Debug logon loop for windows 2025 RDS server on-premise in workgroup, using Azure ARC enabled server and AADLogin extension version 2.2.0

I checked everything the Q&A AI agent told me. Just to add that my user workstation were I try to login from using mstsc is AzureAD joined only, but the user is synced from Active Directory on-prem to the AzureAD. My goal is to get rid of the on-prem active directory for everything, but we still need to keep RDS server on-prem using workgroup because of the application on it can't be in cloud.

Dear Suchitra,

1.

The path: C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.ActiveDirectory.AADLoginForWindows\2.2.0\CommandExecution.log doesn't exist on the server. Even the C:\Windows\Azure folder doesn't exist. I found the following folder: C:\Packages\Plugins\Microsoft.Azure.ActiveDirectory.AADLoginForWindows\2.2.0.0 and C:\ProgramData\GuestConfig\extension_logs\Microsoft.Azure.ActiveDirectory.AADLoginForWindows

2. AzureADPRT:NO here is the full output:

PS C:\Users\Administrator> dsregcmd /status
+----------------------------------------------------------------------+
| Device State |
+----------------------------------------------------------------------+
 AzureAdJoined : YES
 EnterpriseJoined : NO
 DomainJoined : NO
 Virtual Desktop : NOT SET
 Device Name : SRV
+----------------------------------------------------------------------+
| Device Details |
+----------------------------------------------------------------------+
 DeviceId :
 Thumbprint :
 DeviceCertificateValidity : [ 2026-03-05 15:08:44.000 UTC -- 2036-03-05 15:38:44.000 UTC ]
 KeyContainerId :
 KeyProvider : Microsoft Software Key Storage Provider
 TpmProtected : NO
 DeviceAuthStatus : SUCCESS
+----------------------------------------------------------------------+
| User State |
+----------------------------------------------------------------------+
 NgcSet : NO
 WorkplaceJoined : NO
 WamDefaultSet : NO
+----------------------------------------------------------------------+
| SSO State |
+----------------------------------------------------------------------+
 AzureAdPrt : NO
 AzureAdPrtAuthority :
 AcquirePrtDiagnostics : PRESENT
 Previous Prt Attempt : 2026-03-18 15:20:12.600 UTC
 Attempt Status : 0xc004844c
 User Identity : administrator
 Credential Type : Password
 Correlation ID : 5bbf61c2-ff45-4f2e-abc6-3a2959e4edaf
 EnterprisePrt : NO
 EnterprisePrtAuthority :
+----------------------------------------------------------------------+
| Diagnostic Data |
+----------------------------------------------------------------------+
 AadRecoveryEnabled : NO
 Executing Account Name : SRV\Administrator
 KeySignTest : PASSED
 DisplayNameUpdated : YES
 OsVersionUpdated : YES
 HostNameUpdated : YES
 Last HostName Update : NONE
+----------------------------------------------------------------------+
| IE Proxy Config for Current User |
+----------------------------------------------------------------------+
 Auto Detect Settings : YES
 Auto-Configuration URL :
 Proxy Server List :
 Proxy Bypass List :
+----------------------------------------------------------------------+
| WinHttp Default Proxy Config |
+----------------------------------------------------------------------+
 Access Type : DIRECT
+----------------------------------------------------------------------+
| Ngc Prerequisite Check |
+----------------------------------------------------------------------+
 IsDeviceJoined : YES
 IsUserAzureAD : NO
 PolicyEnabled : YES
 PostLogonEnabled : YES
 DeviceEligible : NO
 SessionIsNotRemote : NO
 CertEnrollment : none
 PreReqResult : WillNotProvision
For more information, please visit https://www.microsoft.com/aadjerrors
PS C:\Users\Administrator>

3. The first curl command give me my tenant id and the second one didnt work:

PS C:\Users\Administrator> curl.exe -H Metadata:true "http://localhost:40342/metadata/identity/oauth2/token?resource=urn:ms-drs:enterpriseregistration.windows.net&api-version=2018-02-01"
{"error":"invalid_request","error_description":"The api-version '2018-02-01' could not be found. Supported are 2021-02-01 2020-06-01 2019-11-01 2019-08-15","error_codes":[404],"timestamp":"2026-03-19 19:14:50.1209985 +0100 CET m=+105352.656678501","trace_id":"","correlation_id":"0740714a-5517-4090-b55b-591731bd79b1"}
PS C:\Users\Administrator> curl.exe -H Metadata:true "http://localhost:40342/metadata/identity/oauth2/token?resource=urn:ms-drs:enterpriseregistration.windows.net&api-version=2021-02-01"
{"error":"unauthorized_client","error_description":"Missing Basic Authorization header","error_codes":[401],"timestamp":"2026-03-19 19:15:07.8122278 +0100 CET m=+105370.347399201","trace_id":"","correlation_id":"81b59850-4d5c-4e27-9246-3da3c48f1f67"}

4. All 200 5.Sure its on on both client/server and rebooted

Error: 0x4AA50081 An application specific account is loading in cloud joined session.
Logged at ClientCache.cpp, line: 407, method: ClientCache::LoadPrimaryAccount.

AAD Cloud AP plugin call GenericCallPkg returned error: 0xC0048512

DoGetToken Diagnostic Event:
Result: 0xC0000022
User Identity: redacted
Credential Type: 8
Correlation ID: 10d924d1-c1ea-4c0e-be22-a665841c5d83
Endpoint Uri: https://pas.windows.net/CheckMyAccess?api-version=2018-01-01
HTTP Status: 
HTTP Method: The operation completed successfully.
ErrorCode: 200
Error Description: 

Logon failure. Status: 0xC0000022 Correlation ID: 10d924d1-c1ea-4c0e-be22-a665841c5d83

PRT session key needs to be rolled.
Reason: VSM key rollover

On-prem tgt error: On-prem configuration is missing

sorry I have to continue on another post, as my browser is crashing when I want to edit my old post.

7. 👁 enter image description here

8. are you talking about using: AzureAD\******@mydomain.com or something else ?

@Suchitra Suregaunkar any ideas ?

Thanks for sharing the logs.

From your logs Azure sign‑in (PTA) succeeds.

Azure sign‑in logs show Password Pass‑through Authentication – User approved

Arc agent + AADLoginForWindows extension is installed and Machine is Azure AD joined.

AzureAdJoined : YES and DomainJoined  : NO

Hybrid IMDS endpoint is reachable, Tenant metadata query works, Client PKU2U policy is enabled and Network access to login.microsoftonline.com / pas.windows.net is OK

So authentication to Entra ID is not the problem.

Below are the blockers which is not working:

1. AzureAdPrt = NO (this is fatal for RDP Entra login)

From dsregcmd /status on the server:

AzureAdPrt : NO
Attempt Status : 0xc004844c
PRT session key needs to be rolled.
Reason: VSM key rollover
On-prem tgt error: On-prem configuration is missing

AADLoginForWindows requires a valid Primary Refresh Token (PRT) on the target machine. If PRT cannot be issued → logon succeeds in Entra → local authorization fails → RDP loop → 0xC0000022.

PRT is mandatory for Entra ID–based RDP on Arc-enabled Windows servers.

2. The PRT failure is expected in your configuration

Key facts from your environment:

• Server is workgroup
• User is synced from on‑prem AD
• Authentication method is PTA
• No on‑prem AD trust / Kerberos path available
• No Entra Kerberos server / cloud trust configured

The error confirms this:

On-prem tgt error: On-prem configuration is missing which means the CloudAP plug‑in tried to acquire a Kerberos‑backed PRT, but there is no on‑prem TGT / Kerberos trust available, so the PRT cannot be completed.

This is a limitation, not a misconfiguration.

3. Why Azure sign‑in succeeds but RDP fails

This distinction is critical: AADLoginForWindows does not use raw OAuth tokens for Windows logon. It requires PRT → CloudAP → LSASS authorization.

Without PRT → Windows refuses logon after web sign‑in completes.

Your IMDS token test failed:

You ran:

curl

Result:
"unauthorized_client"
"Missing Basic Authorization header"

This is normal because the Arc hybrid IMDS endpoint is not equivalent to Azure VM IMDS. AADLoginForWindows does not use managed identity OAuth tokens for RDP logon.

RDP relies on CloudAP + PRT, not MSI tokens.

Windows Server 2025 + Arc does NOT remove AD in your scenario:

Your stated goal which is to get rid of the on‑prem AD entirely, but keep an on‑prem RDS server in a workgroup. This is not currently supported for synced users using PTA.

AADLoginForWindows on Arc requires one of the following:

1. Cloud‑only Entra ID users
2. Hybrid users with Kerberos path available
3. Azure VM (not Arc) with Entra join

Your setup is none of the above.

Please have a look into below limitations:

• Synced users without Kerberos trust cannot obtain PRT
• PTA alone is insufficient for Windows logon
• Workgroup Arc servers still require Entra‑Kerberos backing for hybrid users

As a workaround please have a look into below provided supported resolution paths:

1. Use cloud‑only Entra ID users

• Create Entra‑native users (not synced)
• Assign Virtual Machine User Login
• Log in as: AzureAD[******@tenant.onmicrosoft.com](******@tenant.onmicrosoft.com)

This works today with Arc + workgroup.

2. Keep AD but enable Entra Kerberos (Cloud Trust)

• Requires:
  • On‑prem AD retained
  • Kerberos trust enabled
• Allows hybrid users to obtain PRT Supported, but does not meet your “no AD” goal

3. PTA + synced users + workgroup Arc server which is Not supported and Results exactly in:

• • AzureAdPrt = NO
  • On-prem tgt error
  • RDP logon loop.

Thanks,
Suchitra.