https://worldofeuc.com logo
Join Slack
Powered by
Enlighten me on RoamIdentity... chatgpt is saying ...
# microsoft-fslogix
j
Enlighten me on RoamIdentity... chatgpt is saying its not on or is missing for FSLogix (it might be, will check soon)..but at some point, and maybe this started happening when I upgraded FSlogix version from a pretty old one a few months ago, that users are now frequently having to re-authenticate to office apps (outlook/word, etc).. requiring a Duo MFA prompt, etc.
c
If your machines are entra or hybrid joined, it should be set to zero which is default. Otherwise you can set it to one and it may help with SSO into 365 . literally today I had a customer who upgraded to 2601CU1 and started to get OneDrive prompting to sign in, set roamidentity to 1 and it immediately worked. Your mileage may vary
j
is there any way, via logs or something, to know if you need it enabled or not? feel like it shouldnt be a gray area 🙂
c
log file at c\programdata\fslogix\logs\profile Configuration Read (DWORD): SOFTWARE\FSLogix\Profiles\RoamIdentity. Data: 1 registry: HKLM\Software\FSLogix\Profiles\RoamIdentity
j
Sorry I misspoke.. I meant a log file or something that might hint at the fact that you would benefit from enabling RoamIdentity to fix the issue
I see no mention of "RoamIdentity" in the log file.. and dont see it in the registry either
and since you mentioned.. the RDS hosts ARE hybrid joined to entra.. so based off what you said earlier, it should not be set.
image.png
Looking at log files.. looks like I updated FSLogix back in mid december from a very old version to the latest at the time. I think the prompts started coming around then.. yellow exclamation marks in Outlook, office apps, etc.
I enabled Roamidentity and will restart the servers tonight. ChatGPT is pretty adamant about that fixing these specific issues.. hope so
r
Only use if you use Citrix FAS since it removes the PRT which makes it (almost) impossible to SSO to 365, I know you can use cert base authentication but a bit cumbersome. Otherwise, hybrid joined or not, you can still achieve SSO to 365 with out roaming the identity.
j
Thanks Robert... I've had it on for a few days and not sure it fixed anything. i still see a bunch of token errors in event viewer. It was working fine for a long time but might've changed when I upgraded a really old version of FSLogix to a newer one
@Aaron Parker What about you? I ask because I think I used your redirections file at some point.. Now that I'm looking through the fslogix log files.. im seeing things like the below which has me questioning things. But my redirection.xml file doesnt contain any of the below.
Copy code
Removed redirection from C:\Users\test\AppData\Roaming\Microsoft\Protect
[01:07:01.323][tid:00000cd8.00011948][INFO]             Removed redirection from C:\Users\test\AppData\Roaming\Microsoft\Credentials
[01:07:01.323][tid:00000cd8.00011948][INFO]             Removed redirection from C:\Users\test\AppData\Local\Microsoft\Credentials
[01:07:01.323][tid:00000cd8.00011948][INFO]             Removed redirection from C:\Users\test\AppData\Local\Microsoft\Office\16.0\OfficeFileCache
Mirroring exclude folder: AppData\Roaming\Microsoft\Protect\
[01:07:01.370][tid:00000cd8.00011948][INFO]             Mirroring exclude folder: AppData\Roaming\Microsoft\Credentials\
[01:07:01.401][tid:00000cd8.00011948][INFO]             Mirroring exclude folder: AppData\Local\Microsoft\Credentials\
c
i believe the agent is hardcoded to clean up these paths natively; from the release notes: • Updated the default identity exclusions as defined in Device identity and desktop virtualization | Microsoft Learn. • Fixed the registry exclusions. • Fixed logging when a user is excluded using local exclude groups. • Fixed FRX.exe copy-profile utility. • Updated default redirections in Outlook for Windows.
j
i think you're right.. ugh. so stumped on how to get this working in an ideal fashion
2 Views
Open in Slack
PreviousNext
Powered by