Are you all doing dsregcmd /leave on your MCS master images for hybrid joined scenarios? I've never done it on win10 multisession but starting to see issue with aad registration on win11 MS

yes yes yes. Otherwise just don't sync your master to Entra. That's also an option.

does the /leave cmd work fairly quick? any reason to delay shutting down and snapping it?

workes almost instant. I suggest you use BISF for sealing your image. Just configure leave and join in the GPO and link the GPO to both OUs (master + clones)

thanks! i need to get that updated 🙂

I have a powershell script I run to seal my machines and do other things like, AV updates/scans, uberagent generaliaztion, fslogix paths refreshed, wemcache update, etc. Also make sure to modify the workplace join to have it join on machine startup, and on user logon. Makes entra accounts accessible quicker.

@Jeff Riechers do you mind to share the extra points you're doing which BISF isn't covering? I clear stubpaths and do AV scans for vendors like Crowdstrike, SentinelOne and Cortex. Defender is already covered by BISF.

I haven't used BIS-F for years, so I would have to check it out. My scripts have kind of just morphed from stuff I have done over the years. Do you have a current link for BIS-F so I can compare?

Yes to leaving Azure as part of the master image build. Also, for W11, take a look at this article: https://support.citrix.com/s/article/CTX475187-windows-11-vda-machines-stuck-at-initializing-for-azure-ad-or-hybrid-azure-ad?language=en_US We had to implement this fix for our W11 23H2 VDAs. That said, I am not doing exactly what is described in Citrix's article. I simply deployed a GPP for that reg key (Provider = Citrix) via domain GPO. Been working ever since.

We have seen for a while now that you should use /leave even on your vdas that are not going to be hybrid joined or windows sometimes tries to reach out during logon and takes 20 minutes to timeout which is added to the logon time.

@Nick Panaccio do you have Entra ID joined catalogs or hybrid ones? What I also don't get: Do I need those keys really on the master? I guess on the Clones should be enough?

Ours are all hybrid joined. And no, those keys aren't required in the master - we're applying them to the provisioned VDAs.

good, common sense is still here. thank god.

we're running 2402. according to the ctx article, it's not needed for us

2303/2203 CU5 and later. you're affected aswell.

Ah. good catch. We did this well before 2402 was released.

oops. I need to read better. It's late. Sorry guys

We're still running 2203 CU3 in Prod, so...

Which field are you working at Nick? 😄 has to be healthcare

I wish i was running this stuff on server 2003 sometimes 🙂 wouldn't need half of the VDAs i have now lol

Healthcare adjactent... insurance