How do I login with UPN to Windows AD joined WVD host?

Question

Hello,

I have Azure WVD hostpool deployed which is joined to ADDS (Active Directory Domain Services). My UPN in form user@keyman .com is not working to sign in but domain.com\user does. I can see in event logs that when I try to login with UPN in form user@keyman .com Windows thinks that Account Domain is AzureAD even though it's actully valid account in Active Directory. How do I force Windows to accept UPN as local Active Directory account instead?

> An account failed to log on.

Subject:
Security ID: NETWORK SERVICE
Account Name: desktop-1$
Account Domain: DOMAIN
Logon ID: 0x3E4

Logon Type: 3

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: user@keyman .com
Account Domain: AzureAD

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064

Answer 1

I believe we're having the same or very similar issue here. Using Azure Virtual Desktop accessing a Windows Server Azure VM. Both VMs are domain joined using Azure AD Domain Services.

When trying to login using the AVD Windows client (or web client), when connecting to the Session Host I am prompted to login and the filled in user name is the user's UPN (email address). It will not accept that as a login. Instead the user has to change the UPN to domain\user.

That wouldn't be a problem, except it will not ever remember the username. It always defaults back to UPN when the user tries to login, which is frustrating. Users don't like having to remember and change the username each time.

I'm trying to find a way to either:

1 - Get the Session Host to save the domain\user login name so the user doesn't have to type it each time.
2 - Get the AVD VM to accept UPN as a login name.

Can anyone help?

Answer 2

Change targetisaadjoined:i:1 to 0 on the host pool

Answer 3

We had the same issue, worked with MS support. This ended up being a self inflected problem with the Host pool, RDP Properties, Advanced. We removed targetisaadjoined:i:1 from the RDP Properties, then then we could login successfully with the full UPN. If you are using Azure AD DS, you should not have targetisaadjoined:i:1 in the RDP Properties.

Remove the highlighted below:

Answer 4

Hi,
I understand you are leveraging ADDS and not AADDS(Azure ADDS)
Have you synced your on-prem (local ad) users to azure AD. This step is crucial for you to login with UPN.

Requirements for AVD with AD:
https://learn.microsoft.com/en-us/azure/virtual-desktop/overview#requirements

Answer 5

I do in fact use Azure ADDS. It's synced from Azure AD and have the domain.com as UPN suffix