AWS appstream2 documentation change
Summary
Updated product name references from 'Amazon AppStream 2.0' to 'Amazon WorkSpaces Applications' throughout the document. Technical content remains identical except for service name changes in troubleshooting scenarios, API/CLI references, and configuration examples.
Security assessment
The changes are purely branding updates with no modifications to security configurations, vulnerability disclosures, or authentication mechanisms. The Microsoft patch (KB5020276) mentioned is existing content explaining domain join behavior changes, not a new security fix. No evidence of addressing a specific security vulnerability or adding security features.
Diff
diff --git a/appstream2/latest/developerguide/troubleshooting-active-directory.md b/appstream2/latest/developerguide/troubleshooting-active-directory.md index d6778c625..b57b44269 100644 --- a//appstream2/latest/developerguide/troubleshooting-active-directory.md +++ b//appstream2/latest/developerguide/troubleshooting-active-directory.md @@ -3 +3 @@ -[Documentation](/index.html)[Amazon AppStream 2.0](/appstream2/index.html)[Administration Guide](what-is-appstream.html) +[Documentation](/index.html)[Amazon WorkSpaces Applications](/appstream2/index.html)[Administration Guide](what-is-appstream.html) @@ -5 +5 @@ -My image builders and fleet instances are stuck in the PENDING state.My users aren't able to log in with the SAML application.My fleet instances work for one user but don't cycle correctly.My user Group Policy objects aren't being successfully applied.My AppStream 2.0 streaming instances aren't joining the Active Directory domain.User login is taking a long time to complete on a domain-joined streaming session.My users can't access a domain resource in a domain-joined streaming session, but they can access the resource from a domain-joined image builder.My users receive the error “Certificate-Based Authentication not available” and are prompted to enter their domain password. Or users receive the error “Disconnected from session” when they are starting a session enabled with certificate-based authentication.I'm experiencing domain join failures after changing the Active Directory (AD) service account. +My image builders and fleet instances are stuck in the PENDING state.My users aren't able to log in with the SAML application.My fleet instances work for one user but don't cycle correctly.My user Group Policy objects aren't being successfully applied.My WorkSpaces Applications streaming instances aren't joining the Active Directory domain.User login is taking a long time to complete on a domain-joined streaming session.My users can't access a domain resource in a domain-joined streaming session, but they can access the resource from a domain-joined image builder.My users receive the error “Certificate-Based Authentication not available” and are prompted to enter their domain password. Or users receive the error “Disconnected from session” when they are starting a session enabled with certificate-based authentication.I'm experiencing domain join failures after changing the Active Directory (AD) service account. @@ -9 +9 @@ My image builders and fleet instances are stuck in the PENDING state.My users ar -The following are issues that might occur when you set up and use Active Directory with Amazon AppStream 2.0. For help troubleshooting notification codes, see [Troubleshooting Notification Codes](./troubleshooting-notification-codes.html). +The following are issues that might occur when you set up and use Active Directory with Amazon WorkSpaces Applications. For help troubleshooting notification codes, see [Troubleshooting Notification Codes](./troubleshooting-notification-codes.html). @@ -21 +21 @@ The following are issues that might occur when you set up and use Active Directo - * My AppStream 2.0 streaming instances aren't joining the Active Directory domain. + * My WorkSpaces Applications streaming instances aren't joining the Active Directory domain. @@ -36 +36 @@ The following are issues that might occur when you set up and use Active Directo -Image builders and fleet instances can take up to 25 minutes to move into a ready state and become available. If your instances are taking longer than 25 minutes to become available, in Active Directory, verify whether new computer objects were created in the correct organizational units (OUs). If there are new objects, the streaming instances will be available soon. If the objects aren't there, check the directory configuration details in your AppStream 2.0 Directory Config: Directory name (the fully qualified domain name of the directory, service account sign-in credentials, and the OU distinguished name. +Image builders and fleet instances can take up to 25 minutes to move into a ready state and become available. If your instances are taking longer than 25 minutes to become available, in Active Directory, verify whether new computer objects were created in the correct organizational units (OUs). If there are new objects, the streaming instances will be available soon. If the objects aren't there, check the directory configuration details in your WorkSpaces Applications Directory Config: Directory name (the fully qualified domain name of the directory, service account sign-in credentials, and the OU distinguished name. @@ -38 +38 @@ Image builders and fleet instances can take up to 25 minutes to move into a read -Image builder and fleet errors are displayed in the AppStream 2.0 console on the **Notifications** tab for the fleet or image builder. Fleet errors are also available using the AppStream 2.0 API through the [DescribeFleets](https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeFleets.html) operation or the CLI command [describe-fleets](https://docs.aws.amazon.com/cli/latest/reference/appstream/describe-fleets.html). +Image builder and fleet errors are displayed in the WorkSpaces Applications console on the **Notifications** tab for the fleet or image builder. Fleet errors are also available using the WorkSpaces Applications API through the [DescribeFleets](https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeFleets.html) operation or the CLI command [describe-fleets](https://docs.aws.amazon.com/cli/latest/reference/appstream/describe-fleets.html). @@ -42 +42 @@ Image builder and fleet errors are displayed in the AppStream 2.0 console on the -AppStream 2.0 relies on the SAML_Subject "NameID" attribute from your identity provider to populate the username field to log in your user. The username can either be formatted as "``domain`\username`", or "`[email protected]`". If you are using "``domain`\username`" format, ``domain`` can either be the NetBIOS name or the fully qualified domain name. If using "`[email protected]`" format, the UserPrincipalName attribute can be used. If you've verified your SAML_Subject attribute is configured correctly and the problem persists, contact AWS Support. For more information, see [AWS Support Center](https://console.aws.amazon.com/support/home#/). +WorkSpaces Applications relies on the SAML_Subject "NameID" attribute from your identity provider to populate the username field to log in your user. The username can either be formatted as "``domain`\username`", or "`[email protected]`". If you are using "``domain`\username`" format, ``domain`` can either be the NetBIOS name or the fully qualified domain name. If using "`[email protected]`" format, the UserPrincipalName attribute can be used. If you've verified your SAML_Subject attribute is configured correctly and the problem persists, contact AWS Support. For more information, see [AWS Support Center](https://console.aws.amazon.com/support/home#/). @@ -61 +61 @@ For more information, see [Loopback processing of Group Policy](https://support. -## My AppStream 2.0 streaming instances aren't joining the Active Directory domain. +## My WorkSpaces Applications streaming instances aren't joining the Active Directory domain. @@ -63 +63 @@ For more information, see [Loopback processing of Group Policy](https://support. -The Active Directory domain to use with AppStream 2.0 must be accessible through its fully qualified domain name (FQDN) through the VPC in which your streaming instances are launched. +The Active Directory domain to use with WorkSpaces Applications must be accessible through its fully qualified domain name (FQDN) through the VPC in which your streaming instances are launched. @@ -67 +67 @@ The Active Directory domain to use with AppStream 2.0 must be accessible through - 1. Launch an Amazon EC2 instance in the same VPC, subnet, and security groups that you use with AppStream 2.0. + 1. Launch an Amazon EC2 instance in the same VPC, subnet, and security groups that you use with WorkSpaces Applications. @@ -69 +69 @@ The Active Directory domain to use with AppStream 2.0 must be accessible through - 2. Manually join the EC2 instance to your Active Directory domain by using the FQDN (for example, `yourdomain.example.com`) with the service account that you intend to use with AppStream 2.0. Use the following command in a Windows PowerShell console: + 2. Manually join the EC2 instance to your Active Directory domain by using the FQDN (for example, `yourdomain.example.com`) with the service account that you intend to use with WorkSpaces Applications. Use the following command in a Windows PowerShell console: @@ -94 +94 @@ If you were not able to manually join the EC2 instance to your domain, but were -AppStream 2.0 performs a Windows login action after users provide their domain password. After successful authentication, AppStream 2.0 launches the application. The login and launch times are impacted by many variables, such as network contention for the domain controllers or the time it takes to apply Group Policy settings to the streaming instance. If domain authentication takes too long to complete, try performing the following actions. +WorkSpaces Applications performs a Windows login action after users provide their domain password. After successful authentication, WorkSpaces Applications launches the application. The login and launch times are impacted by many variables, such as network contention for the domain controllers or the time it takes to apply Group Policy settings to the streaming instance. If domain authentication takes too long to complete, try performing the following actions. @@ -96 +96 @@ AppStream 2.0 performs a Windows login action after users provide their domain p - * Minimize the network latency from your AppStream 2.0 Region to your domain controllers by choosing the correct domain controllers. For example, if your fleet is in `us-east-1`, use domain controllers with high bandwidth and low latency to `us-east-1` through Active Directory Sites and Services zone mappings. For more information, see [Active Directory Sites and Services](https://technet.microsoft.com/en-us/library/cc730868.aspx) in the Microsoft documentation. + * Minimize the network latency from your WorkSpaces Applications Region to your domain controllers by choosing the correct domain controllers. For example, if your fleet is in `us-east-1`, use domain controllers with high bandwidth and low latency to `us-east-1` through Active Directory Sites and Services zone mappings. For more information, see [Active Directory Sites and Services](https://technet.microsoft.com/en-us/library/cc730868.aspx) in the Microsoft documentation. @@ -103 +103 @@ AppStream 2.0 performs a Windows login action after users provide their domain p -If your domain users' login to AppStream 2.0 fails with the message "An unknown error occurred," you might need to update the Group Policy settings described in [Before You Begin Using Active Directory with Amazon AppStream 2.0](./active-directory-prerequisites.html). Otherwise, these settings might prevent AppStream 2.0 from authenticating and logging in your domain users. +If your domain users' login to WorkSpaces Applications fails with the message "An unknown error occurred," you might need to update the Group Policy settings described in [Before You Begin Using Active Directory with Amazon WorkSpaces Applications](./active-directory-prerequisites.html). Otherwise, these settings might prevent WorkSpaces Applications from authenticating and logging in your domain users. @@ -115 +115 @@ The user can refresh the page on the web client or reconnect from the client for - * AppStream 2.0 could not communicate with AWS Private CA, or AWS Private CA did not issue the certificate. Check CloudTrail to determine if a certificate was issued. For more information, see [What Is AWS CloudTrail?](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html.html) and [Manage Certificate-based Authentication](./certificate-based-authentication-manage.html). + * WorkSpaces Applications could not communicate with AWS Private CA, or AWS Private CA did not issue the certificate. Check CloudTrail to determine if a certificate was issued. For more information, see [What Is AWS CloudTrail?](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html.html) and [Manage Certificate-based Authentication](./certificate-based-authentication-manage.html). @@ -125 +125 @@ The user can refresh the page on the web client or reconnect from the client for - * The AppStream 2.0 agent does not support certificate-based authentication. Use AppStream 2.0 agent version 10-13-2022 or later. + * The WorkSpaces Applications agent does not support certificate-based authentication. Use WorkSpaces Applications agent version 10-13-2022 or later. @@ -129 +129 @@ The user can refresh the page on the web client or reconnect from the client for - * The CRL distribution point for the private CA is not online or accessible from either the AppStream 2.0 fleet instance or the domain controller. For more information, see step 5 in [Prerequisites](./certificate-based-authentication-prereq.html). + * The CRL distribution point for the private CA is not online or accessible from either the WorkSpaces Applications fleet instance or the domain controller. For more information, see step 5 in [Prerequisites](./certificate-based-authentication-prereq.html). @@ -134 +134 @@ The user can refresh the page on the web client or reconnect from the client for -Additional troubleshooting steps involve reviewing the AppStream 2.0 instance Windows event logs. A common event to review for logon failure is [4625(F): An account failed to log on](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625). For more information about capturing log information, see [Persisting application and Windows event logs](https://docs.aws.amazon.com/whitepapers/latest/best-practices-for-deploying-amazon-appstream-2/monitoring.html#persisting-application-and-windows-event-logs). Alternatively, to troubleshoot an active AppStream 2.0 session as an administrator, you can connect to the logs using an Event Viewer on another computer. For more information, see [How to Select Computers in Event Viewer](https://learn.microsoft.com/en-us/host-integration-server/core/how-to-select-computers-in-event-viewer1). Or ,you can connect by using Remote Desktop to connect to the instance private IP address from another computer that can connect to Remote Desktop Services in your AppStream 2.0virtual private cloud (VPC). Use the AWS CLI to determine the IP address for the session based on the AWS Region, AppStream 2.0 stack name, fleet name, user ID, and authentication type. For more information, see the [AWS Command Line Interface.](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/appstream/index.html#cli-aws-appstream) +Additional troubleshooting steps involve reviewing the WorkSpaces Applications instance Windows event logs. A common event to review for logon failure is [4625(F): An account failed to log on](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625). For more information about capturing log information, see [Persisting application and Windows event logs](https://docs.aws.amazon.com/whitepapers/latest/best-practices-for-deploying-amazon-appstream-2/monitoring.html#persisting-application-and-windows-event-logs). Alternatively, to troubleshoot an active WorkSpaces Applications session as an administrator, you can connect to the logs using an Event Viewer on another computer. For more information, see [How to Select Computers in Event Viewer](https://learn.microsoft.com/en-us/host-integration-server/core/how-to-select-computers-in-event-viewer1). Or ,you can connect by using Remote Desktop to connect to the instance private IP address from another computer that can connect to Remote Desktop Services in your WorkSpaces Applicationsvirtual private cloud (VPC). Use the AWS CLI to determine the IP address for the session based on the AWS Region, WorkSpaces Applications stack name, fleet name, user ID, and authentication type. For more information, see the [AWS Command Line Interface.](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/appstream/index.html#cli-aws-appstream) @@ -142 +142 @@ If you have an existing fleet with an image based on the August 2024 [Microsoft -Microsoft has released a patch [KB5020276](https://support.microsoft.com/en-us/topic/kb5020276-netjoin-domain-join-hardening-changes-2b65a0f3-1f4c-42ef-ac0f-1caaf421baf8), which modifies the behavior of domain join operations. AppStream 2.0 reuses existing computer objects when joining your streaming instances to your AD domains. This computer object is generated using the AD service account that you provide when you create a fleet or Directory Config with AppStream 2.0. Prior to this Microsoft patch, new AD service accounts could reuse existing computer objects created by AppStream 2.0, as long as they had "Create Computer Object" permissions configured in the organizational unit (OU). +Microsoft has released a patch [KB5020276](https://support.microsoft.com/en-us/topic/kb5020276-netjoin-domain-join-hardening-changes-2b65a0f3-1f4c-42ef-ac0f-1caaf421baf8), which modifies the behavior of domain join operations. WorkSpaces Applications reuses existing computer objects when joining your streaming instances to your AD domains. This computer object is generated using the AD service account that you provide when you create a fleet or Directory Config with WorkSpaces Applications. Prior to this Microsoft patch, new AD service accounts could reuse existing computer objects created by WorkSpaces Applications, as long as they had "Create Computer Object" permissions configured in the organizational unit (OU). @@ -144 +144 @@ Microsoft has released a patch [KB5020276](https://support.microsoft.com/en-us/t -When the Microsoft patch is enforced, starting on August 13, 2024, and if you change your AD service account for an existing AppStream 2.0 fleet, the new service account will no longer be able to reuse the existing computer objects in the AD. This results in domain join failures on AppStream 2.0 fleets, with one of the following error messages under fleet notifications: +When the Microsoft patch is enforced, starting on August 13, 2024, and if you change your AD service account for an existing WorkSpaces Applications fleet, the new service account will no longer be able to reuse the existing computer objects in the AD. This results in domain join failures on WorkSpaces Applications fleets, with one of the following error messages under fleet notifications: @@ -155 +155 @@ To control which account can reuse the existing computer objects, Microsoft has -For Managed Active Directory (MAD), you must restart your AppStream 2.0 fleet after you make changes to your AppStream 2.0 domain join service account. +For Managed Active Directory (MAD), you must restart your WorkSpaces Applications fleet after you make changes to your WorkSpaces Applications domain join service account. @@ -167 +167 @@ Troubleshooting Fleets -Troubleshooting AppStream 2.0 User Issues +Troubleshooting WorkSpaces Applications User Issues