u/rdaniels16

Hello All. I have another thread going on where ever since the July 2026 update sessions on random avds hang up with black screen etc and the only solution is to kill the searcher indexer via powershell from the azure shell. This is still ongoing and I am working on this issue.

However it brings up another question. Do AVD administrators disable wsearch and searchindexer by default in the avd fleet and golden images, etc? I am sure users would complain about this. I was just curious on standard best practice.

Hello All. So I have been banging my head on the wall over this one since the July 2026 windows update. We are using a small host pool with Windows 11 23H2 and FSLogix (FSLogix 26.01 CU1) for the profiles. All has worked perfectly since June 2024 when we deployed. After July update we are getting issues where ghost sessions in task manager with no username associated with it: Client Server Runtime Process, Desktop Window Manager, Usermode Font Driver Host, Windows logon application and Windows Logon user Interface Host. And users will eventually complain they can not launch applications, etc. Teams specifically. We are running Sophos Advanced Intercept-X MDR on these AVD's and have all the required exclusions for fslogix, etc. Also, I know the July update enforced Kerberos RC4 hardening but since we deployed in 2024 our storage account was already setup with a GPO of 16 for msDS-SupportedEncryptionTypes.

I can not even log users out either from Azure portal or while connected to the AVD. I need to force logout the user via powershell and manually kill their FS Logix locks on their profile. I thought the AVD into drain mode and need to reboot after hours.

Is anyone experiencing these issues after the July 2026 upgrade? It is obvious everything started going south after that update. I have spent countless hours on this so I am curious if others are experiencing the same thing.

Thanks

Update #1: So I was logged into the problem AVD as an administrator and logged out and it hung at the common "Please wait for windows search" screen. It has done this in the past and hung there for hours. So this time I ran the following powershell script against the AVD:

Invoke-AzVMRunCommand `
-ResourceGroupName "RG-Name"
-VMName "AVD Host Name" `
-CommandId "RunPowerShellScript" `
-ScriptString "Stop-Process -Name SearchIndexer -Force -ErrorAction SilentlyContinue; Stop-Service -Name wsearch -Force -ErrorAction SilentlyContinue"

When I did this it immediately freed up my session and also killed the ghost sessions with no users in task manager. I can now login and logout fine. So even though I have the proper Sophos Exclusions I am going to dig in a little there to make sure the searchindexer is properly excluded from scans. I read where I also need to include AMSI and exploit mitigation exclusions as well for searchindexer.

**Update #2: Well back to the drawing board. I woke up this morning with a user saying she cannot launch an outlook on the avd. I logged into the avd and tried to log off and searchindexer hung again. I ran my script to kill searchindexer and everything is back to normal so my Sophos exclusions did not work. I will do some more digging on this and post back.

Hello. I am not sure this is a new security thing but over the last 3 months at random times I am required to reauthenticate with my master password even though my stay logged in setting is enabled. I will say that I often bounce between networks and use tailscale on and off as part of my job. I am using Firefox under kde plasma kde. I deal with it but I am curious if there is some sort of change that was enabled recently perhaps related to my VPN usage?

Hello. I am a Zoho one subscriber and one person IT provider. I need to clean up my customer documentation and was going to go with hudu which is excellent but as a one person shop (not likely to change) some of the hudu stuff is unnecessary. And as a Zoho one subscriber I use books, payroll and desk. I was thinking of using something like Zoho learn to build a knowledge base for individual customers containing all of their information except passwords (keeper for that).

I know Zoho desk has a KB area but I want this to be linked to the customer. Zoho learn seems like a wiki and it might fit the bill.

Any thoughts?

Thanks

Hello All. Has anyone else had issues with their avds after the July 2026 cumulative update? We applied it over the weekend and all day we have had issues with user sessions deadlocked with no ability to kill them other than dropping the avd from the host pool and reregistering it. We are running fslogix as well with a newish version (last 6 months).

I am thinking of rolling back the July update.

Thanks for any feedback

Hello. As a test we are running a trial of splashtop business with 1 technician and 300 unattended endpoints. I see that autonomous endpoint security allows an addon for 100 endpoints. How would this work with the business account with 300 unattended users? Would it be possible to add AEM to 100 of the unintended endpoints and leave 200 just for remote access and manage all of this in the same portal? Or would we need to get 300 AEM licenses to match the 300 unattended in the business account?

Hello. I have been using a self-hosted remote support tool for over 8 years with about 600 endpoints covering about 80 servers and many windows, Linux and Mac endpoints. I have been VERY VERY happy with it and sad to be reviewing other options. I always thought that I held the kill switch if there was a compromise by shutting it down in an emergency and I liked that control. But all security, patching, management is 100% on me. And unfortunately this solution requires open Internet ports to function even though I can firewall parts if it. And I have been becoming more and more wary about having ANY ports open to the public Internet with AI bots constantly scanning these tools finding vulnerabilities at the speed of light that no human can find. So time to move on and go saas.

Note that I do not want to bother with full blown RMM tools that are licensed per endpoint and prefer per technician. But I need "something" and have been evaluating remote access tools that do not require open ports. Obviously they can be (and have been) popped as well but the open port attack surface is not there. I thought I was settled on splashtop especially with the future option to layer in autonomous endpoint management if I need it but I have some headless Linux boxes out there that would not work with splashtop. I could manage them via tailscale since it is only about 15 servers but I am looking for a single pane of glass if possible. Screenconnect looks nice especially with its session based customer joining but the headless Linux appears to be limited (no bash shell). And more importantly I avoid like the plague any vendor that constantly tries to upsell and gives me billing headaches and that appears to be the connectwise way of doing things. Others mention action1 and it is great at patching and vulnerability scanning but remote support is not that great. And I would be over the 200 free endpoint limit so...I have not look at bomgar/beyond trust due to cost. Teamviewer-no.

So am I looking for a unicorn? I might just go with splashtop and deal with the tailscale thing but just evaluting options.

Thanks

Hello. I am looking at splashtop to replace my existing self hosted remote access solution. I am running fedora Linux 44 under kde plasma. I installed the latest splashtop business client. Most of it works but things like command line and power shell cause Firefox to crash right after I enter the credentials. Also the user name and password fields are completely white so I have no idea what I am typing in. It might just be my theme in plasma/Firefox (dark) but I am still unable to run powershell and command line.

Thanks for any info

Hello. I am curious if others here are using hiscox for tech E&O without cyber. I know there are a lot of opinions out there about having cyber as well but I am only interested in tech E&O. I have been with hiscox for a number of years for general business liability and noticed in August 2025 they started offering tech E&O without cyber. I am curious as to the opinions from others on this especially since I am a solo provider.

Thanks

Hello. We have had a request to load claude co-work in an AVD pool. We have an existing pool with several windows 11 avds with fslogix deployed and it works well. Only a handful of people need to run cowork so I was thinking of creating a new host pool with all the same apps as the other host pool but the new host pool will have cowork as part of the golden image. The skus are E8as v5s. For the new host pool I was thinking of the same sku but the one with a drive for caching.

Is this nutty to consider on avds in a pool? Cowork does seem to eat resources and I do not want to punish all other users in the primary host pool with a few cowork users.

Thanks for any input