View Instant Clones Pool provisioning breaks when using OS Optimization Tool (default Windows 10 template).

[LAANSID]

Hi,

Hope someone can help me out with the following error.

Environment:

I am working on a VMware Horizon 7.3.2 environment with only one Windows 10 (Enterprise x64 1607) Instant Clone Pool (+/- 20 desktops).

Like almost everyone, I use the OS Optimization Tool (OSOT) to optimize the golden/master/base image for VDI. The only thing we change is from the defaults is place a check at "disable the first logon experience".

Problem:

Since november 2017 or something the provisioning process breaks after customizing the cp-template machine.

Cloning the golden/master/base image is successful, it re configures the cp-template, starts-up, and then it times out after 600 seconds (10 minutes).

After half a day (error created in evening), when I enable provisioning in the morning it is going pass the timeout and provisioning is successful.

Findings/Troubleshooting:

My first thoughts were going to DHCP, DNS and AD, but they are working correctly (monitored all the registrations). The itXXXXXX is member of the AD and also gets an IP-address of the right DHCP server and register it in DNS.

So continued troubleshooting and it works only correctly when when I don't use the "OS Optimization Tool". It never times out at the above step in the process.

Error in log:

Within the Horizon Connection Server logs I see one line of the error without any root cause to search for: 2018-01-17T13:35:46.020+01:00 DEBUG (0D5C-1278) <WFE-01> [WaitForInternalTemplateAction] Internal Template: vm-4377 customization state returns: error.

Alert in Horizon:

The error in Horizon View Administrator Console (Desktop Pool) is: After waiting for 600 seconds internal template VM: vm-4377 is still has not finished customization. Giving up!.

Does one of you experience, read or find a solution for this? Within OSOT a lot of customizations take place and it is searching for a needle in a haystack.

Thank you in advance.

Sidney

[mmonkman]

Personally I find the optimisation tool heavy handed, particulary when having to deploy VDI to a large complex environment.

You might want to try not disabling so many windows services.  I've had problems with the IPHelper service being disabled for instance.

Microsoft have thier own recommended settings for Windows 10 VDI's which improve performance, the UI, switch off all of the telemetry sending services and generally make the VDI less consumer and more enterprise ready.  Using GPO's enforces and maintains the settings too.

Recommended configuration for VDI desktops | Microsoft Docs

All of the optimisation templates just come with a disclaimer stating that changes might break your VDI, which they have.  🙂

[LAANSID]

Thank you for the tip.

I will have take a look at your link and try it this way.

About your last sentence I agree and I know that disclaimer, but I could hardly believe that the OS optimization tool (default template) get things not working.

It have been working for 3/4 months, within the environment almost nothing changed. The things that changed were reverted back to the level when it worked (i.e. Microsoft patches).

[mmonkman]

No problem, hope it helps you out.

The tool itself and default templates update regularly.  Had you obtained a more recent version maybe?

Are you able to logon to the cp-template machine when the customisation is supposed to be occuring?  If AD\DNS are all good you should have no issues there.  I've had the "trust relationship" error in the past as the computer object was created on a DC that wasn't handling that logon session resulting in the "giving up" message.

Checking the composer log at c:\windows\temp\vmware\ may provide more clues.

[LAANSID]

Have used the b1094 (built-in Windows 10 Template) and the newest b1096 (built-in Windows 10 Template and also tried the LoginVSI one).

In the cp-template we can logon with a local account, but is not added to the domain. The it%number% (which is the computername of the cp-template) is added to the domain.

We don't have a composer server, because we use instant clones so logging can only be done from vCenter or Connection Server.

[mmonkman]

Surpise - the composer log does get written to during instant clone prep.  I don't use composer server either.

[LAANSID]

Probably we found the root cause. After a vCenter Server Appliance reset, provisioning didn't hang anymore at the cp-template step.

Stupid we didn't tried it earlier...

[LAANSID]

Sorry for the late response.

We tried a lot of things made a combination of the Microsof's Best Practices, the OS Optimization Tool and experiences from my colleagues. Even that didn't work.

After a reboot of the VCSA somehow provisioning didn't hang anymore.

Thanks for pointing me in some direction. I was almost out of my options.

[mmonkman]

Great to hear it's working.  A reboot.  I'll move that to the top of my own troubleshooting list.

[JeffSchaef]

How is a reboot Root Cause ???  That is not an answer to the problem....

[sjesse]

Its not, I've found this is usually related to something wrong with the computer object, or not releasing the ip before sealing the parent image.

[LAANSID · Accepted solution]

@all in this topic.

The solution about the reboot was a temporary one. I digged together with VMware Support in this issue and it had something to do with joining the domain in the cp-template step. In the event viewer we saw several domain join failures (3 times), probably when the VM didn't had a network connection yet and then it timed out in the provisioning process.

In Horizon 7.7 and above the issue is fixed (see Horizon 7.7 release notes). They adjusted the timer somewhere and then the problem is solved.

Release Notes for VMware Horizon 7 version 7.7  * Customization of instant-clone virtual machines fails with a domain join failure.