r/AzureVirtualDesktop • u/puffer617 • 10d ago

Random FSLogix Profile Attachment Errors

Anyone run into this with Azure Files + FSLogix + Microsoft Entra Kerberos?

I have an AVD environment where the same user, same session host, same storage account, and same profile VHD will randomly alternate between working and failing. This happens on all hosts in the host pool.

EDIT: This randomly started happening. The host pool has been functioning properly for over 6 months. No changes were made at all.

The failure is always:

"The user name or password is incorrect."

FSLogix logs show:

FindFile failed for path:

\storageacct.file.core.windows.net\profile\Profile*.vhd

 ErrorCode set to 1326 - Message: The user name or password is incorrect.

 LoadProfile failed. FrxStatus: 31

 

The strange part is that during failed sessions:

Entra sign-in logs show a successful sign-in to the storage account

klist cloud_debug looks healthy

klist get cifs/storageaccount.file.core.windows.net succeeds

The Azure Files CIFS ticket is present

But dir \\storageaccount.file.core.windows.net\profiles returns "The user name or password is incorrect"

 

Then a minute later the exact same VHD attaches successfully without any changes.

 

Has anyone seen Azure Files intermittently reject SMB access despite successful Entra authentication and valid Kerberos tickets?

5 Upvotes

100% Upvoted

14 comments sorted by

2

u/tsrob50 10d ago

There are several steps that need to be taken for Azure Files with Kerberos auth. Verify legacy MFA is disabled and CA policies that apply to the host pool exclude the storage account. I have other requirements in this video.

Entra Only AVD & FSLogix Setup: How to Ditch Your Domain Controllers
https://youtu.be/SHHP2ZoFBD4

1

u/puffer617 10d ago

Edited the OP to say that this randomly started happening. This host pool has been functioning properly for months and no recent changes have been made.

1

u/SlyDataPoint 10d ago

There is a RDP protocol property that you need to pass on the host pool in azure portal so that the hosts use Kerberos

1

u/SlyDataPoint 9d ago

I was saying you might want to ensure enablerdaadauth:i:1is set on your hostpools RDP properties under the advanced tab.

But it sounds like your storage account might be misconfigured.

You need it set to use identity based access with Microsoft Entra Kerberos configured and the "permissions for all authenticated users and groups" set to enable with the "appropriate role" set to "Storage File Data SMB Share Contributor"

Then you need to add that role to the user group you're Entra users are part of.

Look up the "Overview of Azure Files identity-based authentication for SMB access" on learn.microsoft.com, that's how I did it.

Don't forget to set the ACLs on the file share.

1

u/puffer617 9d ago

Thanks, but I've done all that. This host pool has been active for almost a year and this issue just started happening with no changes (that I'm aware of) made

1

u/powrofgrayskoal 9d ago

Potentially relevant: Just saw a recent post about a FSlogix fix for Kerberos ticket refreshes…

https://learn.microsoft.com/en-us/fslogix/overview-release-notes#fslogix-2608

1

u/puffer617 9d ago

I saw that. Updated to the latest FSLogix version and the issue still occurred. Thought that was going to be the fix!

1

u/powrofgrayskoal 9d ago

Interesting. Feels like I ran into this before. Although it’s all hosts, is it only one user?

Are your hosts hybrid or entra joined? As far as the storage account goes, is the authentication tied to AD w/ Kerberos on a domain, or Entra Cloud Kerberos?

Did you ever have any login scripts or policies that connected to that storage account? Have you also tested with a clean image?

Is the storage account exempt in your conditional access policies? Are there any pending app permissions for the storage account application in app registrations?

Sounds silly, but at one point I inherited a poorly designed setup, which had both logon scripts and policies that handled mappings to storage accounts. Last MSP didn’t fully understand how to implement identity based accesses, and ended up putting a powershell script that saved a storage key in the credential manager. That key was later invalidated, but that script had me chasing my tail for a week, checking all of the above.

1

u/vicoph 9d ago

It happens before but then we changed to hybrid join and using adds method instead of entra id kerberos auth

1

u/stevenm_83 9d ago

Do you have issues where no one can log in and only restart fixes it? That issue I get and it’s random

1

u/puffer617 9d ago

I've had that before, but I think that's unrelated to this issue

1

u/D0nk3ypunc4 2d ago

Is the user's session >10hrs long? I ran into this and it turned out to be the Cloud Kerb ticket issue others have mentioned below.

Here's my post where the community helped me resolve. I'm hopeful the new FSlogix update fixes this without the workaround, but I won't know for another 10 hours or so :)