Troubleshooting SDE VDI desktop pools

1. Where to look first

docker logs sde-vdi 2>&1 | grep -E 'AUDIT|WARN|ERROR' | tail -50
docker logs sde-vdi 2>&1 | grep W11-OFF-003            # one desktop's history
docker logs sde-gateway 2>&1 | grep vdi | tail -20

2. Look inside a desktop from Proxmox

sde-vdi does everything inside a desktop through the QEMU guest agent, and you can too. You don't need the desktop's password or network access to it. Commands run as SYSTEM.

1. On the Desktops tab, note the desktop's Node · VMID.
2. Open the Shell of that node in Proxmox (qm only works on the node that holds the VM).
3. Run the commands below, with your VMID and domain. The answer comes back as JSON; the command's output is in out-data.

2.1 Who is signed in

qm guest exec 10457 -- cmd /c "query user"

sde-vdi reads the same list. A session in state Active is never recycled; Disc means disconnected.

2.2 Read the event logs

# Failed sign-ins (the Status and Sub Status lines give the reason)
qm guest exec 10457 --timeout 60 -- powershell -NoProfile -Command "Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 5 | Format-List TimeCreated, Message"

# DNS registration refused (stale record, section 4)
qm guest exec 10457 --timeout 60 -- powershell -NoProfile -Command "Get-WinEvent -FilterHashtable @{LogName='System'; Id=8018} -MaxEvents 3 | Format-List TimeCreated, Message"

# The latest System events
qm guest exec 10457 --timeout 60 -- powershell -NoProfile -Command "Get-WinEvent -LogName System -MaxEvents 30 | Format-Table -AutoSize TimeCreated, Id, ProviderName, Message"

Keep -MaxEvents small: the guest agent returns a limited amount of output.

2.3 Check the domain trust with nltest

qm guest exec 10457 -- cmd /c "nltest /dsgetdc:lab.local"       # which DC it finds, or why it finds none
qm guest exec 10457 -- cmd /c "nltest /sc_query:lab.local"      # the secure channel's state and DC
qm guest exec 10457 -- cmd /c "nltest /sc_verify:lab.local"     # tests the channel properly
qm guest exec 10457 -- cmd /c "nltest /sc_reset:lab.local"      # sets the channel up again

A healthy desktop answers NERR_Success for /sc_query and /sc_verify.

2.4 Netlogon setting and debug log

# Should show UseKerberosForSecureChannels 0x0 on a desktop joined by sde-vdi 0.5.9 or later
qm guest exec 10457 -- cmd /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters /v UseKerberosForSecureChannels"

# Netlogon debug log: switch on, try the sign-in again, read it, switch off
qm guest exec 10457 -- cmd /c "nltest /dbflag:0x2080ffff"
qm guest exec 10457 --timeout 60 -- powershell -NoProfile -Command "Get-Content C:\Windows\debug\netlogon.log -Tail 40"
qm guest exec 10457 -- cmd /c "nltest /dbflag:0x0"

2.5 Name and address

qm guest exec 10457 --timeout 60 -- powershell -NoProfile -Command "Resolve-DnsName W11-OFF-003.lab.local; ipconfig /all"

From the gateway host, nslookup W11-OFF-003.lab.local shows what sde-vdi and the gateway see.

3. Desktops that don't become ready

Every desktop must be ready within 20 minutes of starting to boot; after that it goes to Error with the last step in the message. Fix the cause, then use Delete now on the desktops in error so the pool builds fresh ones. The steps are described in the settings reference, section 14.

4. Name resolves to an old address

Symptom. New Windows desktops stay at the step waiting-dns, sometimes with an error such as "W11-OFF-001.lab.local still points at 10.250.2.102 (an older desktop's record Windows may not update)". Activity shows dns-repair events (was=10.250.2.102 now-registering=10.250.2.143). On the desktop, the System log has event 8018 (2.2).

Cause. A pool connects to desktops by name. Each Windows desktop registers its own DNS record, but the DC refuses the update when the record belongs to an older computer object of the same name. That happens when computer objects are deleted in AD and recreated: the join then makes a new object, and the old record keeps pointing at the previous desktop's address. RDP, and users, would go to the wrong machine.

What sde-vdi does. Before it checks RDP, sde-vdi makes sure a Windows desktop's name resolves to its own address. If it doesn't, sde-vdi deletes the old record over LDAP as the join account, then runs ipconfig /registerdns in the desktop, at most every 2 minutes. Normally the desktop is ready a few seconds after the repair.

Fix, when the repair doesn't work:

• "no right to delete the DNS record": the join account may not delete records in that zone. Delete the desktop's A record in DNS Manager; sde-vdi registers it again on its next try. Zone scavenging also removes old records over time.
• The name doesn't resolve at all from sde-vdi (Readiness → Pool … names resolve): give the gateway host the DCs as DNS servers, or clear the pool's DNS suffix to connect by IP address.
• was=no record every time: the desktop's registration never arrives. Check the zone allows secure dynamic updates.

5. Domain sign-ins refused on an SDE Network

Symptom. Every sign-in to a Windows pool on an SDE Network fails, while the same template on the LAN works. The app says "Windows refused the sign-in". On the desktop, Security event 4625 shows status 0xC000018D (the trust relationship failed). Readiness is green and the desktop passed Checking domain trust, because Kerberos itself works. With the Netlogon debug log on (2.4), netlogon.log shows "could not authenticate with Kerberos" (0xC0000022) and "unmatching capabilities".

Cause. Windows 11 (seen on 25H2) with a Windows Server 2025 DC first tries the newer Kerberos-based Netlogon secure channel. From an SDE Network that attempt fails. Windows falls back to the classic channel, but the DC refuses its capabilities check and Windows drops that channel too. Without a working channel the desktop can't check domain passwords for RDP sign-ins.

Fix. sde-vdi 0.5.9 sets the registry value UseKerberosForSecureChannels=0 (under HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters) on every desktop as part of the join, and again before a trust repair. Windows then uses the classic channel, which works.

• Desktops joined before 0.5.9: upgrade sde-vdi, then Delete now on the spare desktops. Desktops in use are replaced when their users sign out.
• To fix one desktop by hand, from the node's Shell:

  qm guest exec 10457 -- powershell -NoProfile -Command "New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters' -Name UseKerberosForSecureChannels -Value 0 -PropertyType DWord -Force; Restart-Service Netlogon -Force"
  qm guest exec 10457 -- cmd /c "nltest /sc_reset:lab.local"
  qm guest exec 10457 -- cmd /c "nltest /sc_verify:lab.local"

• Check the setting with the reg query in 2.4.

The same status, 0xC000018D, on a desktop that fails the trust check (it stays at Repairing domain trust) has a different cause, usually the DC's clock. See section 3.

6. Users can't connect

7. Guacamole-only accounts refused

Accounts listed in the gateway's SDE_LOCAL_ACCOUNTS (by default guacadmin) exist only in Guacamole. They can sign in to SDE Remote, but Windows doesn't know them, so their sign-in can't open a domain desktop.

• The gateway tells sde-vdi when such a user asks for a pool, and sde-vdi refuses before handing out a desktop: "<user> is an SDE-only account, so it can't sign in to the desktops in <pool>. Sign in to SDE Remote with your domain account." The gateway logs AUDIT vdi-authorize REFUSED … reason=guac_only.
• Before this check (gateway 1.0.12 with sde-vdi 0.5.8), such a launch took a spare desktop, failed with "Windows refused the sign-in", and held the desktop for the 3-minute sign-in grace before it was deleted and rebuilt. Other users could be left with nothing to use for several minutes.
• Pools with Users sign in on the desktop ticked still accept these accounts, because the user signs in on the desktop with an account it knows.

Fix: sign in to SDE Remote with a domain account. If an account wrongly appears as Guacamole-only, take it out of SDE_LOCAL_ACCOUNTS and restart the gateway.

8. Desktops recycled too soon or too late

9. Active Directory and Proxmox

10. Related pages

• SDE VDI settings reference: every setting, desktop state and preparation step
• Setting up SDE VDI desktop pools: setting up SDE VDI desktop pools
• Building a Windows 11 gold template: building a Windows 11 gold template
• Building a Linux desktop gold template: building a Linux desktop gold template