2024/07/07/azure-virtual-desktop-kql-queries/ #95
giscus[bot]
bot
Replies: 2 comments 2 replies
-
|
Hi Russ, Thanks for sharing these queries. I recently noticed that in my very similar KQL queries against WVDConnections table occasionally ClientIPAddress == '<>' instead of real IP. Same is for ClientSideIPAddress. I cannot attribute this to a specific user, state of connection or to any other parameter. Wondering if you encountered any similar cases. |
Beta Was this translation helpful? Give feedback.
-
|
Hey Eugene, not 100% sure - but if i was betting man I would say it is probably a connection that is triggering a condtion access rule and failing, so the attempt is logged but as doesn't make it pass the initial connection there isn't any info logged. Russ |
Beta Was this translation helpful? Give feedback.
-
|
Appreciate hint on this, Russ - will verify and share my findings on this (conditional access). Meanwhile found a note: When debugging connectivity issues, in some cases client information might be missing even if the connection events completes. This applies to the WVDConnections and WVDCheckpoints tables., article |
Beta Was this translation helpful? Give feedback.
-
|
That would also make sense if there was a connectivity issue - not very helpful, but makes sense. |
Beta Was this translation helpful? Give feedback.
-
2024/07/07/azure-virtual-desktop-kql-queries/
Discover powerful KQL queries to enhance your Azure Virtual Desktop (AVD) management. Learn how to track user connections, analyze session times, monitor errors, and gain insights into your AVD environment's performance and security.
https://www.russ.cloud/2024/07/07/azure-virtual-desktop-kql-queries/
Beta Was this translation helpful? Give feedback.
All reactions