How to find out why session host configuration fails to join new hosts to the domain

Question

We are trying to use the session host configuration for a new AVD host pool. We have confirmed that it can join computer to the specified OU without difficulty when we do it manually, and that the key vault access is intact since the local admin is created without issue.

 

But any new session hosts fail to join to the domain. They're created with all other specifications.

 

If we try to add them manually it seems to create some kind of instability in the FSLogix where it will then permanently hang for users when they try to log off.

 

It would be good if we had insight to the domain join failures so we can resolve the problem and don't have to manually join them.

 

In the deployment I can see the network, the VM, and a DSC, but that DSC is only for joining to the AVD Host pool. I don't see anything in it to join using the key vault credentials.

Answer 1

Hello, @Justin Montgomery !

Thank you again for following up. In this instance it appears that the root cause was additional configuration that was needed for Key Vault access (specifically ensuring that all AVD resources have the required access).

In speaking with the Azure Virtual Desktop team, there is a plan in the future to allow you to restrict Key Vault to private networks while still allowing Azure Virtual Desktop service access.

I hope this has been helpful! Your feedback is important so please take a moment to accept answers.

If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

Answer 2

Hi Justin Montgomery,

Thank you for getting back, based on your description, it seems that the domain join process is not being triggered during the deployment of the Azure Virtual Desktop (AVD) session hosts.

The extensions you mentioned are not related to domain joined. As there is no domain joined extension (JsonADDomainExtension or CustomScriptExtension) in your deployment confirms that domain joined process has not been initiated.

You can configure Domain Join in the Host Pool: Navigate to the AVD Host Pool in the Azure portal. Under Properties, configure the domain join settings as in specify the domain name, give the correct OU path, reference the credentials stored in Azure Key Vault then redeploy the session hosts.
As you mentioned, you are already using DSC, you can extend it to include domain joining. Modify your DSC configuration to include the domain join step. Ensure the xActiveDirectory DSC resource module is available. You can install from here This guide explains how to use the DSC extension to apply configurations to Azure VMs: Azure Desired State Configuration extension handler

You can try using a Custom Script Extension to join the session host to the domain. Create a PowerShell script to join the domain, store the script in an Azure Storage Account or GitHub. Add the Custom Script Extension to your deployment template or ARM template.

If you have any further queries, please do let us know. If this helps, please click Upvote.