If your master image is incorrectly configured, newly provisioned Trusted Launch VMs will fail with the following symptoms:

• BSOD / Blank Boot Diagnostics: The VM fails to boot into Windows. Azure Boot Diagnostics shows a BitLocker recovery prompt or a blank screen. The Serial Console shows no actionable OS-level output because Windows never loads. The cloned VM's new vTPM cannot unseal the original BitLocker keys, halting the boot process before the OS initializes.

• Raw SIDs in Studio: The newly provisioned VDA appears as a raw SID (e.g., S-1-5-21-XXXXXXXXXX...) instead of its domain machine name (DOMAIN\COMPUTERNAME).

• Unregistered State: The machine power state in DaaS is Power On + Unregistered.

• RDP Failure: Direct RDP connections time out or fail completely because the OS network stack never initializes.

When Citrix MCS provisions a new Azure Trusted Launch VM, it generates a new virtual TPM (vTPM) chip for the clone.

If BitLocker encryption is active on the master image OS disk, the cloned VM's new vTPM chip cannot unlock the OS drive.

This hardware security mismatch halts the boot process at the UEFI level (resulting in the blank boot diagnostics) and prevents the Citrix MCS Identity Service from executing the domain join and identity initialization scripts.

Step 1: Prepare the Master Image (Disable BitLocker)

Before taking the MCS master image snapshot, fully decrypt the OS volume so the new vTPM has no BitLocker state to conflict with.

1. Power on the master VM natively in Azure.

2. Open an elevated PowerShell prompt and begin decryption:

   Disable-BitLocker -MountPoint "C:"
   

3. Wait for decryption to complete.

   Disable-BitLocker is asynchronous — it returns immediately while decryption runs in the background. Monitor progress until the volume is fully decrypted:

   Get-BitLockerVolume -MountPoint "C:"
   

   Repeat until VolumeStatus shows FullyDecrypted and ProtectionStatus shows Off. Do not proceed until both conditions are met.

4. Shut down the VM cleanly from within Windows (Start > Power > Shut down).

   Note: Do not use the Azure Portal "Stop" button — this performs a hard power-off and may leave the filesystem in an inconsistent state.

5. Take a new snapshot of the OS disk in the Azure Portal.

6. Update the MCS catalog to use the new snapshot as the master image.

Step 2: Download and Configure the Provisioning Script

A complete, automated PowerShell script is attached to this article as a ZIP file to prevent formatting errors.

1. Download Create-AzureTrustedLaunchCatalog.zip from the attachments section of this article.

2. Extract the ZIP and open Create-AzureTrustedLaunchCatalog.ps1 in PowerShell ISE or VS Code.

3. Update the environment variables at the top of the script with your specific Azure and Citrix parameters:

   $CatalogName 
   $HostingUnitName 
   $IdentityPoolName 
   $ServiceOffering 
   $ResourceGroupName 
   $MasterImageVM
   $MachineProfileVM 
   $NetworkPath

4. Run the script. It will automatically dynamically map your network path, set the correct custom properties, create the MCS scheme, build the catalog in Studio, and provision a test VM.

Common Pitfalls & Troubleshooting

Unable to create a trusted launch machine catalog via PowerShell. As a workaround when we tried creating a catalog via GUI, catalog creation is successful however the machines are not starting and getting a blue screen error.

Prerequisites