AVD Session Host Unavailable or Needs Assistance: How to Fix

When an Azure Virtual Desktop session host leaves Available, the portal tells you the state but not the cause. Work through three likely causes, in this order: a failed health check, an agent that can't register or reach the broker, and an agent or stack update that didn't finish.

What each status means

Microsoft documents these portal statuses (session host statuses):

The REST API enum has more values: Disconnected, NoHeartbeat, NotJoinedToDomain, DomainTrustRelationshipLost, SxSStackListenerNotReady and FSLogixNotHealthy. It notes that Unavailable "replaces previous 'NoHeartBeat' status" (Session Hosts - Get). One trap: if a VM shuts down before its agent reports the change, it shows Unavailable, not Shutdown. Check the VM's power state before you start troubleshooting.

The health checks

These are the health checks the API reports, with the "Currently Enabled/Disabled" flags from the same REST reference:

The troubleshooting guide still lists UrlsAccessibleCheck as a cause of Needs Assistance (agent troubleshooting), so check URLs anyway. Agent 1.0.15732.100, a validation-ring release, also adds a Windows Update health check for Windows 11 hosts (agent release notes).

Step 1: Find the failing check

In PowerShell, the session host object exposes Status, UpdateState, UpdateErrorMessage and HealthCheckResult (SessionHost model). Each HealthCheckResult entry has HealthCheckName, HealthCheckResult and AdditionalFailureDetailMessage (report model).

$hp = @{ ResourceGroupName = '<ResourceGroupName>'; HostPoolName = '<HostPoolName>' }
Get-AzWvdSessionHost @hp |
  Select-Object Name, Status, UpdateState, UpdateErrorMessage, AllowNewSession, LastHeartBeat, AgentVersion
(Get-AzWvdSessionHost @hp -Name '<SessionHostName>').HealthCheckResult |
  Select-Object HealthCheckName, HealthCheckResult, AdditionalFailureDetailMessage

To see the whole fleet over time, query WVDAgentHealthStatus (table reference):

WVDAgentHealthStatus
| where TimeGenerated > ago(1d)
| summarize arg_max(TimeGenerated, Status, AgentVersion, LastHeartBeat) by SessionHostName
| where Status != "Available"

Step 2: Drain the host

Update-AzWvdSessionHost @hp -Name '<SessionHostName>' -AllowNewSession:$false

This needs the Desktop Virtualization Session Host Operator role. Wait 60 seconds before you refresh the portal (drain mode). In pooled pools, autoscale overrides drain mode, so tag the VM with the scaling plan's exclusion tag (autoscale scenarios).

Step 3: Read the Application log

On the host, open Event Viewer > Windows Logs > Application and filter on these sources: WVD-Agent, WVD-Agent-Updater, RDAgentBootLoader and MsiInstaller (agent troubleshooting):

Also confirm the Remote Desktop Agent Loader service is running. If Service Control Manager logs start timeouts (events 7000 or 7011), set the service to Automatic (Delayed Start). You can also raise the timeout with reg add "HKLM\SYSTEM\CurrentControlSet\Control" /v ServicesPipeTimeout /t REG_DWORD /d 60000 /f and reboot.

Step 4: Re-register the agent

Generate a key (add session hosts):

New-AzWvdRegistrationInfo @hp -ExpirationTime $((Get-Date).ToUniversalTime().AddHours(24).ToString('yyyy-MM-ddTHH:mm:ss.fffffffZ'))
(Get-AzWvdHostPoolRegistrationToken @hp).Token

Then on the host, run as administrator (agent troubleshooting):

$newKey = '<RegistrationToken>'
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\RDInfraAgent" -Name "IsRegistered" -Value 0 -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\RDInfraAgent" -Name "RegistrationToken" -Value $newKey -Force
Restart-Service RDAgentBootLoader
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\RDInfraAgent" | FL IsRegistered, RegistrationToken

You want IsRegistered : 1 and an empty RegistrationToken. A key can last from one hour to 27 days. Hosts left powered off for more than 90 days also lose their machine token. If the registry reset doesn't work, do a clean reinstall:

1. Uninstall Remote Desktop Agent Boot Loader, Remote Desktop Services Infrastructure Agent, Remote Desktop Services Infrastructure Geneva Agent and Remote Desktop Services SxS Network Stack (every instance), then restart. If you're connected over RDP when the SxS stack uninstall prompts, choose Do not close applications.
2. Remove the session host from the host pool.
3. Install the agent with a new key, then the boot loader, then restart.

Step 5: Unblock endpoints (Needs Assistance, 3703, 3019)

Run the Azure Virtual Desktop Agent URL Tool from the RDAgent folder (check required FQDNs):

$RDAgent = Get-WmiObject -Class Win32_Product | ? Name -eq "Remote Desktop Services Infrastructure Agent" | Sort-Object Version -Descending
$path = ($RDAgent[0]).InstallSource + "RDAgent_" + ($RDAgent[0]).Version
cd $path
.\WVDAgentUrlTool.exe

The tool doesn't test wildcard entries. Compare your rules against the list itself: *.wvd.microsoft.com, login.microsoftonline.com, the agent telemetry endpoints, mrsglobalsteus2prod.blob.core.windows.net (agent and SxS updates), azkms.core.windows.net:1688, and the certificate endpoints on TCP 80. Microsoft doesn't support deployments with these blocked (required FQDNs). Also check that none of them appear in the hosts file.

• MetaDataServiceCheck: unblock 169.254.169.254 and bypass the proxy: netsh winhttp set proxy proxy-server="http=<proxy>" bypass-list="169.254.169.254".
• MonitoringAgentCheck: keep only the latest Remote Desktop Services Infrastructure Geneva Agent. Read C:\Program Files\Microsoft RDInfra\GenevaInstall.txt, and confirm the GenevaTask_<version> scheduled task is enabled.

Step 6: Fix domain trust, domain join and the SxS listener (Unavailable)

• DomainTrustCheck: run Test-ComputerSecureChannel -Repair -Credential (Get-Credential) (Test-ComputerSecureChannel).
• DomainJoinedCheck: the VM configuration guide covers bad credentials, DNS resolution and blocked computer-account reuse.
• SxSStackListenerCheck: run qwinsta.exe. Both rdp-tcp and rdp-sxs should show Listen. If they don't, run Stop-Service RDAgentBootLoader, uninstall the SxS stack, reinstall the newest SxSStack*.msi from C:\Program Files\Microsoft RDInfra\, and reboot. The stack activates only on Enterprise or Server SKUs. A DisableRegistryTools policy also blocks it (agent troubleshooting).

Step 7: Clear Upgrading and Upgrade Failed

If a host is stuck in Upgrading, reinstall the SxS stack (Step 6), then re-register (Step 4). Agent updates roll out in flights over five-day periods. Each host keeps three versions of the agent and stack so it can roll back, so don't delete them (agent overview). With Scheduled Agent Updates, an update fails if the VM is deallocated during the window, and the broker forces the install after four tries (Scheduled Agent Updates).

Step 8: Check FSLogix, return to service, monitor

FSLogixHealthCheck is marked disabled, so a broken profile share may not change the host's status. Read C:\ProgramData\FSLogix\Logs\Profile. Microsoft also warns that the April 2026 Windows Server update changes the default Kerberos encryption from RC4 to AES-SHA1. Shares that haven't been moved to AES-SHA1 may break (FSLogix logging). See our FSLogix troubleshooting guide.

When the host is healthy, run -AllowNewSession:$true and remove the exclusion tag. Turn on the AgentHealthStatus diagnostic category for AVD Insights. Microsoft's sample query decodes the numeric health-check IDs. More in our AVD monitoring guide.

FAQ

What does "Needs Assistance" mean in AVD?

A non-fatal health check failed: URLs, IMDS or the Geneva monitoring agent. Users can still connect, but their experience may degrade.

Why is my AVD session host Unavailable while the VM is running?

Either a fatal check failed (domain join, domain trust or SxS listener) or the agent isn't registered or connected. Check HealthCheckResult and look for event 3277.

What does the "Shutdown" health state mean?

The VM was shut down. If it shut down before the agent could report it, the portal shows Unavailable instead.

How long is an AVD registration token valid?

Anywhere from one hour to 27 days, depending on what you set. Separately, a host's machine token expires after 90 days powered off.

What is the AVD Agent URL Tool?

WVDAgentUrlTool.exe ships with RDAgent 1.0.2944.400 and later. It lists required endpoints the host can't reach. It doesn't check wildcard entries.

Want a second pair of eyes?

Sessionwright's AVD assessment reviews health-check results, agent versions, and drain and autoscale settings across your host pools, and gives you an expert-reviewed report. It's read-only by default. If you later let the Sessionwright for Azure Virtual Desktop fix hosts, you approve every change and every action is logged. If cost is also on your list, see our AVD cost optimization checklist.

Sources

• Microsoft Learn: Session host statuses and health checks in Azure Virtual Desktop
• Microsoft Learn: Troubleshoot common Azure Virtual Desktop Agent issues
• Microsoft Learn: Troubleshoot session host virtual machine configuration
• Microsoft Learn: Session Hosts - Get (REST API, 2025-10-10)
• Microsoft Learn: Get-AzWvdSessionHost
• Microsoft Learn: SessionHost class (Az.DesktopVirtualization models)
• Microsoft Learn: SessionHostHealthCheckReport class
• Microsoft Learn: Update-AzWvdSessionHost
• Microsoft Learn: New-AzWvdRegistrationInfo
• Microsoft Learn: Drain session hosts for maintenance
• Microsoft Learn: Autoscale scaling plans and example scenarios
• Microsoft Learn: Add session hosts to a host pool
• Microsoft Learn: Check access to required FQDNs and endpoints
• Microsoft Learn: Required FQDNs and endpoints for Azure Virtual Desktop
• Microsoft Learn: Test-ComputerSecureChannel
• Microsoft Learn: Get started with the Azure Virtual Desktop Agent
• Microsoft Learn: Scheduled Agent Updates
• Microsoft Learn: What's new in the Azure Virtual Desktop Agent
• Microsoft Learn: FSLogix troubleshooting with logging and diagnostics
• Microsoft Learn: Enable Insights to monitor Azure Virtual Desktop
• Microsoft Learn: WVDAgentHealthStatus table reference
• Microsoft Learn: Queries for the WVDAgentHealthStatus table