Azure Windows Virtual Desktop administration with WVDAdmin

Azure (Windows) Virtual Desktop is generally available under continuous improvement and currently available in the ARM and in the Classic (Fall) version. The ARM version is completely into the Azure Portal. Sometimes it helps to have a native GUI to make some configuration and - for me, most important - to have an easy image handling to deploy session hosts based on a template VM (golden image approach). Therefore I build a native Windows application to do this, and I’m happy to share it with the community.

Are you interested in the new “Hydra for Azure Virtual Desktop” solution to manage AVD even better with a lot of automation? Check it out here.

Download the latest release from 01/23/2024

Check out the Youtube video to install and configure WVDAdmin in four steps

The current version supports a lot of configuration and administration capabilities, and I’m continuously improving WVDAdmin. Some features:

• Imaging
  • Create images from golden masters (without destroying the master)
  • Handle sysprep and modern app
  • Clean-up
  • Use of shared image gallery definitions
• Rollout
  • Rollout of multiple session hosts
  • Store some base settings encrypted for reuse (domain join name, password, …)
  • Select VM type for each rollout (is not fixed to the host pool)
  • Use of ephemeral disks
  • Support of a second partition from the master VM (D:)
  • Azure Monitor
  • AAD only, join to MEM/intune
• AVD Support
  • Classic AVD
  • ARM AVD (Spring Update)
  • Migration of resources and session hosts
• Working with AVD resources
  • Add/create/delete
    • Host Pools
    • Application groups
    • Workspaces
    • Session hosts
  • Working with user sessions
    • Disconnect
    • Logoff
    • Send message
    • Shadow
• Session hosts
  • Move between host pools
  • Start/Stop/Restart
  • Delete - with VM, disk, and nic
  • Get error report from AVD agent
  • Run scripts remotely on hosts (trigger Windows updates, enable RDP Shortpath, …)
  • Change drain-mode
  • Change disk type, e.g.: on-start -> to Premium, after deallocation -> to HDD(for cost savings)
  • Remove user assignment
• Virtual machine
  • List all VMs with power state in all subscriptions
  • Start/Stop/Restart
  • Run scripts remotely on hosts (trigger Windows updates, enable RDP Shortpath, …)
  • Shrink disk to 64 or 32 GByte (to create small images for ephemeral hosts)
  • Change disk type, e.g.: on-start -> to premium, after deallocation -> to HDD (for cost savings)
  • Create and restore snapshots with a click
  • Add an existing domain-joined VM as a session host
• Others
  • Multi-Tenant switch
  • Split-Tenant mode
  • Search for unused disks and nics
  • Rollout VM Scale Sets
  • Start and deallocate Scale Set instances
  • Re-image Scale Set instances
  • Remove customer-managed key (CMK)
• …

Installation

Release History

Download the latest release from 01/23/2024 Check out the Youtube video to install and configure WVDAdmin in four steps

Configuration

Service principal (functional account)

To work with the GUI, you need a service principal (function account) with permission to administrate access to the AVD and Azure resources. I decide to use a service principal to avoid confusion if my Azure AD user is only a guest account in the AVD tenant I have to administrate and easily switch between different tenants.

To create a service principal, go to your Azure AD -> App registration -> New registration and type a name for your principal like “ svc_WVDAdmin” and press “register”.

Click on “certificates & secrets”. Click “new client secret”, select a validity period and a description (like “Key01”). Press “add”.

Copy the generated key directly - it will never be displayed again. Note the key for later.

To assign users to app groups, the service principal needs one API permissions to get the users and groups from Azure AD (optional):

Add the permission “Microsoft Graph” -> Application Permission -> Directory.Read.All

To consent, the permission and administrator of Azure AD have to grant this:

Go to “Overview”. Note the “Application (client) ID” and the “Directory (tenant) ID” as well.

You now have all data for your service principal:

• Tenant id
• Service principal id (application id)
• Service principal key

AVD permissions

This chapter is for AVD ARM / Spring. Skip this chapter if you only work with WVD Classic (Fall).

The service principal needs permission to add and modify AVD resource objects (host pools, workspaces, app groups). To assign users and groups to app groups, the service principal needs the owner role on the resource groups you want to use for your AVD environment. Add the service principal in the next step and use the owner role.

Register Resource Provider

If you have never worked with AVD, you have to register the AVD resource provider once. To do that, go to the Azure portal -> subscriptions -> select your subscription -> Resource providers

Search for “Microsoft.DesktopVirtualization” and click on “Register”.

Azure resource permissions

The service principal needs permission to subscriptions or resource groups to manage your AVD resources, imaging template VM and rollout session hosts.

Open the Azure portal and go to the resource groups you want to use or to the subscriptions. In each resource group/subscription, click “Access control (IAM)” -> select “Add” -> Add role assignment. Select “owner” and search in “Select” for your service principal name. Click on the principal and save the settings.

Note: Owner is needed to assign users to app groups. For other resources, “contributor” is fine.

The service principal must have permissions to your virtual network (vnet) to assign new VMs to the right subnet. Go to your vnet, click “Access control (IAM)” -> select “Add” -> Add role assignment. Select “contributor” and search in “select” for your service principal name. Click the principal and save the settings. You could skip this step if you assigned the service principal to the subscription or to the resource group containing your vnet.

Prepare your “native” Active Directory

Today each session host must be part of a “native” active directory domain (or have to use the domain services). To add new session hosts unattended, we need an administrative user account to add a computer object to the active directory domain. You can use an existing one, or you can create a new service user:

Open “Active Directory Users and Computers” and create a user object with a complex password, and set a password to “never expire” (if you fine with this). I added the user srv_WVD-Join@itprocloud.de.

Delegate permission for the user to an OU. I found a really good blog post from Prajwal Desai. Check out hist post on (external web site): Method 2 – Delegate rights to user/group using Active Directory Users and Computers

In my case I added my function account to: “OU=WVD,OU=Azure,OU=Site,OU=Servers,OU=Sys,OU=Organisation,DC=ITProCloud,DC=test”

Optional: Create a file share

In earlier versions (<1.6.40), you had to provide the deployment script and the AVD agent binaries on a custom file share or blob storage. With WVDAdmin 1.6.40 or newer, this no longer mandatory. In some cases, where virtual machines don’t have access to the internet to download the AVD agent binaries, you can use a custom file share.

Configure WVDAdmin

Please start WVDAdmin. Before you load AVD and Azure data, copy the Azure tenant id, service principal id, and service principal key into the welcome tab. Press save and load the data by clicking “Reload all”.

You are now able to administrate WVD, create images from template VMs and rollout new session hosts.

The first time you want to roll out new session hosts, you have to enter some information from your Active Directory and file share configuration from above:

Local Admin and local pw. are the local administrator account credentials which you can enter at this time.

Build an image

You can rollout VMs and VM Scale Set with images created by WVDAdmin. These images contain the logic to join the AD domain and WVD.

You can simple create an image from a template VM. The template VM must part of your AD like a standard client. You have not to sysprep or to normalize this template VM. Use the same template VM for Windows and application updates.

Following these steps to build your template:

• Install a VM in the Azure portal. Select the right OS (like Windows 10 Enterprise for Virtual Desktops)
• Make all Windows updates
• Join the VM to your AD
• Install your application
• Make your customizing (like installing language packages)
• Shutdown the template VM

To create the image, open WVDAdmin and

• Navigate to the Azure template VM (Azure -> Virtual Machines -> RG -> VM)
• Right-click -> “Create a template image”
• Select the resource group to store the image
• Press “Capture”

You can and should reuse the template VM for new updates and applications. After these changes, shut down the template VM and create a new image.

Tipps & Tricks

VM Scale Sets

First node: VM Scale Sets cannot autoscale AVD session hosts. Auto-scaling only works for stateless services like a web server. But if you need hundreds of session hosts, then VM Scale Set allows you to work with these numbers efficiently.

Ephemeral disks

Ephemeral disks are awesome. They give you a high performance free of charge. Especially in a AVD multiuser environment where no data a stored permanently on the session hosts, this kind of disk can give you some value add.

Secret Features

WVDAdmin has some features not directly visible but configurable via registry keys. All settings in the registry are in the current user part under HKEY_CURRENT_USER\SOFTWARE\ITProCloud\WVDAdmin. Keep in mind to restart WVDAdmin after changing the registry settings.

Troubleshooting

Create an Image

• The image is not created. An error message occurs:
• Check if your template VM part of the AD
• If your file server Windows Server 2019, read above
• Check if you have set the NTFS and share permission correctly
• Azure portal: Go to the temp VM (next to the template VM) and check the extension installation state. There should be an error message like script not found, access denied, etc.
• Have you renamed the RD agent and bootloader?
• Is the script saved correctly: ITPC-WVD-Image-Processing.ps1, not ITPC-WVD-Image-Processing.ps1.txt
• Don’t forget to delete the temp VM and temp disk to avoid costs
• Make sure that your template VM uses managed disk
• The script generates additional log files in %WinDir%\System32\LogFiles
• Windows 7: Make sure to install PowerShell 5.1 and all Windows updates (including the optional updates without the language packages) to the template VM and restart the VM to take effect: https://www.microsoft.com/en-us/download/details.aspx?id=54616 Makes sure that you use the newest script file from 09/2020: ITPC-WVD-Image-Processing.ps1
• NEW: An endless loop of “Waiting for the temporary vm (power off)” : Update to the newest PowerShell script for generalizing: ITPC-WVD-Image-Processing.ps1

Others

• You have created a host pool, an app group, and assigned a user to the app group, but the user cannot see the apps/desktop.
  • For AVD ARM: Don’t forget to create a workspace and link the app group in the workspace. The workspace is mandatory to show the users’ resources.
  • For the HTML5 web site: Check the correct web address:
    • ARM/Spring: https://aka.ms/wvdarmweb
    • Classic/Fall: http://aka.ms/wvdweb

Download the latest release from 01/23/2024