Much Appreciated for making the content so informative and in single video. I always loved your content, graphics, video quality, easy explanation good to grasp even for newbee. Many thanks
Would like to see a future video that discusses the combination of fslogix containerization and folder redirection. By redirecting user profile folders such as Documents, Desktop, and Downloads, it makes it easier for administrators to maintain those folders while still keeping the thousands of small files under AppData subfolder of the user profile containerized. To me, this seems to be a perfect marriage of the two user profile technologies
@@AzureAcademy I've actually already implemented this solution. But I was interested in your thoughts RE pros/cons of the solution as a best practice. My feeling was that, by combining folder redirection (via GP) with fslogix, the size of the VHDX files would stay small, yet the fslogix container would provide better small file performance while the Azure file share that hosts the folder redirected content provides decent performance for larger files typically found in Documents, Desktop, and Downloads. For the client that I used this solution for, it worked out really well but they only have 30ish users so it may not scale well for larger deployments. This client didn't want to use OneDrive, so the known folder redirection wasn't in the mix
If I understand, you used the redirections.xml file to stop the docs, music, pics, desktop, etc, standard user folders from being in the profile Where did you think you redirect them to?
Don't need a Private Endpoint to lock down the Storage Account Firewall do the specific AVD subnet. Can simply use a Service Endpoint instead and therefore, no additional resources to deploy.
A service endpoint allows the entire service or service in a region to communicate with your network…example: allow all storage accounts in East us to communicate to your virtual network. A private endpoint takes your file or blob feature of a single storage account and gives it an IP on your private network directly…very different service
@@AzureAcademy Ya, just depends on the requirements. Don't "need" the private endpoint. But like with anything, would have the conversation with the customer. If the customer is ok with using a service endpoint on that subnet to begin using the Azure Backbone to communicate to all Storage Accounts allowing them to use Storage Account Firewall feature on a Storage Account by Storage Account basis, then Service Endpoints are ok. If the customer wants to continue using the public internet for all subnet > Storage Account traffic and instead have the AVD instances use a Private Endpoint to lock down just those machines to that one Storage Account, then agreed, Private Endpoints would be good. It depends and good to talk through both options.
Recovery Services Vault replication has no impact on the storage account as no data is copied to the vault. Snapshots are done directly on the storage account. So if you have LRS storage account and a GRS vault, you only get LRS replication for the backups
2 questions for you… 1. You mention a storage account…are you talking about using “unmanaged disk” 2. Do you have a link to the docs to show that LRS storage saving to a GRSv recovery vault will only replicate to LRS level?
@@AzureAcademy Why Azure Files backups doesn't replicate based on the Storage Replication Type setting of the vault? The Storage Replication setting of the vault isn't relevant for Azure Files backup. This is because the current solution is snapshot-based and there's no data transferred to the vault. Snapshots are stored in the same storage account as the backed-up file share, and therefore replicated as per the replication setting of storage account.
@@AzureAcademy 1. Azure Files is what I am referencing. It's actually very annoying to work around as we are happy to have LRS for fault tolerance but would like in the event of a datacenter being destroyed that the backups still remained even though it would take time to restore. Its very poorly documented as well.
Are you talking about VM Disks or Azure Files inside storage accounts??? I think you are talking about FSLogix. The snapshot will be stored in the storage account but if you have Azure backup then the management of the snapshots is done by the backup vault. The second part of this is IF the snapshot replicates into the backup vault and if you have LRS storage account and a GRS backup vault do you get LRS or GRS protection…not sure I will check with the docs and the product team and get back to you
First of all thanks for your Videos. It helped a lot. I have one question about how to define multiple azure file share for 10K users. I am going to deploy Citrix VDIs on Azure for 10,000 users. One subscription support only 2500 VDIs so will be using 4 different subscriptions. One Azure file share support up to 100 TB so it can handle around 2500 users with 40 GB disk each. So would need 4 or more file shares. All the 10,000 VDIs will be in same OU, how can i define multiple file shares for the users? I know one way to create 4 different OUs or 4 different GPOs and link to Computer group but i am looking for best way to do it. Please assist.
The other thing to consider is storage performance. Each user connecting to the share will consume an average of 50 IOPS when logging on or off. 10,000 users would put you around 500,000 IOPS, Azure files premium scales to 100,000 IOPS per share which would put you at 5-6 file shares, not 4. But at that scale you should also consider Azure NetApp files. 1 NetApp can sale to 400,000 IOPS you would need at least 2, then think about DR and replication
A host pool is a metadata container for a AVD workload and a central connector for app groups and workspaces. Learn more here 👉 th-cam.com/video/FLbcayyodqk/w-d-xo.html
Hi Dean, first i want to thank you for the great content. Would it be possible that you show us the Inbound and Outbound NSG Rules in detail? I think the Timestamp is around 54:30. Thank you :)
Hi Dean, I do have a question about a issue we are currently facing using fslogix. We have setup fslogix with cloud cache and a normal profile and office profile. We have also setup one drive known folder move to be configured silently through gpo. This works fine most of the time but sometimes it just breaks for a user and stops working at all. If we throw away their fslogix profile it works again, so it seems something in their profile messing up. However I can't find much information about how to troubleshoot one drive known folder move. Have you seen this happen before?
Natively RDP uses user profile disks. But yes you can use FSLogix…And the last time I used RDS, it does not know that you are not using FSLogix profiles
Hi Dean, I have setup of 700+ users and most of times users face profile space full issue . Can we have any pro active alert if the profile Is reaching max size even after it is dynamic ? Second question : what is the reason users facing " Access Denied Group Policy client service failed" as user's see this image even after using latest version of fslogix ?
When you create the profiles…I think you may have made them too small. I suggest a very large size like 30-50GB then also make them dynamic, then you should not generally run out of space. You should also run the profile shrink script to reduce the white space.
There is a way to do profile migration check this out - but user mustn't be logged in. "C:\Program Files\FSLogix\Apps\frx.exe" copy-profile -filename \\server\UserProfile\profile.vhdx -username mydomain\tes.user -dynamic 1 -verbose
Much Appreciated for making the content so informative and in single video. I always loved your content, graphics, video quality, easy explanation good to grasp even for newbee. Many thanks
Much appreciated! Thanks for watching...and for letting me know!
Would like to see a future video that discusses the combination of fslogix containerization and folder redirection. By redirecting user profile folders such as Documents, Desktop, and Downloads, it makes it easier for administrators to maintain those folders while still keeping the thousands of small files under AppData subfolder of the user profile containerized. To me, this seems to be a perfect marriage of the two user profile technologies
Interesting thought Alan…do you think the scenario you want is just like using OneDrive known folder redirection with FSLogix?
@@AzureAcademy I've actually already implemented this solution. But I was interested in your thoughts RE pros/cons of the solution as a best practice. My feeling was that, by combining folder redirection (via GP) with fslogix, the size of the VHDX files would stay small, yet the fslogix container would provide better small file performance while the Azure file share that hosts the folder redirected content provides decent performance for larger files typically found in Documents, Desktop, and Downloads. For the client that I used this solution for, it worked out really well but they only have 30ish users so it may not scale well for larger deployments.
This client didn't want to use OneDrive, so the known folder redirection wasn't in the mix
If I understand, you used the redirections.xml file to stop the docs, music, pics, desktop, etc, standard user folders from being in the profile
Where did you think you redirect them to?
The best content ever!!! thank you
Awesome, thanks! There is more to come, please share the videos with others!
Don't need a Private Endpoint to lock down the Storage Account Firewall do the specific AVD subnet. Can simply use a Service Endpoint instead and therefore, no additional resources to deploy.
A service endpoint allows the entire service or service in a region to communicate with your network…example: allow all storage accounts in East us to communicate to your virtual network. A private endpoint takes your file or blob feature of a single storage account and gives it an IP on your private network directly…very different service
@@AzureAcademy Ya, just depends on the requirements. Don't "need" the private endpoint. But like with anything, would have the conversation with the customer.
If the customer is ok with using a service endpoint on that subnet to begin using the Azure Backbone to communicate to all Storage Accounts allowing them to use Storage Account Firewall feature on a Storage Account by Storage Account basis, then Service Endpoints are ok.
If the customer wants to continue using the public internet for all subnet > Storage Account traffic and instead have the AVD instances use a Private Endpoint to lock down just those machines to that one Storage Account, then agreed, Private Endpoints would be good.
It depends and good to talk through both options.
Totally agree
@azureacademy , can you please do a video on AVD GPO ( Group Policy Implementation) ?
I do cover the official AVD GPO here at the 3:00 mark
th-cam.com/video/k2FdqfIpiWs/w-d-xo.html
brilliant!!
Thanks
Recovery Services Vault replication has no impact on the storage account as no data is copied to the vault. Snapshots are done directly on the storage account. So if you have LRS storage account and a GRS vault, you only get LRS replication for the backups
2 questions for you…
1. You mention a storage account…are you talking about using “unmanaged disk”
2. Do you have a link to the docs to show that LRS storage saving to a GRSv recovery vault will only replicate to LRS level?
@@AzureAcademy Why Azure Files backups doesn't replicate based on the Storage Replication Type setting of the vault?
The Storage Replication setting of the vault isn't relevant for Azure Files backup. This is because the current solution is snapshot-based and there's no data transferred to the vault. Snapshots are stored in the same storage account as the backed-up file share, and therefore replicated as per the replication setting of storage account.
@@AzureAcademy 1. Azure Files is what I am referencing. It's actually very annoying to work around as we are happy to have LRS for fault tolerance but would like in the event of a datacenter being destroyed that the backups still remained even though it would take time to restore. Its very poorly documented as well.
If you can point me to the doc you think should be updated my team can do it…
Are you talking about VM Disks or Azure Files inside storage accounts??? I think you are talking about FSLogix. The snapshot will be stored in the storage account but if you have Azure backup then the management of the snapshots is done by the backup vault.
The second part of this is IF the snapshot replicates into the backup vault and if you have LRS storage account and a GRS backup vault do you get LRS or GRS protection…not sure
I will check with the docs and the product team and get back to you
can I get the powershell script as reference incase I need to configure it manually?
It’s on my GitHub
github.com/DeanCefola/Azure-WVD/blob/master/PowerShell/FSLogixSetup.ps1
How do you apply all those settings with AzureAD joined host?
Either Intune policy a script or regkeys are the simplest ways
First of all thanks for your Videos. It helped a lot.
I have one question about how to define multiple azure file share for 10K users.
I am going to deploy Citrix VDIs on Azure for 10,000 users.
One subscription support only 2500 VDIs so will be using 4 different subscriptions.
One Azure file share support up to 100 TB so it can handle around 2500 users with 40 GB disk each. So would need 4 or more file shares.
All the 10,000 VDIs will be in same OU, how can i define multiple file shares for the users?
I know one way to create 4 different OUs or 4 different GPOs and link to Computer group but i am looking for best way to do it. Please assist.
Also need to consider future expansion.
The other thing to consider is storage performance. Each user connecting to the share will consume an average of 50 IOPS when logging on or off.
10,000 users would put you around 500,000 IOPS, Azure files premium scales to 100,000 IOPS per share which would put you at 5-6 file shares, not 4.
But at that scale you should also consider Azure NetApp files. 1 NetApp can sale to 400,000 IOPS you would need at least 2, then think about DR and replication
what is a host pool? is it a collection of VDdesktops or something else? do you have a video I can referenc for that?
A host pool is a metadata container for a AVD workload and a central connector for app groups and workspaces. Learn more here 👉 th-cam.com/video/FLbcayyodqk/w-d-xo.html
Hi Dean, first i want to thank you for the great content. Would it be possible that you show us the Inbound and Outbound NSG Rules in detail? I think the Timestamp is around 54:30. Thank you :)
Yes, this was covered as part of the AZ-140 series and here is a link - th-cam.com/video/kjqFUN78lso/w-d-xo.html the NSG rules start at 13:25
Thank you, i will check this out.
Awesome
Hi Dean, I do have a question about a issue we are currently facing using fslogix. We have setup fslogix with cloud cache and a normal profile and office profile. We have also setup one drive known folder move to be configured silently through gpo. This works fine most of the time but sometimes it just breaks for a user and stops working at all. If we throw away their fslogix profile it works again, so it seems something in their profile messing up. However I can't find much information about how to troubleshoot one drive known folder move. Have you seen this happen before?
I have seen profile corruption before…but it is rare. I suggest looking at the FSLogix logs or opening a support ticket to resolve it
Can you use FSlogix for RDS?
Natively RDP uses user profile disks. But yes you can use FSLogix…And the last time I used RDS, it does not know that you are not using FSLogix profiles
Hi Dean,
I have setup of 700+ users and most of times users face profile space full issue . Can we have any pro active alert if the profile Is reaching max size even after it is dynamic ?
Second question : what is the reason users facing " Access Denied Group Policy client service failed" as user's see this image even after using latest version of fslogix ?
When you create the profiles…I think you may have made them too small. I suggest a very large size like 30-50GB then also make them dynamic, then you should not generally run out of space. You should also run the profile shrink script to reduce the white space.
There is no way to alert from Azure on the users profile disk sizes. Azure can only alert on the file share size.
I’m not sure about that error…I haven’t seen it in the context of FSLogix. This sounds like a standard GPO issue. When do you get the error?
Hi Dean, is there any latency / performance benefit to using private endpoints for FSLofix File shares? If the NIC is presented in the vnet?
No, the nic is a local ip to represent the files service. The path in Azure is basically the same…maybe 1ms different. The main benefit is security
@@AzureAcademy Thanks Dean 🙂
anytime!
Can FSLogix gather the data from existing profiles and merge it into the VHDX?
Do you mean multiple profiles and combine them into 1 vhdx…no, no it doesn’t
@@AzureAcademy I'm wondering if there's any way to automatically get the existing data that is in the local machine into the profile disk.
There is a way to do profile migration check this out - but user mustn't be logged in.
"C:\Program Files\FSLogix\Apps\frx.exe" copy-profile -filename \\server\UserProfile\profile.vhdx -username mydomain\tes.user -dynamic 1 -verbose