Outlook 365 app error 1001 on RDS environment ( FSLogix)

Question

Hello,

We encounter an issue with M365 apps (Outlook, Work, Excel) on a specific environment ( Remote Desktop Service)

Sometime, when an user open his application (Outlook for instance) on a RDS, an authentification pop and ask for credentials. If the user enter his credentials, he encounter a 1001 error.

« We encountered an issue [1001] »

https://learn-attachment.microsoft.com/api/attachments/5a947921-955a-4688-ad93-acc305bf77c6?platform=QnA

We already try some step to resolve the issue that help in some case but not all the case, and not defintely for a same user ( Issue occur again) :

• Clear folder C:\Users*yourusername*\AppData\Local\Microsoft\OneAuth and  C:\Users*yourusername*\AppData\Local\Microsoft\IdentityCache
• Move the user from 1 TSE server to an other TSE)e
• Clear FSlogix User profil ( The specific one link to FSLogix Office 365 Container technology )

The main issue is that the error can occur again few day laterfor the same user.

We also generate some log from M365 apps client during the signin process with this link to help : https://learn.microsoft.com/en-us/office/troubleshoot/diagnostic-logs/how-to-enable-office-365-proplus-uls-logging

In the log I find the reference to the 1001 error but the log is a bit complex to understand or analyse.

0xa3e4	Microsoft Outlook	Identity Authentication Client	48cmb	Monitorable	OneAuth log {"Message": "[MSAL:0004]\tERROR  \tErrorInternalImpl:134\tCreated an error: 58tm1, StatusInternal::Unexpected, InternalEvent::None, Error Code 2147942403, Context '(pii)'", "IsError": true}	

07/07/2023 09:04:21.440	OUTLOOK (0x8b30)	0xa3e4	Microsoft Outlook	Identity Authentication Client	48cmb	Monitorable	OneAuth log {"Message": "[OneAuth:Error:58tm1:db6d7d6e-a557-4465-a968-a874c5e456e5] (Code:1001) An unexpected error occurred.", "IsError": true}	

07/07/2023 09:04:21.440	OUTLOOK (0x8b30)	0xa3e4	Microsoft Outlook	Identity Authentication Client	48cmb	Monitorable	OneAuth log {"Message": "[OneAuth:Error:9vdpp:db6d7d6e-a557-4465-a968-a874c5e456e5] Unexpected error code: 1001", "IsError": true}	

Environment :

• Microsoft FSLogix version : 2.9.7654.46150
• Office version : version 2305 build 16501.20228
• OS version : Windows Server 2019 Standard 1809 build 17763.4499

Answer 1

FINALLY A STRAIGHT ANSWER FROM MICROSOFT!

Hello Lars,

Please check this and follow the below steps and let me know of the outcome. and if you needed any help, please let me know.

What Causes Error 1001?

There are several possible causes of error 1001, such as:

• Corrupted office registry key under user configuration.
  • Customer disabled WAM. (Disabling ADAL or WAM isn't recommended for fixing Office sign-in or activation issues)​

https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/administration/disabling-adal-wam-not-recommended​

• user signed out from office and try to sign-in again
  https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/sign-in/office-365-users-not-signed-in-office​
• WAM components are missing or corrupted.
• Antivirus blocks WAM.
• Wrong configured device identity.
• Using more than one user mailbox in outlook associated with the same domain in same Tenant.
  https://learn.microsoft.com/en-us/office/troubleshoot/activation/another-account-already-signed-in
• Cached firewall rules in windows registry.
• Missing configuration in CITRIX

How to Fix Error 1001?

Depending on the cause of error 1001, you can try one or more of the following solutions:

• Reset for office activation.
• Fix WAM component.
• Exclude required authentication component from your Antivirus.
• Correct device identity by configuring your device as hybrid join if it is a domain join device.
• Add additional mailboxes using delegated credential.
• Roaming of WAM token when using roaming profile management tools like UPD, FSLOGIX or other tools
• Rest cash for Firewall rules.
• Ask customer to apply CITRIX recommendations:
  Fixed issues | Citrix Virtual Apps and Desktops 7 2203 LTSR

How to apply the Fix?

Depending on the cause of error 1001, you can try one or more of the following solutions:

-Reset for office activation.

• Make sure to close all running office desktop applications, OneDrive, and teams.
• To reset office activation, the affected user should be member of the local administrators on the device.
• To promote the user as an admin on device you can use these steps. Make sure to remove the user after troubleshooting is done.
• In Windows press Windows button + R to open the Run and type “lusrmgr.msc” for opening the windows Local user and group manager.
• you can just start CMD as admin and type same command “lusrmgr.msc”.
• Make sure you run it as an admin.
• Select Groups → then double-click on "Administrators" -> Add -> Locations -> [select domain] -> Enter Username in Box -> Check Names -> then “OK.”
• If not then running the scripts should be done twice, one time as a user and another one as an administrator.
  • Scripts required to be run are:

1. OLicenseCleanup.vbs
   Download the OLicenseCleanup.zip file, extract the OLicenseCleanup.vbs script, and run it using the following command in CMD:
   cscript OLicenseCleanup.vbs
2. signoutofwamaccounts.ps1
   Download the signoutofwamaccounts.zip file, extract, and run the signoutofwamaccounts.ps1 script with elevated permissions. 
   .\ signoutofwamaccounts.ps1
   make sure running scripts is allowed on the device. If not use this PowerShell command to allow it:
   Set-ExecutionPolicy -ExecutionPolicy Unrestricted
3. WPJCleanUp.cmd
   Download WPJCleanUp.zip, extract the WPJCleanUp folder, and run WPJCleanUp.cmd as user and not as admin.

-Fix WAM component.

to make sure that WAM components are present, run the two PowerShell commands in the following article:

https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/authentication/automatic-authentication-fails

If you use office desktop application on RDS, AVD or VDI, then make sure to have these commands as part of a logon script for the users.

-Roaming of WAM token when using roaming profile management tools like UPD, FSLOGIX or other tools

Roaming of WAM token is not supported, since these tokens are encrypted with a session key, which will be stored on the device during token acquisition, therefore roaming the token causes authentication loop for users.

Make sure to exclude the token following folders from roaming with the user profile:

%localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker

%localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\LocalState

%localappdata%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy

%localappdata%\Microsoft\TokenBroker

%localappdata%\Microsoft\OneAuth

%localappdata%\Microsoft\IdentityCache

-Exclude required authentication component from your Antivirus.

Make sure you exclude the component listed in the following article in your Antivirus configuration.
https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/authentication/cannot-sign-in-microsoft-365-desktop-apps

%windir%\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy

%localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy

%windir%\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy

%localappdata%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy

%localappdata%\Microsoft\TokenBroker

%localappdata%\Microsoft\OneAuth

%localappdata%\Microsoft\IdentityCache

-Correct device identity by configuring your device as hybrid join if it is a domain join device.

• The preferred device identity for a domain join device is hybrid join.
• Workplace Join is not supported on RDS, AVD or VDI.
• You need to instruct customers to block it using registry.
• You can run this command as admin in PowerShell on affected RDS server:
  Set-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin -Name BlockAADWorkplaceJoin -Type DWord -Value 1
• You can make it available to all organizational devices.

https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join

• or apply it to a specified set of devices.

https://learn.microsoft.com/en-us/entra/identity/devices/hybrid-join-control

-Add additional mailboxes using delegated credential.

Add a shared mailbox as an additional account in Outlook Desktop - Outlook | Microsoft Learn

-Cached firewall rules in windows registry.

Use the following commands to reset Firewall rules:
Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules"

New-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules

-Missing configuration in CITRIX

Confirm that issue is not reproducible outside CITRIX or in full desktop versions and only to published applications.

Use the following commands to create required registry entry as per CITRIX recommendations:
Set-ItemProperty "HKLM:\SOFTWARE\Citrix\Citrix Virtual Desktop Agent" -Name Shellbridge -Type DWord -Value 1

**Note:**If the issue can’t be reproduced when logging directly to the server, and the configuration for CITRIX did not help, the customer needs to involve CITRIX support in this situation

Scop and logs required for escalation:

• Affected application (only Outlook, all Office Apps);
• Number of affected users.
• Number of affected devices.
• How does it happen? Is it when they sign in for the first time? When they open a new session? When they open specific files?
• Is it reproducible or sporadic?
• Windows(server/client) version and build.
• Office version and build.
• Physical or virtualized environment.
• Details on their networking including Antivirus/Proxy/Firewall
• How are they managing users' profiles: UPD, FSLogix, Citrix,…?
• Details on their network include Proxy/Firewall.
• MSOAID logs 
  https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/diagnostic-logs/use-msoaid-for-authentication-issues
• Output for the command “dsregcmd /status” in CMD as user

Answer 2

Hello,

No we still have the issue for some user occasionally.

Our best solution is to delete this folder :

• C:\users<yourusername>\appdata\local\packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy

But some time we need to do the others steps describe in this link O365 - Outlook Logon Error: Something Went Wrong 1001 | Matrix 7

Answer 3

Hi Guys
I don't understand why it's so complicated to follow the explanation that was written for exactly now 6 Months things work like a charm, with no 1001 Errors more, why yo waste your, just follow our Threads, and that's it.

Regards

Hello,

Are you suggesting that the solution is to downgrade Office to a version released before the issue emerged, despite the potential security risks, bugs, and missing features?

Please advise.
Thank you;

Answer 4

Hi all,

Microsoft officially acknowledges this issue since yesterday.

"Some of the scenarios that receive the error Something went wrong [1001] are related to security software causing impact on the WAM plug-in (AAD.BrokerPlugin). "

https://support.microsoft.com/en-gb/office/error-something-went-wrong-1001-signing-in-to-microsoft-365-desktop-applications-6f63238d-d83c-437c-a929-de72fe819793

Answer 5

Our 1001 errors stem from Workplace Join enabled on our VDIs and we should not have. We have been getting 1001 errors pretty consistently for a little over a month now. After this implementation, they have stopped and have so for approx 2 weeks. Here's what we noticed and what we did.

Our environment uses multi-session servers. Server 2019.
Some clients use profile containers, some use Citrix Profile Management. Both were having 1001 errors.

Because we had workplace join enabled in our non-persistent environment, every time someone authenticated and workplace joined, a duplicate device entry was created with the Hostnames of all our non-persistent VDIs. I saw this in Microsoft Entra, under devices. We had hundreds of Stale Devices, all dupes of our VDI hostnames. And hundreds of unmanaged devices in the same state. I removed all of those.

This article here clued me in to that and also the potential problems it may cause.

https://learn.microsoft.com/en-us/azure/active-directory/devices/howto-device-identity-virtual-desktop-infrastructure 

Quotation from the article:

"Failure to manage stale devices can lead to pressure increase on your tenant quota usage consumption and potential risk of service interruption, if you run out of tenant quota. You should follow the guidance documented below when deploying non persistent VDI environments to avoid this situation."

Also the registry entry it states to ensure that is set:

"When using non-persistent VDI, if you want to prevent adding a work or school account, ensure the following registry key is set:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin: "BlockAADWorkplaceJoin"=dword:00000001"

"

I set that key, via GPO on our VDIs.

After setting that registry key, new profiles authenticate without incident and more smoothly. There's no more attempt to WPJ. However, existing profiles that were created before the registry key above were set, still attempt to workplace join. With WPJ disabled via GPO, profiles in this state will attempt to WPJ, but eventually time out and auth successfully. (the little WPJ box just sits and spins for a minute or so) To address this, I made a batch script that deletes all the M365 authentication locations. This way we don't have to delete the entire user profile. The script definitely takes a more "scorched earth" approach. I run this within the logged-in user context. I then log off the user, log back in, attempt to authenticate again. It's usually successful. If not, I delete the entire profile under mail in control panel and try again.

Here's the batch. Please use at your own risk:

"
:: @echo off

setlocal

:: Delete directories

rd /s /q "%userprofile%\AppData\Local\Microsoft\IdentityCache"

rd /s /q "%userprofile%\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy"

rd /s /q "%userprofile%\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy"

rd /s /q "%userprofile%\AppData\Local\Microsoft\TokenBroker"

rd /s /q "%userprofile%\AppData\Local\Microsoft\OneAuth"

rd /s /q "%userprofile%\Appdata\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy"

:: Search for and delete TokenBroker directories

FOR /D /R "%localappdata%\Packages" %%D IN (*\AC\TokenBroker) DO (

IF EXIST "%%D" ( 

    echo Deleting: %%D 

    rd /s /q "%%D" 

) 

)

:: Delete registry keys

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\AAD" /f

reg delete "HKCU\Software\Microsoft\WindowsNT\CurrentVersion\WorkPlaceJoin" /f

reg delete "HKCU\Software\Microsoft\Office\16.0\Common\Identity\Identities" /f

reg delete "HKCU\Software\Microsoft\IdentityCRL" /f

endlocal

echo Script completed.

pause
"
Note:

-You'll need to disable the GPO "Prevent access to registry editing tools" for a bit if you want to prevent access denied when deleting those registry keys.

Other things I've found:
If you're including/excluding folders in your profiles after log off, make sure these two folders are included, or users will be asked to authenticate every fresh login.

'AppData\Local\Microsoft\OneAuth'

'AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy'

That's it. Maybe that makes sense. I hope that helps someone. I saw someone post in this thread that their 1001 errors just went away. Maybe this wasn't the cause and MS fixed something on their side. Either way, WPJ should not be enabled in an Non-Persistant VDI env per Microsoft, so at the very least, we're no longer getting duplicate and stale devices in Entra and the auth process is as it should be.

Summary:

1001 errors seem to occur during the WPJ process. Does your env need Workplace Join? If not, turn it off with the reg key above, then fix your existing profiles by nuking all M365 auth locations, and reauthenticate.