Azure AD Kerberos FSLogix

Nekola Christian 10 Reputation points
2023-02-18T15:33:43.2966667+00:00 
Hi,

I trying to build an "Cloud Only AVD Environment with FSLogix" in my test tenant.

I create:
1) an Azure AD Domain Service
2) a Test User and an Admin in Azure AD
3) Server VM (MGMT) and join to AADDS, read Domain GUID
4) Storage Account and configure Azure AD Kerberos with Domain name und Doman Guid
5) configure ADDS App registrations
6) Set the RBAC Roles (SMB Share Contributor) for my Testuser on the Storage Account
7) Link the Share with Access Keys on my Server VM and set the ntfs permissions
8) Create an AVD Environment with one Windows 11 VM Multiuser. Azure AD Join
	dsregcmd /status
	AzureADJoined: YES
	DomainJoined: NO
9) Configure on the Windows 11 VM Kerberos functionality 
	reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 1
	reg add HKLM\Software\Policies\Microsoft\AzureADAccount /v LoadCredKeyFromProfile /t REG_DWORD /d 1

My problem is now that I can't access to the fileshare. As I see I do not get an Kerberos Key:

After a login on AVD with the Testuser:
> klist:
	Cached Tickets: (0)

> klist get krbtgt

	Current LogonId is 0:0x146a092
	Error calling API LsaCallAuthenticationPackage (GetTicket substatus): 0x520
	klist failed with 0x8009030e/-2146893042: No credentials are available in the security package

I read the learn.microsoft.com Sites again and again. Deleted everything and started from the beginning. Several times. The same result again and again.
I found the YT Video: https://www.youtube.com/watch?v=dCUUkkzfcug. I do exactly the same. No change
I have no idea what I am doing wrong and how to find the error.

thx, Chris
Azure Virtual Desktop
Azure Virtual Desktop
A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.
1,378 questions
FSLogix
FSLogix
A set of solutions that enhance, enable, and simplify non-persistent Windows computing environments and may also be used to create more portable computing sessions when using physical devices.
463 questions
Microsoft Entra

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Michael Durkan 12,156 Reputation points MVP
    2023-02-23T19:52:37.09+00:00

    Hi

    does the article below help at all as regards setup of the solution?

    https://techcommunity.microsoft.com/t5/fslogix-blog/fslogix-profile-containers-for-azure-ad-cloud-only-identities/ba-p/3739352?WT.mc_id=EM-MVP-5003580

    Hope this helps,

    Thanks

    Michael Durkan

    • If the reply was helpful please upvote and/or accept as answer as this helps others in the community with similar questions. Thanks!
    0 comments
  2. Prrudram-MSFT 22,396 Reputation points
    2023-03-01T20:40:09.7366667+00:00

    Hello @Nekola Christian

    According to this below document, Azure AD DS Joined systems are NOT supported, at minimum they need to be hybrid devices

    "Clients must be Azure AD-joined or hybrid Azure AD-joined. Azure AD Kerberos isn’t supported on clients joined to Azure AD DS or joined to AD only."
    Link: Use Azure Active Directory to access Azure file shares over SMB for hybrid identities using Kerberos authentication | Microsoft Learn
    As per the expert advisory, FSLogix hosting on file shares without an AD DS infrastructure is fraught with peril! This is the simple, and easy way to get FSLogix working in a test environment using Cloud Cache: Spare the Share: AADJ AVD and FSLogix Cloud Cache – Azure Advanced Migration Topics for Government (azurewebsites.us)

    If this does answer your question, please accept it as the answer as a token of appreciation.

    0 comments
  3. Ruby Bala 0 Reputation points
    2023-11-30T15:47:36.06+00:00

    @Nekola Christian

    I have same issue,. have you resolved the issue?

    0 comments