Having trouble with FSLogix user profile sharing - any good troubleshooting steps to follow?

[Johan_Eriksson]

I followed the steps in https://docs.microsoft.com/en-us/azure/virtual-desktop/create-host-pools-user-profile. 
The problem I have is that the profile is not shared. Also I see no files in share folder when I logon to the file server. It appears to be an access issue to the file share for FSLogix.

Basically I am asking: If this is an access issue to the share for FSLogix, what am I missing in my setup?
Possibly also interesting if there is a tool to check what is wrong or a manual check-list.

Browsed Get-RdsDiagnosticActivities - No relevant info
Browsed Applications/FSLogix App/Operational Event Log:
- FindFile failed for path: \\prod-fs-vm00\rdsavprofiles\<SID>\Profile*.VHDX (Access is denied.)
- No Create access: \\prod-fs-vm00\rdsavprofiles\<SID>_<USER>-test (Access is denied.)
- Unable to find parent path of "" ({Application Error} The exception s (0x)

I did the following in the my domain:

1. Added a file share server in the domain (Using an Azure AD DS domain)

2. Shared a folder according to the steps and gave all "Domain Computers" access to share and NTFS folder (Get-ADGroupMember -Identity "Domain Computers": Includes both hostpool hosts as expected)

3. Created a "custom image" where I followed the steps in configuring FSLogix before running sysprep

4. Created a host pool with two servers from this custom image in the same domain as file server

5. Logged in with a user and checked what host the user was routed to.

6. Created a .txt document in my documents

7. Logged off

8. Stopped the machine the user logged on to to see if profiles are saved of file server

9. Logged on again and got routed to the other (only running) server

10. Looked for the .txt file in my documents - not there - profile sharing not working...

[#2]

@Johan_Eriksson sorry for the stupid question but did you follow the steps to enable FSLogix and point that agent to the path you have created

[#3]

@Stefan Georgiev 

No questions are stupid when troubleshooting: I specified the UNC path to the share.

My suspicion is that step 5. under https://docs.microsoft.com/en-us/azure/virtual-desktop/create-host-pools-user-profile#prepare-the-vi... is perhaps lacking some permissions that FSLogix require.

On a hunch, I gave "Domain Users" full control to the share and it started to work. I then removed "Domain Users" and FSLogix was unable to load the profile. My wild guess is therefore that "Domain Computers" full control permissions are insufficient for proper operations.

(Also note that the link FSLogix documentation at the end of that section only leads to a login prompt for me. I tried to get a user account from FSLogix, but it was not accepted.)

[#4]

hmm...good news is that you got it working :)...and the slightly better news is that we have an update to the document on permissions in particular...should be there in 24 hours as I think it was published today (this is the bad news). So its pasted below :)

1. Add the Windows Virtual Desktop AD Users to an Active Directory security group. This security group will be used to authenticate the Windows Virtual Desktop users to the file share virtual machine you just created.
2. Connect to the file share virtual machine.
3. On the file share virtual machine, create a folder on the C drive that will be used as the profile share.
4. Right-click the new folder, select Properties, select Sharing, then select Advanced sharing....
5. Select Share this folder, select Permissions..., then select Add....
6. Search for the security group to which you added the session host virtual machines, then make sure that group has Full Control.
7. After adding the security group, right-click the folder, select Properties, select Sharing, then copy down the Network Path to use for later.

[#5]

@Stefan Georgiev 

Thanks, makes sense. You may want to also change step 6. to refer to "Windows Virtual Desktop users" rather than "session host virtual machines". 

[#6]

Hi

We are doing this with azure storage instead of using a server and it doesn't work.

We followed the instructions on this link.

We create the share

We enable AAD DS

We assign specific users with "Storage File Data SMB Share Contributor" role to the share

We mount the share on a VM and configure full access for domain users

But still not allowing access

On the event log I can see this message:

No Create access: \\intechwvd.file.core.windows.net\wvdprofiles\S-1-5-21-303179029-2383376087-3032883996-1139_jmorales-test (The user name or password is incorrect.)

[#7]

@JaviMora We are having the same issue. Were you able to fix it?

[#8]

Were you able to get to the bottom cause of this yet?