Normal RDP Connections to Azure Hosted Virtual Desktop (Windows 10 machines) are going via FS Logix resulting in failure

hi,

the error Access is denied and Cannot find virtual disk points to a permissions issue, but the real problem is that fslogix is trying to attach a profile for the admin user. this happens because fslogix hooks into the logon process for all users, not just avd users.

to fix this, you need to create an exclusion for your admin accounts in the fslogix configuration. this tells fslogix to leave those logins alone and not try to attach a profile.

here's how to do it. on the avd session host, open the registry editor and navigate to HKLM\SOFTWARE\FSLogix\Profiles. look for a value called ExcludedAccount1 or create it if it doesn't exist. set the data to the username of your admin account, like domain\adminuser. you can add multiple excluded accounts if needed.

this might help in other scenarios too, excluding service accounts from profile handling.

after adding the exclusion, restart the machine or restart the fslogix service for the changes to take effect. your admin rdp connections should now bypass fslogix completely.

also, double check the ntfs permissions on the file share itself. make sure the admin accounts have at least read and execute permissions to the root of the share, even if they don't need a profile. sometimes access denied errors can occur if the account can't even browse the share path.

hope this gets your admin access back. those profile errors are no fun. let me know if the exclusion does the trick.

Best regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer

https://ctrlaltdel.blog/

Hey Alex,

Thanks a lot for quickly jumping into this.

Is there not a way to exclude all connections which are coming via RDP connection requests instead of excluding single accounts. And, how to exclude local admins, because even local admin account is facing the same issue

We've several AVDs in the environment which are working fine, this issue is only with this specific one.

Thanks!

To add on, I added the local admin account to the local FS Logix Exclusion group and that worked. I was able to RDP to the AVD, but this group doesn't populate the local Administrators group on the machines, which is why I cannot exclude all Admin in one go.

Moreover, I compare the membership of Local FS Logix group memberships with a working AVD and the working one doesn't contain any Exclusion member?

Am I missing anything here.

Hi,

Thank you for your detailed inquiry. We understand the issue you're encountering with FSLogix blocking direct RDP access to Azure Virtual Desktops (AVDs), despite successful connections via the AVD client.

FSLogix is designed to manage profile containers for all interactive logons, including those initiated via direct RDP. This behavior is expected and not limited to AVD client sessions. When administrators attempt direct RDP, FSLogix still attempts to mount the profile container, and if the account lacks appropriate permissions to the Azure File Share, access is denied—resulting in Event ID 26 and profile load failure.

To resolve this, ensure that administrative accounts used for RDP have the necessary NTFS and RBAC permissions on the storage account. Specifically, assign the Storage File Data SMB Share Elevated Contributor role to these accounts and verify that the registry settings under HKLM\SOFTWARE\FSLogix\Profiles correctly define the VHDLocations path.

For scenarios where FSLogix should not apply to certain accounts (e.g., break-glass or admin logons), you may configure the SIDExclude registry key to bypass FSLogix for specific user SIDs.

If my answer is useful for you, please vote for it.

Best regards,

Quinnie Quoc.

Thanks Quinnie,

I've many other working VDs which just work fine with no such issues.

Also, how do I configure the SIDExclude registry key please.