Onboarding Azure Arc VM fails: can't install Azure Connected Machine Agent

Question

I'd like to add an offsite Windows VM to Azure Arc for health monitoring. The VM is hosted by Vultr and runs Windows Server 2016 Standard Build 14393.

However, installing AzureConnectedMachineAgent.msi on the target VM fails with error code 1603. Installation log also contains this error:

Start-Service : Service 'Guest Configuration Extension service 
WixQuietExec64:  (ExtensionService)' cannot be started due to the following error: Cannot start 
WixQuietExec64:  service ExtensionService on computer '.'.
WixQuietExec64:  At C:\Program Files\AzureConnectedMachineAgent\ExtensionService\GC\Modules\Exte
WixQuietExec64:  nsionService\ServiceHelper.psm1:367 char:5

Any suggestions on how to fix this?

Answer 1

To get support for Windows Agent and extensions in Azure, the Windows Agent on the Windows VM must be later than or equal to version 2.7.41491.911. However the cause for the failure of agent installation is different in this case.

You may also want to check %programdata%\\ext_mgr_logs\\gc_ext_telemetry.txt log which must have had an entry something like this :

<GCLOG>........ Not starting Extension Service since machine is an Azure VM</GCLOG>

Cause: This can happen while attempting to install the agent on an Azure VM.This is an unsupported production scenario.One Should not be installing this agent on an Azure VM as it conflicts with the Azure Guest Agent and interferes with Azure VM management.

If one wishes to use an Azure VM simply for testing purposes then they can follow the below document for guidance

https://docs.microsoft.com/en-us/azure/azure-arc/servers/plan-evaluate-on-azure-virtual-machine

Answer 2

You may Check if the user with which you are logged into the VM have sufficient permissions to start a system service

• If you find the following in the %ProgramData%\\AzureConnectedMachineAgent\\Log\\himds.log or in installation logs :

   time="2021-02-11T08:39:38-08:00" level=error msg="Cannot open event source: Azure Hybrid Instance Metadata Service."

• You can verify the permissions by collecting the following registry key from an impacted server.

   HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Eventlog\\Application\\CustomS

• Mitigation can be to grant the permission to write to the SECURITY_SERVICE_RID S-1-5-6 which would grant the required permissions to the himds service account. https://docs.microsoft.com/en-us/windows/win32/secauthz/well-known-sids .

If the registry key does NOT exist on the impacted VM, then this resolution will NOT apply as there will be a separate root cause such as AV interference.

• If the root cause is not found here ,then a procmon trace needs to be taken to analyze the root cause for the msi not being able to start a service.

  ( In case a procmon trace has to be analyzed , please open an MS Support ticket)