Merge pull request #263313 from rpsqrd/esu-troubleshooting-style

Updated ESU URLs to reflect HTTP protocol

Author: v-regandowner

articles/azure-arc/servers/includes/esu-network-requirements.md

@@ -17,7 +17,7 @@ If you are using Azure Arc-enabled servers only for the purpose of Extended Secu
 |`management.azure.com`|Azure Resource Manager - to create or delete the Arc server resource|When connecting or disconnecting a server, only| Public, unless a [resource management private link](../../../azure-resource-manager/management/create-private-link-access-portal.md) is also configured |
 |`*.his.arc.azure.com`|Metadata and hybrid identity services|Always| Private |
 |`*.guestconfiguration.azure.com`| Extension management and guest configuration services |Always| Private |
-|`microsoft.com/pkiops/certs`| Certificate download for ESUs | ESUs enabled by Azure Arc | Public |
+|`www.microsoft.com/pkiops/certs`| Intermediate certificate updates for ESUs (note: uses HTTP/TCP 80 and HTTPS/TCP 443) | ESUs enabled by Azure Arc | Public |
 |`san-af-<region>-prod.azurewebsites.net`| Azure Arc data processing service| SQL Server ESUs | Public|
 
 #### [Azure Government](#tab/azure-government)
@@ -30,7 +30,7 @@ If you are using Azure Arc-enabled servers only for the purpose of Extended Secu
 |`management.usgovcloudapi.net`|Azure Resource Manager - to create or delete the Arc server resource|When connecting or disconnecting a server, only| Public, unless a [resource management private link](../../../azure-resource-manager/management/create-private-link-access-portal.md) is also configured |
 |`*.his.arc.azure.us`|Metadata and hybrid identity services|Always| Private |
 |`*.guestconfiguration.azure.us`| Extension management and guest configuration services |Always| Private |
-|`microsoft.com/pkiops/certs`| Certificate download for ESUs | ESUs enabled by Azure Arc | Public |
+|`www.microsoft.com/pkiops/certs`| Intermediate certificate updates for ESUs (note: uses HTTP/TCP 80 and HTTPS/TCP 443) | ESUs enabled by Azure Arc | Public |
 
 #### [Microsoft Azure operated by 21Vianet](#tab/azure-china)
 

articles/azure-arc/servers/includes/network-requirements.md

@@ -40,7 +40,7 @@ The table below lists the URLs that must be available in order to install and us
 
 > [!NOTE]
 > When configuring the Azure connected machine agent to communicate with Azure through a private link, some endpoints must still be accessed through the internet. The **Endpoint used with private link** column in the following table shows which endpoints can be configured with a private endpoint. If the column shows *Public* for an endpoint, you must still allow access to that endpoint through your organization's firewall and/or proxy server for the agent to function.
-> 
+
 | Agent resource | Description | When required| Endpoint used with private link |
 |---------|---------|--------|---------|
 |`aka.ms`|Used to resolve the download script during installation|At installation time, only| Public |
@@ -60,7 +60,7 @@ The table below lists the URLs that must be available in order to install and us
 |`dc.services.visualstudio.com`|Agent telemetry|Optional, not used in agent versions 1.24+| Public |
 | `san-af-<region>-prod.azurewebsites.net` | Azure Arc data processing service | For SQL Server enabled by Azure Arc. The Azure Extension for SQL Server uploads inventory and billing information to the data processing service. | Public |
 | `telemetry.<region>.arcdataservices.com` | For Arc SQL Server. Sends service telemetry and performance monitoring to Azure | Always | Public |
-|`microsoft.com/pkiops/certs`| Certificate download for ESUs |ESUs enabled by Azure Arc | Public |
+|`www.microsoft.com/pkiops/certs`| Intermediate certificate updates for ESUs (note: uses HTTP/TCP 80 and HTTPS/TCP 443) | ESUs enabled by Azure Arc | Public |
 
 > [!NOTE]
 > To translate the `*.servicebus.windows.net` wildcard into specific endpoints, use the command `\GET https://guestnotificationservice.azure.com/urls/allowlist?api-version=2020-01-01&location=<region>`. Within this command, the region must be specified for the `<region>` placeholder.
@@ -71,7 +71,7 @@ The table below lists the URLs that must be available in order to install and us
 
 > [!NOTE]
 > When configuring the Azure connected machine agent to communicate with Azure through a private link, some endpoints must still be accessed through the internet. The **Endpoint used with private link** column in the following table shows which endpoints can be configured with a private endpoint. If the column shows *Public* for an endpoint, you must still allow access to that endpoint through your organization's firewall and/or proxy server for the agent to function.
-> 
+
 | Agent resource | Description | When required| Endpoint used with private link |
 |---------|---------|--------|---------|
 |`aka.ms`|Used to resolve the download script during installation|At installation time, only| Public |
@@ -84,7 +84,7 @@ The table below lists the URLs that must be available in order to install and us
 |`*.guestconfiguration.azure.us`| Extension management and guest configuration services |Always| Private |
 |`*.blob.core.usgovcloudapi.net`|Download source for Azure Arc-enabled servers extensions|Always, except when using private endpoints| Not used when private link is configured |
 |`dc.applicationinsights.us`|Agent telemetry|Optional, not used in agent versions 1.24+| Public |
-|`microsoft.com/pkiops/certs`| Certificate download for ESUs |ESUs enabled by Azure Arc | Public |
+|`www.microsoft.com/pkiops/certs`| Intermediate certificate updates for ESUs (note: uses HTTP/TCP 80 and HTTPS/TCP 443) | ESUs enabled by Azure Arc | Public |
 
 #### [Microsoft Azure operated by 21Vianet](#tab/azure-china)
 

articles/azure-arc/servers/run-command.md

@@ -40,11 +40,11 @@ Run Command on Azure Arc-enabled servers supports the following operations:
 
 ## Example scenarios
 
-Suppose you have an Azure Arc-enabled server called “2012DatacenterServer1” in resource group “ContosoRG” with Subscription ID “aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa”. Consider a scenario where you need to provide remote access to an endpoint for Windows Server 2012 / R2 servers. Access to Extended Security Updates enabled by Azure Arc requires access to the endpoint `microsoft.com/pkiops/certs`. You need to remotely configure a firewall rule that allows access to this endpoint. Use Run Command in order to allow connectivity to this endpoint.
+Suppose you have an Azure Arc-enabled server called “2012DatacenterServer1” in resource group “ContosoRG” with Subscription ID “aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa”. Consider a scenario where you need to provide remote access to an endpoint for Windows Server 2012 / R2 servers. Access to Extended Security Updates enabled by Azure Arc requires access to the endpoint `www.microsoft.com/pkiops/certs`. You need to remotely configure a firewall rule that allows access to this endpoint. Use Run Command in order to allow connectivity to this endpoint.
 
 ### Example 1: Endpoint access with Run Command
 
-Start off by creating a Run Command script to provide endpoint access to the `microsoft.com/pkiops/certs` endpoint on your target Arc-enabled server using the PUT operation.
+Start off by creating a Run Command script to provide endpoint access to the `www.microsoft.com/pkiops/certs` endpoint on your target Arc-enabled server using the PUT operation.
 
 To directly provide the script in line, use the following operation:
 
@@ -60,11 +60,11 @@ PUT https://management.azure.com/subscriptions/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaa
     "parameters": [
       {
         "name": "ruleName",
-        "value": " Allow access to microsoft.com/pkiops/certs"
+        "value": " Allow access to www.microsoft.com/pkiops/certs"
       },
       {
         "name": "endpoint",
-        "value": ""microsoft.com/pkiops/certs"
+        "value": "www.microsoft.com/pkiops/certs"
       },
       {
         "name": "port",
@@ -100,11 +100,11 @@ PUT https://management.azure.com/subscriptions/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaa
     "parameters": [
       {
         "name": "ruleName",
-        "value": " Allow access to microsoft.com/pkiops/certs"
+        "value": " Allow access to www.microsoft.com/pkiops/certs"
       },
       {
         "name": "endpoint",
-        "value": ""microsoft.com/pkiops/certs"
+        "value": "www.microsoft.com/pkiops/certs"
       },
       {
         "name": "port",

articles/azure-arc/servers/troubleshoot-extended-security-updates.md

@@ -57,36 +57,44 @@ If you're unable to enable this service offering, review the resource providers
 
 Ensure that both the licensing package and servicing stack update (SSU) are downloaded for the Azure Arc-enabled server as documented at [KB5031043: Procedure to continue receiving security updates after extended support has ended on October 10, 2023](https://support.microsoft.com/topic/kb5031043-procedure-to-continue-receiving-security-updates-after-extended-support-has-ended-on-october-10-2023-c1a20132-e34c-402d-96ca-1e785ed51d45). Ensure you are following all of the networking prerequisites as recorded at [Prepare to deliver Extended Security Updates for Windows Server 2012](prepare-extended-security-updates.md?tabs=azure-cloud#networking).
 
-
-### Error: Trying to check IMDS again (HRESULT 12002)
+### Error: Trying to check IMDS again (HRESULT 12002 or 12029)
 
 If installing the Extended Security Update enabled by Azure Arc fails with errors such as "ESU: Trying to Check IMDS Again LastError=HRESULT_FROM_WIN32(12029)" or "ESU: Trying to Check IMDS Again LastError=HRESULT_FROM_WIN32(12002)", you may need to update the intermediate certificate authorities trusted by your computer using one of the following two methods:
 
-1. Configure your network firewall and/or proxy server to allow access from the Windows Server 2012 (R2) machines to `https://microsoft.com/pkiops/certs`. This will allow the machine to automatically retrieve updated intermediate certificates as required and is Microsoft's preferred approach.
-1. Download all intermediate CAs from a machine with internet access, copy them to each Windows Server 2012 (R2) machine, and import them to the machine's intermediate certificate authority store:
-    1. Download the 4 intermediate CA certificates:
-        1. [Microsoft Azure TLS Issuing CA 01](https://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%20Issuing%20CA%2001%20-%20xsign.crt)
-        1. [Microsoft Azure TLS Issuing CA 02](https://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%20Issuing%20CA%2002%20-%20xsign.crt)
-        1. [Microsoft Azure TLS Issuing CA 05](https://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%20Issuing%20CA%2005%20-%20xsign.crt)
-        1. [Microsoft Azure TLS Issuing CA 06](https://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%20Issuing%20CA%2006%20-%20xsign.crt)
-    1. Copy the certificate files to your Windows Server 2012 (R2) machine.
-    1. Run the following commands in an elevated command prompt or PowerShell session to add the certificates to the "Intermediate Certificate Authorities" store for the local computer. The command should be run from the same directory as the certificate files. The commands are idempotent and won't make any changes if you've already imported the certificate:
-
-        ```powershell
-        certstore -addstore CA "Microsoft Azure TLS Issuing CA 01 - xsign.crt"
-        certstore -addstore CA "Microsoft Azure TLS Issuing CA 02 - xsign.crt"
-        certstore -addstore CA "Microsoft Azure TLS Issuing CA 05 - xsign.crt"
-        certstore -addstore CA "Microsoft Azure TLS Issuing CA 06 - xsign.crt"
-        ```
-
-After allowing the servers to reach the PKI URL or manually importing the intermediate certificates, try installing the Extended Security Updates again using Windows Update or your preferred patch management software. You may need to reboot your computer for the changes to take effect.
+#### Option 1: Allow access to the PKI URL
+
+Configure your network firewall and/or proxy server to allow access from the Windows Server 2012 (R2) machines to `http://www.microsoft.com/pkiops/certs` and `https://www.microsoft.com/pkiops/certs` (both TCP 80 and 443). This will enable the machines to automatically retrieve any missing intermediate CA certificates from Microsoft.
+
+Once the network changes are made to allow access to the PKI URL, try installing the Windows updates again. You may need to reboot your computer for the automatic installation of certificates and validation of the license to take effect.
+
+#### Option 2: Manually download and install the intermediate CA certificates
+
+If you're unable to allow access to the PKI URL from your servers, you can manually download and install the certificates on each machine.
+
+1. On any computer with internet access, download these intermediate CA certificates:
+    1. [Microsoft Azure TLS Issuing CA 01](https://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%20Issuing%20CA%2001%20-%20xsign.crt)
+    1. [Microsoft Azure TLS Issuing CA 02](https://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%20Issuing%20CA%2002%20-%20xsign.crt)
+    1. [Microsoft Azure TLS Issuing CA 05](https://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%20Issuing%20CA%2005%20-%20xsign.crt)
+    1. [Microsoft Azure TLS Issuing CA 06](https://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%20Issuing%20CA%2006%20-%20xsign.crt)
+1. Copy the certificate files to your Windows Server 2012 (R2) machines.
+1. Run the following commands in an elevated command prompt or PowerShell session to add the certificates to the "Intermediate Certificate Authorities" store for the local computer. The command should be run from the same directory as the certificate files. The commands are idempotent and won't make any changes if you've already imported the certificate:
+
+    ```powershell
+    certstore -addstore CA "Microsoft Azure TLS Issuing CA 01 - xsign.crt"
+    certstore -addstore CA "Microsoft Azure TLS Issuing CA 02 - xsign.crt"
+    certstore -addstore CA "Microsoft Azure TLS Issuing CA 05 - xsign.crt"
+    certstore -addstore CA "Microsoft Azure TLS Issuing CA 06 - xsign.crt"
+    ```
+
+1. Try installing the Windows updates again. You may need to reboot your computer for the validation logic to recognize the newly imported intermediate CA certificates.
 
 ### Error: Not eligible (HRESULT 1633)
 
 If you encounter the error "ESU: not eligible HRESULT_FROM_WIN32(1633)", follow these steps:
 
-`Remove-Item “$env:ProgramData\AzureConnectedMachineAgent\Certs\license.json” -Force`
-
-`Restart-Service himds`
+```powershell
+Remove-Item "$env:ProgramData\AzureConnectedMachineAgent\Certs\license.json" -Force
+Restart-Service himds
+```
 
 If you have other issues receiving ESUs after successfully enrolling the server through Arc-enabled servers, or you need additional information related to issues affecting ESU deployment, see [Troubleshoot issues in ESU](/troubleshoot/windows-client/windows-7-eos-faq/troubleshoot-extended-security-updates-issues).