Forum Discussion

Dale Hayter's avatar
Dale Hayter
Copper Contributor
Nov 11, 2020

WVD logon issues. The Group Policy Client Service failed the sign-in. Access is denied.

Hi. We have a mutli-session Win10 WVD farm up and running. We are running 1909 with the latest quality updates applied. FSLogix profile container is being used. 

 

We are seeing intermittent issues with users not being able to login. They are being presented with the error:

 

"The Group Policy Client Service failed the sign-in. Access is denied"

 

 

From investigation, cant see anything appropriate in the event logs. Anyone seen this issue before?

 

 

  • Lee_E's avatar
    Lee_E
    Brass Contributor

    I've set up a 5 minute scheduled task that runs a script (below).  It's not pretty and if someone logs off and back on in less than 5 minutes it may still error until the 5 minute point but it works for us. We can run this with minimal complications until a production ready version is released.  Hope this helps a few of you.

    $profilesKey = "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileService\References\"
    $userProfiles = Get-ChildItem -Path $profilesKey
    ForEach ($userProfile in $userProfiles) { 
        $RefCountProperty = Get-ItemPropertyValue -Path "Registry::$userProfile" -Name "RefCount"
        If ($RefCountProperty[0] -eq 1) {
            $RefCountProperty[0] = 0
            Set-ItemProperty -Path "Registry::$userProfile" -Name "RefCount" -Value $RefCountProperty 
        }
    }

     

    • StevenR's avatar
      StevenR
      Brass Contributor
      Life saver, I had this issue when not even using fslogix but was on an Azure AD joined AVD, deleting the user from the "Reference" folder fixed it, Thanks
    • bloggin1725's avatar
      bloggin1725
      Copper Contributor

      michael_moshkovich 

       

      Hi Michael, we are seeing this issue with the latest FSLogix version running on Server 2022.  If I set the Refcount key to 0 then the affected person can log in again.

    • Andreas Möri's avatar
      Andreas Möri
      Copper Contributor
      same for us "access denied" for users (less then before but still happening)... with AVD and Windows 10 Enterprise multi-session (mostly when 2 or more sessions hosts are in a AVD-ppol)
    • SOVE-82's avatar
      SOVE-82
      Copper Contributor
      Hi,
      I installed fslogix 2201 hotfix 1 but we still have this issue.
      We are using profile and office container in a RDS environment.
      We notice the problem when the server does an unexpected reboot and with user logged on.
      With Lab I noticed that this issue appear only when office 365 Is installed, without it there is no issues.
      If I delete the "user" folder the user can log in. If can help under the user folder there is ntuser.dat file (without Office 365, the folder is empty).
      Regards
  • Is it consistent repro on the same sessionhosts? Can you please share the connection activityid that produce this error?
    From the activityId, find out the session host, check the sessionhost eventlog for any FSLogix, user profiles errors. Please share your findings.
  • mark1nh's avatar
    mark1nh
    Copper Contributor
    We see the same problem with citrix server 2019 based multisession. the folder c:\users\local_USERNAME cannot be deleted because some process locks appdata\local\credentials.

    Only solution: reboot the affected server.
    • Dale Hayter's avatar
      Dale Hayter
      Copper Contributor

      mark1nh From our investigation the issue was caused by the FSLogix service stopping for some reason. This then resulted in profiles being left behind. We are still working with Microsoft on a resolution for the stopping of the service.

  • Hello All, The fix will be included into the next FSLogix version released on January with a public preview this month. We are in the middle of a testing phase as we cannot release a version or a fix without fully tested otherwise we could have other issues in your environment. Our sincerely apologies for all problems that this is causing in your environment. Feel free to reach me out if you have additional questions.

    • lilalexMS's avatar
      lilalexMS
      Brass Contributor
      Hi Guido! have you got some other updates about the fix? The ETA that you say us is confirmed? We have big troubles with our customers.
      • Guido's avatar
        Guido
        Icon for Microsoft rankMicrosoft

        Hello. The FSLogix Public preview version has slipped to early January. We apologize for any inconvenience this may cause.

    • sachin1988's avatar
      sachin1988
      Copper Contributor
      Will this resolved permanently once and after installation of latest version (FSLogix) ?
      • CaptainReboot's avatar
        CaptainReboot
        Brass Contributor
        It has resolved it for us so far. We have not seen the error come up since. Please note that you need the preview version of FSLogix, not the latest production version.
  • Hi Dale, try a reboot and see if it fixes the issue temporarily (am sure it will)
    Also you can always:
    ○ Look for RefCount value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileService\References\<User SID> and set that to 0

    This is a temp fix for the issue

    Lets hope it gets fixed in the next version
    • syedaltamash's avatar
      syedaltamash
      Copper Contributor

      Agdar 
      We are facing same issue from many days we have many times changed ReFcount value to 0 but again and again it's reversing.

       

      • MarkF26's avatar
        MarkF26
        Brass Contributor

        syedaltamash 

        I am suggesting the following short script as a logoff script for WVD users to be deployed by a GPO. Please use at your won risk: 

        $ProfRefsPath  = "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileService\References"
        $MySID = (Get-CimInstance -Class Win32_UserAccount -Filter "Domain = '$ENV:Userdomain' AND Name = '$ENV:UserName'").SID
        If (Test-path $ProfRefsPath\$MySID) {
           set-itemProperty -Path $ProfRefsPath\$MySID -Name RefCount -Value 0
        
        }