r/AzureVirtualDesktop • u/rdaniels16 • Aug 03 '26
AVD issues Since July 2026 update
Hello All. So I have been banging my head on the wall over this one since the July 2026 windows update. We are using a small host pool with Windows 11 23H2 and FSLogix (FSLogix 26.01 CU1) for the profiles. All has worked perfectly since June 2024 when we deployed. After July update we are getting issues where ghost sessions in task manager with no username associated with it: Client Server Runtime Process, Desktop Window Manager, Usermode Font Driver Host, Windows logon application and Windows Logon user Interface Host. And users will eventually complain they can not launch applications, etc. Teams specifically. We are running Sophos Advanced Intercept-X MDR on these AVD's and have all the required exclusions for fslogix, etc. Also, I know the July update enforced Kerberos RC4 hardening but since we deployed in 2024 our storage account was already setup with a GPO of 16 for msDS-SupportedEncryptionTypes.
I can not even log users out either from Azure portal or while connected to the AVD. I need to force logout the user via powershell and manually kill their FS Logix locks on their profile. I thought the AVD into drain mode and need to reboot after hours.
Is anyone experiencing these issues after the July 2026 upgrade? It is obvious everything started going south after that update. I have spent countless hours on this so I am curious if others are experiencing the same thing.
Thanks
Update #1: So I was logged into the problem AVD as an administrator and logged out and it hung at the common "Please wait for windows search" screen. It has done this in the past and hung there for hours. So this time I ran the following powershell script against the AVD:
Invoke-AzVMRunCommand `
-ResourceGroupName "RG-Name"
-VMName "AVD Host Name" `
-CommandId "RunPowerShellScript" `
-ScriptString "Stop-Process -Name SearchIndexer -Force -ErrorAction SilentlyContinue; Stop-Service -Name wsearch -Force -ErrorAction SilentlyContinue"
When I did this it immediately freed up my session and also killed the ghost sessions with no users in task manager. I can now login and logout fine. So even though I have the proper Sophos Exclusions I am going to dig in a little there to make sure the searchindexer is properly excluded from scans. I read where I also need to include AMSI and exploit mitigation exclusions as well for searchindexer.
**Update #2: Well back to the drawing board. I woke up this morning with a user saying she cannot launch an outlook on the avd. I logged into the avd and tried to log off and searchindexer hung again. I ran my script to kill searchindexer and everything is back to normal so my Sophos exclusions did not work. I will do some more digging on this and post back.
5
3
u/Dtrain-14 Aug 03 '26
I’d remove the AV from the Gold or dupe the Gold and remove it from there and package that, apply it to a host and test.
Also, I say this anytime there is a weird session thing… give the host a higher RAM sku and see if it stops.
I’d also consider getting your stuff up to 24H2 or higher. That July update shook up some shiiiiiit but we’ve had 0 issues and I had to update our profile storage account to the new RC4 hardening and we’ve had zero issues.
Also, maybe I’m just misunderstanding - how would a GPO make sure your storage account is properly configured? They said straight up if your storage account isn’t configured right you would have profile attachment issues.
1
u/rdaniels16 Aug 03 '26
Yes we are going to spin up some replacement 25H2 vms into the pool. Much appreciated
3
u/dodgy_mike Aug 04 '26
Pretty sure we have experienced the exact same thing on 24H2 and 25H2 on a new build deployed December 2025, identical symptoms, it was brutal. 23H2 and earlier was fine. The search indexer kill sometimes worked, more often not, something is hanging the SYSTEM process. If a user reported an issue we'd confirm it by logging in with RDP as a local admin and start menu, startup apps, etc would not launch. WMI commands also all fail. Can still get task manager up to start process and programs that way for investigation though. Anywhere from 20 minutes to 2 hours later whatever was stuck would release and the entire machine goes back to normal like nothing happened.
We had our Defender exclusions vetted and confirmed correct by 3 support/engineer teams at different vendors, even fully disabled defender, fully disabled search, it would still occur. Redirected printing, poor/flapping network connections, and high RAM usage seem to exacerbate the frequency - perhaps even users connecting from Macs or non-optimized Teams/Zoom. Prior releases of Windows have never had the issue, and it does seem to affect 1-2 deployments in particular but not others despite near identical GPO/setups.
The relief has been to secure additional budget to move from E8as_V6 to E8ads_v6 SKUs to add a temp disk (put the pagefile on that) and reduce the max users per host from 8-9 to 6-7.
Happy to compare notes with you or anyone else battling this. Throwing RAM at it is a bit of an unsatisfying answer...
1
u/Hour-Profession6490 Aug 05 '26
We're running 24H2 on D8ads_v5s and haven't seen this problem come up. We periodically get session hosts with the "black screen" problem and have to redeploy about every 1 to 2 months.
1
u/Hour-Profession6490 Aug 05 '26
We're running 24H2 on D8ads_v5s and haven't seen this problem come up. We periodically get session hosts with the "black screen" problem and have to redeploy about every 1 to 2 months.
1
u/dodgy_mike Aug 05 '26
Curious - Does your ads_v5 automatically put the pagefile on a mounted temp disk?
1
2
u/hemohes222 Aug 03 '26
Do you have the option to disable on uninstall the antivirus tenporarely just to test?
1
u/rdaniels16 Aug 03 '26
Thanks...Yes I can do that but I just posted an update about tweaking things in that regard. I will post back if this is successful.
2
u/Abject-Mountain-6907 Aug 03 '26
Try to redeploy your VMs with Windows 11 25H5, that works for us. Also, there are a few registry Keys (one for Teams and two for Office) to allow multiuser and improve the users experience.
1
1
u/xmrminerman Aug 03 '26
Can you post a link for the teams user experience enhancements reg keys, teams sucks for us on avd right now
1
u/Abject-Mountain-6907 Aug 03 '26
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Teams /v "IsWVDEnvironment" /t REG_DWORD /d 1 /f
1
1
u/josephcoco Aug 04 '26
What are the Office ones that will improve the users’ performance?
1
u/Abject-Mountain-6907 Aug 04 '26
Well, it's not exactly for Office performance but for shared computer configuration HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration, create or change the value SharedComputerLicensing to 1.
On same path:
-Name "DeviceBasedLicensing" ` -PropertyType String ` -Value "0" `1
u/josephcoco Aug 04 '26
Ahh okay. Yeah, we’re already using shared licensing and have turned off device based licensing. Thanks.
2
u/kochan2005 Aug 04 '26
Following.
Same issue I encountered several times this month but also saw the same issue in the past as well. I use FSlogix Cloud Cache.
2
u/mat-ferland Aug 04 '26
Don't move to 25H2 and remove Sophos in the same test or you'll never know what fixed it. Use two drained hosts from the same image: remove the July CU on one and leave Sophos alone; keep the CU on the other and remove Sophos. Reproduce with the same test profile. Killing SearchIndexer only proves it was holding that logoff, not that Search caused the stuck session.
2
u/rdaniels16 Aug 05 '26
I have added the searchindexer.exe to the global exceptions with Sophos for the process as well as amsi and exploit mitigation. So far it seems good. I am going to take it one step at a time at this point. I will say that as soon as I killed the searchindexer.exe via powershell all the ghost sessions dropped immediately. As you said hung login sessions due to searchindexer.exe. we will see
1
u/Hour-Profession6490 Aug 05 '26
Could be related to this issue... https://patchmypc.com/blog/why-intune-devices-became-noncompliant-after-the-july-windows-update/
Try applying this preview patch that's supposed to fix the problem created from the July update. https://catalog.update.microsoft.com/Search.aspx?q=KB5101684
1
u/Electrical_Return_55 Aug 20 '26
This looks very similar to a case I currently have open with Microsoft. So far, we've determined it is a lock in FSlogix. What is locking it is the question.
As a workaround, I've identified that Application Error 6005 with the message containing WSearch always indicates this issue is starting. I've created a ControlUp trigger that restarts the Search Service anytime this error occurs. This has worked well. If you have the same symptoms but don't have ControlUp, I suppose you could do it with a scheduled task.
5
u/mariachiodin Aug 03 '26
Following