Lesson: Creating Azure Virtual Desktop (AVD) Session Host Images Manually

Introduction: Why Image Management Matters

In the world of Azure Virtual Desktop (AVD), the session host image is the foundation of your entire user experience. When a user connects to a remote desktop session, they are interacting with an operating system that has been deployed from a specific virtual machine image. If that image is slow, bloated with unnecessary software, or missing critical security patches, the user will experience poor performance and frustration from the moment they log in. Creating images manually is a foundational skill for any cloud engineer, as it allows you to maintain full control over the software stack, configuration settings, and security hardening of your desktop environment.

While automated tools like Azure Image Builder or Packer are excellent for production environments at scale, understanding the manual process is essential. It helps you grasp exactly what goes into a functional image, how Windows handles sysprep operations, and how to troubleshoot common deployment issues. By manually creating and refining a "Golden Image," you establish a reproducible standard that ensures every user in your organization receives a consistent, high-performance desktop experience.

Understanding the Anatomy of an AVD Image

Before we dive into the steps of creation, it is important to understand what actually constitutes an AVD image. At its core, an AVD image is a Virtual Hard Disk (VHD) that contains a Windows operating system, the necessary AVD agents, your required business applications, and specific registry optimizations.

When you create an image manually, you are essentially building a virtual machine, installing your software, configuring the OS to your company's specifications, and then "generalizing" the machine so that it can be captured as a reusable template. This template is then stored in an Azure Compute Gallery (formerly known as Shared Image Gallery), which serves as the central repository for your organization's desktop images.

The Role of the AVD Agent

One of the most critical components of any AVD image is the AVD Agent. Without this software, the virtual machine cannot communicate with the Azure control plane. The agent is responsible for registering the machine with the AVD service, managing user sessions, and facilitating the connection between the user's client and the virtual machine. When building your image, you must ensure that the agent is installed last, or at least configured correctly, to avoid registration issues once the VM is deployed from your template.

Callout: Image Types Comparison When planning your image strategy, you will encounter two main types: Multi-session and Single-session. Windows 10/11 Enterprise Multi-session is unique to Azure and allows multiple users to share a single virtual machine, significantly reducing infrastructure costs. Single-session images are closer to traditional VDI environments, where one user is assigned to one virtual machine. Manual image creation processes are largely identical for both, but the optimization requirements differ significantly.

Step-by-Step: Creating a Golden Image Manually

Phase 1: Provisioning the Master Virtual Machine

The first step in the manual process is to create the virtual machine that will serve as the "master" or "source" for your image. This VM does not need to be a large, expensive SKU; a standard D-series or E-series VM with sufficient storage will suffice for the installation process.

1. Deployment: Navigate to the Azure portal and create a new Virtual Machine. Select your desired operating system version (e.g., Windows 11 Enterprise Multi-session).
2. Networking: Place the VM in a virtual network that has internet access so you can download necessary installers and updates.
3. Storage: Use Premium SSD storage to speed up the installation of your applications.
4. Access: Ensure you have RDP access enabled, or use Azure Bastion for a secure connection to the machine.

Phase 2: Installing Software and Customizations

Once the VM is running, log in as an administrator. This is where you configure the environment. Follow these best practices to keep your image clean:

• Windows Updates: Run Windows Update until the system is completely current. An outdated image creates security vulnerabilities and potential compatibility issues.
• Application Installation: Install the software required by your users. Always install applications in the default directories unless there is a strict reason not to.
• User Experience Optimization: Disable unnecessary services, clear temporary files, and set up desktop icons or taskbar shortcuts as per your company policy.
• AVD Software: Download and install the Remote Desktop Agent and the Remote Desktop Agent Bootloader. These are the two primary components required for the VM to join your AVD host pool.

Phase 3: Optimizing the Image (The "Secret Sauce")

An unoptimized image is often sluggish. To provide a high-quality experience, you should perform several manual optimizations.

• Disable Startup Apps: Use Task Manager to disable any non-essential startup items that might have been installed with your applications.
• Registry Tweaks: Depending on your environment, you may want to apply registry keys that disable telemetry, suppress first-run wizards, or optimize disk performance.
• Cleanup: Run the Disk Cleanup tool to remove Windows Update remnants and temporary files.

Note: The Importance of Cleanliness Before capturing your image, ensure you have removed any user-specific profiles. If you have logged in as a test user, delete that profile from the "Advanced System Settings" menu. Leaving behind even a single user profile can cause significant issues when the image is generalized and redeployed to new users.

Preparing for Capture: Sysprep and Generalization

The most critical step in the manual process is "generalizing" the image. If you simply take a snapshot of a running VM and try to use it as a template, the deployment will fail or experience identity conflicts because the VM's security identifiers (SIDs) and machine names are unique.

The Sysprep (System Preparation) tool is the Microsoft-provided utility to strip these unique identifiers from the OS.

Executing Sysprep

1. Open the Command Prompt as an Administrator.
2. Navigate to C:\Windows\System32\Sysprep.
3. Execute the following command: sysprep.exe /generalize /oobe /shutdown.

• /generalize: This removes the unique information from the Windows installation (like the SID).
• /oobe: This tells the system to start the "Out-of-Box Experience" (the first-run setup wizard) the next time the machine boots.
• /shutdown: This shuts down the machine immediately after the process finishes, leaving it in a clean state for capturing.

Warning: Irreversible Action Once you run Sysprep, you cannot log back into this master VM. If you realize you forgot to install an application or change a setting after running Sysprep, you will have to either restore a snapshot of the VM taken before the Sysprep command or start the process over from scratch. Always take a snapshot of your master VM before running Sysprep.

Capturing the Image into the Azure Compute Gallery

Once the VM has shut down, it is ready to be captured. The Azure Compute Gallery is the recommended destination because it allows for versioning and easy replication across different Azure regions.

1. Stop the VM: Ensure the VM status in the Azure portal is "Stopped (deallocated)."
2. Capture: In the VM menu in the Azure portal, click "Capture."
3. Gallery Selection: Select the option to save the image to an Azure Compute Gallery.
4. Versioning: Provide a version number (e.g., 1.0.0). This allows you to track iterations of your image.
5. Replication: Choose the target regions where you plan to deploy your AVD hosts.

Best Practices for Image Management

Creating a golden image is not a one-time task; it is a lifecycle. As Windows updates are released and business requirements change, you will need to update your image.

1. Versioning Strategy

Always use a semantic versioning approach (e.g., 1.0.0, 1.0.1, 1.1.0). This allows you to roll back to a previous version if a new update breaks your application stack. When creating a new version, create a new VM from the existing version, apply your changes, and then capture it as a new version in the same gallery definition.

2. Infrastructure as Code (IaC)

While this lesson focuses on manual creation, you should eventually move toward automating the deployment of these images. Use Terraform or Bicep to define your host pools and reference the specific image version from your gallery. This creates a bridge between your manual "master image" work and a repeatable, automated deployment pipeline.

3. Documentation

Maintain a "Change Log" for your images. Document every application installed, every registry change made, and the version of the AVD agent used. When a user reports a specific issue, having a clear record of what is inside the image makes troubleshooting significantly faster.

Callout: Image Optimization Tips When optimizing, focus on the "Windows 10/11 Multi-session Optimization Guide" provided by Microsoft. It includes specific scripts that disable background tasks, remove pre-installed "bloatware" apps (like Candy Crush or Xbox), and tune the search indexer. These changes can reduce CPU and RAM usage by 20-30% on a busy session host.

Common Pitfalls and How to Avoid Them

Pitfall 1: The "Dirty" Image

Many administrators forget to run Sysprep or leave behind temporary files and user profiles. This results in "ghost" profiles, where new users see settings or icons left over from the person who built the image.

• Solution: Always verify that no user profiles exist under C:\Users other than the default profiles. Use the "System Properties" > "User Profiles" dialog to confirm.

Pitfall 2: Agent Communication Failures

The AVD agent requires specific URLs to be reachable. If you build your image in a restricted environment without internet access, the agent may not be able to heartbeat correctly with the service.

• Solution: Ensure your master VM has the necessary outbound access to the AVD service endpoints during the build process.

Pitfall 3: Failing to Disable Windows Update

If you don't disable Windows Update, the VMs deployed from your image might start downloading and installing updates simultaneously. This can cause massive CPU spikes and disk I/O contention, rendering the session hosts unusable for the first hour of the day.

• Solution: Use Group Policy or registry settings to manage Windows Updates centrally, rather than letting the individual VMs manage them autonomously.

Comparison Table: Manual vs. Automated Image Creation

Practical Example: A Script for Post-Install Cleanup

After installing your applications, you might want to run a cleanup script to ensure the environment is ready for the AVD agent. Below is a simple PowerShell snippet that performs common cleanup tasks.

# Remove temporary files
Remove-Item -Path "C:\Windows\Temp\*" -Recurse -Force
Remove-Item -Path "C:\Users\Administrator\AppData\Local\Temp\*" -Recurse -Force

# Disable specific services that are not needed in a VDI environment
Set-Service -Name "MapsBroker" -StartupType Disabled
Set-Service -Name "RetailDemo" -StartupType Disabled

# Check for AVD Agent status (Example check)
$agentService = Get-Service -Name "RDAgent"
if ($agentService.Status -ne 'Running') {
    Write-Host "AVD Agent is not running. Please verify installation."
}

Explanation: This script clears out temporary directory clutter that accumulates during software installs. It also disables services like MapsBroker and RetailDemo, which are unnecessary for a server-side session host and consume system resources. Finally, it performs a quick check to ensure the AVD Agent service is present and configured correctly.

Troubleshooting Checklist for Failed Deployments

If you deploy a VM from your image and it fails to join the host pool, follow this checklist:

1. Verify Agent Presence: Log in to the VM and check if the RDAgentBootloader and RDAgent services are running.
2. Check Event Viewer: Navigate to Applications and Services Logs > Microsoft > Windows > RemoteDesktopServices-RdpCoreTS. Look for errors related to registration.
3. Validate Connectivity: Use Test-NetConnection to verify that the VM can reach the AVD service endpoints (e.g., rdweb.wvd.microsoft.com).
4. Review Sysprep Logs: If the VM failed to boot, check C:\Windows\System32\Sysprep\Panther\setupact.log for errors that occurred during the finalization process.

Key Takeaways for Success

Mastering the creation of AVD images manually is a core competency for any cloud administrator. By following a structured process, you ensure that your infrastructure is reliable, secure, and performant.

1. The Golden Image Lifecycle: Treat your image as a product. It needs versioning, documentation, and a clear update path. Never treat an image as a "set it and forget it" task.
2. Sysprep is Non-Negotiable: Always use the /generalize flag to ensure that your VMs don't have conflicting identity information. Skipping this will lead to hard-to-diagnose authentication and connectivity issues.
3. Optimize for VDI: Remember that a session host is not a standard workstation. Remove unnecessary background services and bloatware to ensure that the limited resources of the VM are dedicated to the user's applications.
4. Centralized Storage: Always use the Azure Compute Gallery. It is the industry standard for managing image versions and replicating them across your Azure environment.
5. Consistency through Automation: While this lesson focuses on the manual process, treat your manual steps as a blueprint for eventual automation. If you find yourself performing the same steps every time, look for ways to script those tasks.
6. Security First: Always patch the OS and your applications before capturing the image. A golden image is a "trusted" starting point, and you want to ensure it starts with the latest security posture.
7. Test, Test, Test: Never deploy a new image version to your production host pool without testing it in a staging or development pool first. Verify that your core applications launch correctly and that the user experience is as expected.

By adhering to these principles, you will build a robust AVD environment that scales effectively and provides a high-quality experience for your end users. The time you invest in creating a clean, well-optimized image today will pay dividends in reduced support tickets and improved performance tomorrow.