Azure AD Kerberos FSLogix

Question

Hi,

I trying to build an "Cloud Only AVD Environment with FSLogix" in my test tenant.

I create:
1) an Azure AD Domain Service
2) a Test User and an Admin in Azure AD
3) Server VM (MGMT) and join to AADDS, read Domain GUID
4) Storage Account and configure Azure AD Kerberos with Domain name und Doman Guid
5) configure ADDS App registrations
6) Set the RBAC Roles (SMB Share Contributor) for my Testuser on the Storage Account
7) Link the Share with Access Keys on my Server VM and set the ntfs permissions
8) Create an AVD Environment with one Windows 11 VM Multiuser. Azure AD Join
	dsregcmd /status
	AzureADJoined: YES
	DomainJoined: NO
9) Configure on the Windows 11 VM Kerberos functionality 
	reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 1
	reg add HKLM\Software\Policies\Microsoft\AzureADAccount /v LoadCredKeyFromProfile /t REG_DWORD /d 1

My problem is now that I can't access to the fileshare. As I see I do not get an Kerberos Key:

After a login on AVD with the Testuser:
> klist:
	Cached Tickets: (0)

> klist get krbtgt

	Current LogonId is 0:0x146a092
	Error calling API LsaCallAuthenticationPackage (GetTicket substatus): 0x520
	klist failed with 0x8009030e/-2146893042: No credentials are available in the security package

I read the learn.microsoft.com Sites again and again. Deleted everything and started from the beginning. Several times. The same result again and again.
I found the YT Video: https://www.youtube.com/watch?v=dCUUkkzfcug. I do exactly the same. No change
I have no idea what I am doing wrong and how to find the error.

thx, Chris

Answer 1

Hi

does the article below help at all as regards setup of the solution?

https://techcommunity.microsoft.com/t5/fslogix-blog/fslogix-profile-containers-for-azure-ad-cloud-only-identities/ba-p/3739352?WT.mc_id=EM-MVP-5003580

Hope this helps,

Thanks

Michael Durkan

• If the reply was helpful please upvote and/or accept as answer as this helps others in the community with similar questions. Thanks!

Answer 2

Hello @Nekola Christian

According to this below document, Azure AD DS Joined systems are NOT supported, at minimum they need to be hybrid devices

"Clients must be Azure AD-joined or hybrid Azure AD-joined. Azure AD Kerberos isn’t supported on clients joined to Azure AD DS or joined to AD only."
Link: Use Azure Active Directory to access Azure file shares over SMB for hybrid identities using Kerberos authentication | Microsoft Learn
As per the expert advisory, FSLogix hosting on file shares without an AD DS infrastructure is fraught with peril! This is the simple, and easy way to get FSLogix working in a test environment using Cloud Cache: Spare the Share: AADJ AVD and FSLogix Cloud Cache – Azure Advanced Migration Topics for Government (azurewebsites.us)

If this does answer your question, please accept it as the answer as a token of appreciation.

Answer 3

@Nekola Christian

I have same issue,. have you resolved the issue?