AppX Package Staging Deadlock Causes Login Delays and Temporary Profile Assignment on Shared Workstations and RDS

Indicators

• New user login duration exceeds 5 minutes on shared workstations or RDS session hosts
• New users are landed directly into a temporary profile environment instead of their own roaming or local profile
• User Profile Service Event ID 1509 logged in Application Event Log — file deployment permission issue or timeout during AppX staging
• User Profile Service Event ID 1511 logged in Application Event Log — profile creation failed with temporary profile assignment
• Issue reproducible consistently for first-login new users on affected shared fleet machines
• %USERPROFILE% path shows C:\Users\TEMP or similar temporary profile path

Likely causes

• User Profile Service becomes deadlocked while staging default provisioned AppX applications for a new user profile — background AppX optimization runs hold file or registry locks that block the staging operation
• Excessive number of default provisioned AppX packages in the base system image increases lock contention surface area during profile creation on shared or multi-session hosts
• High frequency of new user first-logins on shared workstations and RDS hosts amplifies probability of colliding with background AppX optimization tasks

Diagnostic steps

1. Open Event Viewer and navigate to Windows Logs > Application. Filter for Source 'User Profile Service' and look for Event ID 1509 and Event ID 1511. Note the verbatim message text, timestamps, and any referenced file paths or user SIDs.
   Confirms the User Profile Service is the blocking component and identifies the specific file deployment permission issue or timeout causing the deadlock during AppX staging.
2. Reproduce the issue by logging in as a brand-new user account that has never logged into the affected machine. Time the login duration with a stopwatch and observe whether the user lands in their own profile or a temporary profile (check via System Properties > User Profiles or echo %USERPROFILE%).
   Validates the symptom is reproducible and scoped to new-user first-login profile creation, distinguishing from roaming profile sync issues or GPO processing delays.
3. Run: Get-AppxProvisionedPackage -Online | Select-Object DisplayName, PackageName. Review the output to identify unnecessary default built-in app packages that should not be present on a shared or enterprise workstation image.
   Identifies provisioned AppX packages present in the system image that the User Profile Service must stage on each new user first-login, revealing candidates for de-provisioning to reduce lock contention.
4. While a new user login is in progress (or immediately after a failed/delayed login), check Task Manager or Process Explorer for the UserProfileService (svchost.exe hosting ProfSvc) and AppX-related processes (AppXSvc, TiledDataLayer). Observe if any are in a wait or deadlocked state consuming elevated CPU or blocking on I/O.
   Provides real-time confirmation of the deadlock condition — the User Profile Service being blocked by AppX background optimization locks during new profile creation.
5. Test new user first-login on two or more shared workstations or RDS session hosts. If only some machines are affected, compare their provisioned AppX package lists using Get-AppxProvisionedPackage -Online to identify differences.
   Determines whether the issue is systemic to the fleet image (requiring image remediation) or isolated to specific machines (requiring per-machine de-provisioning as interim fix).

Resolution path

• Step 1 — Identify unnecessary provisioned AppX packages: On the base/golden image or affected machine, run: Get-AppxProvisionedPackage -Online | Select-Object DisplayName, PackageName. Review the list and identify packages not required for enterprise use (e.g., consumer apps, games, social media apps).
• Step 2 — De-provision unnecessary AppX packages: For each unnecessary package, run: Remove-AppxProvisionedPackage -Online -PackageName <PackageName>. For offline image servicing (recommended): Remove-AppxProvisionedPackage -Path <MountPath> -PackageName <PackageName>. Repeat for all identified unnecessary packages.
• Step 3 — Redeploy the cleaned image to production fleet: Re-capture and redeploy the updated image to all affected shared workstations and RDS session hosts via standard image deployment toolchain (SCCM/MECM, MDT, WDS, or Intune Autopilot).
• Step 4 — Validate by testing new user first-login on redeployed machines: Log in as a brand-new user account, confirm login completes in under 60 seconds, user lands in their own profile (not temporary), and no Event ID 1509/1511 entries appear in the Application Event Log.

Prevention

• Establish a standard AppX de-provisioning script as part of the golden image build pipeline: before every image release, run Remove-AppxProvisionedPackage against a defined whitelist of approved enterprise applications to ship with minimum required AppX footprint
• Implement periodic review process aligned to Windows feature update cycles to audit provisioned AppX packages in the base image — Microsoft may re-add or update packages via feature updates
• On RDS session host builds, configure AppX background optimization tasks (via Group Policy or scheduled task management) to run only during defined maintenance windows (e.g., overnight) rather than opportunistically during business hours

Tools

• PowerShell — Get-AppxProvisionedPackage (enumerate provisioned AppX packages on live or offline image)
• PowerShell — Remove-AppxProvisionedPackage (de-provision unnecessary AppX packages from live system or offline image)
• Event Viewer — Application Log, User Profile Service source (identify Event ID 1509/1511 deadlock indicators)
• Task Manager / Process Explorer — observe UserProfileService and AppXSvc process states during login
• Image deployment toolchain (SCCM/MECM, MDT, WDS, Intune) — redeploy cleaned base image to fleet

References

• Microsoft Docs — Get-AppxProvisionedPackage
• Microsoft Docs — Remove-AppxProvisionedPackage