I am trying to create a mainteanance configuration, But it is failing at the following parameters in the command. Please suggest I have done debug, following is the error Command I have used: $me=New-AzMaintenanceConfiguration -ResourceGroupName Ue2LuStgResourceGroup -Name workervms -MaintenanceScope InGuestPatch -Location EastUS2 -StartDateTime "2023-11-14 12:00" -ExpirationDateTime "2023-12-04 17:00" -Timezone "Eastern Standard Time" -Duration 03:00 -RecurEvery Day -ExtensionProperty $ht -InstallPatchRebootSetting "IfRequired" -Visibility Custom -Debug Below is the error what exactly and where to add in guest patch mode or platform, and can amend and share, thanks Error: Headers: Cache-Control : no-cache Pragma : no-cache x-ms-request-id : d963f309-a8b1-4900-a1a2-6431b53b7c21 x-ms-ratelimit-remaining-subscription-writes: 1199 x-ms-correlation-request-id : d963f309-a8b1-4900-a1a2-6431b53b7c21 x-ms-routing-request-id : EASTUS:20231114T041916Z:d963f309-a8b1-4900-a1a2-6431b53b7c21 Strict-Transport-Security : max-age=31536000; includeSubDomains X-Content-Type-Options : nosniff Date : Tue, 14 Nov 2023 04:19:16 GMT Body: { "Message": "Extension properties must contain Patch mode. e.g. InGuestPatchMode = 'User' or InGuestPatchMode = 'Platform',Windows/Linux patch configuration is missing" } DEBUG: 4:19:16 AM - [ConfigManager] Got nothing from [DisableErrorRecordsPersistence], Module = [], Cmdlet = []. Returning default value [False]. DEBUG: 4:19:16 AM - [ConfigManager] Got [True] from [EnableDataCollection], Module = [], Cmdlet = []. New-AzMaintenanceConfiguration: Operation returned an invalid status code 'BadRequest' DEBUG: 4:19:16 AM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True]. DEBUG: 4:19:16 AM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True]. DEBUG: 4:19:16 AM - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [False]. DEBUG: AzureQoSEvent: Module: Az.Maintenance:1.3.1; CommandName: New-AzMaintenanceConfiguration; PSVersion: 7.3.8; IsSuccess: False; Duration: 00:00:04.5203904; Exception: Operation returned an invalid status code 'BadRequest'; DEBUG: 4:19:16 AM - NewAzureRmMaintenanceConfiguration end processing.cn

sns Kindly execute the below command before executing the above query. The variable can take input values either User or Platform. Update based on your requirement. $ht = @{inGuestPatchMode="User"}

Parameters are missing in the Maintenance configuration creation command

Accepted answer

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-14T04:31:42.5866667+00:00

sns Kindly execute the below command before executing the above query. The variable can take input values either User or Platform. Update based on your requirement.

$ht = @{inGuestPatchMode="User"}
Please sign in to rate this answer.
sns 9,236 Reputation points

2023-11-14T06:31:39.65+00:00

Hi Swathi,

I have executed above command and executed subsequent command. this time seems to be issue with INGuestPatchMode.

which I should declare in my case?

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-14T07:16:58.3633333+00:00

Shyam - Kindly execute the commands as shown in below order. Also make to include Linux Classifications within your command.

sns 9,236 Reputation points

2023-11-14T07:35:18.47+00:00

Hi Swathi,

You can see below I executed in order only. but not sure whats wrong with guestuser

PS /home/diptesh> $ht = @{inGuestPatchMode="shyamkumarcheekoti@gmail.com"} PS /home/diptesh> New-AzMaintenanceConfiguration -ResourceGroupName Ue2LuStgResourceGroup -Name workervms -MaintenanceScope InGuestPatch -Location EastUS2 -StartDateTime "2023-11-14 02:40" -ExpirationDateTime "2023-12-04 18:40" -Timezone "Eastern Standard Time" -Duration 03:00 -RecurEvery Day -ExtensionProperty $ht -LinuxParameterClassificationToInclude Security,Critical -InstallPatchRebootSetting "IfRequired" -Visibility Custom New-AzMaintenanceConfiguration: Operation returned an invalid status code 'BadRequest' PS /home/diptesh> New-AzMaintenanceConfiguration -ResourceGroupName Ue2LuStgResourceGroup -Name workervms -MaintenanceScope InGuestPatch -Location EastUS2 -StartDateTime "2023-11-14 02:40" -ExpirationDateTime "2023-12-04 18:40" -Timezone "Eastern Standard Time" -Duration 03:00 -RecurEvery Day -ExtensionProperty $ht -LinuxParameterClassificationToInclude Security,Critical -InstallPatchRebootSetting "IfRequired" -Visibility Custom -Debug DEBUG: 7:34:11 AM - NewAzureRmMaintenanceConfiguration begin processing with ParameterSet 'DefaultParameter'. DEBUG: 7:34:11 AM - using account id 'MSI@50342'... DEBUG: 7:34:11 AM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True]. Confirm Are you sure you want to perform this action? Performing the operation "New" on target "workervms". [Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): Y DEBUG: [Common.Authentication]: Authenticating using Account: 'MSI@50342', environment: 'AzureCloud', tenant: '8e0b6750-ef80-4f5b-98b3-fa2b9f690006' DEBUG: 7:34:13 AM - [ManagedServiceIdentityAuthenticator] Calling ManagedIdentityCredential.GetTokenAsync - TenantId:'8e0b6750-ef80-4f5b-98b3-fa2b9f690006', Scopes:'https://management.core.windows.net/', UserId:'' DEBUG: ManagedIdentityCredential.GetToken invoked. Scopes: [ https://management.core.windows.net/ ] ParentRequestId: DEBUG: Request [e9f2b76c-b349-46c1-9703-853cc4b80052] POST http://localhost:50342/oauth2/token Content-Type:application/x-www-form-urlencoded Metadata:REDACTED x-ms-client-request-id:e9f2b76c-b349-46c1-9703-853cc4b80052 x-ms-return-client-request-id:true User-Agent:azsdk-net-Identity/1.6.1 (.NET 7.0.13; Linux 5.10.102.2-microsoft-standard #1 SMP Mon Mar 7 17:36:34 UTC 2022) client assembly: Azure.Identity DEBUG: Response [e9f2b76c-b349-46c1-9703-853cc4b80052] 200 OK (00.0s) X-Powered-By:REDACTED ETag:W/"8bd-DMPwR+znh9JJ4yJwUtVqUH7bc5o" Date:Tue, 14 Nov 2023 07:34:14 GMT Connection:keep-alive Keep-Alive:REDACTED Content-Type:application/json; charset=utf-8 Content-Length:2237 DEBUG: ManagedIdentityCredential.GetToken succeeded. Scopes: [ https://management.core.windows.net/ ] ParentRequestId: ExpiresOn: 2023-11-14T08:00:16.0000000+00:00 DEBUG: [Common.Authentication]: Received token with LoginType 'User', Tenant: '8e0b6750-ef80-4f5b-98b3-fa2b9f690006', UserId: 'MSI@50342' DEBUG: ============================ HTTP REQUEST ============================ HTTP Method: PUT Absolute Uri: https://management.azure.com/subscriptions/93048f2d-2d0f-44cc-b12c-4df25a3c5ff5/resourcegroups/Ue2LuStgResourceGroup/providers/Microsoft.Maintenance/maintenanceConfigurations/workervms?api-version=2023-04-01 Headers: Accept-Language : en-US x-ms-client-request-id : 0d9b6490-3060-4641-bc5b-756c552253c8 Body: { "location": "EastUS2", "properties": { "extensionProperties": { "inGuestPatchMode": "shyamkumarcheekoti@gmail.com" }, "maintenanceScope": "InGuestPatch", "maintenanceWindow": { "startDateTime": "2023-11-14 02:40", "expirationDateTime": "2023-12-04 18:40", "duration": "03:00", "timeZone": "Eastern Standard Time", "recurEvery": "Day" }, "visibility": "Custom", "installPatches": { "rebootSetting": "IfRequired", "linuxParameters": { "classificationsToInclude": [ "Security", "Critical" ] } } } } DEBUG: ============================ HTTP RESPONSE ============================ Status Code: BadRequest Headers: Cache-Control : no-cache Pragma : no-cache x-ms-request-id : 2ccdde0b-8803-48f2-b15d-5098470379be x-ms-ratelimit-remaining-subscription-writes: 1198 x-ms-correlation-request-id : 2ccdde0b-8803-48f2-b15d-5098470379be x-ms-routing-request-id : EASTUS:20231114T073414Z:2ccdde0b-8803-48f2-b15d-5098470379be Strict-Transport-Security : max-age=31536000; includeSubDomains X-Content-Type-Options : nosniff Date : Tue, 14 Nov 2023 07:34:13 GMT Body: { "Message": "Extension properties must contain Patch mode. e.g. InGuestPatchMode = 'User' or InGuestPatchMode = 'Platform'" } DEBUG: 7:34:14 AM - [ConfigManager] Got nothing from [DisableErrorRecordsPersistence], Module = [], Cmdlet = []. Returning default value [False]. DEBUG: 7:34:14 AM - [ConfigManager] Got [True] from [EnableDataCollection], Module = [], Cmdlet = []. New-AzMaintenanceConfiguration: Operation returned an invalid status code 'BadRequest' DEBUG: 7:34:14 AM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True]. DEBUG: 7:34:14 AM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True]. DEBUG: 7:34:14 AM - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [False]. DEBUG: AzureQoSEvent: Module: Az.Maintenance:1.3.1; CommandName: New-AzMaintenanceConfiguration; PSVersion: 7.3.8; IsSuccess: False; Duration: 00:00:03.1090643; Exception: Operation returned an invalid status code 'BadRequest'; DEBUG: 7:34:14 AM - NewAzureRmMaintenanceConfiguration end processing.

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-14T07:44:39.3866667+00:00

Shyam - Below highlighted command should be either of these @{InGuestPatchMode="User"} or @{InGuestPatchMode="Platform"}. The values should be either User or Platform not your email id.

sns 9,236 Reputation points

2023-11-14T08:24:11.2866667+00:00

Hi Swathi.

It worked.

but 2 questions

HOw do I make sure machines triggred correctly as per timings

I believe above command takes care of updates every day as per timing, as you suggested to make it happen as per MS updates every month Tuesday what I should provide in command to make it happen month Tuesday

is there any filter to check updates status for those machines for last 1 or 3 hrs?

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-15T06:46:07.68+00:00

sns Here is an example on the schedule within maintenance confirguration and how it works.

Below is the schedule I have set for the Maintenance configuration named "Test"

Based on above schedule, my updates start around 8:00 PM IST every Wednesday and takes about 3 hours duration to apply the updates.

Below image shows the history of this maintenance configuration for the past 30 days where it is recurring every Wednesday. As I haven't specified at which the schedule ends on, it will trigger every Wednesday as long as no one updates the ends on date.

Let me know if you have any further questions.

sns 9,236 Reputation points

2023-11-15T10:02:40.9866667+00:00

Hi Swathi,

I am not seeing anything in history at the respective timings. although I have seen schedule details were set correctly

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-15T10:41:21.25+00:00

You are looking in History(Preview) under Manager Azure Stack HCI Tab . Kindly check the History under Manage tab.

sns 9,236 Reputation points

2023-11-15T10:44:48.12+00:00

Hi Swathi,

I am not seeing any info there as well.

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-15T10:48:46.5766667+00:00

sns Can you please share the screenshot from History tab under Manager tab ?

sns 9,236 Reputation points

2023-11-15T10:50:36.93+00:00

Please find above.

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-15T11:06:25.73+00:00

Shyam - You are still looking at wrong location. Kindly click on the highlighted section as shown in below image.

sns 9,236 Reputation points

2023-11-15T11:16:23.3766667+00:00

Hi Swathi,

I have set for linux machines with dynamic scope with respective resource group as below

but in the history it is showing only 1 machine from above list as below

I know i Have set yesterday at 3.30 AM EST but why it is showing only 1 machine and 8 am instead of scheduled time?

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-15T11:30:12.6166667+00:00

Shyam - For checking the runs related to maintenance configuration, you need to check the "By maintenance run ID" tab which is next to By machines.

Within By machines tab, the record shown is about the periodic assessment done on that specific machine. Periodic assessment is an update setting on a machine that allows you to enable automatic periodic checking of updates by Update Manager. We recommend that you enable this property on your machines as it allows Update Manager to fetch latest updates for your machines every 24 hours and enables you to view the latest compliance status of your machines.For more information, you can refer this document.

sns 9,236 Reputation points

2023-11-15T11:36:39.53+00:00

HI Swathi,

Yes just now i tested at 5 pm IST. I could see that by maintenace id as below

but why it is not showing message "no pending updates" in the below highlighted area as it is done as per above screenshot

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-15T12:09:23.5066667+00:00

Shyam - As there were no pending updates to install, the maintenance configuration just executed without deploying any updates. Below highlighted section shows the number of updates installed which are none same as the next screenshot you shared.

sns 9,236 Reputation points

2023-11-16T03:47:49.1866667+00:00

Hi Swathi,

Got it.

Please suggest on my following 2 follow up questions:

When I select dynamic scope there is option to choose filter subscription, resource group and windows OS etc. but my question is in resource group we have suppose around 10 machines, in that 10 machines I don't want to have 2 machines ( clusters) NOT to be scheduled, is there any way we can exclude those VMs( cluster) as part of schedule maintenance?

and other one is for production subscription, we want machines to have part of maintenance plan but not scheduled automatically. is that possible if yes how?

And we created the maintenance configuration but not dynamic scope what would happen to VMs?

sns 9,236 Reputation points

2023-11-17T03:18:18.62+00:00

HI Swathi,

Did you get a chance to look into my previous comment?

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-20T09:52:59.96+00:00

Shyam -

You can add tags to the machines. Based on the tags that you can filter the machines.

It's not possible to create maintenance configuration without schedule. However, you can try to give unachievable schedule where the schedule never executes. For example, in below schedule, it starts on Monday and ends on Tuesday but repeats on every Wednesday which will not happen. Kindly note that I haven't tested this scenario. Do test it out.

If there are no machines added to maintenance configuration, the schedule just runs without doing anything.

sns 9,236 Reputation points

2023-11-20T09:53:04.83+00:00

HI Swathi

Did you get a chance to look my previous comment?

sns 9,236 Reputation points

2023-11-20T10:14:30.6666667+00:00

Hi Swathi,

Since I dont find option yesterday I have created the dynamic scropt for linux machines only as I Have cluster which I dont want part of scduled for windows machines

so I have dynamic scope now with linux

so now i have noticed the respective resource have got tags and windows machine in that resource group has below tag

now I will delete yesterday dynamic scope for linux machines

and then I will will with tag as per your suggestion..

so I need to modify only below command which is new assignment right? and yes do I need to add

New-AzConfigurationAssignment -ConfigurationAssignmentName $mc.Name -MaintenanceConfigurationId $mc.Id -FilterLocation eastus2 -FilterOsType Linux -FilterOperator "Any"

1.

where exactly I need to add tag in the above command?

2.

and whatever I have plan to exclude cluster machines these machines also have similar tag. so now do I need to create special tag for those exclude machines?

in the second point you have suggested does it have dynamic scope?

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-20T10:46:55.0433333+00:00

Shyam -

You can reference this thread for example on how to filter based on tags.

Find the tag which is common across the machines that you want to include, make sure that tag is not available in excluded machines. If all the tags are same across the machines, then yes, you need to create new tag.

It doesn't have to be part dynamic scope.

sns 9,236 Reputation points

2023-11-20T10:55:33.38+00:00

Hi Swathi,

is below one correct way approach in assigning the tags?

SwathiDhanwada-MSFT 18,756 Reputation points

2023-11-21T07:01:49.08+00:00

Shyam - Here is sample example for reference.

New-AzConfigurationAssignment -ResourceGroupName RG -Location westus2 -MaintenanceConfigurationId $a.Id -FilterOsType Linux -ProviderName Microsoft.Compute -ResourceType virtualMachines -ConfigurationAssignmentName workervms -FilterTag '{"Environment" : ["Production"], "Department" : ["IT", "Finance"]}' -ResourceName VM

sns 9,236 Reputation points

2023-11-21T07:21:45.39+00:00

Hi Swathi,

I will have to check it out.

If I get issue again I will raise new ticket, thank you.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.