FSLogix Profile Include List - empty after login

Question

Hello,

We are using FSlogix Profile and Office containers on our Windows 10 Citrix Virtual Desktops. Since a while now, the containers aren't loaded all the time.
This happens not always, but a few times per week. When this problem occurs, I can see in the FSlogix Status Tool: User is not a member of the include group.
When I check Computer Management >> Local Users and Groups, I see the FSLogix Profile Include List (and FSLogix Profile Exclude List) has no members in it.

We have a GPO that fills these groups with "Everyone" for the Include group, and "domain\domain admins" for the exclude group. Via gpresult I can see that this specific GPO is applied.
When I manually run a gpupdate/force the include and exclude groups are filled. But FSlogix is not working then as it needs a reboot.

In the eventviewer I see in the Security logs: "A member was added to a security-enabled local group." This is about the Include group that is filled with "Everyone" (by GPO)
A few seconds later I see in the same log: "A member was removed from a security-enabled local group." This is also about the same Include group (why?)
So something is clearing these FSlogix Include and Exclude groups, but I don't not what and/or why.
According to the eventlog the removal was done by "System" and accountname is my computername.
In my opinion this is not caused by another GPO, because when I manually run a gpupdate /force it's only filling the group and not removing it afterwards.

Sometimes it's working for a 3 weeks and we don't have any issues. Sometimes we have this problem daily.

Hopefully someone has an idea?

Some more information:
Citrix VDA 1912 CU1
Windows 10 enterprise LTSB 2016
FSLogix 2201 (2.9.8111.53415)
Windows Defender anti-virus (with FSlogix exclusions)

Thank you very much.

Answer 1

not that one?

https://james-rankin.com/all-posts/quickpost-fslogix-container-failures-when-managing-local-groups-through-gpp/