Windows 11 25H2 VM Clone issues

[hiattech]

We are running vSphere and rolling out users on Windows 11 25H2 on a couple different networks (one is air gapped and has a lot more restrictive GPOs). The template seems to work just fine with our software and such. We can spin up a New VM from Template just fine. The issue is when users login.

 

1. On both networks, when a user logs in, if they need to launch an RDP session, it pops up the error "The remote session was disconnected because license store creation failed with access denied. Please run remote desktop client with elevated privileges." After some digging, I discovered that this is caused by the user not having permissions to create/edit the HKLM\Software\Microsoft\MSLicensing folder to create a new HardwareID. I can either run RDP as admin and connect to another machine to fix this or run a quick registry file to fix this, but having to touch every one of the 500+ machines we need to roll out is/will be incredibly time consuming. Anyone know why it does this and a better fix? I could try to apply the registry fix to the template but I think part of the process during VM creation is set to delete that key so it recreates it. Why don't basic users have permission to create that ID? I would think a system process would do it. 

 

2. Also on both networks though the issue acts a bit differently on each. On the internet system, users can login but when we try to run anything as admin, it pops up the error "explorer.exe - System Error. The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application." If we login as admin and install the app, it works fine and I believe the issue doesn't happen again if we switch back to the user and run as admin (I'll try to confirm this. We usually just install everything needed while we're logged in as admin.)

On the air-gapped system, we get the same explorer error if we try to run things as an admin for a user however, if an admin without an existing profile on the system tries to login, they get the error immediately. The screen is black, no taskbar, nothing. I've tried getting into task manager and restarting explorer but it does nothing. Only admins that have a profile on the template before it's rolled out can login. Any other admins that try to login have the black screen issue. The weird thing is, once we install our multifactor authentication software (requests a token instead of a password), the issue clears up. Everyone can login just fine. The RDP issue still happens unless we run the mentioned fix but everything works fine otherwise. 

 

Everything I can find says to just run the DISM health scan and fix etc etc. Doing that takes well over 3 hours per user on the online systems. I have tried running that on the template to clean it up but it hasn't helped. I am running a script to uninstall a number of windows programs before shutdown because they seem to cause issues with the image deploying. With most of these, if I don't remove them, the system doesn't finish going through the OS Customizations (vSphere version of sysprep) and throws errors about "this app was installed for one user but not all users" and won't continue. Is it possible one of these needs to stay? Any suggestions or hints to fix these would be great.

 

Get-AppxPackage -allusers *WebExperience* | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.Widget* | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.Copilot* | Remove-AppxPackage
Get-AppxPackage -allusers NotePadPlusPlus* | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.XboxGamingOverlay | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.XboxApp | Remove-AppxPackage
Get-AppxPackage -allusers XboxOneSmartGlass | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.XboxSpeechToTextOverlay | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.XboxIdentityProvider | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.MicrosoftEdge.Stable* | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.GamingApp | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.MicrosoftOfficeHub | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.MicrosoftSolitaireCollection | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.Xbox.TCUI | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.XboxGameOverlay | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.ZuneMusic | Remove-AppxPackage
Get-AppxPackage -allusers Microsoft.ZuneVideo | Remove-AppxPackage
Get-AppxPackage -allusers MicrosoftCorporationII.QuickAssist | Remove-AppxPackage
Get-AppxPackage Microsoft.StartExperiencesApp* | Remove-AppxPackage
dism /online /disable-feature /featurename:Recall -Remove