You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: support/azure/virtual-machines/windows/windows-azure-guest-agent-tools-vmassist.md
+17-18Lines changed: 17 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Troubleshooting Tool for Windows Guest Agent - VM assist
3
-
description: Provides script-based tool to help diagnose and resolve Azure Guest Agent issues on Azure virtual machines runnign Windows.
3
+
description: Provides script-based tool to help diagnose and resolve Azure Guest Agent issues on Azure virtual machines running Windows.
4
4
author: JarrettRenshaw
5
5
ms.author: jarrettr
6
6
manager: dcscontentpm
@@ -18,24 +18,23 @@ ms.custom: sap:zzzz
18
18
The Microsoft Azure Windows VM Agent is a secure, lightweight process that manages virtual machine (VM) interaction with the Azure fabric controller. The Azure Windows VM Agent has a primary role in enabling and running Azure VM extensions. VM extensions enable post-deployment configuration of VMs, such as installing and configuring software. VM extensions also enable recovery features, such as resetting the administrative password of a VM. Without the Azure Windows VM Agent, you can't run VM extensions.
19
19
20
20
## Purpose
21
-
VM assist (Windows version) is a PowerShell script that's intended to be used to diagnose issues that affect the Azure Windows VM Agent in addition to other issues that are related to the general health of the VM. This diagnosis includes such information about the system as firewall rules, running services, running drivers, installed software, network adapter settings, installed software, and installed Windows Updates.
21
+
VM assist (Windows version) is a PowerShell script to diagnose issues that affect the Azure Windows VM Agent. It also examines other issues that are related to the general health of the VM. This diagnosis includes firewall rules, running services, running drivers, installed software, network adapter settings, installed software, and installed Windows Updates.
22
22
23
23
## Key features
24
24
You can view output from the checks in the PowerShell window that the script is run in. Additionally, running VM assist generates a detailed .htm report that shows the results of each check that it performs. The tool also suggests mitigations for the issues that it finds.
25
25
26
26
## Prerequisites
27
27
* Windows Server 2012 R2 and later versions of Windows
28
28
* Windows 11 or later versions of the client
29
-
* Windows Powershell 4.0+ and PowerShell 6.0+
29
+
* Windows PowerShell 4.0+ and PowerShell 6.0+
30
30
31
31
## How to run the tool
32
32
33
33
You can run the tool in any of the following manners.
34
34
35
35
### Option 1: Download from GitHub and run within the VM
36
36
37
-
Download the scripts from GitHub, and then run them manually. To access the scripts, follow the resource links in the previous sections.
38
-
Please see the GitHub page to see the latest instruction to [install VM assist](https://github.com//azure/azure-support-scripts/blob/master/vmassist/windows/README.md).
37
+
Download the scripts from GitHub, and then run them manually. To access the scripts, follow the resource links in the previous sections. See this GitHub page for the latest instruction to [install VM assist](https://github.com//azure/azure-support-scripts/blob/master/vmassist/windows/README.md).
39
38
40
39
RDP into the VM, open an elevated PowerShell window, and then run the following code to download and run the script:
41
40
@@ -94,11 +93,11 @@ After the script finishes running, it also generates a log file and an html repo
94
93
C:\logs\vmassist_*.htm
95
94
```
96
95
97
-
The `.log` file have a copy of the results that are displayed in the PowerShell window for later reference.
96
+
The `.log` file has a copy of the results that are displayed in the PowerShell window for later reference.
98
97
99
-
The `.htm` file is a report that shows all the checks and findings together with information about how to mitigate the issues it finds. It will also have additional information about the OS and the VM that can further assist you to troubleshoot any issues.
98
+
The `.htm` file is a report that shows all the checks and findings together with information about how to mitigate the issues it finds. It also has additional information about the OS and the VM that can further assist you to troubleshoot.
100
99
101
-
If you open a support request, please include both of these log files to aid your support representative.
100
+
If you open a support request, please include both of these log files to aid the support agent.
102
101
103
102
:::image type="content" source="media/windows-azure-guest-agent-tools-vmassist/windows-azure-guest-agent-tools-vmassist-output.png" alt-text="Azure VM assist output example." lightbox="media/windows-azure-guest-agent-tools-vmassist/windows-azure-guest-agent-tools-vmassist-output.png":::
104
103
@@ -109,25 +108,25 @@ The following table lists the current checks and findings together with any pote
109
108
| Checks | Details |
110
109
|--------|---------|
111
110
| Check for Folder| Verifies that the C:\WindowsAzure folder exists. Also used to help determine whether the Guest Agent is installed.<br><br>If this check doesn't exist, it's likely that the Guest agent has to be installed. |
112
-
| Check for binaries | Verifies that the guest agent .exes (WindowsAzureGuestAgent.exe and WaAppAgent.exe) exist and is also used to help determine that the Guest Agent was installed.<br><br>If this check doesn't exist then its likely that the guest agent has to be installed. |
113
-
| Status of agent services | Verifies that the guest agent services (WindowsAzureGuestAgent and RdAgent) exist and is also used to help determine that the Guest Agent was installed.<br><br>If this check doesn't exist, it's likely that the guest agent has to be installed. If they do exist then ensure they're set to `Running` and ideally their StartType will be set to `Automatic`|
111
+
| Check for binaries | Verifies that the guest agent .exe files (WindowsAzureGuestAgent.exe and WaAppAgent.exe) exist and is also used to help determine that the Guest Agent was installed.<br><br>If this check doesn't exist, it's likely that the guest agent has to be installed. |
112
+
| Status of agent services | Verifies that the guest agent services (WindowsAzureGuestAgent and RdAgent) exist. Also used to help determine whether the guest agent was installed.<br><br>If this check doesn't exist, it's likely that the guest agent has to be installed. If it is installed, make sure that it's set to `Running` and that the StartType is `Automatic`.|
114
113
| Status of `winmgmt` service | Verifies that the winmgmt service is running. |
115
-
| Status of `KeyIso` service | Verifies that the `KeyIso (CNG Key Isolation)` service is running.<br><br> See this [Needs to be Public](windows-azure-guest-agent#remote-procedure-call-rpc-issues---rdcrypt-initialization-failed) for more details. |
114
+
| Status of `KeyIso` service | Verifies that the `KeyIso (CNG Key Isolation)` service is running.<br><br> See [Needs to be Public](windows-azure-guest-agent#remote-procedure-call-rpc-issues---rdcrypt-initialization-failed). |
116
115
| Check if agent services/processes have crashed | This checks whether the Guest Agent services and processes have failed during the past day. If the incident is only a one-time event, it might not be important unless it occurs at the time when the issue is reported. However, if the services constantly fail, the incident must be investigated.<br><br>Start the investigation by looking in the WaAppAgent.log and system and application event logs. |
117
-
| Checks if `stdregprov` is working | The VM agent MSI uses WMI StdRegProv to access the registry. If WMI is not working correctly, the MSI cannot set the RdAgent service path from the registry, and the MSI installation fails. <br><br> See [Guest Agent installation fails because of faulty WMI](windows-azure-guest-agent#guest-agent-installation-fails-because-of-faulty-wmi). |
116
+
| Checks if `stdregprov` is working | The VM agent MSI uses WMI StdRegProv to access the registry. If WMI isn't working correctly, the MSI can't set the RdAgent service path from the registry, and the MSI installation fails. <br><br> See [Guest Agent installation fails because of faulty WMI](windows-azure-guest-agent#guest-agent-installation-fails-because-of-faulty-wmi). |
118
117
| Agent is installed | Returns True if the guest agent is installed. Otherwise, the guest agent has to be installed. |
119
118
| Installed by PA or MSI | This check determines whether the guest agent was installed by the provisioning agent or manually through .MSI. Neither of these options are `wrong`. However, it's included for information. |
120
119
| Supported version | Checks whether the Azure Guest Agent version is up to date and supported. |
121
-
| Proxy | Checks for netsh proxies. This check doesn't look for the existance of *all* types of proxy on the system. For example, it doesn't check whether a `3rd party proxy application` is installed. <br><br>If wireserver connectivity issues exist, you can start troubleshooting by using [Troubleshooting 168.63.129.16](/azure/virtual-network/what-is-ip-address-168-63-129-16#troubleshoot-connectivity). |
120
+
| Proxy | Checks for netsh proxies. This check doesn't look for the existence of *all* types of proxy on the system. For example, it doesn't check whether a `3rd party proxy application` is installed. <br><br>If wireserver connectivity issues exist, you can start troubleshooting by using [Troubleshooting 168.63.129.16](/azure/virtual-network/what-is-ip-address-168-63-129-16#troubleshoot-connectivity). |
122
121
| CRP cert exists and is valid | Checks whether the CRP "Windows Azure CRP Certificate Generator" certificate exists. This certificate secures the communication with the host, and transfers protected settings that are used by extensions.<br><br> See [Troubleshoot extension certificate issues on a Windows VM in Azure](troubleshoot-extension-certificates-issues-windows-vm.md). |
123
122
| WCF debugging | This check might run if Windows Communication Framework (WCF) profiling is enabled. WCF profiling should be enabled only while debugging a WCF issue. It should not be left enabled while running a production workload.<br><br> See [Windows Azure Guest Agent service or the RdAgent service stops responding on startup (WCF)](windows-azure-guest-agent#windows-azure-guest-agent-service-or-the-rdagent-service-stops-responding-on-startup). |
124
123
| Wireserver (168.63.129.16) connectivity on 80, 32526, and REST API | If wireserver connectivity issues exist, you can start troubleshooting by using [Troubleshooting 168.63.129.16](/azure/virtual-network/what-is-ip-address-168-63-129-16#troubleshoot-connectivity). |
125
-
| IMDS connectivity | IMDS connectivity is not required for the guest agent to work, but the guest agent does try to connect. Therefore, you might see error entriess in the logs. Additionally, VM assist itself gets information about the VM from IMDS to populate some sections of the .HTML file.<br><br>Not having connectivity to IMDS doesn't break the Guest Agent. See [Troubleshooting tool for Azure VM Instance Metadata Service issues](windows-vm-imds-tool.md). |
126
-
| Third-party modules in WaAppAgent and WindowsAzureGuestAgent | Other applications occasionally inject their DLLs into the Guest Agent process. Usually, this behavior doesn't cause the guest agent to fail. However, DLLs might cause unexpected failures in the Guest Agent that are difficult to debug. Although it is relatively rare that these cause an issue, if any of these .dlls are from unexpected applications injected, consider remove/reconfigure the application so that it no longer injects its .dlls into the Guest Agnet process(es). |
127
-
| Checks permissions on machineKeys folder | Checks to see that the default permissions are in place on `C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys`. If improper permissions are applied that block access then the Guest Agent itself may be 'Ready', but extensions that use protected settings won't work.<br><br> See this [PInvoke PFXImportCertStore failed and null handle is returned. Error Code: 86](windows-azure-guest-agent#pinvoke-pfximportcertstore-failed-and-null-handle-is-returned-error-code-86) for more details. |
124
+
| IMDS connectivity | IMDS connectivity isn't required for the guest agent to work, but the guest agent does try to connect. Therefore, you might see error entries in the logs. Additionally, VM assist itself gets information about the VM from IMDS to populate some sections of the .HTML file.<br><br>Not having connectivity to IMDS doesn't break the Guest Agent. See [Troubleshooting tool for Azure VM Instance Metadata Service issues](windows-vm-imds-tool.md). |
125
+
| Third-party modules in WaAppAgent and WindowsAzureGuestAgent | Other applications occasionally inject their DLLs into the Guest Agent process. Usually, this behavior doesn't cause the guest agent to fail. However, DLLs might cause unexpected failures in the Guest Agent that are difficult to debug. Although DLLs rarely cause an issue, if any of them are from unexpectedly injected applications, consider removing or reconfiguring the application so that it no longer injects its .dlls into the guest agent processes. |
126
+
| Checks permissions on machineKeys folder | Checks whether the default permissions exist on `C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys`. If improper permissions are that block access are applied, extensions that use protected settings won't work even if the guest agent is in a 'Ready' state.<br><br> See [PInvoke PFXImportCertStore failed and null handle is returned. Error Code: 86](windows-azure-guest-agent#pinvoke-pfximportcertstore-failed-and-null-handle-is-returned-error-code-86). |
128
127
| Checks permissions on `C:\WindowsAzure` and `C:\Packages`| Verifies that the System account has access to these directories. These directories are what the guest agent and extensions use for their binaries, configuration files, and log files. Therefore, it's important that the System account has access. |
129
-
| Sufficient disk space |This check looks for available disk space. If the disk space is completely filled, the guest agent might not be able to write its status file, update, install extensions, and so on. In this situation, you must either delete files or expand the disk capacity. |
130
-
| DHCP IP | If one private IP exists on the VM's network adapter, we highly recommend that you have DHCP enabled on the guest VM. If a static private IP address is needed, [configure it through the Azure portal or PowerShell](/azure/virtual-network/ip-services/virtual-networks-static-private-ip-arm-ps). Make sure that the DHCP option inside the VM is enabled. This makes sure that the IP configuration always matches the VM configuration in Azure.<br><br>If multiple private IPs are assigned to the VM's natwork adapter, make sure that you follow these steps to [statically assign the IPs correctly](/azure/virtual-network/ip-services/virtual-network-multiple-ip-addresses-portal#os-config). After you perform this procedure, if the guest agent can't communicate with 168.63.129.16, check whether the primary IP in Windows [matches the primary IP in the VM's network adapter in Azure](no-internet-access-multi-ip.md). |
128
+
| Sufficient disk space |This check looks for available disk space. If the disk space is filled, the guest agent might not be able to write its status file, update, install extensions, and so on. In this situation, you must either delete files or expand the disk capacity. |
129
+
| DHCP IP | If one private IP exists on the VM's network adapter, we highly recommend that you have DHCP enabled on the guest VM. If a static private IP address is needed, [configure it through the Azure portal or PowerShell](/azure/virtual-network/ip-services/virtual-networks-static-private-ip-arm-ps). Make sure that the DHCP option inside the VM is enabled. This setting makes sure that the IP configuration always matches the VM configuration in Azure.<br><br>If multiple private IPs are assigned to the VM's network adapter, make sure that you follow these steps to [statically assign the IPs correctly](/azure/virtual-network/ip-services/virtual-network-multiple-ip-addresses-portal#os-config). After you perform this procedure, if the guest agent can't communicate with 168.63.129.16, check whether the primary IP in Windows [matches the primary IP in the VM's network adapter in Azure](no-internet-access-multi-ip.md). |
0 commit comments