Proxmox VDI Plan: FSLogix + Disposable Windows 11 Desktops
Budget: £20 – £250 GBP
Objective
Create a cost-effective virtual desktop environment using Proxmox, where users access Windows 11 desktops.
Desktops must be disposable, centrally managed, easy to update, and use FSLogix to keep user profiles persistent.
1. Core Components Required
Proxmox VE installed on the dedicated server.
Windows 11 Enterprise master image (golden image).
Active Directory domain (existing or new).
FSLogix for profile containers.
Central SMB share for storing FSLogix profiles.
RDP access for users.
2. Architecture Logic
Proxmox is used to host all Windows 11 VMs.
Each desktop is a clone of the master image.
Users do not store data inside the VM itself.
All user data and settings are redirected into FSLogix profile containers.
FSLogix profiles are stored on a central SMB share
hosted on a NAS or Windows server.
Desktops are disposable.
They can be deleted and recreated at any time without losing user profiles.
Updates are applied only to the master image.
Not to each individual VM.
When updates are required, new VMs are created from the updated template and old ones are removed.
3. Master Image Logic (Golden Image)
Build one fully configured Windows 11 VM.
Install common apps.
Apply Windows optimisation for VDI (GPO or local config).
Install and configure FSLogix.
Domain join the VM.
Convert this VM into a Proxmox template.
This template serves as the base for all user desktops.
4. VM Deployment Logic
For each user, create a clone from the master template.
Assign appropriate CPU, RAM, and storage.
Join the clone to the domain.
Apply group policies for FSLogix redirection.
Users log in through RDP.
FSLogix loads their profile from the central file share.
5. User Profile Logic (FSLogix)
Each user has their own .VHDX file stored on a NAS/SMB share.
Profiles are mounted dynamically when a user logs in.
Profiles follow the user across refreshed desktops.
No user data is stored inside the VM.
This ensures clean desktops and zero data loss when desktops are rebuilt.
6. Update & Maintenance Logic
When software or system updates are needed:
Update the golden image.
Convert it back to a refreshed Proxmox template.
Delete existing user VMs.
Recreate fresh clones from the updated template.
Users log in and FSLogix attaches their profiles.
This ensures all desktops run the same version of everything.
7. Access Control Logic
Only licensed users are added to a dedicated AD group:
“VDI-Entitled-Users”
Only users in this group can connect to the Windows VMs.
This ensures Microsoft licensing compliance (user-based VDA or M365 licensing).
8. Security Logic
All RDP access must go through a secure method such as:
VPN,
Reverse proxy, or
RDP Gateway server.
Firewalls must restrict RDP access from the public internet.
User VMs should run in an isolated VLAN or subnet.
Optional MFA enforcement for RDP access.
9. Performance Logic
Use fast local SSD/NVMe storage for desktop performance.
Use NAS storage with SSD cache for FSLogix profiles.
Allocate CPU/RAM based on typical usage.
Allow scale-out by creating additional clones as required.
10. Optional Automation Logic
If desired, the system can automatically:
Rebuild desktops nightly or weekly.
Rotate disposable clones.
Clean up unused VMs.
Send alerts when profiles grow too large.
Automation can be done via Proxmox API, Ansible, or scripts.
Summary for the Server Engineer
You want a Proxmox-based VDI solution where:
One Windows 11 master image controls everything.
All users receive cloned desktops from this template.
FSLogix stores user profiles centrally.
Desktops are disposable and can be rebuilt at any time.
Updates are applied only to the master template.
Access is restricted to licensed users.
The environment is secure, clean, and easy to maintain.
Create a cost-effective virtual desktop environment using Proxmox, where users access Windows 11 desktops.
Desktops must be disposable, centrally managed, easy to update, and use FSLogix to keep user profiles persistent.
1. Core Components Required
Proxmox VE installed on the dedicated server.
Windows 11 Enterprise master image (golden image).
Active Directory domain (existing or new).
FSLogix for profile containers.
Central SMB share for storing FSLogix profiles.
RDP access for users.
2. Architecture Logic
Proxmox is used to host all Windows 11 VMs.
Each desktop is a clone of the master image.
Users do not store data inside the VM itself.
All user data and settings are redirected into FSLogix profile containers.
FSLogix profiles are stored on a central SMB share
hosted on a NAS or Windows server.
Desktops are disposable.
They can be deleted and recreated at any time without losing user profiles.
Updates are applied only to the master image.
Not to each individual VM.
When updates are required, new VMs are created from the updated template and old ones are removed.
3. Master Image Logic (Golden Image)
Build one fully configured Windows 11 VM.
Install common apps.
Apply Windows optimisation for VDI (GPO or local config).
Install and configure FSLogix.
Domain join the VM.
Convert this VM into a Proxmox template.
This template serves as the base for all user desktops.
4. VM Deployment Logic
For each user, create a clone from the master template.
Assign appropriate CPU, RAM, and storage.
Join the clone to the domain.
Apply group policies for FSLogix redirection.
Users log in through RDP.
FSLogix loads their profile from the central file share.
5. User Profile Logic (FSLogix)
Each user has their own .VHDX file stored on a NAS/SMB share.
Profiles are mounted dynamically when a user logs in.
Profiles follow the user across refreshed desktops.
No user data is stored inside the VM.
This ensures clean desktops and zero data loss when desktops are rebuilt.
6. Update & Maintenance Logic
When software or system updates are needed:
Update the golden image.
Convert it back to a refreshed Proxmox template.
Delete existing user VMs.
Recreate fresh clones from the updated template.
Users log in and FSLogix attaches their profiles.
This ensures all desktops run the same version of everything.
7. Access Control Logic
Only licensed users are added to a dedicated AD group:
“VDI-Entitled-Users”
Only users in this group can connect to the Windows VMs.
This ensures Microsoft licensing compliance (user-based VDA or M365 licensing).
8. Security Logic
All RDP access must go through a secure method such as:
VPN,
Reverse proxy, or
RDP Gateway server.
Firewalls must restrict RDP access from the public internet.
User VMs should run in an isolated VLAN or subnet.
Optional MFA enforcement for RDP access.
9. Performance Logic
Use fast local SSD/NVMe storage for desktop performance.
Use NAS storage with SSD cache for FSLogix profiles.
Allocate CPU/RAM based on typical usage.
Allow scale-out by creating additional clones as required.
10. Optional Automation Logic
If desired, the system can automatically:
Rebuild desktops nightly or weekly.
Rotate disposable clones.
Clean up unused VMs.
Send alerts when profiles grow too large.
Automation can be done via Proxmox API, Ansible, or scripts.
Summary for the Server Engineer
You want a Proxmox-based VDI solution where:
One Windows 11 master image controls everything.
All users receive cloned desktops from this template.
FSLogix stores user profiles centrally.
Desktops are disposable and can be rebuilt at any time.
Updates are applied only to the master template.
Access is restricted to licensed users.
The environment is secure, clean, and easy to maintain.