{"id":22597,"date":"2022-05-06T01:10:54","date_gmt":"2022-05-06T05:10:54","guid":{"rendered":"https:\/\/www.eginnovations.com\/blog\/?p=22597"},"modified":"2022-11-25T11:48:24","modified_gmt":"2022-11-25T16:48:24","slug":"troubleshoot-avd-logon","status":"publish","type":"post","link":"https:\/\/www.eginnovations.com\/blog\/troubleshoot-avd-logon\/","title":{"rendered":"Troubleshoot Slow Azure Virtual Desktop (AVD) Logons"},"content":{"rendered":"
\n

In order to troubleshoot slow Azure Virtual Desktop logons, it is helpful to have a complete understanding of the application and how it operates. Here, we will outline the architecture and key components of AVD, the impact of DNS on the connection flow, and how eG Innovations offers time saving tools to troubleshoot problems with AVD before they negatively impact your organization’s productivity.<\/p>\n<\/div>\n

\n

About Azure Virtual Desktop (AVD) Technology<\/h2>\n

Azure Virtual Desktop (AVD)<\/a> is a desktop and application virtualization offering from Microsoft and based on Azure Cloud infrastructure. AVD is the only virtual desktop infrastructure (VDI) that delivers multi-session Windows 10<\/strong> optimized for Office 365 ProPlus and support for Remote Desktop Services (RDS) environments. The architecture of AVD is shown below and you can see how Microsoft manage the Control Plane (middle part) whilst you are responsible for managing the Resource plane (right side).<\/p>\n

\"\"<\/a><\/p>\n

As you can see the AVD architecture has many moving elements, and all these elements need to perform efficiently for the user to logon and consume the resources available in the resource plane. It is insufficient to monitor AVD host pools and sessions as key components such as the brokering by the AVD broker and authentication components need full coverage whether that be Azure AD, Azure AD Connector or any on-premises Active Directory synchronized to the AVD environment.<\/p>\n

\"\"<\/a><\/p>\n

The Connection Flow Sequence in Azure Virtual Desktop Access<\/h2>\n

Microsoft has documented the connection flow sequence – see, “Understanding Azure Virtual Desktop network connectivity\u201d,<\/a> a representation is shown below:<\/p>\n

\"Azure<\/a><\/p>\n

    \n
  1. Using a supported Azure Virtual Desktop client, the user subscribes to the Azure Virtual Desktop Workspace.<\/li>\n
  2. Azure Active Directory (Azure AD) authenticates the user and returns the token used to enumerate resources available to a user.<\/li>\n
  3. Client passes token to the Azure Virtual Desktop feed subscription service.<\/li>\n
  4. Azure Virtual Desktop feed subscription service validates the token.<\/li>\n
  5. Azure Virtual Desktop feed subscription service passes the list of available desktops and RemoteApps back to the client in the form of digitally signed connection configuration.<\/li>\n
  6. Client stores the connection configuration for each available resource in a set of .rdp files.<\/li>\n
  7. When a user selects the resource to connect, the client uses the associated .rdp file and establishes the secure TLS 1.2 connection to the closest Azure Virtual Desktop gateway instance and passes the connection information.<\/li>\n
  8. Azure Virtual Desktop gateway validates the request and asks the Azure Virtual Desktop broker to orchestrate the connection.<\/li>\n
  9. Azure Virtual Desktop broker identifies the session host and uses the previously established persistent communication channel to initialize the connection.<\/li>\n
  10. Remote Desktop stack initiates the TLS 1.2 connection to the same Azure Virtual Desktop gateway instance as used by the client.<\/li>\n
  11. After both client and session host connected to the gateway, the gateway starts relaying the raw data between both endpoints, this establishes the base reverse connect transport for the RDP (Remote Desktop Protocol).<\/li>\n
  12. After the base transport is set, the client starts the RDP handshake.<\/li>\n<\/ol>\n

    How DNS Plays a Key Role in AVD Connection Flow Sequence<\/h2>\n

    Jack Tracey<\/strong> documents the importance of DNS and its role in the AVD connection flow, see \u201dDNS Importance With WVD – Jack Tracey – Cloud & Networking\u201d.<\/a> If the user\u2019s DNS points to a DNS server that is not geographically local, perhaps in a different region or country, then the user will experience a bad user experience since the AVD traffic decides the location of the Front Door service, Gateway and Traffic manager based on DNS level.<\/p>\n

    The AVD Reverse Connect Mechanism<\/h3>\n

    Azure Virtual Desktop uses the Reverse Connect mechanism for establishing the AVD session and for carrying RDP traffic. I have explained in a previous article,<\/a> that whilst this ensures security by ensuring listening on open ports does not occur, it also obscures information such as the client\u2019s endpoint IP address that admins are used to having access to on-premises. My article also covers how it is possible to capture the end-user IP address (public IP address) within AVD for security, compliance, threat-hunting and GDPR requirements.<\/p>\n

    The Role of FSLogix User Profile and its Implications<\/h3>\n

    When you login and logout from the desktop, user profiles are transferred from\/to the centralized storage location. This frequently caused elevated logon duration. In recent years, Microsoft has adopted an innovative technology \u2013 the \u201cFSLogix Container\u201d in AVD to capture the profile information and stored as a Virtual hard disk (VHD(X)) either on Azure Files or Azure NetApp File services, etc and mounted this disk to the user when he logs into the desktop. FSLogix Container architecture is shown below<\/p>\n

    \"Azure<\/p>\n

    Sometimes, the FSLogix container hard disk can fail to attach to the user, and this affects the user profile needs. Additionally, the FSLogix container hard disk takes time to mount and affects the AVD user logon duration. James Kindon has some insightful articles available (see FSLogix Synchronous Processing (jkindon.com)<\/a>) covering how FSLogix affects the user-logon experience.<\/p>\n

    Proactively monitoring the FSLogix process within the logon is essential, eG Enterprise will proactively alert administrators of attachment errors and unacceptable performance problems associated with FSLogix. Out-of-the-box thresholds and alerts are configured to ensure FSLogix events and metrics are continually monitored, and anomalous trends highlighted.<\/p>\n

    The Roles of Azure Active Directory and Azure AD Connect and their Implications<\/h3>\n

    AVD heavily depends on Azure Active Directory (Azure AD) infrastructure. It is incredibly important to monitor Azure AD. I have explained in further detail about this in previous articles, see: \u201cAzure AD Monitoring Tips & Strategies\u201d<\/a> and \u201cMonitor Azure Active Directory (AD) Users\u201d.<\/a> AVD users are part of the On-Premises Active Directory Domain and with the help of Azure AD Connect, you can allow the users to consume AVD resources from the resource plane. If there is a problem in Azure AD Connect, it will also impact the AVD user\u2019s logon process. So, it is equally important to monitor the Azure AD Connect component, the details of which I have covered in my article, \u201cAzure Active Directory (Azure AD) \u2013 101\u201d.<\/a><\/p>\n

    Consider the scenario when the AVD user accounts need to be part of both On-Premises AD and Azure AD. Before the user session is created on the session host, the user should be authenticated firstly on Azure AD and secondly against On-Premises AD. This is where a crucial step \u201cIdentity Matching\u201d is done by Azure to ensure the actual user is the same person logging in at both places. Tom Hickling has a good and detailed overview of this process available, see \u201cThe WVD Log in process and Active Directory topologies explained\u201d.<\/a><\/p>\n

    As you can see there are many activities are happening behind the scenes when the user tries to logon and many things can go wrong. Since Microsoft manages the Control Plane elements like Web Access, Brokering, Load-Balancing session hosts, Azure AD, etc., Monitoring the user logon duration is complex in AVD. Microsoft has enabled the diagnostics in the connection sequence and available in the following Azure Monitor tables below:<\/p>\n