This message was deleted.

Are you excluding stuff from the profile? If so let's see the redirections.xml file.

they are non-persistant, so thats a no go. This is a citrix environment

Hybrid-join works perfectly fine in non-persistent, I have done it many times going back to 2012 R2 machines 🙂

ok. whats the downside on doing it?

Nothing

yes 2019

Then you don't even have to worry about the devices enrolling into Intune. I haven't found any downsides to hybrid-joining a server OS. If you follow the guidelines from Microsoft and Citrix when dealing with non-persistent machines, it just works.

ok. i will consider that. but also want any thougts on how to solve it without enrolling them

These articles should get you going with hybrid-join: https://docs.citrix.com/en-us/citrix-daas/install-configure/machine-identities/hybrid-azure-active-directory-joined.html https://support.citrix.com/article/CTX284738/provision-hybrid-aad-joined-virtual-machine-on-azureto-enable-intune

Always hybrid-join, right @Deyda? 😄

always...this is the easiest way to solve so much problems 🙂

Hybrid-join is a must, especially if you are using Office 365. Makes your job slightly more complicated, but your users will feel a change and should thank you for it 🙂

this is my redirections file: <?xml version="1.0" encoding="UTF-8"?> <!--Generated 2019-04-29 from https://raw.githubusercontent.com/aaronparker/FSLogix/master/Redirections/Redirections.csv--> <FrxProfileFolderRedirection ExcludeCommonFolders="0"> <Excludes> <Exclude Copy="0">Videos</Exclude> <Exclude Copy="0">Saved Games</Exclude> <Exclude Copy="0">Contacts</Exclude> <Exclude Copy="0">Tracing</Exclude> <Exclude Copy="0">Music</Exclude> <Exclude Copy="0">Downloads</Exclude> <Exclude Copy="0">$Recycle.Bin</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\Cache</Exclude> <Exclude Copy="0">AppData\Local\Downloaded Installations</Exclude> <Exclude Copy="0">AppData\Local\assembly</Exclude> <Exclude Copy="0">AppData\Local\CEF</Exclude> <Exclude Copy="0">AppData\Local\Deployment</Exclude> <Exclude Copy="0">AppData\Local\GroupPolicy</Exclude> <Exclude Copy="0">AppData\Local\Microsoft Help</Exclude> <Exclude Copy="0">AppData\Local\Sun</Exclude> <Exclude Copy="0">AppData\Local\VirtualStore</Exclude> <Exclude Copy="0">AppData\Local\CrashDumps</Exclude> <Exclude Copy="0">AppData\Local\Package Cache</Exclude> <Exclude Copy="0">AppData\Local\D3DSCache</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\TokenBroker\Cache</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Notifications</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Internet Explorer\DOMStore</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\MSOIdentityCRL\Tracing</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Messenger</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Terminal Server Client</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\UEV</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\Application Shortcuts</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\Mail</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\WebCache.old</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\AppCache</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\Explorer</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\GameExplorer</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\DNTException</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\IECompatCache</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\iecompatuaCache</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\Notifications</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\PRICache</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\PrivacIE</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\RoamingTiles</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\SchCache</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\WebCache</Exclude> <Exclude Copy="0">AppData\Local\Microsoft\Windows\1031</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\BrowserMetrics</Exclude> <Exclude Copy="0">AppData\Roaming\GoogleChrome\UserData\Default\Code Cache\js</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\CertificateRevocation</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\CertificateTransparency</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\Crashpad</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\FileTypePolicies</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\InterventionPolicyDatabase</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\MEIPreload</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\PepperFlash</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\pnacl</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\Safe Browsing</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\ShaderCache</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\SSLErrorAssistant</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\Subresource Filter</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\SwReporter</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\Default\JumpListIcons</Exclude> <Exclude Copy="0">AppData\Roaming\Google\Chrome\UserData\Default\JumpListIconsOld</Exclude> <Exclude Copy="0">AppData\Roaming\com.adobe.formscentral.FormsCentralForAcrobat</Exclude> <Exclude Copy="0">AppData\Roaming\Adobe\Acrobat\DC</Exclude> <Exclude Copy="0">AppData\Roaming\Adobe\SLData</Exclude> <Exclude Copy="0">AppData\Roaming\Sun\Java\Deployment\cache</Exclude> <Exclude Copy="0">AppData\Roaming\Sun\Java\Deployment\log</Exclude> <Exclude Copy="0">AppData\Roaming\Sun\Java\Deployment\tmp</Exclude> <Exclude Copy="0">AppData\Roaming\Citrix\PNAgent\AppCache</Exclude> <Exclude Copy="0">AppData\Roaming\Citrix\PNAgent\IconCache</Exclude> <Exclude Copy="0">AppData\Roaming\Citrix\PNAgent\ResourceCache</Exclude> <Exclude Copy="0">AppData\Roaming\ICAClient\Cache</Exclude> <Exclude Copy="0">AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys</Exclude> <Exclude Copy="0">AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\flashplayer\#SharedObjects</Exclude> <Exclude Copy="0">AppData\Roaming\ConnectWise\CrashDumps</Exclude> <Exclude Copy="0">AppData\Roaming\ConnectWise\cache</Exclude> <Exclude Copy="0">AppData\LocalLow</Exclude> </Excludes> <Includes> <Include Copy="3">AppData\LocalLow\Sun\Java\Deployment\security</Include> </Includes> </FrxProfileFolderRedirection>

In my opinion you are excluding way too much. However I can't say if that is the reason for the issue you have.

The rule is with fslogix....redirect so less as possible...the best case is to exclude nothing....if u want a small whitelisted profile..use upm

The trade-off with FSLogix and other container based solutions is the increased storage use compare to windows roaming profiles and the classic Citrix Profile Management. IMO that trade-off provides a better user experience and a more resilient user profile.

I agree that it should be smaller. will work on that later. But regarding the SSO. sso in browsers work. but office apps prompt for both username and password

+1 for hybrid join, my time in consulting led to no wins without hybrid domain join. I’m with @Kasper Johansen

Off the top of my head it sounds like the RoamIdentity part?

Try roaming Appdata\Local\Microsoft\IdentityCache we had issues with O365 apps constantly asking for signin and when we roamed that folder the issue went away - “This folder (“Appdata\Local\Microsoft\IdentityCache\”) is known as the "Universal Cache" used by ADAL. Because the customer is using Windows Server 2016, they are not using the WAM library, and so Office fallsback to using ADAL. Therefore ADAL in Office is looking for a refresh token in this cache folder, and is not able to find it, so a sign-in prompt is required

you don’t need hybrid join if you can enable cert based auth with entra

I have not done the certificated based setup, but I'll venture a guess and say that hybrid-join is easier and less complex

only if you don’t have FAS

@c4rm0 I think this is handled by fslogix. And the customer is using 2019

When I have seen the message for the Login box for office. My mind went to the RoamIndentity issue where it was 0, and changing it to 1. Also @c4rm0 was stating that he had to do both to get it to work 100%. Test it.

looks like roamidentity solved the problem for word etc, but oulook still prompts for login (not activation anymore)

And you put in @c4rm0 fix?

Yeah our issue was weird we was using Windows server 2016 with latest semi annual channel version of O365 Apps and we had constant account sign in error's and all O365 apps prompted for signin even with the Roamidentity set in fslogix (shared computer activation on O365 install was set) i also tried the sclcacheoveride gpo setting and that didnt work either. I came across this article https://support.citrix.com/article/CTX489573/office-365-account-error-sorry-we-cant-get-to-your-account-right-now so roamed the Identitycache folder and it fixed all my account sign in errors and users no longer got prompted for constant sign ins to O365 apps. I had microsoft go over the MSOID traces and they told me that folder needs to be roamed as we was using ADAL (Server 2016) and it uses that folder for a refresh token

im using fslogix, so none of these folders are excluded

Well according to that MS article for non persistent they should be excluded

you need to tell Outlook to do autodiscover if you want it auto open with the logged in user

@André Rovik If Outlook is the only application acting up now, try setting the following two reg keys and see if they help. reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity" /v DisableADALatopWAMOverride /t REG_DWORD /d 1 /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity" /v DisableAADWAM /t REG_DWORD /d 1 /f Prior to us going with Hybrid-join we needed these two set, for outlook to stop prompting for username and password every now and then. Found them in this thread at Citrix.com https://discussions.citrix.com/topic/403721-office-365-pro-plus-shared-activation-password-screen-not-able-to-select/page/8/

Might look ok now. I'm a little confused as this is not consistent and act different depending on new/old fslogix profile, reboot and so on. Will try those if its a problem again. but i want to stay on the most modern authentication mode if possible (WAM)

hybird join wouldnt work for me. only way I have office working is by blocking hybrid join