Outlook 365 app error 1001 on RDS environment ( FSLogix)

Hi everyone

After loosing a lot of time investigating this b***-breaking issue, I found it worthy to spend some time sharing our solution here as well. Hopefully it might help some of you admins preventing more headaches on this MS issue.

One of our customers ran into this issue only since recently too! After many troubleshooting steps - thanks to everyone that contributed to this post btw - and going through all the presented workarounds (which sometimes seemed to work temporarily) we've found a permanent solution. Perhaps this will not be applicable to all of you, but at least our issue got solved using this method.

We are running RDS in a Citrix CVAD 2203 CU5 environment, so this might not be applicable to all of you, but the root cause might be related (as it is not Citrix... ;-)

*Servers are only domain (not hybrid or AAD) joined since Office is licensed using a different tenant.

Server 2019 OS standard 1809 build 17763.6293

Office 2402 build 17328.20588 (Semi-annual enterprise)

FSLogix 2210 hotfix 4 (2.9.8884.27471)

A login script runs the register WAM (Add-AppxPackage) commands for each user, and re-registers it if it is not present.

Resetting a user's profile did not solve the issue. Neither resetting appdata folders or what so ever. Even tried excluding FSLogix, rolling back PVS images, etc etc..

The cause lays in the password prompt not being able to be shown to the user, which generated this error [1001]. Once the user logs in by using a desktop instead of a published app, the issue did not occur! So this (CTX267071 - Shellbridge feature) is what we finally discovered and applied to all of our RDS (Citrix workers) servers which addressed the issue for us. This recommendation WAS described in the summary Lars posted here as well, via this link.

Solution:

HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Citrix Virtual Desktop Agent
Name: Shellbridge
Type: REG_DWORD
Value: 1

Previous workaround:

Please note that the workaround described in this article was already applied for a couple of years, until now, since it suddenly does not work anymore!:

1. Disable Web Account Manager via registry.***

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity

“DisableADALatopWAMOverride”= dword:00000001

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Identity

“DisableAADWAM”= dword:00000001

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Identity

"DisableMSAWAM"= dword:00000001

Also mentioned there: ***    Disabling WAM as a workaround does not always work and may not be supported by Microsoft.

The above registry keys which served as a workaround for years have now been removed, as they no longer have a purpose for us.

Hope this helps! cheers to all

Hi everyone

After loosing a lot of time investigating this b***-breaking issue, I found it worthy to spend some time sharing our solution here as well. Hopefully it might help some of you admins preventing more headaches on this MS issue.

One of our customers ran into this issue only since recently too! After many troubleshooting steps - thanks to everyone that contributed to this post btw - and going through all the presented workarounds (which sometimes seemed to work temporarily) we've found a permanent solution. Perhaps this will not be applicable to all of you, but at least our issue got solved using this method.

We are running RDS in a Citrix CVAD 2203 CU5 environment, so this might not be applicable to all of you, but the root cause might be related (as it is not Citrix... ;-)

*Servers are only domain (not hybrid or AAD) joined since Office is licensed using a different tenant.

Server 2019 OS standard 1809 build 17763.6293

Office 2402 build 17328.20588 (Semi-annual enterprise)

FSLogix 2210 hotfix 4 (2.9.8884.27471)

A login script runs the register WAM (Add-AppxPackage) commands for each user, and re-registers it if it is not present.

Resetting a user's profile did not solve the issue. Neither resetting appdata folders or what so ever. Even tried excluding FSLogix, rolling back PVS images, etc etc..

The cause lays in the password prompt not being able to be shown to the user, which generated this error [1001]. Once the user logs in by using a desktop instead of a published app, the issue did not occur! So this (CTX267071 - Shellbridge feature) is what we finally discovered and applied to all of our RDS (Citrix workers) servers which addressed the issue for us. This recommendation WAS described in the summary Lars posted here as well, via this link.

Solution:

HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Citrix Virtual Desktop Agent
Name: Shellbridge
Type: REG_DWORD
Value: 1

Previous workaround:

Please note that the workaround described in this article was already applied for a couple of years, until now, since it suddenly does not work anymore!:

1. Disable Web Account Manager via registry.***

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity

“DisableADALatopWAMOverride”= dword:00000001

 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Identity

“DisableAADWAM”= dword:00000001

 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Identity

"DisableMSAWAM"= dword:00000001

 

Also mentioned there: ***    Disabling WAM as a workaround does not always work and may not be supported by Microsoft.

The above registry keys which served as a workaround for years have now been removed, as they no longer have a purpose for us.

Hope this helps! cheers to all

Now, after few weeks, the 1001 error returns! And other customers are now reporting similar issues as well (since end of September it seems).

This time, no difference whether the user is using published app or a full desktop. Issue occurs after authentication (password & MFA), after the "You are all set!" message and clicking OK.

After going through all the steps mentioned in Lars' post here again, discovered that the registry key "BlockAADWorkplaceJoin" kind of solves the 1001 error. HKLM:\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin -Name BlockAADWorkplaceJoin -Type DWord -Value 1

-> this fixes the issue of receiving the 1001 error on sign in. Remaining issue is that the token is not roamed in between sessions. One needs to perform an Office sign in again when starting a new Citrix session. It does not matter if FSLogix is used or not. Also, the profile exclusions and anti-virus have been ruled out here.

Other customers were also having the issue of not roaming the sign in anymore (having to activate Office again each new Citrix session). Of which some are also running Server 2022 btw.

Hoping someone has already found the solution for this.

Investigation still ongoing...

Mate, you legend.

Ok since I seen so many people having issues. Here is the fix that worked for me.

MY ENVIRONMENT

1x GW/Broker server 2022
2x Session host server 2022
-365 for business (latest build) (using business premium licensing) Install with custom XML to override the SCLCacheOverrideDirectory, you want to point this to a UNC share. https://learn.microsoft.com/en-us/microsoft-365-apps/deploy/office-deployment-tool-configuration-options

<Property Name="FORCEAPPSHUTDOWN" Value="FALSE"/>

<Property Name="SharedComputerLicensing" Value="1"/>

<Property Name="SCLCacheOverride" Value="1" />

<Property Name="SCLCacheOverrideDirectory" Value="\server\share%username%" />

The above are the parameters I used.

FSLOGIX REG SETTINGS:
CleanOutNotifications - dword - 1
DeleteLocalProfileWhenVHDShouldApply - dword - 1
Enabled - dword - 1
FlipFlopProfileDirectoryName - dword - 1
IsDynamic - dword - 1
KeepLocalDir - dword - 1
LockedRetryCount - dword - 12
LockedRetryInterval - dword - 5
OutlookCachedMode - dword -1
PreventLoginWithFailure - dword - 1
PreventLoginWithTempProfile - dword - 1
ProfileType - dword - 3
ReAttachIntervalSeconds - dword - 10
ReattachRetryCount - dword - 60
ReDirectXMLSourceFolder - RegSZ - path to UNC
RemovedOrphanedOSTFilesOnLogoff - dword - 1
RoamIdentity - dword - 1
Roamsearch - dword - 0
SetTempToLocalPath - dword - 3
SizeInMBs - dword - whatever size you want
VHDLocations - RegSZ - path to UNC
VolumeType - RegSZ - VHDX

Add the following to this:

<?xml version="1.0" encoding="UTF-8"?>

<FrxProfileFolderRedirection ExcludeCommonFolders="0">

<Exclude Copy="0">AppData\Local\Packages\Microsoft.AAD.BrokerPlugin\_cw5n1h2txyewy</Exclude> 

<Exclude Copy="0">AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost\_cw5n1h2txyewy</Exclude> 

<Exclude Copy="0">AppData\Local\Microsoft\TokenBroker</Exclude> 

</FrxProfileFolderRedirection>

Note: I believe this is if you do not do the custom 365 install with XML (read above) I could be wrong. You can add it for good measure anyway it does not break anything.

REG KEY TO ADD ON BOTH SESSION HOSTS

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin]

"BlockAADWorkplaceJoin"=dword:00000001

This will remove that prompt for Microsoft to manage the device. we do not want this. I beleive this is what breaks the identity token for OneDrive. Log into Entra ID > go to devices and search your session hosts. If they are in there just remove them it will not break anything.

Note: Users will have to sign into the following
Edge - will prompt MFA
Teams - will prompt MFA
Office apps - will prompt MFA
OneDrive - will prompt MFA

This is the only down side. Once you do this once they won't have to go again for like 30 or 90 days (i cant remember)
They will also need to do this on the other session host just once to.

Hello,

i have a Question. do you have the following notice in the redirections.xml?

<?xml version="1.0" encoding="UTF-8"?>

<FrxProfileFolderRedirection ExcludeCommonFolders="0">

<Exclude Copy="0">AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy</Exclude>

<Exclude Copy="0">AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy</Exclude>

<Exclude Copy="0">AppData\Local\Microsoft\TokenBroker</Exclude>

</FrxProfileFolderRedirection>

EDIT: Ok i didnt saw the reply from Admin Chris's posts. There is the notice.