Forum Discussion
Having trouble with FSLogix user profile sharing - any good troubleshooting steps to follow?
I followed the steps in https://docs.microsoft.com/en-us/azure/virtual-desktop/create-host-pools-user-profile.
The problem I have is that the profile is not shared. Also I see no files in share folder when I logon to the file server. It appears to be an access issue to the file share for FSLogix.
Basically I am asking: If this is an access issue to the share for FSLogix, what am I missing in my setup?
Possibly also interesting if there is a tool to check what is wrong or a manual check-list.
Browsed Get-RdsDiagnosticActivities - No relevant info
Browsed Applications/FSLogix App/Operational Event Log:
- FindFile failed for path: \\prod-fs-vm00\rdsavprofiles\<SID>\Profile*.VHDX (Access is denied.)
- No Create access: \\prod-fs-vm00\rdsavprofiles\<SID>_<USER>-test (Access is denied.)
- Unable to find parent path of "" ({Application Error} The exception s (0x)
I did the following in the my domain:
1. Added a file share server in the domain (Using an Azure AD DS domain)
2. Shared a folder according to the steps and gave all "Domain Computers" access to share and NTFS folder (Get-ADGroupMember -Identity "Domain Computers": Includes both hostpool hosts as expected)
3. Created a "custom image" where I followed the steps in configuring FSLogix before running sysprep
4. Created a host pool with two servers from this custom image in the same domain as file server
5. Logged in with a user and checked what host the user was routed to.
6. Created a .txt document in my documents
7. Logged off
8. Stopped the machine the user logged on to to see if profiles are saved of file server
9. Logged on again and got routed to the other (only running) server
10. Looked for the .txt file in my documents - not there - profile sharing not working...
Wrong Approch with icacls y: /grant "CONTOSO\AVDUsers:(M)"
When we mount the drive with the net use command, it says using the Access key.
Since we use Azure<storageaccountname>, It will look like a group in windows.core.net rather than the desired ADDS or Entra Domain service.The mounted storage should use the desired domain ID with elevated SMB rights.
Hello all,
I my case, I worked with a Microsoft expert on this and we got it to work for my account just fine. All other users trying to login got the error that many people have seen here. I figured it was a permissions issue....but where?
Here is the Microsoft doc for setting up the Azure Files Shares:
Step 4 in the 'Configure NTFS permissions' section: (This is done on one of the VM's in the host pool.)
After running all four icacls lines for the first user, you will need to run the first icacls line for EVERY USER INDIVIDUALLY for BOTH the Windows profile and the Office profile local VM shares. Oddly, you only need to do this on the on VM. I tried on the second and it was already done 🙂
The 'net use' commands in step 2 creates the links to the Azure File shares, but you need to apply permissions to the shares that are consistent to the permissions on the shares in Azure Files (Storage File Data SMB Share Contributor). Also so users are not not able to access other users profiles.
Example for LOCAL share permissions:
(O and R drive letters are what I used on Step 2)
icacls O: /grant john.doe@contoso.com:(M)
icacls R: /grant john.doe@contoso.com:(M)
I hope this helps!
Mark Plantenberg Is there not a way to use Security groups instead? I mean I have 3,000 users I have to set this up for, Does this mean I Have to script it for all the users, and then when we get new employees gotta remember to do this for them as well? That's crazy to maintain.
You can use groups. Its described here:
Set up FSLogix Profile Container with Azure Files and AD DS or Azure AD DS - Azure Virtual Desktop | Microsoft Learn
Stefan GeorgievMicrosoft
Johan_Eriksson sorry for the stupid question but did you follow the steps to enable FSLogix and point that agent to the path you have created
No questions are stupid when troubleshooting: I specified the UNC path to the share.
My suspicion is that step 5. under https://docs.microsoft.com/en-us/azure/virtual-desktop/create-host-pools-user-profile#prepare-the-virtual-machine-to-act-as-a-file-share-for-user-profiles is perhaps lacking some permissions that FSLogix require.
On a hunch, I gave "Domain Users" full control to the share and it started to work. I then removed "Domain Users" and FSLogix was unable to load the profile. My wild guess is therefore that "Domain Computers" full control permissions are insufficient for proper operations.
(Also note that the link FSLogix documentation at the end of that section only leads to a login prompt for me. I tried to get a user account from FSLogix, but it was not accepted.)
Hi
We are doing this with azure storage instead of using a server and it doesn't work.
We followed the instructions on this link.
We create the share
We enable AAD DS
We assign specific users with "Storage File Data SMB Share Contributor" role to the share
We mount the share on a VM and configure full access for domain users
But still not allowing access
On the event log I can see this message:
No Create access: \\intechwvd.file.core.windows.net\wvdprofiles\S-1-5-21-303179029-2383376087-3032883996-1139_jmorales-test (The user name or password is incorrect.)
