VM Agent fails to create WFP rules on non-English system locale (nl-NL)

### **Summary**

On Azure Virtual Desktop multi-session hosts (Windows 10 and Windows 11 any release), the Azure Windows VM Agent (WaAppAgent / BfeToolWin8.exe) fails to create the required Windows Filtering Platform (WFP) rules for wireserver (168.63.129.16) if the system/welcome screen language is set to a non-English locale (e.g. Dutch nl-NL).

This results in:

WVDAgentURLTool timeouts
WaAppAgent log errors: “Failed to add filter to permit outgoing traffic from specific user”
MissingRules validation failures
Hosts intermittently appearing as Unavailable in the AVD portal

### **Root cause**

When user language settings are copied to system accounts via:

Control Panel → Region → Administrative → Copy settings → Welcome screen and system accounts

Windows localizes well-known principal names, for example:

BUILTIN\Administrators → INGEBOUWD\Administrators (Dutch)

NT AUTHORITY\SYSTEM may also appear localized

The VM Agent currently attempts to create WFP rules using the localized account name strings.
Because the tool expects the English names (BUILTIN\Administrators / NT AUTHORITY\SYSTEM), the filter creation fails with error:

[ERROR] Failed to add filter to permit outgoing traffic from specific user.
[ERROR] <- BaseFilterpAddFilterToAllowOutgoingFromUser=0x800706f7

### **Expected behavior**

The VM Agent should use well-known SIDs, not localized names:

S-1-5-32-544 → Administrators
S-1-5-18 → System

SIDs are consistent across all Windows locales and would prevent this issue.