Several users reported a failure during the rollout of images in Azure Virtual Desktop in the last months. The error pattern was always the same: The virtual machine was built, and the next step failed while the VM was no longer running.

We figured out that the VM installation resulted in a blue screen with the error message 0xc000000f, Windows shut down internally, and the VM was stopped in Azure. That was reproducible and caused by the image itself. The image was created by capturing a Golden Master with Hydra for Azure Virtual Desktop or WVDAdmin (which can image an existing VM without destroying it).

Interesting: Older images from the same Golden Masters are working. The only difference between them is that the Golden Master was updated to Windows 11 24H2.

So, we inspected the Golden Master and started the imaging process step by step. After a while, we figured out that during the Sysprep process, Windows started to encrypt the C: drive. During the encryption, Sysprep finished and shut down the VM, and the imaging process continued. Unfortunately, the captured image is half encrypted and, for that reason, not deployable as a new VM/host.

We never figured out why this happened after upgrading to 24H2, and that also doesn't happen if your Golden Master was built on 24H2 initially.

Solution: The solution is more of a workaround. But if we disable the Bit Locker service on the Golden Master, the Sysprep process will not encrypt the C: drive, and the image will be deployable.

The upcoming version of Hydra and WVDAdmin will disable the Bit Locker service temporarily during the imaging process.