Skip to main content
Version: Developer

Windows persistent profiles with FSLogix

Overview​

Stateless and disposable Windows VMs lose user data when a session ends, which disrupts desktops and RemoteApp workflows that rely on saved settings. This guide configures FSLogix Profile Containers so that user profiles persist across sessions in Kasm Workspaces, while the underlying VMs stay stateless and disposable. FSLogix stores each user profile in a container on an SMB share and attaches it at sign-in, which preserves personal settings, application data, and customizations. For background, see What is FSLogix? and FSLogix Profile Containers.

note

For automated FSLogix setup with Kasm AutoScaled VMs, see the FSLogix Container Profiles section of the AutoScale configuration guide.

Prerequisites​

Before you begin, confirm the following:

  • Supported operating systems. Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025.
  • Shared identity source. FSLogix uses Windows identities to assign profiles to sessions. The Windows VMs and the storage provider must share an identity source, such as Active Directory, Microsoft Entra ID, or Entra Domain Services domain-joined VMs.
  • Profile storage location. An SMB share, such as Azure Files or an on-premises file server, or Azure Page Blobs.
  • Kasm Connection Credential Type. Set the Windows server to Single Sign-On with Active Directory or Prompt User.

Solution approach​

This guide progresses through the following phases:

  1. Create and permission the SMB share.
  2. Install and configure FSLogix on the Windows VM.

Detailed steps​

Create and permission the SMB share​

Create an SMB share for the profile containers, then apply share and NTFS permissions. Correct permissions isolate each user profile, prevent unauthorized access, and keep the system stable. For more information, see Configure SMB storage permissions.

Create the SMB share and set share permissions​

Set the following share permissions:

  • Administrators: Full Control
  • Domain Users: Change
$SharePath = "C:\FSLogixProfiles"
$ShareName = "FSLogixProfiles"

# Create the directory
New-Item -Path "C:\FSLogixProfiles" -ItemType Directory -Force

# Create the SMB share
New-SmbShare -Name $ShareName -Path $SharePath -FullAccess "Administrators" -ChangeAccess "Domain Users"

Configure NTFS permissions​

Set the following NTFS permissions:

  • CREATOR OWNER: Full Control (subfolders and files only)
  • Domain Users: Modify (this folder only)
  • Administrators: Full Control (this folder, subfolders, and files)
  • SYSTEM: Full Control (this folder, subfolders, and files)
# Disable inheritance and remove inherited permissions
$ACL = Get-Acl -Path $SharePath
$ACL.SetAccessRuleProtection($true, $false)
Set-Acl -Path $SharePath -AclObject $ACL

# Remove all existing permissions
$ACL = Get-Acl -Path $SharePath
$ACL.Access | ForEach-Object { $ACL.RemoveAccessRule($_) } | Out-Null

# Add SYSTEM - Full Control
$SystemRule = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
$ACL.AddAccessRule($SystemRule)

# Add Administrators - Full Control
$AdminRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
$ACL.AddAccessRule($AdminRule)

# Add CREATOR OWNER - Full Control (Subfolders and files only)
$CreatorRule = New-Object System.Security.AccessControl.FileSystemAccessRule("CREATOR OWNER", "FullControl", "ContainerInherit,ObjectInherit", "InheritOnly", "Allow")
$ACL.AddAccessRule($CreatorRule)

# Add Domain Users - Modify (This folder only)
$UsersRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Domain Users", "Modify", "None", "None", "Allow")
$ACL.AddAccessRule($UsersRule)

# Apply the ACL
Set-Acl -Path $SharePath -AclObject $ACL

Print the network path of the SMB share. You need this path to configure FSLogix on the Windows VM.

Write-Host "Network path: \\$env:COMPUTERNAME\$ShareName"

Install and configure FSLogix​

On the Windows VM, install FSLogix.

$Archive = "FSLogix_latest.zip"
$Installer = ".\FSLogix_latest\x64\Release\FSLogixAppsSetup.exe"

# Download and extract installer
Invoke-Webrequest -Uri "https://aka.ms/fslogix_download" -OutFile $Archive
Expand-Archive -Path $Archive

# Run installer
Start-Process -FilePath $Installer -ArgumentList "/install /quiet /norestart" -Wait

Set the registry values for the profile container. Replace the placeholder with the network path from the previous phase.

# Replace with network path from above
$Hostname = "<replace-me>"
$VHDLocations = "\\$Hostname\FSLogixProfiles"

$RegistryPath = "HKLM:\SOFTWARE\FSLogix\Profiles"

New-Item -Path $RegistryPath -Force

# Add registry settings for profile container configuration
New-ItemProperty -Path $RegistryPath -Name VHDLocations -PropertyType string -value $VHDLocations -Force
New-ItemProperty -Path $RegistryPath -Name ProfileType -PropertyType dword -Value 3 -Force
New-ItemProperty -Path $RegistryPath -Name Enabled -PropertyType dword -Value 1 -Force
New-ItemProperty -Path $RegistryPath -Name DeleteLocalProfileWhenVHDShouldApply -PropertyType dword -Value 1 -Force
New-ItemProperty -Path $RegistryPath -Name FlipFlopProfileDirectoryName -PropertyType dword -Value 1 -Force
New-ItemProperty -Path $RegistryPath -Name LockedRetryCount -PropertyType dword -Value 3 -Force
New-ItemProperty -Path $RegistryPath -Name LockedRetryInterval -PropertyType dword -Value 15 -Force
New-ItemProperty -Path $RegistryPath -Name ReAttachIntervalSeconds -PropertyType dword -Value 15 -Force
New-ItemProperty -Path $RegistryPath -Name ReAttachRetryCount -PropertyType dword -Value 3 -Force
New-ItemProperty -Path $RegistryPath -Name SizeInMBs -PropertyType dword -Value 30000 -Force
New-ItemProperty -Path $RegistryPath -Name VolumeType -PropertyType string -Value vhdx -Force

For the full list of settings, see FSLogix configuration setting reference.

Common troubleshooting steps​

  • Profiles do not persist between sessions. Confirm that the Kasm Connection Credential Type is Single Sign-On with Active Directory or Prompt User, and that the VHDLocations registry value points to the SMB share.
  • Users cannot access their profile container. Confirm that the share and NTFS permissions match the values in this guide, and that Domain Users have Modify access on the folder.
  • The profile container does not attach. Confirm that the Windows VMs and the storage provider share the same identity source, such as Active Directory, Microsoft Entra ID, or Entra Domain Services.
  • A profile fails to attach while another session holds the container. FSLogix retries based on the LockedRetryCount and LockedRetryInterval settings. Confirm that only one active session uses a profile at a time, or adjust the retry settings.