Adding on-prem VM to Azure Arc using OnboadingScript.ps1 fails with "Error storing certificate"

John Joyner 41 Reputation points
2020-07-09T04:26:25.573+00:00

We have one on-prem Windows Server 2012 R2 computer successfully onboarded to Azure Arc using the OnboadingScript.ps1 downloaded from Azure Portal. Running the script on the second computer also Windows Server 2012 R2 fails with this error:

time="2020-07-08T20:31:09-07:00" level=error msg="Request error: Error storing certificate, Details: The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation." Error="Error response from agent"

C:\Windows\System32\>azcmagent show
Resource Name :
Resource Group Name :
Subscription ID :
Tenant ID :
VM ID :
Location :
Agent Version : 0.9.20164.002
Agent Logfile : C:\ProgramData\AzureConnectedMachineAgent\Log\himds.log

Agent Status : Disconnected
Agent Last Heartbeat :
Agent Error Code : Error in storing in certificate store
Agent Error Details : The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.
Agent Error Timestamp : 08 Jul 20 20:31 MST

Looking for tips to troubleshoot this. Unable to run azcmagent reconnect due to this error:

C:\Windows\System32\>azcmagent reconnect --tenant-id 56xxxx6e-xxxx-xxxx-xxxx-9066xxxxab2d
time="2020-07-08T21:08:46-07:00" level=fatal msg="Invalid Resource Name. Resource Name can only contain alphanumeric characters, - , _ or . Resource Name cannot contain more than 54 characters." Resource Name=

Thank you.

Azure Arc
Azure Arc
A Microsoft cloud service that enables deployment of Azure services across hybrid and multicloud environments.
437 questions
0 comments No comments
{count} votes

Accepted answer
  1. Manu Philip 18,676 Reputation points MVP
    2020-07-09T04:49:45.933+00:00

    Hi,
    Please set the following value in registry editor and try again

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb

    ProtectionPolicy = 1 (DWORD)

    Ref: https://support.microsoft.com/en-ca/help/3000850/november-2014-update-rollup-for-windows-rt-8-1-windows-8-1-and-windows

    Please mark as "Accept the answer" if the above steps helps you. Others with similar issues can also follow the solution as per your suggestion

    Regards,

    Manu


0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.