How do I login with UPN to Windows AD joined WVD host?

Question

question

artisticcheese asked Dec 23, '21 BalazsBarna-2515 edited Jun 8, '22

How do I login with UPN to Windows AD joined WVD host?

Hello,

I have Azure WVD hostpool deployed which is joined to ADDS (Active Directory Domain Services). My UPN in form user@domain.com is not working to sign in but domain.com\user does. I can see in event logs that when I try to login with UPN in form user@domain.com Windows thinks that Account Domain is AzureAD even though it's actully valid account in Active Directory. How do I force Windows to accept UPN as local Active Directory account instead?

> An account failed to log on.

Subject:
Security ID: NETWORK SERVICE
Account Name: desktop-1$
Account Domain: DOMAIN
Logon ID: 0x3E4

Logon Type: 3

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: user@domain.com
Account Domain: AzureAD

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064

azure-virtual-desktop

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

TexRanger-9804 · Mar 25 at 08:59 AM

Hi @artisticcheese,

We're having the same problem, although we fixed it by making sure the AAD Connect anchor attribute (mail) matched the UPN, but now it's broken again. Did you by any chance work out a fix?

TIA

0 ·

Answer 1 · 2021-12-24T02:46:59.19Z

Dev073 answered Dec 24, '21

Hi,
I understand you are leveraging ADDS and not AADDS(Azure ADDS)
Have you synced your on-prem (local ad) users to azure AD. This step is crucial for you to login with UPN.

Requirements for AVD with AD:
https://docs.microsoft.com/en-us/azure/virtual-desktop/overview#requirements

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 2 · 2021-12-24T13:31:27.823Z

artisticcheese answered Dec 24, '21 TimAnderson-8944 commented Jan 6, '22

I do in fact use Azure ADDS. It's synced from Azure AD and have the domain.com as UPN suffix

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

TimAnderson-8944 · Jan 06 at 05:41 PM

One thing to be aware of is that if a user is in Azure AD before you setup Azure ADDS then the password is not synched until it is changed. So you will get logon failure to Azure ADDS. Change the password in Azure AD and then it is synched and will work.

Tim

0 ·

Answer 3 · 2022-03-09T18:53:16.38Z

ClaytonTschirhart-3491 answered Mar 9, '22

I'm having the same issue when trying to sign into RemoteApp and Desktop Connection. I'm using my On-Premise UPN which is the same as my Azure AD primary login. When IIS receives the Windows Authentication, I'm showing it's trying to use the AzureAD domain and not my local domain.

screenshot-2022-03-09-125239.jpg (58.5 KiB)

image.png (17.8 KiB)

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 4 · 2022-04-11T21:07:09.627Z

BJJDad73-4296 answered Apr 11, '22 BJJDad73-4296 edited Apr 11, '22

I believe we're having the same or very similar issue here. Using Azure Virtual Desktop accessing a Windows Server Azure VM. Both VMs are domain joined using Azure AD Domain Services.

When trying to login using the AVD Windows client (or web client), when connecting to the Session Host I am prompted to login and the filled in user name is the user's UPN (email address). It will not accept that as a login. Instead the user has to change the UPN to domain\user.

That wouldn't be a problem, except it will not ever remember the username. It always defaults back to UPN when the user tries to login, which is frustrating. Users don't like having to remember and change the username each time.

I'm trying to find a way to either:

1 - Get the Session Host to save the domain\user login name so the user doesn't have to type it each time.
2 - Get the AVD VM to accept UPN as a login name.

Can anyone help?

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 5 · 2022-05-23T17:44:19.973Z

lolllfewa-5521 answered May 23, '22 lolllfewa-5521 published May 23, '22

Having the same problem.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 6 · 2022-06-07T19:15:10.3Z

lolllfewa-5521 answered Jun 7, '22

Change targetisaadjoined:i:1 to 0 on the host pool

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 7 · 2022-06-07T22:26:06.53Z

RyanWahrenbrock-9610 answered Jun 7, '22

We had the same issue, worked with MS support. This ended up being a self inflected problem with the Host pool, RDP Properties, Advanced. We removed targetisaadjoined:i:1 from the RDP Properties, then then we could login successfully with the full UPN. If you are using Azure AD DS, you should not have targetisaadjoined:i:1 in the RDP Properties.

Remove the highlighted below:

image.png (143.6 KiB)

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 8 · 2022-06-08T14:50:14.59Z

BalazsBarna-2515 answered Jun 8, '22 BalazsBarna-2515 edited Jun 8, '22

I had multiple machines configured with AAD ( not AD DS) joined and working properly, but now I just created a new AVD machine and I have the same issue. I have the same configuration, rights assigned on the machine level and on the Application group level as well, aadjoined tag is also in the RDP properties. Also a common issue, that Azure Windows VM Sing In has to be excluded in the conditional access policy for AVD Enterprise App. Now I have everything in place, still not able to logon to the machine.

screenshot-2022-06-08-164851.png (49.6 KiB)

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

question