RDV GRAPHICS SERVICE

Question

Is the "RDV GRAPHICS SERVICE" user account still needed if i have a domain that has been completely upgraded to Server 2019? I'm running into an issue with Azure AD Connect failing to synchronize this account for some reason and I'm wondering if I still need it if everything is running 2019.

Answer 1

Hello @DJX995 ,
The user account "RDV GRAPHICS SERVICE" is a local system account which is created when the RemoteFX feature was enabled on a Remote desktop Virtualization Host and it is made a member of the Users group on a normal server. You will get into this situation where AD connect is trying to sync this system account only when the Domain controller in your on-premise environment have Remote desktop virtualization host enabled and hence this account has moved to Active directory now. It is a system account and if you are not using any application which leverage RemoteFX hosted on this server 2019 , I don't think you need this. Generally it is recommended to enable the RD Virtualization host feature on a server which is not a domain controller. However it seems the server had this enabled and then it was promoted to a domain controller due to which this scenario could occur.

I don't think it matters if you are running server 2019 because the important thing to check will be if you have any apps hosted on the Remote Desktop Virtualization leveraging RemoteFX on this server . If you have such apps then I would suggest to check with the maintainer of the applications and move it to a separate domain server rather than have this on a domain controller. Also if you are looking for an exact reason then more troubleshooting would need to be done and the ACLs on this object within the Active directory database will need to be checked to find out if the sync engine service account have read permissions on it or not .

There is no reason for this account to be used in the Azure Active directory for any purpose as far as I know hence syncing this to the cloud is not needed unless there is any extreme corner case scenario for this. I would suggest you to go with container filtering in the AD connect setup to exclude this account as this would generally be in the Built-in or Users container. It can be at other places as well if it has been manually moved . I do not have this setup in my lab so I cannot test this exactly and confirm the location but you should be able to check .

Hope this clarifies the query and provides a valid solution. If the information in this post is helpful , please do accept the post as answer so that its helpful for other members of the community searching for similar issues. In case you have any further query on this, please feel free to let us know and we will be happy to help .

Thank you.

Answer 2

Got it. Makes Sense. If this is what I have on all domain controllers now, am I safe to delete that account?

I also found out the exact issue of the Azure sync is because that account does not have a UPN, it's blank. Even if it had one, it would be invalid to Azure because it would have spaces.