WVD logon issues. The Group Policy Client Service failed the sign-in. Access is denied.

Copper Contributor

Hi. We have a mutli-session Win10 WVD farm up and running. We are running 1909 with the latest quality updates applied. FSLogix profile container is being used. 

 

We are seeing intermittent issues with users not being able to login. They are being presented with the error:

 

"The Group Policy Client Service failed the sign-in. Access is denied"

 

wvderror.png

 

From investigation, cant see anything appropriate in the event logs. Anyone seen this issue before?

 

 

58 Replies

@Agdar 
We are facing same issue from many days we have many times changed ReFcount value to 0 but again and again it's reversing.

 

@syedaltamash 

I am suggesting the following short script as a logoff script for WVD users to be deployed by a GPO. Please use at your won risk: 

$ProfRefsPath  = "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileService\References"
$MySID = (Get-CimInstance -Class Win32_UserAccount -Filter "Domain = '$ENV:Userdomain' AND Name = '$ENV:UserName'").SID
If (Test-path $ProfRefsPath\$MySID) {
   set-itemProperty -Path $ProfRefsPath\$MySID -Name RefCount -Value 0

}

 

I am facing this issue for only 2 users out of 100 users.

Is there any workaround solutions for the same? Please help

Hi @Guido , has the update released to preview yet and is it possible to download?

 

 

@townendk Hello. The public preview will be available before the end of January. Regards

I plan on doing my own testing but has anyone validated if this script works? Does the user need to be a local admin to write into HKLM or are they given access to the subkey when it's created?

@mnickom 

By the time you fully test it, the patch may be out, but the script needs to run in the SYSTEM context, since the end-user does not have write permission to the key: 

MarkF26_0-1642530658179.png

hope this helps. 

But if you run in the SYSTEM context, how do you gather the user's SID?

Appears that there is a new FSLogix update, although it doesn't specifically address this. It only came out yesterday but curious if anybody is going to try this soon.

https://docs.microsoft.com/en-us/fslogix/whats-new

@CaptainReboot Thanks for alerting us all to this, disappointing it didn't come from @Guido or someone from MS.

Looks like this is the line that covers it:

  • FSLogix now correctly handles cases where the Windows Profile SVC refCount registry value is set to an unexpected value.

We only have one server and it's production so unable to test yet, will be good to see how others get on.

@CaptainReboot  We'll be rolling it out to a small environment tomorrow. It only has a dozen or so concurrent users, but this error is prevalent so fingers crossed. 

@Lee_EThanks, missed that line. We have a few test and UAT environments. I might throw it on there but it doesn't get used much.  We also have a production pool that we've seen it on that only a handful of us in IT uses, so I might do that as well as I just saw the error myself this morning and did the reg change manually to see if it would work (which it did).

Did anybody get access to the private preview download yet?  I requested it and it said within 24 hours I should get a response.  Curious if that's accurate.

Thit Script shows me the right way to resolve that issue, thx @MarkF26
Propably i renamed the Folder of that affected SID and it works too.

@Guido 

Hi,

We have experienced this issue with 3-4 of maybe 50 users in two host pools. Installing the latest (preview) release did not resolve the problem. After installing FSLogix_Apps_2.9.7979.62170 and rebooting the VM, I logged on to get my user sid registered, logged off and then edited the ref count value to 01. When trying to connect I get the Group Policy error still.