Windows Server 2022 Datacenter Azure Edition VM deactivated in MS Azure due to lack of "Azure Stack Hypervisor"

Question

Multiple Windows Server 2022 Datacenter Azure Edition VMs started to give the following pop-up

We are a bit puzzled as all the servers having this issue are in located in MS Azure (East-US).
We checked the connectivity to KMS and we are able to resolve the KMS. We can reactivate the servers successfully but after next restart the popup reappears and all servers are deactivated again.
What could cause the deactivation and how can we fix this issue?

Answer 1

PS C:\Users\xxxxxxx> $Proxy=New-object System.Net.WebProxy

$WebSession=new-object Microsoft.PowerShell.Commands.WebRequestSession

$WebSession.Proxy=$Proxy

$attestedDoc = Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri http://169.254.169.254/metadata/attested/document?api-version=2020-09-01 -WebSession $WebSession

 $signature = [System.Convert]::FromBase64String($attestedDoc.signature)

 $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]($signature)

$chain = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Chain

$chain.Build($cert)

True

We are getting true but eventhough getting pop up windows here windows activation licensing showing an 180 day's but pop up windows and in setting also say windows not yet activated even though try to IMBS cer to download appropriate CN name to upload as you mention path we though getting same

Answer 2

as you mention we tried even though getting same error how to stop this

Answer 3

How to solved this ?

Answer 4

Azure Instance Metadata Service-Attested data TLS: Critical changes are here! https://techcommunity.microsoft.com/t5/azure-governance-and-management/azure-instance-metadata-service-attested-data-tls-critical/ba-p/2888953

Apply this update if missing: April 9, 2024 Security update (KB5036909) https://support.microsoft.com/en-us/topic/april-9-2024-security-update-kb5036909-0e07bb7f-e3bc-417f-b20a-bbbfc7fd353b

If missing, add these certificate domains to your firewall allow list:

Certificate downloads and revocation lists https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-ca-details?tabs=root-and-subordinate-cas-list#certificate-downloads-and-revocation-lists