FsLogix error "Group Policy Client service failed the logon. Access denied."

Question

Hello,

I have a Citrix Virtual Apps and Desktops 1912 LTSR CU1 environment with FsLogix profiles in place on top of Windows Server 2019 session machines. After installing the latest FsLogix version 2.9.7576.47294 we have been getting the following error from a considerable number of end users when trying to login to their Citrix/RDS session: "Group Policy Client service failed the logon. Access denied.". The case is described in more detail at https://stefanos.cloud/blog/kb/how-to-resolve-error-group-policy-client-service-failed-the-logon-access-denied-in-citrix-and-fslogix-environments/.

Has anyone seen this error persistently in their VDI environment? Is this something which is identified as potential defect/bug in this new FsLogix release?

Looking forward to your feedback.

Answer 1

I have the same issue here, on premises servers.
Windows2019server, Citrix CVAD LTSR 1912 CU1
I rolled back to the previous version of FSLogix.

I was using fslogix version : 2.9.7621.30127

Answer 2

Hi, 2.9.7576.47294 is not the latest version.

Try to upgrade to 2.9.7621.30127

https://social.msdn.microsoft.com/Forums/en-US/defe5828-fba4-4715-a68c-0e4d83eefa6b/release-notes-for-fslogix-apps-release-2009-29762130127?forum=FSLogix

And see if that helps.

Answer 3

I encountered the same issue in a couple of different environments too and it happened before and after the latest the FSLogix release. Whenever this happens, I noticed that the local_username folder is always there even when the user is not logged in.

One fix other than editing registry permission that I found seems to work is to do the following -

(this is for a standard MS RD farm environment)

1. Add the affected user to the local admins group of the RD server.
2. RDP to the server as the user by using "mstsc /v servername /admin".
3. The first time you will see a black blinking screen. You can't do anything and can't logout from here. So go to the RDS collections (Server Manager > Remote Desktop Services > Collections) and log the user out from there.
4. Repeat RDP as the user to the server with the /admin switch.
5. This time you should be logged in successfully. If you browse to C:\users, you will see local_username1 appearing. Log out, and you should see local_username1 and username folders both disappear.
6. Remove user from local admins group.

I wonder if there has been a windows update recently that caused this issue as I see it reported by multiple people already?

Answer 4

We've been getting the same issues on the most recent version of FSLogix as well. This affected a couple of users, but the issue was persistent. Therefore we've decided to rollback to FSLogix 2004 and this seemed to resolve the issues for us.

Answer 5

Hi,

We have not heard any known issue about FsLogix. Also have not found any update package for this issue.

I noticed the issue occur on multiple computers instead of all users. So I am afraid log analysis based on environment is necessary for further troubleshooting.
However as log analysis is out of Microsoft Q&A forum support scope, we recommend to create a ticket for your issue.

If it is caused by Microsoft product, the consult fee will be refunded to you. If you have any information from support engineer, we would be very appreciate if you could share it here.

Bests,

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.