“Our mission is to empower every person and every

organization on the planet to achieve more.”

Troubleshooting - Introduction

Windows Virtual Desktop

User Experience

Participant Guide

© 2024 Microsoft Corporation. All rights reserved. Last modified: July 24, 2024

This training package content is proprietary and confidential and is intended only for users described in the training materials. Some elements
of this document are subject to change. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS
OR IMPLIED, IN THIS SUMMARY.
This content and information is provided to you under a Non-Disclosure Agreement and cannot be distributed. Copying or disclosing all or
any portion of the content and/or information included in this package is strictly prohibited. Complying with all applicable copyright laws is
the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in, or
introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or
otherwise), or for any purpose, without the express written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this
document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you
any license to these patents, trademarks, copyrights, or other intellectual property.
The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are
fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is
intended or should be inferred.
The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
Microsoft and the Microsoft products and services listed are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
Table of Contents
Troubleshooting - Introduction.....................................................................................................................................................3
Common issues and initial troubleshooting approach.................................................................................................4
Troubleshooting tools.............................................................................................................................................................. 14
Troubleshooting data locations............................................................................................................................................15
Collect data with WVD-Collect.............................................................................................................................................21
Collect Web client trace...........................................................................................................................................................29
Collect Desktop client trace................................................................................................................................................... 31
How to capture portal traces.................................................................................................................................................33
Collaboration and Escalation process................................................................................................................................35
Change log........................................................................................................................................................................................... 44

2
Troubleshooting - Introduction
This course/module was created for WVD Support Engineers.

It will take approximately 50 minutes to train agents.

This module introduces you to troubleshooting Windows Virtual Desktop. We go through the
available documentation, troubleshooting data that we usually collect, troubleshooting tools
and how to use them, and also what to do when you are stuck and require help from another
support team or an escalation resource.

After this course/module, you will be able to:

 Identify common issues and corresponding available troubleshooting resources
 Use Workflows, SDK, SharePoint, Cybot for research.
 Know what tools to use for troubleshooting depending on scenario.
 Know where to find the most useful WVD related data depending on scenario.
 Collect troubleshooting data using the WVD-Collect PowerShell script.
 Collect web client trace
 Collect Desktop client trace
 Know how to capture portal traces.
 Engage the appropriate support team when working on cross-technology issues and
collaboration with another team is needed: Networking, DS, Perf, Teams, Office etc.
 Use the correct escalation process when necessary to engage the product team using
IcMs or SMEs for DCR, RCA, supportability etc.

Icons are used throughout this guide to direct you to types of information:

The time a lesson or activity will take. An individual activity.

Resource lookup information. An activity for partners.

3
 Additional note information. A group activity.

Common issues and initial troubleshooting

approach
Customers may run into various issues during deployment or configuration of WVD host pools or later
while managing or connecting to their host pools.

At the same time, WVD has interconnectivity with various other Azure solutions too, which could also
encounter issues and indirectly affect WVD functionality too. It is important to identify early on if the issue
is related to the WVD service itself or to some other components not directly related to WVD and to
engage the right support team in order to provide the best expertise available to our customers (e.g. if we
identify an issue related to the Azure virtual network, engage the Azure Networking team for
collaboration as they are the experts in this field).

The most common issues customers may be running into are:

 Deployment issues

o Deployment fails with domain join error

o Deployment fails with DSC extension error

o Deployment fails with Quota limit reached

o Azure Portal issues preventing deployment

 Management issues

o Issues managing existing workspaces, host pools, app groups

o Issues assigning users

o Users are not seeing their published resources in the WVD clients

 Connectivity issues

o Cannot connect to the host pool

o Sessions get disconnected unexpectedly

 Performance issues

o Slow connection / latency

o Slow logon / logon hang

o Slow performance of specific applications inside the session

o Slow performance of the whole user session or session host / session or host hang

4
 Note: Some of these issues are documented and can be resolved with the guidance provided
through our public WVD documentation: https://docs.microsoft.com/en-us/azure/virtual-
desktop/troubleshoot-set-up-overview

We will go into some more details on some of these scenarios later through this module.

As CSS support engineer, you have access to a variety of internal tools and knowledge databases to help
you with troubleshooting WVD issues:

 CSS WVD Workflows: https://aka.ms/csswvdworkflows

 CSS RDS SharePoint site: http://aka.ms/css-rds

 Service Desk Knowledge: https://servicedesk.microsoft.com/#/knowledge

 CyBot: https://aka.ms/cybot

Error scenarios are categorized in internal to the service and external to Windows Virtual Desktop.

 Internal Issue: specifies scenarios that can't be mitigated by the customer and need to be resolved as
a support issue. In this case it's important for further troubleshooting to have the correlation ID and
approximate time frame of when the issue occurred.

 External Issue: relate to scenarios that can be mitigated by the customer. These are external to
Windows Virtual Desktop.

The following table lists common errors admins might run into .

Management errors

Error message Suggested solution

Failed to create registration Registration token couldn't be created. Try creating it again with a
key shorter expiry time (between 1 hour and 1 month).

Failed to delete registration Registration token couldn't be deleted. Try deleting it again. If it
key still doesn't work, use PowerShell to check if the token is still there.
If it's there, delete it with PowerShell.

Failed to change session host Couldn't change drain mode on the VM. Check the VM status. If
drain mode the VM's unavailable, drain mode can't be changed.

Failed to disconnect user Couldn't disconnect the user from the VM. Check the VM status. If
sessions the VM's unavailable, the user session can't be disconnected. If the
VM is available, check the user session status to see if it's
disconnected.

5
 Failed to log off all user(s) Could not sign users out of the VM. Check the VM status. If
within the session host unavailable, users can't be signed out. Check user session status to
see if they're already signed out. You can force sign out with
PowerShell.

Failed to unassign user from Could not unpublish an app group for a user. Check to see if user
application group is available on Azure AD. Check to see if the user is part of a user
group that the app group is published to.

There was an error retrieving Check location of VM used in the create host pool wizard. If image
the available locations is not available in that location, add image in that location or
choose a different VM location.

External connection error codes

Numeric Error code Suggested solution

code

-2147467259 ConnectionFailedAdTrustedRelationshipFailure The session host is not correctly

joined to the Active Directory.

-2146233088 ConnectionFailedUserHasValidSessionButRdshIsUnhealthy The connections failed because the

session host is unavailable. Check the
session host's health.

-2146233088 ConnectionFailedClientDisconnect If you see this error frequently, make

sure the user's computer is connected
to the network.

-2146233088 ConnectionFailedNoHealthyRdshAvailable The session the host user tried to

connect to isn't healthy. Debug the
virtual machine.

-2146233088 ConnectionFailedUserNotAuthorized The user doesn't have permission to

access the published app or desktop.
The error might appear after the
admin removed published resources.
Ask the user to refresh the feed in the
Remote Desktop application.

2 FileNotFound The application the user tried to

access is either incorrectly installed or
set to an incorrect path.

When publishing new apps while the

user has an active session, the user
won’t be able to access this app. The

6
 session must be shut down and
restarted before the user can access
the app.

3 InvalidCredentials The username or password the user

entered doesn't match any existing
usernames or passwords. Review the
credentials for typos and try again.

8 ConnectionBroken The connection between Client and

Gateway or Server dropped. No
action needed unless it happens
unexpectedly.

14 UnexpectedNetworkDisconnect The connection to the network

dropped. Ask the user to connect
again.

24 ReverseConnectFailed The host virtual machine has no

direct line of sight to RD Gateway.
Ensure the Gateway IP address can be
resolved.

Azure Portal errors

Reading guidance:

{0} is a wildcard replaced by the original value set by the customer

For errors where you see {0} and {1} in the same error, {0} is the WVD object, {1} is the property OR the
other related object like user, permission, etc.

Error Code (not visible in UI) Error message

Notifications_CreateRegistrationKey_DescriptionError Failed to create {0}'s registration

key.

Notifications_DeleteRegistrationKey_DescriptionError Failed to delete {0}'s registration

key.

Notifications_ChangeDrainMode_ErrorDescription Failed to change session host '{0}'

drain mode

Notifications_RestartVM_ErrorDescription Failed to restart virtual machine

'{0}'

NotificationManager_AddErrorDescription Failed to add {0} '{1}'

NotificationManager_DeleteErrorDescription Failed to delete {0} '{1}'

7
NotificationManager_ErrorRetrievingDescription There was an error retrieving the
{0}. Please refresh the page and
try again

NotificationManager_ErrorRetrievingInstanceDescription There was an error retrieving the

{0} '{1}'. Please refresh the page
and try again

NotificationManager_ErrorRetrievingInstanceTitle Failed to retrieve the {0} '{1}'

NotificationManager_ErrorRetrievingTitle Failed to retrieve {0}

NotificationManager_StatusBarMessage_SingleItem There was an error performing

your operation

NotificationManager_UpdateErrorDescription Failed to update {0} '{1}'

Notifications_Disconnect_Multiple_ErrorDescription Failed to disconnect user '{0}' {1}

sessions

Notifications_Disconnect_Single_ErrorDescription Failed to disconnect user '{0}'

from the VM '{1}'

Notifications_LogOff_All_ErrorDescription Failed to log off all users within

the session host '{0}'

Notifications_LogOff_Multiple_ErrorDescription Failed to log off user '{0}' {1}

sessions

Notifications_LogOff_Single_ErrorDescription Failed to log off user '{0}' from the

VM '{1}'

Notifications_RemoveAssignment_Multiple_ErrorDescription Failed to unassign user '{0}' from

{1} application group

Notifications_RemoveAssignment_Single_ErrorDescription Failed to unassign user '{0}' from

application group '{1}'

Notifications_SendMessage_Single_ErrorDescription Failed to send message to user

'{0}'

Notifications_SendMessage_ToAll_ErrorDescription Failed to send message to all

active users within the session
host '{0}'

Notifications_Image_ErrorRetriving_Description There was an error retrieving the

available locations for the
selected

Notifications_Image_ErrorRetriving_Title Failed to retrieve the available

locations

Validations_Image_UnknownError There was an error validating your

8
 image

Windows Virtual Desktop offers a diagnostic feature that allows administrators to identify issues through
a single interface. To learn more about the diagnostic capabilities of Windows Virtual Desktop, see the
"Troubleshoot with Log Analytics" document in this module.

Connections that don't reach Windows Virtual Desktop won't show up in diagnostics results because the
diagnostics role service itself is part of Windows Virtual Desktop. Windows Virtual Desktop connection
issues can happen when the end-user is experiencing network connectivity issues.

Proper scoping is very important in order to fully understand the issue and to provide the best possible
support.

Try to get as many useful information as possible, depending on the scenario, including:

 Subscription ID

 Host pool

 Application Group

 Workspace

 UPN of a couple affected users

These may be helpful later when troubleshooting with Kusto.

When starting to troubleshoot a customer issue, some questions that should be clarified right in the
beginning are:

1. What is the exact issue?

Describe the problem in as much detail as possible.

2. Are there any (error) messages displayed for the user?

If yes, get a screenshot or the complete (error) message. This is vital and can make the difference
between solving an issue in 30 minutes or 20 hours.

3. When did the issue start?

Knowing at least an approximate time frame would help to better narrow down the possible causes
and also help filter logs easier.

4. Have there been any changes or other issues within the environment lately (update/software
installations, hardware changes, server crashes, disk failures etc.)?
This may be useful especially when we know the time frame for when the issue started.

5. Is it a constant or a sporadic/intermittent issue?

If it is sporadic/intermittent, can it be narrowed down to a specific time of the day or activity? (like
does it occur only in the mornings, or when there is a high load, or when users are performing a

9
 specific task or use a specific application, or an antivirus or backup software is performing scheduled
activities in the background etc.)

6. Are all users affected or only some of them?

If more than one user is affected, are all of them affected at the exact same time (like in a server
hang/freeze situation) or randomly (like User1 has the issue but User2 not, then sometime later User2
has the issue but User1 not)?

7. Has there been any research/troubleshooting done already?

If yes, what were the findings? Has anything been spotted that might be relevant? Avoid any
assumptions. Look for facts, double-check things if needed, to avoid following a wrong path.

8. Are there any known (temporary) workarounds?

Like rebooting the server or disconnecting/reconnecting the session etc.

9. How is the issue impacting the users and overall, the business? What is the business context of
the issue?
While an issue may sound simple and with low impact at first (e.g.: some users may not be able to
start a 3rd-party RemoteApp from one Session Host), understanding the business context could
drastically change things and how you work/focus on an issue (e.g.: that RemoteApp may be used by
field medics fighting deadly diseases, to access medical records and research notes from remote
locations and therefore every minute could make the difference between life and death).

Not all these questions may need to be asked every single time. Keep reevaluating all the existing
information as your discussion with the customer progresses and decide which questions may still be
relevant.

Based on the results of these initial questions, additional, more specific questions for specific scenarios
may be needed.

Questions and hints for connectivity issues

Connectivity issues can have various completely different causes, but most of them are related to some
sort of network and/or configuration issues.

 Is the connection failing right from the start (cannot log in to a target machine at all) or the initial
connection works but then the session gets disconnected/terminated unexpectedly?

 Can you log in to the target machine using direct RDP (mstsc) instead of WVD, using the exact same
user account? This may require to temporarily enable outbound RDP or to RDP from another working
machine from the same network, but the outcome can be vital for the troubleshooting.

 Are there any firewalls or proxies used to connect to the Internet or to Azure resources? You might
have to check if any of these are not blocking the communication.

 Try to get the Correlation Id for the failed connection, which can then be used to query Kusto for
additional information/troubleshooting.

 Especially when unexpected disconnects occur, clarify all the following:

10
o UPN that experienced the disconnect?

o Date/Time the disconnect occurred?

o Time zone user was connecting from?

o Error message when session was disconnected (screenshot if possible)?

o Was user disconnected in web client or WVD client?

o Were other users logged in on same RDSH also disconnected?

o Was the session able to reconnect successfully? If so how long did it take?

o Are users going through proxy or VPN?

o Are WVD VM's going through proxy?

o Is there any device or appliance Infront of WVD VM's that is doing SSL inspection, packet
inspection, load balancing or web filtering?

o Is there any pattern when disconnects occur? For example are all users working from same
location? logged into same VM when disconnect occurs? only occurs on VM’s located in same
region? only get disconnected from VM’s using custom image? Etc..

o Have you confirmed WVD VM's can connect to required URL's per
https://docs.microsoft.com/en-us/azure/virtual-desktop/overview#requirements . If
needed engage Azure Networking to assist.

o Have you confirmed client computers can connect to required URL's per
https://docs.microsoft.com/en-us/azure/virtual-desktop/overview#requirements . If
needed engage Azure Networking to assist.

11
Questions and hints for Microsoft RemoteApp issues
 Can you reproduce the issue also within a full desktop WVD session on the same WVD Host, with the
same user account and same application? This is to compare if the issue may be something generic to
remote session connections or just something strictly RemoteApp specific.

 Does the issue occur only with a specific RemoteApp (if so, is it 3rd party?) or can it also be
reproduced with other (especially with Microsoft applications like Notepad, Calculator, Paint)?

 When UserA is affected, are also other users who are using the same RemoteApp affected at the exact
same time? Keyword is 'at the exact same time'. If yes, it may be again some generic issue.

 If you have issues with RemoteApp windows or window elements not being rendered or working
properly, does it happen with any window/window element of the RemoteApp or just with a specific
window/window element? If just a specific window is affected, understanding how that window is
different from the other windows of the same application may be key to solving the issue. In this case,
support from the application developer will also be important.

 If you have issues with a RemoteApp window flickering or rendered incorrectly, does it help to
minimize and then maximize the affected RemoteApp window or to move it to a different monitor (in
a multimon scenario)?

 There are several known issues with these kinds of symptoms, so looking up the symptoms in the
internal knowledge databases might help.

Questions and hints when facing session or application hangs/crashes

 In case of server or session hangs/crashes: Is the entire server affected or only specific users/user
sessions?

12
 In case of application crashes: Are only specific applications affected or any application?

 Are there any specific crash error codes/messages or event logs?

 Most of the time, the best approach to troubleshoot a crash/hang is to collect a memory dump
(full/complete memory dump for server hangs/crashes and process dumps for application
hangs/crashes).

Questions and hints when facing black screen at logon

 How long does the black screen last?

o Does it go away after waiting for up to 5-10 minutes and then the logon continues, and the user
can use the session? If yes, then a slow logon trace might help understand what's taking the
logon process so long.

o Does the connection stay in the black screen regardless how long you wait? If yes, then usually
something got stuck and a full memory dump of the affected host while in black screen is the
best approach for further troubleshooting.

 Is FSLogix installed on the hosts? If yes, make sure that it is updated to the latest available version. If
the issue still persists even with the latest FSLogix version, check if it still reproduces also without
FSLogix.

 Make sure the host is fully up to date. There were several black screen issues already fixed in the past
through Windows Updates.

13
Troubleshooting tools
Customers have the option to use Log Analytics to troubleshoot their environment. If customers have
Log Analytics already set up by the time, they face the issue, running specific queries can help better
understand the cause. Customers can then provide the Log Analytics results to CSS support engineers for
further troubleshooting with an internal tool named Kusto.

Azure Support Center (ASC) is a main CSS troubleshooting tool for Azure environments that can provide
useful insight into the customer's deployment and potential issues based on customer support case. The
product team is planning to include more and more WVD troubleshooting options into ASC in the future.

Kusto (also called Azure Data Explorer) is another main tool CSS support engineer use to troubleshoot
WVD.

When neither ASC nor Kusto can help, or when you need to collect additional data either from clients
connecting to the WVD environment or from the WVD session hosts, then you can use our internal WVD-
Collect PowerShell script to automate data collection. The same data that WVD-Collect is gathering can
also be collected by the engineer/customer manually, the script only speeds up gathering the relevant
data.

When deploying a WVD host pool fails during the validation or deployment phase, then the Azure
Activity log may also provide useful information on the cause. In the Azure Portal, search for "Activity
log" and look for any errors showing up for your recent deployment. More details later in the
troubleshooting examples.

There are various other tools too that you many need during your investigation of a WVD issue, to collect
network traces, process or full memory dumps, slow logon traces etc., but these are highly dependent on
the actual scenario that has to troubleshoot.

Next, we will go through our main WVD troubleshooting tools, where to find them, how to get access to
them and some basic steps to use them.

14
Troubleshooting data locations
There are various locations where information relevant for WVD troubleshooting can be located.

Based on the scenario you are troubleshooting, you may need to look through one or more of these
locations and use one or more of the available troubleshooting or data collector tools.

The main tool for troubleshooting WVD related connectivity issues is Kusto, but for other issues you may
need to take a deeper look either at the client or host settings, event logs or even traces.

Following is a list of common locations for WVD related data:

WVD client (Windows)

Note: Web Feed Information can be found under: C:\Users\%username%\AppData\Local\

rdclientwpf

After the user subscribed to the web feed, RDP files corresponding to the resources the user has access
to are being downloaded and stored locally, for easier access. If admins change anything (e.g. new
resources have been published or old resources removed, these files will be updated accordingly after
user logon:

Registry keys relevant for the WVD client are stored under: HKEY_CURRENT_USER\Software\Microsoft\
RdClientRadc\

15
ETL Traces generated by the WVD desktop client are stored under: C:\Users\%username%\AppData\
Local\Temp\DiagOutputDir\RdClientAutoTrace

WVD Client Upgrade Log: C:\Users\%username%\AppData\Local\Temp\DiagOutputDir\

RdClientAutoTrace\MSI.log

WVD Session Host Logs

WVD hosts have their own set of logs too.

The Agent installation logs can be found under:

16
 RD Agent: C:\Program Files\Microsoft RDInfra\AgentInstall.txt

 Geneva Agent: C:\Program Files\Microsoft RDInfra\GenevaInstall.txt

 SXS Stack: C:\Program Files\Microsoft RDInfra\SXSStackInstall.txt

Agent registry locations:

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RDAgentBootLoader

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RDInfraAgent

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RDMonitoringAgent

Event Logs related to the WVD Agents or useful for host troubleshooting can be found under:
 Application Logs

o Source: WVD-Agent

o Source: RDAgentBootLoader

17
 RemoteDesktopServices

Session Host Providers:

This list will constantly change as we add providers

To get the current list open Perfmon -> Data Collector Sets -> Event Trace Sessions

18
Go to Properties -> Trace Providers

WVD Session Host deployment logs

These logs may be useful when troubleshooting deployment issues.

Domain Join:

 C:\Packages\Plugins\Microsoft.Compute.JsonADDomainExtension\1.3.2\Status\0.status (open in
notepad)

19
 C:\Windows\debug\NetSetup.log

DSC Logs:
 C:\Windows\Temp\ScriptLog.log

 C:\Packages\Plugins\Microsoft.Powershell.DSC\2.80.0.0\Status\0.status (open in notepad)

20
Collect data with WVD-Collect
WVD-Collect is a PowerShell script to simplify data collection for troubleshooting Windows Virtual
Desktop issues and a convenient method for submitting and following quick & easy action plans.

The collected data can help with troubleshooting WVD deployment or configuration issues, session
connectivity issues, profile issues or even Remote Assistance issues when MSRA is used in WVD
environments.

The script works on any Windows client and Windows server OS supporting at least PowerShell 5.1.

Download
The latest version of the script can be downloaded from HERE. See also: revision history

Note: Please make sure to always use the latest available version!

How to use
The script must be run with elevated permissions in order to collect all required data.

Run the script on WVD host VMs and/or Windows based devices from where you connect to the WVD
hosts, as needed.

The script will collect a set of "default data" regardless of parameters. By adding one or more parameters,
you can collect additional data, useful for specific troubleshooting scenarios.

The collected data will be automatically archived into a .zip file located in the same folder as the script
itself.

Available command line parameters

 Certificate = Collects Certificates related data

 ClientAutoTrace = Collects existing RD client ETL traces and RD client upgrade log from devices
running the WVD Desktop client

Note: This parameter is useful for collecting the automatic client ETL traces, when
troubleshooting WVD client connectivity or WVD client issues. The RdClientAutoTrace folder
might be quite large. When such data is needed for CSS troubleshooting, recommended is to
first clear the content of the folder (eventually create a backup of the old content if you want),
then reproduce the issue so that new traces are generated and after that run the WVD-Collect
script so that only the latest, relevant traces are collected.

 MonTables = Collects existing converted monitoring traces from WVD hosts

21
 Note: This parameter is useful for investigating issues with WVD hosts not communicating
with the WVD services (Broker or Diagnostics). In these scenarios Kusto/Log Analytics may not
receive any data, but some traces are still available on the hosts themselves and may help
identify the underlying cause.

 MSRA = Collects Remote Assistance related data

 Profile = Collects User Profile related data (incl. FSLogix)

 Teams = Collects Teams WVD optimization related data

Note: To collect the proper data when having issues with Teams optimized for WVD,
reproduce the issue with an affected user, press Ctrl+Alt+Shift+1 within the Teams window of
the affected user to generate additional Teams diagnostics data and after that run the WVD-
Collect script with the "-Teams" parameter (WVD-Collect.ps1 -Teams) within this affected user's
WVD session. The script itself will not force generating the Teams diagnostics files, it will only
collect them if they are already available. There is also an additional confirmation prompt
when launching the script with the "-Teams" parameter to get the user's confirmation that
these prerequisites have been met before continuing.

 Verbose = Displays more verbose information about the steps performed during data collection

Usage example without parameters (collects only default data):

.\WVD-Collect.ps1

22
Usage example with parameters (collects default data + monitoring traces + profile related information +
displays more information on the performed steps):
.\WVD-Collect.ps1 -MonTables -Profile -Verbose

If you are missing any of the data that the tool should normally collect (see "Data being collected"), check
the content of "*_WVD-Collect-Output.txt" and "*_WVD-Collect-Errors.txt" for more information. Some
data may not be present during data collection and thus not picked up by the script. This should be
visible in one of the two text files.

Customer-friendly action plan

This example does not include any parameters. Add any of the parameters specified
above as you see necessary, depending on the scenario you are troubleshooting. If
you need to collect data from multiple machines, repeat these steps on each machine.

23
 Please retrieve the "WVD-Collect.zip" file from the workspace, copy it to the affected machine and
extract the content into a folder such as C:\WVD-Collect.

 While logged in on the affected machine, open an elevated PowerShell console, go to the folder with
the script and execute:

.\WVD-Collect.ps1

 If the script does not start, complaining about execution restrictions, then in an elevated PowerShell
console run:
Set-ExecutionPolicy -ExecutionPolicy Bypass -Force -Scope Process

After that run the WVD-Collect script again.

If you cannot change the ExecutionPolicy settings or a higher restriction applies that blocks
execution of the script, please ask your domain admin (or the responsible team) for a temporary
exemption.

 Please wait until the script finishes collecting the data.

 The script will automatically archive all collected data into a .zip file located in the same folder as the
script itself. Please upload this .zip file to the workspace.

 If there are any questions or concerns about the data collected please let me know. You can also
review the contents of the .zip file before uploading it.

Data collected
The collected data is stored in a subfolder under the same folder where the script is located and at the
end of the data collection, the results are archived into a .zip file. No data is automatically uploaded to
Microsoft.

The script collects the following set of default data regardless if command line parameters have been
specified.

Depending on the scenario you are troubleshooting, you may need to go through one or more of the log
files, event logs, registry keys or other system settings as needed.

 Log files - these are mostly useful for troubleshooting deployment issues and agent issues:

o C:\Packages\Plugins\Microsoft.Powershell.DSC\<version>\Status\

o C:\Packages\Plugins\Microsoft.Compute.JsonADDomainExtension\<version>\Status\

o C:\Packages\Plugins\Microsoft.EnterpriseCloud.Monitoring.MicrosoftMonitoringAgent\<version>\
Status\

o C:\Program Files\Microsoft RDInfra\AgentInstall.txt

o C:\Program Files\Microsoft RDInfra\GenevaInstall.txt

o C:\Program Files\Microsoft RDInfra\SXSStackInstall.txt

o C:\Windows\debug\NetSetup.log

24
 o C:\Windows\Temp\ScriptLog.log

o C:\WindowsAzure\Logs\WaAppAgent.log

o C:\WindowsAzure\Logs\Plugins\ folder with all subfolders

 Geneva Scheduled Task information

 Local group membership information:

o Remote Desktop Users

 Registry keys:

o HKEY_CURRENT_USER\SOFTWARE\Microsoft\RdClientRadc

o HKEY_CURRENT_USER\SOFTWARE\Microsoft\Remote Desktop

o HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Azure\DSC

o HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RDAgentBootLoader

o HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RDInfraAgent

o HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RDMonitoringAgent

o HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Terminal Server Client

o HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies

o HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server

o HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography

o HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation

o HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services

o HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography

o HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

o HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders

o HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server

o HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinRM

 Event Logs:

o Application

o Microsoft-Windows-DSC/Operational

o Microsoft-Windows-PowerShell/Operational

o Microsoft-Windows-RemoteDesktopServices-RdpCoreCDV/Admin

o Microsoft-Windows-RemoteDesktopServices-RdpCoreCDV/Operational

o Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin

25
 o Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational

o Microsoft-Windows-TerminalServices-LocalSessionManager/Admin

o Microsoft-Windows-TerminalServices-LocalSessionManager/Operational

o Microsoft-Windows-TerminalServices-PnPDevices/Admin

o Microsoft-Windows-TerminalServices-PnPDevices/Operational

o Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin

o Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational

o Microsoft-Windows-WinRM/Operational

o Microsoft-WindowsAzure-Diagnostics/Bootstrapper

o Microsoft-WindowsAzure-Diagnostics/GuestAgent

o Microsoft-WindowsAzure-Diagnostics/Heartbeat

o Microsoft-WindowsAzure-Diagnostics/Runtime

o Microsoft-WindowsAzure-Status/GuestAgent

o Microsoft-WindowsAzure-Status/Plugins

o System

 "gpresult /h" and "gpresult /r /v" output

 Details of the running processes and services

 Networking information (firewall rules, ipconfig /all, profiles, netstat -anob, proxy settings)

 Qwinsta output

 PowerShell version

 Get-Hotfix output

 Get-DscConfiguration output

 Get-DscConfigurationStatus output

 File versions of the currently running binaries

 File information about the WVD desktop client binaries ("msrdc.exe" and "msrdcw.exe")

 File versions of key binaries:

o Windows\System32\*.dll

o Windows\System32\*.exe

o Windows\System32\*.sys

o Windows\SysWOW64\*.dll

o Windows\SysWOW64\*.exe

26
 o Windows\System32\drivers\*.sys

 Basic system information

 Msinfo32 output

 Basic WinRM configuration information

o presence of "WinRMRemoteWMIUsers__" group

o IPv4Filter and IPv6Filter values

o presence of firewall rules for ports 5985 and 5986

o "winrm get winrm/config" output

o "winrm e winrm/config/listener" output

When used together with the -ClientAutoTrace command line parameter, the following data is also
collected:

 The content of the "C:\Users\%username%\AppData\Local\Temp\DiagOutputDir\RdClientAutoTrace"

folder (available on devices used as source clients to connect to WVD hosts), containing WVD remote
desktop client ETL traces)

When used together with the -MonTables command line parameter, the following steps are also
performed:

 Convert existing .tsf files on WVD hosts from under "C:\Windows\System32\config\systemprofile\

AppData\Roaming\Microsoft\Monitoring\Tables" into .csv files

 Collect the resulting .csv files

When used together with the -Profile command line parameter, the following data is also collected:

 FSLogix log files:

o C:\ProgramData\FSLogix\Logs
 Registry keys:

o HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office

o HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive

o HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office

o HKEY_LOCAL_MACHINE\SOFTWARE\FSLogix

o HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

o HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search

o HKEY_LOCAL_MACHINE\SOFTWARE\Policies\FSLogix

27
 Event Logs:

o Microsoft-Windows-SMBClient/Connectivity

o Microsoft-Windows-SMBClient/Operational

o Microsoft-Windows-SMBClient/Security

o Microsoft-Windows-SMBServer/Connectivity

o Microsoft-Windows-SMBServer/Operational

o Microsoft-Windows-SMBServer/Security

o Microsoft-Windows-User Profile Service/Operational

o Microsoft-Windows-VHDMP/Operational

When used together with the -Certificate command line parameter, the following data is also collected:

 Certificate and thumbprint information

 Event Logs:

o Microsoft-Windows-CAPI2/Operational

When used together with the -MSRA command line parameter, the following data is also collected:

 Membership information for the following groups:

o Distributed COM Users

o Offer Remote Assistance Helpers

 Event Logs:

o Microsoft-Windows-RemoteAssistance/Admin

o Microsoft-Windows-RemoteAssistance/Operational

28
Collect Web client trace
For issues with the WVD Web Client, you can collect a Web Client trace as described below:

1. Login to web client

2. In top right corner click 3 dots -> About

3. Click Start Recording

4. Reproduce the issue

5. In top right corner click 3 dots again -> About -> Stop Recording -> Trace will automatically
download

29
 6. Trace file will automatically download

If you are investigating a customer's issue, ask the customer to provide the following for further
troubleshooting:

7. Upload trace (RD Console Logs.txt) to the secure DTM workspace

30
Collect Desktop client trace
If the issue occurs before connection starts
1. Close all instances of MSRDC.exe and MSRDCW.exe through task manager

2. Open File Explorer -> navigate to C:\Users\%username%\AppData\Local\Temp\DiagOutputDir

and delete RdClientAutoTrace folder

3. Ask the user to open the WVD client and try to connect

4. When connection fails:

a. Click Ctrl+C to copy the error information and then save the information to a .txt file (e.g.
FailedConnect.txt)

b. Take also a screenshot and save it as e.g. FailedConnect.jpg

5. The ETL trace won't finish writing until the WVD client is gracefully closed

1. Click X to close the client

2. Then right click on WVD icon in SysTray -> select disconnect all sessions

31
If you are investigating a customer's issue, ask the customer to provide the following for further
troubleshooting:
6. Go to C:\Users\%username%\AppData\Local\Temp\DiagOutputDir -> zip up RdClientAutoTrace
folder -> upload zip to the secure DTM workspace

7. Upload FailedConnect.txt and FailedConnect.jpg to the secure DTM workspace

8. Send email with answers to the following:

b. UPN that experienced the disconnect

c. Time zone the user was connecting from

If the issue occurs after connection starts

10. Close all instances of MSRDC.exe and MSRDCW.exe through task manager

11. Open File Explorer -> navigate to C:\Users\%username%\AppData\Local\Temp\DiagOutputDir

and delete RdClientAutoTrace folder

12. Ask the user to open the WVD client and connect normally

13. After connection completes click Connection info icon

14. Click down arrow to show details -> Press Ctrl+C to copy -> paste in notepad and save as
FailedConnect.txt

32
 15. Reproduce the issue

16. Take a screenshot of the error and save it as e.g. FailedConnect.jpg

17. ETL trace won't finish writing until the WVD client is gracefully closed

a. Click X to close the client

b. Then right click on WVD icon in SysTray -> select disconnect all sessions

If you are investigating a customer's issue, ask the customer to provide the following for further
troubleshooting:
18. Go to C:\Users\%username%\AppData\Local\Temp\DiagOutputDir -> zip up RdClientAutoTrace
folder -> upload zip to the secure DTM workspace

19. Upload FailedConnect.txt and FailedConnect.jpg to the secure DTM workspace

20. Send email with the following additional information:

a. UPN that experienced the disconnect

b. Time zone the user was connecting from

How to capture portal traces

If you encounter issues with the new WVD Azure portal itself (e.g. information not being available or
displayed properly), you can capture portal traces that may help narrow down the problem.

For example, if you do not see a user's active session through the Users blade, but it does show up
through the VM Properties blade, in this case:

33
 21. Open the Azure Portal and navigate to the WVD portal blade that has the issue (e.g. the Sessions
tab blade under Users blade)

22. Press F12 and in the debugging window go to "Network"

23. Clear console (generally the circle with the diagonal line icon - tooltip or location may vary based
on the browser used)

24. Refresh the affected tab to reproduce the issue

25. Grab the traces and open the response (for our example with the missing user session, you should
normally be able to see the VM and user session info in the response like the following):

This may give us information on whether the issue is on the portal or in the API.

Engage the product team for further assistance through an IcM.

34
Collaboration and Escalation process
These topics are mostly relevant for CSS support engineers working on WVD related support cases.

Collaboration process
Just because a problem is occurring on a Windows Virtual Desktop VM or within a Windows Virtual
Desktop session, it does not automatically mean that a WVD engineer is needed or that a WVD engineer
is the best qualified resource to resolve the issue.

Based on the actual issue and preliminary troubleshooting you may find out that involving other teams
may be needed to progress with the investigation.

Always try to get the relevant information and data (logs, traces) from the customer, try to analyze them
and if you are stuck involve the right team as soon as possible to speed up troubleshooting.

For example:

 when dealing with Networking issues (for example connectivity failing, unexpected disconnects, VPN
issues etc.) and regular WVD workflows and troubleshooting steps do not help:

o engage the Azure Networking or on-prem Networking team as needed for assistance,

 when dealing with Performance issues (for example slow overall VM or session performance, slow
application performance) and regular WVD workflows and troubleshooting steps do not help:

o engage the Azure VM team or from Windows Performance team for assistance as
needed,

 when dealing with Azure AD authentication issues (for example authentication to Azure/WVD service
fails, Conditional Access issues, user logon issues) and regular WVD workflows and troubleshooting
steps do not help:

o engage the Azure Identity team for assistance,

 when dealing with FSLogix issues (for example user profile or Office container issues, temporary
profiles on logon, Java application masking issues) and regular WVD workflows and troubleshooting
steps do not help:

o engage the FSLogix team for assistance,

 when dealing with Office issues on a WVD VM (for example Office activation issues or performance or
other issues affecting Office applications only) and regular WVD workflows and troubleshooting steps
do not help:

o engage the Office/Microsoft 365 team for assistance, as they are the ones specialized in
these kind of issues and can help provide the proper action plan and next steps to resolve
the customer's issue.

If you are unsure which team to contact, reach out to your Technical Advisor (or Partner Technical Advisor)
or to one of the WVD SMEs for clarification.

35
Sometimes transferring the whole case to one of these other teams might make more sense, in order to
reduce ping pong between teams and provide the customer the best possible support experience. It
depends on the situation, so discuss with your Technical Advisor on a case by case basis.

When reaching out for help, either team internal (e.g. escalation) or to another team, make sure to always
have a proper summary of the issue and all the troubleshooting steps done so far, so that it will be easier
for whoever is going to assist you to understand the issue and the current status. It is also recommended
to have had some preliminary analysis done on the topic that you need help for (e.g. you have collected
and checked network traces if there is a networking issue) so that you can also have a proper
discussion/collaboration with the Networking engineer and not just expect them to solve the case for you.

Escalation process
If you need assistance from the product group, you must create an IcM.

You do not need extra permission to create an IcM (severity 3), but common sense should be applied
before reaching out to the product team. Make sure you exhausted all other resources and channels you
have (you've collected and analyzed data, you've tried to repro the issue internally, you've reached out to
other SMEs or to the PG through our CSS/PG Teams channel or Tech Triages etc.) before opening an IcM.

Important: Leave Severity at level 3. Never change severity unless instructed by your Technical
Advisor, Manager, or the Product Group.

There are two ways to create an IcM:

 Create through ASC (recommended)

 Create Manually

Create ICM through ASC (recommended)

26. Go to ASC (Azure Support Center) and enter case number:
https://azuresupportcenter.msftcloudes.com/

36
 Note: If you get access denied and don't have access to ASC
a. Request access per Getting access to ASC
b. Create ICM through the web interface

27. In top right corner click triangle with exclamation point

28. Select the appropriate ICM template

 For regular escalations select: WVD CRI ICM Template -> Next

 For RCA requests select: WVD RCA Template -> Next

 For WVD Spring Update topics select: WVD Spring Update 2020 -> Next

29. Fill out ICM template

 Make sure that the Title field is filled out and matches the problem you are escalating. Now
by default it will take the title for the case in Service Desk which might not be good. Please ensure
you update the title accordingly.

37
 Leave Severity at level 3. Never change severity unless instructed by your Technical Advisor, Manager,
or the Product Group.

 For Summary provide answers to questions

30. Open your case in Service Desk -> Verify that the ICM was added -> if not, enter the ICM number ->
Save

38
Create ICM through the web interface
31. Go to https://aka.ms/icm

32. Click Create

33. Choose I'll search for the team to own this incident

34. Search "Windows Virtual Desktop"

39
35. Select Azure Virtual Desktop (Preview) OnCall

36. Enter information -> click Next

Note: Always leave Severity at level 3. Never change severity unless instructed by your
Technical Advisor, Manager, or the Product Group

40
37. Enter Customer Name and Case Number

41
38. Click Submit

39. Wait for email with ICM number

42
40. Open case in Service Desk -> Enter ICM number -> Save

43
Change log
Date Changes Changed by

08/14/2020 Document was created. a-dacali

44