can anyone help me force log this user off. cvad fulldesktop with fslogix. Not sure why this is happining all of the sudden to a number of users. These are the only process left after a user attempted to log off i belive

Do you have a 'local_username' directory remaining under C:\Users after logging out?

Delete the fslogix session registry key for the user in hklm\software\fslogix\profiles\sessions and hklm\software\polices\fslogix\odfc\sessions and then dismount the vhdxs from disk management for the user. Finally kill winlogon for the session in task manager

Yes, I have local username when logging out. Is the Microsoft credentials folder that is locked in the local username.

Yup the reg keys I provided is on the vda

check your AV exclusions. it is usually related to that. known behavior for the credentials folder.

Yes the credentials folder being locked is something I have seen alot with incorrect AV exclusions. The reg keys i provided are just to force a fslogix user off a VDA if they got a ghost/incomplete session ect

Thanks, so I should exclude that folder from windows defender?

Not really. It are the default exclusions. Otherwise check via procmon wich process is holding the lock. •

%Programfiles%\FSLogix\Apps\frxdrv.sys

•

%Programfiles%\FSLogix\Apps\frxdrvvt.sys

•

%Programfiles%\FSLogix\Apps\frxccd.sys

•

%TEMP%*.VHD

•

%TEMP%*.VHDX

•

%Windir%\TEMP*.VHD

•

%Windir%\TEMP*.VHDX

•

\\<http://storageaccount.file.core.windows.net|storageaccount.file.core.windows.net>\share**.VHD

•

\\<http://storageaccount.file.core.windows.net|storageaccount.file.core.windows.net>\share**.VHDX

Exclude processes:

•

%Programfiles%\FSLogix\Apps\frxccd.exe

•

%Programfiles%\FSLogix\Apps\frxccds.exe

•

%Programfiles%\FSLogix\Apps\frxsvc.exe

@Balint Oberrauch Thank you. Would it look like this?

modify path into "starts with", user can also be SYSTEM and Process doesn't have to be word.