highlight the MEM features that you can use to manage these desktops, especially in regard to Windows 10 multi-session. At the time of writing Configuration Manager 2006 in the latest production version.

For performance reasons ConfigMgr disables user policies on Windows 10 multi-session devices. This only happens with new client installations (1906 and later). If you upgraded the client from a previous version (pre 1906) then user policies will still be enabled. There may, of course, be a situation where you want to enable user policies and will accept any performance hit.

Open the Client Policy tab of Client Settings and choose "Enable user policy for multiple user sessions"

In versions 2006 and later, Windows 10 multi-session is now available in the list of supported versions for requirement rules. This is very useful when targeting FSLogix installations and registry settings.

If you previously selected the top-level Windows 10 platform, this action automatically selected all child platforms. The new platform isn't automatically selected. If you want to add Windows 10 multi-session, manually select it in the list.

Notes:

• Currently Intune does not support Windows 10 multi-session but development work is actively being carried out.
• Co-management is not supported on a client running Windows 10 multi-session.

These are exciting new MEM features with more to come. I hope this helps.

Until next time.......

Windows Virtual Desktop - AD join account requirements

It took me a while to figure out why my customer deployment of a WVD host pool would not work. Everything looked normal to me. The problem was that the VMs could be created but could not be joined to the domain (remember all Windows Virtual Desktops must be domain joined). Eventually I tracked down the problem to the domain-join account. This made me look more closely at the requirements for this account, so here we go.

What is the WVD domain-join account? 

This account has to be entered during the provisioning of a WVD host pool.

One of the required items is the AD domain join UPN. This is the account that will be used to join the VMs to your on-premises Active Directory. If you look at the tooltip you will see the following text:

"UPN of an Active Directory user that has permissions and will be used to join the virtual machines to your domain. For example, vmjoiner@contoso.com. A local user account with this name will be created on each virtual machine. Do not enter a user who has MFA enabled. See https://aka.ms/vmUsernameReq for invalid usernames".

There are a few takeways here.

• the account must have permissions to join AD (this is obvious)
• a local account is actually created on each VM
• the account cannot be MFA enabled
• take note of the URL for invalid usernames (see next section)

Requirement #1: MFA cannot be enabled on the WVD AD join account. 

(tip: you should create a service account for this).

Invalid usernames

The official WVD docs don't tell us much about the requirements for this account.

"Enter the user principal name and password. This account must be the domain account that will join the virtual machines to the Active Directory domain. This same username and password will be created on the virtual machines as a local account. You can reset these local accounts later".

However there are some specific requirements around invalid usernames, which are actually enforced by Azure (this was my problem). You can find them in the Azure VMs FAQ docs 

These are the blacklisted usernames. There are a number of popular contenders in there.

Requirement #2: the username cannot be one of the blacklisted usernames.

Password

You will find the password requirements in the same doc

Requirement #3: in general the password must be complex with a minimum of 12 characters.

I hope this helps you when implementing WVD. Until next time.....

Error while adding users to WVD host pool - apostrophe problem

I was creating a Windows Virtual Desktop environment for a customer today and had some difficulty when I was creating the host pool. WVD is not yet fully integrated with the Azure portal so doesn't support dynamic groups. You have to add a comma separated list of users when you are creating the host pool (or you can do it afterwards). Anyway I was getting this error when I entered a pre-prepared list of approximately 200 users.

The list may only contain UPNs (in the form of valid email addresses) separated by commas. Leading whitespace, trailing whitespace, or additional spaces before or after commas is not allowed.

I looked through my list in Notepad trying to find a space before or after a comma but no joy. Eventually I found the problem. One of the users had an apostrophe in their UPN and this was messing with my formatting. Removing this UPN from the list allowed me to continue.

It's the little things that cost you the most time sometimes. I hope this helps if you see a similar problem.

Until next time.....

Creating a Windows Virtual Desktop host pool and MFA

For now you can't. It's not supported to use an MFA enabled account when creating a WVD host pool. That's a little tricky. Most production accounts should at this stage be MFA enabled. So what do we do? It's easy, we can use an Azure AD service principal.

What is that about? 

It's not a user account. Rather, an Azure service principal is a security identity used by user-created apps, services, and automation tools to access specific Azure resources.

So how do we use it?

These are the steps we will follow:

• Create a service principal in Azure Active Directory.
• Create a role assignment in Windows Virtual Desktop.
• Sign in to Windows Virtual Desktop by using the service principal.
• Create the WVD host pool.

The first steps involve using PowerShell.

• First install the Azure AD and WVD PoSH modules.

Install-Module AzureAD

Install-Module -Name Microsoft.RDInfra.RDPowerShell

Import-Module -Name Microsoft.RDInfra.RDPowerShell

• Next create the service principal in Azure AD.

Import-Module AzureAD
$aadContext = Connect-AzureAD
$svcPrincipal = New-AzureADApplication -AvailableToOtherTenants $true -DisplayName "Windows Virtual Desktop Svc Principal"
$svcPrincipalCreds = New-AzureADApplicationPasswordCredential -ObjectId $svcPrincipal.ObjectId

• Now that you've created the service principal you'll need some details before you can continue.

Check the service principal password (you need to do this now as you won't be able to retrieve it once you close this PoSH session).

$svcPrincipalCreds.Value (this will be Result 1)

Tenant ID:

$aadContext.TenantId.Guid (Result 2)

Application ID:

$svcPrincipal.AppId (Result 3)

• Now create a role assignment for the service principal in Azure AD

First get your tenant name

Add-RdsAccount -DeploymentUrl "https://rdbroker.wvd.microsoft.com"
Get-RdsTenant

Add the role assignment

$myTenantName = "<Windows Virtual Desktop Tenant Name>"
New-RdsRoleAssignment -RoleDefinitionName "RDS Owner" -ApplicationId $svcPrincipal.AppId -TenantName $myTenantName

Test the service principal by signing into Azure AD

$creds = New-Object System.Management.Automation.PSCredential($svcPrincipal.AppId, (ConvertTo-SecureString $svcPrincipalCreds.Value -AsPlainText -Force))
Add-RdsAccount -DeploymentUrl "https://rdbroker.wvd.microsoft.com" -Credential $creds -ServicePrincipal -AadTenantId $aadContext.TenantId.Guid

• Finally we can use the service principal to create the WVD host pool

On the Windows Virtual Desktop information page, choose Service principal as the Windows Virtual Desktop RDS owner.

Enter the results from the previous PoSH cmdlets and continue to create the WVD host pool.

I hope this helps. Until next time....

fslogix issue - the media is write protected

This was a tricky little issue to solve. I've implemented a Windows Virtual Desktop POC for a customer and this included configuring fslogix for profile management. The initial registry settings were pretty straightforward:

HKLM\Software\fslogix.
Created a Profiles key with the following values:

Name: Enabled, Type: DWORD, Value: 1
Name: VHDLocations, Type: Multi-String Value, Value: \\remoteshare\Profiles

However my test accounts were being logged on with temporary profiles. Luckily fslogix has good logging. I configured verbose logging (HKLM\SOFTWARE\FSLogix\Logging\LoggingLevel=0)

The log file can be located %ProgramData%\FSLogix\Logs\Profile\Profile-xxxx.log

[00:29:42.963][tid:00000d60.00002248][INFO]             VHD attached
[00:29:42.963][tid:00000d60.00000d64][INFO]             Volume attach event
[00:29:43.056][tid:00000d60.00002248][INFO]             Volume name: \\?\Volume{c58d9a99-2a23-420d-ab67-b45e416cfaae}\
[00:29:43.056][tid:00000d60.00002248][INFO]             Configuration setting not found: SOFTWARE\FSLogix\Profiles\CleanOutNotifications.  Using default: 1
[00:29:43.056][tid:00000d60.00002248][INFO]             Prep1
[00:29:43.056][tid:00000d60.00002248][INFO]             Status set to 100: Waiting for the Windows Profile Service to determine the user's profile folder
[00:29:43.056][tid:00000d60.00002248][INFO]             Profile refcount incremented to: 1
[00:29:43.056][tid:00000d60.00002248][INFO]             Configuration setting not found: SOFTWARE\FSLogix\Profiles\CleanOutNotifications.  Using default: 1
[00:29:43.056][tid:00000d60.00002248][INFO]             Prep1
[00:29:43.074][tid:00000d60.00002248][INFO]             Configuration setting not found: SOFTWARE\FSLogix\Profiles\RegisterAppNotifications.  Using default: 1
[00:29:43.074][tid:00000d60.00002248][INFO]             Prep2
[00:29:43.074][tid:00000d60.00002248][INFO]             Prep2 \AppData\Local\Microsoft\Windows\UsrClass.dat was not found.
[00:29:43.074][tid:00000d60.00002248][INFO]             OneDriveTemp setup
[00:29:43.074][tid:00000d60.00002248][INFO]             C:\OneDriveTemp\S-1-5-21-1xxxxxxxx--> \\?\Volume{c58d9a99-2a23-420d-ab67-b45e416cfaae}\ODTemp
[00:29:43.074][tid:00000d60.00002248][INFO]             OneDriveTemp setup successful
[00:29:43.074][tid:00000d60.00002248][INFO]             Configuration setting not found: SOFTWARE\FSLogix\Profiles\CleanOutNotifications.  Using default: 1
[00:29:43.074][tid:00000d60.00002248][INFO]             Prep1
[00:29:43.074][tid:00000d60.00002248][INFO]             Configuration setting not found: SOFTWARE\FSLogix\Profiles\PreventLoginWithFailure.  Using default: 0
[00:29:43.074][tid:00000d60.00002248][INFO]             vhd(x) \\remoteshare\Profiles\S-1-5-21-1xxxxx_ghampson\Profile_ghampson.vhd has 29932.54 MB left (99.78 % free)
[00:29:43.074][tid:00000d60.00002248][INFO]             LoadProfile successful.  User: ghampson. SID: S-1-5-21xxxxxx
[00:29:43.074][tid:00000d60.00002248][INFO]             loadProfile time: 12797 milliseconds
[00:29:43.074][tid:00000d60.00002248][INFO]           ===== End Session:  LoadProfile: ghampson
[00:29:43.074][tid:00000d60.00002248][INFO]           ===== End Session: Logon
[00:29:43.135][tid:00000d60.00001508][INFO]           ===== Begin Session: Profile Directory Changed: S-1-5-21-108xxxxxxx
[00:29:43.135][tid:00000d60.00001508][INFO]            New Profile Directory: C:\Users\ghampson
[00:29:43.135][tid:00000d60.00001508][INFO]            Configuration setting not found: SOFTWARE\FSLogix\Profiles\ProfileDirSDDL.  Using default:
[00:29:43.135][tid:00000d60.00001508][ERROR:00000013]  CreateDirectory failure: \\?\Volume{c58d9a99-2a23-420d-ab67-b45e416cfaae}\Profile (The media is write protected.)
[00:29:43.135][tid:00000d60.00001508][ERROR:00000013]  Creating VHD Profile directory: \\?\Volume{c58d9a99-2a23-420d-ab67-b45e416cfaae}\Profile (The media is write protected.)
[00:29:43.135][tid:00000d60.00001508][INFO]            Added redirection C:\Users\ghampson -> \\?\Volume{c58d9a99-2a23-420d-ab67-b45e416cfaae}\Profile
[00:29:43.135][tid:00000d60.00001508][INFO]            Configuration setting not found: SOFTWARE\FSLogix\Profiles\KeepLocalDir.  Using default: 0
[00:29:43.135][tid:00000d60.00001508][INFO]            Local temp directory: C:\Users\local_ghampson
[00:29:43.135][tid:00000d60.00001508][INFO]            Successfully handled: S-1-5-21-1xxxxxxxx
[00:29:43.135][tid:00000d60.00001508][INFO]           ===== End Session: Profile Directory Changed: S-1-5-21-1xxxxxxx
[00:29:43.197][tid:00000d60.00001bb4][INFO]           ===== Begin Session: Profile Directory Changed: S-1-5-21-10xxxxxxxx
[00:29:43.197][tid:00000d60.00001bb4][INFO]            New Profile Directory: C:\Users\TEMP

[00:29:43.213][tid:00000d60.00001bb4][INFO]           ===== End Session: Profile Directory Changed: S-1-5-21-10xxxxxxx

So it looked like the flow was as follows:

•  the VHD was created successfully on the remote share (verified)
•  the VHD was mounted successfully
•  fslogix could not copy files to the mounted VHD
•  fslogix profile could not be loaded
•  temporary local profile was created

This was the key line from the log file

CreateDirectory failure: \\?\Volume{c58d9a99-2a23-420d-ab67-b45e416cfaae}\Profile (The media is write protected.)

The mounted VHD file was write-protected, but why? I've implemented this solution previously and didn't have this problem. Group policy is always a good place to start and sure enough I found the problem there.

GPO: Deny write access to fixed drives not protected by BitLocker

This GPO setting was enabled. The result was that all fixed drives that are not BitLocker-protected would be mounted as read-only.

I filtered the GPO targeting so that the GPO was not applied to the WVD desktops and all was good. I hope this helps you if you run into the same issue.

Until next time....

Deploy management tool for Windows Virtual Desktop host pools

I've been test driving Windows Virtual Desktop recently and I'm impressed with what I've seen. I've blogged about my experience here. I have noticed however that I can create a host pool in the Azure Portal but I can't see it or manage it afterwards in the portal. 

I can see the VMs but not the host pool. 

Try it yourself. Have a look at All Resources. You won't find anything related to Windows Virtual Desktop or host pools.

So how do we manage WVD? We have two options. We can manage the host pool using PowerShell (see here for a full list of cmdlets) or we can create our own management user interface. It's very easy. Microsoft have already provided a sample, which is an Azure Resource Manager template. Admins are encouraged to customize to suit their requirements. 

Here's how it works.

Navigate to the ARM template on GitHub

Scroll down and select Deploy to Azure. You'll need permissions to create resources in your Azure subscription.

Enter the parameters (subscription, resource group, admin account). Give the application a unique name.

The deployment is under way and you can see the resources being created.

The deployment has completed. Now we need to launch the tool.

First, ensure that Users can consent to apps accessing company data on their behalf.

Where do we get the URL for the tool? Have a look in All Resources and find the application that you have just created.

You'll find the URL on the top right corner. It's of the format https://yourappname.azurewebsites.net. Browse to the URL and sign in with the host pool owner.

Grant permission to access WVD.

Choose your Tenant Group from the drop-down arrow and you have access to the host pool.

You can now manage the host pool. See how you can add or drain a host and see details of user sessions.

I hope you find this useful. Until next time.

Use FSLogix Containers for Windows Virtual Desktop profiles

Recently I published a blog post of my first experience with Windows Virtual Desktop. In this post we'll look at how to integrate with FSLogix containers for profile management. This is now the recommended profile management solution for WVD. The User Profile Disk (UPD) solution has been around for a long time (introduced in Windows Server 2012). However it is scheduled for deprecation. This was inevitable since Microsoft acquired FSLogix in 2018.

So what is FSLogix all about? 

Remember roaming profiles? I've always hated them. They grow in size and out of control. When a user logs in the entire profile is copied from a central location to the desktop. This can takes ages and provides a very poor user experience. I've always seen roaming profiles as nothing but trouble so have avoided implementing them at all costs to avoid the 9am madness. 

FSLogix is designed to provide "roaming-profile-like" functionality in remote computing environments, such as WVD. When a user logs into a VM in the host pool, the FSLogix container is dynamically attached using a natively supported Virtual Hard Disk (VHD) or a Hyper-V Virtual Hard Disk (VHDX). The user profile is immediately available and appears in the system exactly like a native user profile. No data is actually copied so the performance and user experience are first class (which is why FSLogix have been the industry leader in this space for quite some time).

How do I buy FSLogix?

FSLogix is not licensed independently (and doesn't actually require a license key to install). It is included with many Microsoft licensing bundles (e.g. Microsoft 365 E3/E5). You can find the full list here.

Storage option

Where do we begin? The first thing we must do is decide where the FSLogix containers will be stored. There are a number of options in Azure.

You can use any of the following technologies:

• Azure Files
• Azure NetApp files
• Storage Spaces Direct

You can read about these technologies and the pros and cons of each in the official Microsoft documentation.

For my testing I've decided to keep it simple. I'll use a traditional fileshare. Obviously this fileshare cannot be on one of the host pool VMs so I'll need another VM for that.

I created a new Azure VM (WVDShare).

It was on the same virtual network as my host pool VMs. It had a public as well as private IP address so I would be able to connect remotely via RDP.

DNS was already configured on this virtual network (that's the IP address of my DC). The VM was joined to the Active Directory domain.

I created an AD group and added my test user.

Finally I created a share (\\WVDShare\FSLogix) on the VM and assigned full control to the AD group.

Install and configure FSLogix

Next FSLogix had to be installed on all the VMs in the host pool. I only had three so I did this manually. However you could use a management tool like ConfigMgr to automate the installation.

The host pool VMs were not configured with public IP addresses by default so the easiest way to connect was via WVDShare which was on same virtual network but had a public IP address.

The FSLogix software was downloaded using this link

https://go.microsoft.com/fwlink/?linkid=2084562

The files were extracted.

I was interested in x64. I launched the installer (FSLogixAppsSetup.exe).

Accepted the license terms for the various components and started the installation.

The installation was short......

….and finished successfully.

The FSLogix folder structure.

App could be seen in "Programs & Features". It could now be configured - which really meant some registry changes.

Ran RegEdit as an administrator. Navigated to HKLM\Software\FSLogix.

Created a key named Profiles.

Created the following values for the Profiles key:

Name: Enabled
Type: DWORD
Value: 1

Name: VHDLocations
Type: Multi-String Value
Value: \\WVDShare\FSLogix

This told FSLogix where to save the user profile.

Unfortunately this gave me an error, although it seemed to work:

Data of type REG_MULTI_SZ cannot contain empty strings. Registry editor will remove any empty strings found. 

I don't like messy so I re-created the value as a string value and didn't get the error. After all I only had a single value.

The registry settings should then be configured on the other host pool VMS. This can be done with a GPO but for simplicity I just exported the key and imported to the other VMs. 

See the local groups created by the installation. By default the Include group contains "Everyone" and the Exclude group contains the "Administrator" account.

Members of the Include group are subject to the FSLogix policy. Members of the Exclude group are not.

User Experience

All the configurations had been carried out so I just needed to log in to the host pool to see the profile management solution working. However it didn't work for me first time. I didn't see anything in the \\WVDShare\FSlogix folder.

I followed this procedure to configure logging.

HKLM\Software\FSLogix\Logging

Name: LoggingEnabled
Type: DWORD
Value: 2

This was the log file I needed.

There was my answer. 

"Local profile already exists. Do nothing".

I hadn't read anything in the docs about local profiles and the fact that they should not exist for the FSLogix solution to function. However when I looked further I found it in this troubleshooting doc.

I deleted the local profile and signed in again.

This looked a little better.

I created a file on the desktop of GH-2.

Signed out of the VM. Looks like the profile was being saved to the FSLogix container.

 

I signed in to the host pool again. This time I got GH-0 and there was my file on the desktop - cool.

Finally I could see content in the FSLogix share.

It's a VHD as expected.

I really like the integration of FSLogix and WVD. It's very effective and really easy to set up and configure. I hope this helps you to do the same.

Until next time.....