FSLogix Interactive Setup

A PowerShell script that deploys FSLogix Profile Containers to a set of Remote Desktop Session Hosts through Group Policy, then verifies that the deployment actually works before you walk away from it.

What it does

Setting up FSLogix by hand means copying ADMX templates into SYSVOL, creating a GPO, setting fifteen registry values through the Group Policy console, linking the GPO, refreshing policy on every host, and then signing in as a test user to find out whether any of it worked. This script does all of it in one pass:

1. Copies the FSLogix ADMX and ADML templates into the SYSVOL Central Store, sourcing them from whichever session host already has FSLogix installed.
2. Creates the GPO, or reuses it if it already exists.
3. Writes the profile container registry settings into the GPO.
4. Links the GPO to the target OU.
5. Forces a policy refresh on each session host over PowerShell remoting and reports whether the settings landed, including the state of the frxsvc service.

It then pauses, asks you to sign a test user in, and checks the profile share for a container created in the last fifteen minutes. If nothing appears it prints the specific things to check rather than leaving you to guess.

Every step is idempotent, so re-running the script is safe.

Requirements

• Windows Server with the Group Policy Management Console (Install-WindowsFeature GPMC)
• Domain administrator rights, and an elevated PowerShell session
• PowerShell remoting reachable on the session hosts
• FSLogix already installed on at least one session host, for the ADMX templates
• A file share for the containers, with Modify rights for the computer accounts or users that will own profiles

Usage

.\FSLogix-Interactive-Setup.ps1 `
    -Domain corp.example.com `
    -TargetOU "OU=RDS Servers,DC=corp,DC=example,DC=com" `
    -VHDLocation \\fileserver\FSLogixProfiles `
    -SessionHosts RDS1, RDS2, RDS3

The script prints the configuration it is about to apply and waits for confirmation before changing anything.

Parameters

Parameter	Required	Default	Description
Domain	yes		Active Directory DNS domain name.
TargetOU	yes		Distinguished name of the OU containing the session hosts.
VHDLocation	yes		UNC path of the share that will hold the profile containers.
SessionHosts	yes		Host names to refresh policy on.
GPOName	no	FSLogix - Profile Containers	Name of the GPO to create or update.
VHDSizeMB	no	30720	Maximum container size in megabytes. Containers expand dynamically.
ConcurrentUserSessions	no	3	Simultaneous sessions permitted per user.

Settings applied

The GPO writes the following under HKLM\SOFTWARE\FSLogix\Profiles:

Setting	Value	Why
Enabled	1	Turns on profile containers.
VHDLocations	your share	Where containers are stored.
SizeInMBs	VHDSizeMB	Maximum container size.
IsDynamic	1	Containers grow on demand rather than preallocating.
VolumeType	VHDX	VHDX rather than the older VHD format.
ConcurrentUserSessions	ConcurrentUserSessions	Multi-session support.
PreventLoginWithFailure	1	Block sign-in if the container cannot attach.
PreventLoginWithTempProfile	1	Never silently fall back to a temporary profile.
DeleteLocalProfileWhenVHDShouldApply	1	Remove a stale local profile that would shadow the container.
FlipFlopProfileDirectoryName	1	Name folders username_SID for easier browsing.
AccessNetworkAsComputerObject	1	Authenticate to the share as the computer account.
LockedRetryCount / LockedRetryInterval	3 / 15	Retry a container locked by another host.
ReAttachRetryCount / ReAttachIntervalSeconds	3 / 15	Retry after a transient network drop.
ExcludeList	BUILTIN\Administrators	Administrators keep local profiles.

Before you run it in production

PreventLoginWithFailure and PreventLoginWithTempProfile are both enabled. This is the right setting for profile integrity, because a temporary profile silently discards the user's data at sign-out. The trade-off is that a misconfigured share stops users signing in rather than degrading quietly. Test against a non-production OU first, and confirm share permissions before linking the GPO to a live OU.

License

MIT. See LICENSE.