Folks, I'm having issues getting silent office act...
# citrix-vadj
John Gallacher
02/04/2025, 2:53 PMFolks, I'm having issues getting silent office activation working on a new win11 24h2 CVAD 2402 deployment. The desktops are pooled / non persistent with FSLogix for profiles. The VDAs are sync'd to EntraID and I've run the install/XML with shared computer activation etc and added the trusted sites via GPO for SSO. I keep getting the activation popup when opening any office app. The test account does appear to be signed office. Its been been a while since I done this, is there any good community articles you could link with the end to end walkthrough and reqs? cheers
j
Jeff Riechers
02/04/2025, 5:19 PMDid you modify the workplace join scheduled task to run at startup along with at login? And using fslogix to store the auth token?
j
John Gallacher
02/04/2025, 5:42 PMHey Jeff, I will double-check what's happening with workplace join. I don't recall doing anything specific with that, cheers
c
c4rm0
02/04/2025, 8:16 PMWhats dsregcmd /status showing ?
c4rm0
02/04/2025, 8:20 PMYou also need to check the Entra ID tenancy and check to make sure Pass through Authentication / Seamless SSO is enabled as they might just be using password hash sync. Also check AD connecto to make sure hybrid join is enabled. Once configured It should look like this when you go to office.com / portal.office.com ect
j
John Gallacher
02/04/2025, 8:57 PMThanks @c4rm0. I'll check in the morning. In the past, I've set bis-f to leave and register /AAD/EntraID, which I found wasn't set. I've enabled that and will try the updated image in the AM 🙂
a
Aaron Parker
02/05/2025, 4:00 AMYou've got to stop pushing Seamless SSO - it's not secure and only there for downlevel operating systems. Hybrid join + PHS is what most organisations should be using, with falling back to Pass-through Auth only if needed for customers who must keep authn on-prem
👍 1
Aaron Parker
02/05/2025, 4:01 AM@John Gallacher as @c4rm0 points out -
dsregcmd /statusj
John Gallacher
02/05/2025, 3:46 PMLooks like a PRT failure. The machine reporting ok but the user isnt. Possibly a sync or UPN issue. Will run some more checks, cheers
John Gallacher
02/10/2025, 3:41 PMSo, I changed the UPN on my test account and it works as expected. The client said a 3rd party who manages EntraID/M365 have it working as expected for physical machines as is, and there are technical/historic reasons blocking the change of UPNs in AD for live users. I'm assuming another attribute like email or the like is being used and that how it works for the physical workstations. The client is going to get more detail but I'm wondering why it wouldn't work for Citrix - anything else I'm missing if they are using an alternate attribute on the EntraID side? cheers
John Gallacher
02/18/2025, 8:58 AM@c4rm0 @Aaron Parker have any of you had to use this alternateID config on Windows 11 before? https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configuring-alternate-login-id
John Gallacher
02/18/2025, 8:58 AMimage.png
John Gallacher
02/18/2025, 8:59 AMIve added the domain hint reg entry but its not grafting. Conscious it only references Win 7/8 and 10, cheers
John Gallacher
02/18/2025, 9:00 AMPS forgot to add, when I set the 365 domain as my AD UPN, everything works as expected but we cant do that for prod as the internal upn is needed for legacy apps, cheers
a
Aaron Parker
02/19/2025, 9:33 PMI haven't
👍 1
j
John Gallacher
02/20/2025, 4:26 PMThanks @Aaron Parker, the customer managed to fix the dependency for sso/internal domain on the blocking apps so we are good. The AD objects are being updated to use the correct UPN.