WVD logon issues. The Group Policy Client Service failed the sign-in. Access is denied.

%3CLINGO-SUB%20id%3D%22lingo-sub-1876481%22%20slang%3D%22en-US%22%3EWVD%20logon%20issues.%20The%20Group%20Policy%20Client%20Service%20failed%20the%20sign-in.%20Access%20is%20denied.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1876481%22%20slang%3D%22en-US%22%3E%3CP%3EHi.%20We%20have%20a%20mutli-session%20Win10%20WVD%20farm%20up%20and%20running.%20We%20are%20running%201909%20with%20the%20latest%20quality%20updates%20applied.%20FSLogix%20profile%20container%20is%20being%20used.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20seeing%20intermittent%20issues%20with%20users%20not%20being%20able%20to%20login.%20They%20are%20being%20presented%20with%20the%20error%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%22The%20Group%20Policy%20Client%20Service%20failed%20the%20sign-in.%20Access%20is%20denied%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22wvderror.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F232916iEB0557BAD622B4AD%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22wvderror.png%22%20alt%3D%22wvderror.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFrom%20investigation%2C%20cant%20see%20anything%20appropriate%20in%20the%20event%20logs.%20Anyone%20seen%20this%20issue%20before%3F%3C%2FP%3E%3CDIV%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1877618%22%20slang%3D%22en-US%22%3ERe%3A%20WVD%20logon%20issues.%20The%20Group%20Policy%20Client%20Service%20failed%20the%20sign-in.%20Access%20is%20denied.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1877618%22%20slang%3D%22en-US%22%3EIs%20it%20consistent%20repro%20on%20the%20same%20sessionhosts%3F%20Can%20you%20please%20share%20the%20connection%20activityid%20that%20produce%20this%20error%3F%3CBR%20%2F%3EFrom%20the%20activityId%2C%20find%20out%20the%20session%20host%2C%20check%20the%20sessionhost%20eventlog%20for%20any%20FSLogix%2C%20user%20profiles%20errors.%20Please%20share%20your%20findings.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2325356%22%20slang%3D%22en-US%22%3ERe%3A%20WVD%20logon%20issues.%20The%20Group%20Policy%20Client%20Service%20failed%20the%20sign-in.%20Access%20is%20denied.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2325356%22%20slang%3D%22en-US%22%3EWe%20see%20the%20same%20problem%20with%20citrix%20server%202019%20based%20multisession.%20the%20folder%20c%3A%5Cusers%5Clocal_USERNAME%20cannot%20be%20deleted%20because%20some%20process%20locks%20appdata%5Clocal%5Ccredentials.%3CBR%20%2F%3E%3CBR%20%2F%3EOnly%20solution%3A%20reboot%20the%20affected%20server.%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi. We have a mutli-session Win10 WVD farm up and running. We are running 1909 with the latest quality updates applied. FSLogix profile container is being used. 

 

We are seeing intermittent issues with users not being able to login. They are being presented with the error:

 

"The Group Policy Client Service failed the sign-in. Access is denied"

 

wvderror.png

 

From investigation, cant see anything appropriate in the event logs. Anyone seen this issue before?

 

 

36 Replies
Is it consistent repro on the same sessionhosts? Can you please share the connection activityid that produce this error?
From the activityId, find out the session host, check the sessionhost eventlog for any FSLogix, user profiles errors. Please share your findings.
We see the same problem with citrix server 2019 based multisession. the folder c:\users\local_USERNAME cannot be deleted because some process locks appdata\local\credentials.

Only solution: reboot the affected server.

@mark1nh From our investigation the issue was caused by the FSLogix service stopping for some reason. This then resulted in profiles being left behind. We are still working with Microsoft on a resolution for the stopping of the service.

@Dale Hayter Did you find any solution, as I am facing the same problem.

Hi Dave,
Appreciate any update on this we are seeing the same symptoms
Hello. Could you please check if setting up RefCount value to 0 solve the issue without rebooting the machine? Here's the path for this key:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileService\References\<sid affected user>
RefCount
Thanks for the reply. Will try it next time it happens and report back. Thanks

@Guido 

 

I can confirm that setting up the RefCount value to 0 solved the issue and the user is able to log in without rebooting the server. 

Let's see how long will take to happen again.

 

Thank you.

Thanks for confirming that. We will fix this in the next FSLogix release which could be at the end of the year. Regards.
Hey Guido - I can also confirm that the RefCount registry change works without rebooting the machine, however this issue appears to be getting worse and worse. This is causing a major business impact for 2 of our clients at the moment, with 5-10 people experiencing it per day. I know you said the next update would be the end of the year, but is there a better estimation you can provide at this time?

Additionally, I'm unable to find any official confirmation of this bug besides this post. Do you have anything I can reference confirming Microsoft is aware of this issue?

@Kyorii and @Guido 

 

We too are seeing an increased number of occurrences of this issue. The best solution for us at the moment is to enable drain mode on the session host that the user is failing to sign into so that they are signed into a different one and then disable drain mode after they've successfully signed in. We are also rebooting all of the session hosts every night.

 

This is obviously not ideal and an earlier fix for this would be much appreciated.

We've now seen this twice in 2 days and we aren't in a position to fix it quickly when it happens due to the size of our team. I don't understand how it can suddenly get so bad when it's been running fine for a long while.
Thanks so much for this it has really helped.

Hello All, The fix will be included into the next FSLogix version released on January with a public preview this month. We are in the middle of a testing phase as we cannot release a version or a fix without fully tested otherwise we could have other issues in your environment. Our sincerely apologies for all problems that this is causing in your environment. Feel free to reach me out if you have additional questions.

Hi Dale, try a reboot and see if it fixes the issue temporarily (am sure it will)
Also you can always:
○ Look for RefCount value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileService\References\<User SID> and set that to 0

This is a temp fix for the issue

Lets hope it gets fixed in the next version
Hi Guido! have you got some other updates about the fix? The ETA that you say us is confirmed? We have big troubles with our customers.

Hello. The FSLogix Public preview version has slipped to early January. We apologize for any inconvenience this may cause.