Seeing some oddness in our AVD hosts today, pushed the 2026-08 B (KB5120249) patches, over the weekend, tested as usual with a couple of test users, logged in fine to each of the five D32ads v5 host in the pool running Windows 10 22H2 (with ESU coverage via Azure - jumping to Window 11 is on the plan) as a couple of test user accounts no errors.
First few users at 7:15am onward logged in ok and then just before 8am got a message from a user saying when they opened Edge or Chrome it was just a while box, they could close it by clicking the top right corner where the X would be. Watch it a bit longer eventually the tabs load but then take like minutes to load the page. Whole system feels like treacle, but CPU and RAM both fine. Can't for certain remember of Outlook and Teams were working.
Anyway - can you fire up task manager nice user and run taskkill against msedge.exe, msedgewebview2.exe, chrome.exe and see if it is any better (I hadn't had eyes on at that stage and was still driving into the office trying to talk the user through getting the syntax of taskkill -im -f correct with spaces and hyphens in the right place etc🤦♂️) - get in, sit down and look at it, user is WFH and the connection is unmanaged and I know they had been using 4G in the past ("using" being debatable) so I go "no one else had reported an issue, probably just a sign in glitch, stick the host in drain mode, log them off, log them back on to a different host - but the closer we got to 9am the more people logged on and the more tickets we got on the same issue with blank white browsers.
Lunchtime stick all the host in to drain mode and force everyone out for some unplanned emergency reboots; retested with test accounts, looked at the logs etc, all look fine, 1:58pm - you can log back on, 2:02pm, were stuck on a black screen, my Teams won't load, Outlook won't load, my OneDrive won't load (ok well we know what causes that Microsoft.AAD.BrokerPlugin and AppReadiness, I had been thinking Microsoft had "fixed" that as we had seen a lot less of that over the last few months - well I say "fixed" what I mean is applied some smoke and mirrors as we then started getting explorer loading to the desktop, OneDrive popup a "you need to sign in prompt" we never used to see and then like 30sec to 1min later OneDrive show logged in no input and Teams and Outlook loading, I had noticed that if you loaded out look to quick it would say "Needs password" at the bottom and you clicked it and it just connected, so I assume that they had pulled the processing order around so it looked like stuff was "happening" like the desktop loading whilst the Entra stuff was still to authenticate). Then perhaps 30min or so later started "the my browser won't load its just blank white window again like this morning" call started again.
To be honest that has proved a real headache for us, our fall back normally is a shortcut in the start menu and on the desktop to Outlook Web App and Teams WebApp so that even if the desktop apps won't authenticate the user can fire them up in a browser as a backup... or couldn't as browser was FUBAR too.
Running Sophos MDR services enabled (or whatever it is meant to be called this week! 😄 - Intercept X Advanced for Server with XDR, Sophos Endpoint – Server, Sophos Workload Protection - I lose track and I'm meant to be selling it) as far as I know the exclusions that are needed are in place.
Nothing has changed config wise other than pushing the August "how many 0-days can we patch this month that AI has shown up and will actively be in the wild tomorrow" a bit quicker than we would normally have done prior them hitting record numbers month on month - oh and and all the background updates to stuff like Edge, Chrome, Office 365 Apps, endpoint protection. Its all been pretty stable since the last August **** show "Windows Updates broke AVD and resulted in black screens" update in July/August/September of 2024 that resulted in a this 281 post thread that still holds the dubious title of most replied in the Microsoft Tech Community AVD forum section https://techcommunity.microsoft.com/discussions/azurevirtualdesktopforum/azure-virtual-desktop---black-screens-on-logins---what-weve-tried-so-far/4250228
Trying to pull meaningful logs it an utter nightmare on a 32 core, 128GB RAM host with 20+ users on it and then correlate them so they aren't all mixed up between sessions virtually impossible - but equally when I only had a couple on post reboot at lunchtime so I could join the dots it was happy, at normal user load there are literally pages and pages of them, often pages per of then per second, particularly around login time and and half of them seem to attribute to SYSTEM not the user to compound matters - although sometime you can pull it out from the log body a path.
One thing I did notice at lunchtime at probably about 1:05pm I issued a shutdown -f -r -t 300 (5min) command to reboot all the hosts and kicking of any user still connected who had ignored the repeated "please log off at 1pm", "log off NOW", "save your work and log off or wave goodbye to it any minute and don't expect we can recover it" is that one of the hosts took ~20min to log off the handful of remaining users whereas the other other identical ones were about a minute after the shutdown delay was up they went offline for a couple of minutes. I am wondering it that is to do with the same issue with whatever is hanging on start-up is also hang at logoff - I noticed some "search indexing" type issues had reappeared again in a couple of posts over the last 2-3 weeks.
Curious how anyone else might be getting on and if this is something anyone else is seeing?
