Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deployment failure #27773

Closed
andersgidlund opened this issue Mar 22, 2019 — with docs.microsoft.com · 45 comments
Closed

Deployment failure #27773

andersgidlund opened this issue Mar 22, 2019 — with docs.microsoft.com · 45 comments
Assignees
@shashishailaj @Heidilohr
Labels
assigned-to-author product-question triaged virtual-desktop/svc

Comments

@andersgidlund docs.microsoft.com
Copy link

Got this error when I tried to provision a host pool. Followed the guide exactly...

{
"code": "DeploymentFailed",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details.",
"details": [
{
"code": "Conflict",
"message": "{\r\n "status": "Failed",\r\n "error": {\r\n "code": "ResourceDeploymentFailure",\r\n "message": "The resource operation completed with terminal provisioning state 'Failed'.",\r\n "details": [\r\n {\r\n "code": "VMExtensionProvisioningError",\r\n "message": "VM has reported a failure when processing extension 'dscextension'. Error message: \"DSC Configuration 'FirstSessionHost' completed with error(s). Following are the first few: PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: One or more errors occurred. The SendConfigurationApply function did not succeed.\"."\r\n }\r\n ]\r\n }\r\n}"
}
]
}

Dokumentinformation

⚠ Redigera inte det här avsnittet. Det krävs för docs.microsoft.com ➟ länkning till GitHub-problem.
@chunsiongtan docs.microsoft.com
Copy link
Contributor

@Diwiton, I'm getting the same error. I was thinking if it was caused by lack of "administrative access" on the created host pool, or Set-TargetResource is casuing a conflict

@chunsiongtan docs.microsoft.com
Copy link
Contributor

@Diwiton, I've added "domain computers" to my AD Account. It works now when i tried it for the 2nd time.

Not sure it this was the fix, or it was just an intermittent error the 1st time around.

@chunsiongtan docs.microsoft.com
Copy link
Contributor

@Diwiton, I've also added Windows Virtual Desktop tenant name as xxxxxxxxx.onmicrosoft.com for the 2nd time attempt.

@andersgidlund docs.microsoft.com
Copy link
Author

@chunsiongtan, I do not follow exactly. I cant see how I can add ".onmicrosoft.com" to my WVD Tenant Name. My WVD Tenant name is "Diwitest Virtual Desktop".

Im also using Azure AD Domain Services in my test setup and Im not sure how to assign the "Domain Computers" group to my admin account.

@chunsiongtan docs.microsoft.com
Copy link
Contributor

My bad, I meant something like this.
Existing tenant group name: "Default tenant group"
Existing Tenant Name: xxxxxx.onmicrosoft.com <--- this is based on my Azure Active Directory Name.

Let me try to run the template again without the "domain computers" group

@chunsiongtan docs.microsoft.com
Copy link
Contributor

By the way @Diwiton, I'm using AD DS on VM.
I've checked the requirement,
The Azure virtual machines you create for Windows Virtual Desktop must be:
Standard domain-joined or Hybrid AD-joined. Virtual machines can't be Azure AD-joined. <--- that might be the issue

https://docs.microsoft.com/en-us/azure/virtual-desktop/overview#requirements

@andersgidlund docs.microsoft.com
Copy link
Author

No I do not mean Azure AD joined. The session hosts VM's will be joined to Azure AD Domain Services, Microsofts hosted ADDS.

Of course ADDS on VM is an option, but I like the concept of Azure ADDS because you do not need to worry about updates and backup and do not need to install Azure AD Connect, its built in to the service.

It would be stupid (in my opinion) for Microsoft not to support WVD on Azure ADDS machines.

@andersgidlund docs.microsoft.com
Copy link
Author

I read the link you supplied with the requirements now and it says:

"A Windows Server Active Directory in sync with Azure Active Directory. This can be enabled through:
Azure AD Connect
Azure AD Domain Services"

Azure AD Domain Services is what I run so it seems thats not the problem at least. However, in my directory I can not add user accounts (or any members at all) to the Domain Computers group.

@shashishailaj shashishailaj self-assigned this Mar 22, 2019
@shashishailaj
Copy link
Member

@Diwiton Thank you for your query . We will investigate and update further.

@tiktb8 docs.microsoft.com
Copy link

tiktb8 commented Mar 22, 2019

I received this error yesterday and after investigating the dsc package I uncovered that I had not correctly following the pre-reqs of creating the tenant with powershell and also granting the proper role on the app registration.

@andersgidlund docs.microsoft.com
Copy link
Author

Ok, tenant is created with PowerShell and the role TenantCreator is assignee to the service principal per the dokumentation.

Dora the user adding the CM’s to the domain need to have the TenantCreator role as well?

@tiktb8 docs.microsoft.com
Copy link

tiktb8 commented Mar 22, 2019

The user I used for domain join in my deployment did NOT have the TenantCreator role.

@rbergertd docs.microsoft.com
Copy link

When WVD was first released the documentation did not have the link to create the tenant, this caused a lot of confusion and led to that DSC failure on deployment. Follow the below links:

https://docs.microsoft.com/en-us/powershell/windows-virtual-desktop/overview - install WVD PS Module
https://docs.microsoft.com/en-us/azure/virtual-desktop/tenant-setup-azure-active-directory - create the WVD tenant

Then you can move on to deploying the WVD marketplace offer.

@rbergertd docs.microsoft.com
Copy link

I guess I spoke too soon. Even after adding the tenant, following the guide step by step, I am still getting the same DSC failure. It's joining my Active Directory domain, but still failing on the DSC with the same error.

https://i.imgur.com/K8TGL4K.png

@NeoTech124 docs.microsoft.com
Copy link

Same issue here also. Been trying since yesterday. Not sure what else to try

@rbergertd docs.microsoft.com
Copy link

So, I just had a successful deployment after ensuring that my AD Connect was synchronizing to Azure AD. Usually in my demo tenant I don't use AD Connect or have it on, but I think for this deployment to succeed - you have to have AD Connect set up and running, to sync the AD DS users to Azure AD. Once doing this, and specifying the UPN of the synchronized AD DS Users (user@verifiedo365domain.com) during the deployment (Page 1 of WVD Deployment) this worked. I think since it is assigning the users you specify on page 1 to the tenant, that something is requiring that sync to be active in order to work. I'll continue to see if I can make further progress...

@NeoTech124 docs.microsoft.com
Copy link

That could be my issue, maybe. I'm all Azure ADDS; no on-premises AD.

@LeonJansen
Copy link

I also had the same problem with AADDS, it kept failing on the DSCextension. Now i booted a VM with ADDS and now i got WVD to work. So it seems that AADDS is not working (yet)

@rbergertd docs.microsoft.com
Copy link

Leon,

I've got to the point where I can see my Session Desktop in the WVD client, but when I click on it I get an error, 'invalid connection file'. After the deployment, did you do anything else before you were able to connect? It authenticated my UPN user/password, and pulled down the webfeed and the session desktop - but I can't launch it.

https://i.imgur.com/7fZTamq.png

@LeonJansen
Copy link

@rbergertd I'm also now struggling to get the RDP connection to work. My WVD is now deployed without errors, but when i publish an RemoteApp (Calc.exe for example) i get an error message: Can't connect to the Remote Desktop Gateway Server.

@rbergertd docs.microsoft.com
Copy link

@LeonJansen just out of curiosity, could you try the automatically created SessionDesktop and see if it lets you in that way? Sorry, I am just hoping I'm not alone at this point! :)

@LeonJansen
Copy link

@rbergertd Nope, that also doesn't work. So we are at the same level right now ;-) I will try some stuff to get it to work. I'll send you a message when i found something.

@rbergertd docs.microsoft.com
Copy link

@LeonJansen I think we may be at a stand still until Microsoft fixes things on the broker/gateway side. That's the point we're at with accessing the resource. If you navigate to the directory where the RDP file is launching from (my previous screen shot) you can 'edit' the .RDP file and look, it's going thru their Gateway at this point. If you try and double click the .RDP file from there, you'll get further errors. It's not even trying to connect before it errors out. I think at this point, this will be something Microsoft looks into. Let me know if you make any progress, I am going to call it a day. :)

https://i.imgur.com/vQo85x0.png
https://i.imgur.com/w3tPNc8.png

@tiktb8 docs.microsoft.com
Copy link

tiktb8 commented Mar 23, 2019

What is the status of your session host when queried with Get-RdsSessionHost

@rbergertd
Copy link

rbergertd commented Mar 23, 2019 via email

@rbergertd
Copy link

rbergertd commented Mar 24, 2019 via email

@shashishailaj
Copy link
Member

@Heidilohr Could you please review this issue ?

@andersgidlund docs.microsoft.com
Copy link
Author

This is now resolved for us. The service principal I created myself was the problem. When I followed the instructions on this page it went better:
https://docs.microsoft.com/en-us/azure/virtual-desktop/create-service-principal-role-powershell

This instruction should be included or linked to in the tutorial section "Windows Virtual Desktop Preview tenant information" under point 3 here:
https://docs.microsoft.com/en-us/azure/virtual-desktop/create-host-pools-azure-marketplace#windows-virtual-desktop-preview-tenant-information

@BjornBorjesson docs.microsoft.com
Copy link

@Diwiton ! Thx had the same scenario and issue. And agree the documentation was not in a logic order.

Did create a service principal when realizing an MFA enabled account would not work as the "WVD RDS Tenant Owner" BUT did that without setting it with the AvailableToOtherTenants=True
Changed that flag to true and all was good for me.

The information about creating service principals and role assignment came in too late , since then I already hade created the SP and didn´t noticed the parameter they did it with.

@mattchandleruk docs.microsoft.com
Copy link

Having issues with the DSC failure. Copied the instructions on setting up the tenant in sections 1 and 4 but still having issues. Also seeing this when attempting to create the Host Pool via Powershell: New-RdsHostPool : User is not authorized to query the management service.

I am using a test Pay as you go subscription. Can anyone help point me in the right direction as to why I cannot create the Host Pool?

@Joepvtilburg docs.microsoft.com
Copy link

Also experiencing this error:

"id": "/subscriptions/01c0266d-fa91-4918-a9a5-b2a028fc8522/resourceGroups/Test_WVD/providers/Microsoft.Resources/deployments/rds.wvd-provision-host-pool-20190402141619/operations/08586473995036309862",
"operationId": "08586473995036309862",
"properties": {
  "provisioningOperation": "EvaluateDeploymentOutput",
  "provisioningState": "Failed",

Any ideas/solutions available? The registrations etc were all donw following the tutorial, the tenant group name is identical during initial setup aswell.

@Mr-Famous
Copy link
Contributor

Try to verify that you enter the correct Application ID and Tenant Admin PW.
If you want to verify those run the following commands in PowerShell:

By running the command you will get the Password:
$svcPrincipalCreds.Value

By running the command you will get the Tenant ID:
$aadContext.TenantId.Guid

By running the command you will get the Application ID:
$svcPrincipal.AppId

@erjenrijnders
Copy link

I succesfully deployed a WVD, created a blogpost about it:
https://erjenrijnders.nl/2019/04/04/how-to-deploy-windows-virtual-desktop-in-azure/
Please let me know if that works for you, otherwise let me know where you struggle.

@Joepvtilburg
Copy link

Joepvtilburg commented Apr 5, 2019 via email

@erjenrijnders
Copy link

Does your user have Owner access on the Azure Subscription?

@stavrosmitchell docs.microsoft.com
Copy link

Hey has anyone got it to work with AADDS. I seem to have the problem with AADDS, it kept failing on the DSCextension

I have folllowed the microsoft and https://erjenrijnders.nl/2019/04/04/how-to-deploy-windows-virtual-desktop-in-azure/ guide step by step and am thinking the problem is AADDS

thanks

@andersgidlund
Copy link
Author

@stavrosmitchell yes, we used AADDS (Azure AD Domain Services) and got it to work.
Have you done as I wrote in my answer?

#27773 (comment)

@fbcarvalho docs.microsoft.com
Copy link

I still getting the error:

VM has reported a failure when processing extension 'dscextension'. Error message: "DSC Configuration 'FirstSessionHost' completed with error(s). Following are the first few: PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: User is not authorized to query the management service.\nActivityId: df42f7e3-73d9-47ec-be4a-408019d2d62f\nPowershell commands to diagnose the failure:\nGet-RdsDiagnosticActivities -ActivityId df42f7e3-73d9-47ec-be4a-408019d2d62f\n The SendConfigurationApply function did not succeed."."

  • my user has owner access on the Azure Subscription.
  • i had created the service principals
  • all the follow commands worked:
    By running the command you will get the Password:
    $svcPrincipalCreds.Value

By running the command you will get the Tenant ID:
$aadContext.TenantId.Guid

By running the command you will get the Application ID:
$svcPrincipal.AppId

Can you help me, please?

@stgeorgi
Copy link
Contributor

@fbcarvalho Hi whatever user you are using does not have RDS Owner or RDS Contributor permissions on the WVD tenant and is not able to complete the creation of the WVD host pool

Error in IsAuthorizedAsync(Resources/Tenant/≤RPA_Tenant≥///Read) Exception=Microsoft.RDInfra.Authorization.Common.UserNotFoundException: WVD_50002: not found.
at Microsoft.RDInfra.RDBroker.Authorization.RDmiUserIdentity.IsAuthorizedImplAsync(Provider provider, Operation operation, AuthorizationRoleScope scope, CancellationToken cancellationToken)

@fbcarvalho docs.microsoft.com
Copy link

How can I assing RDS Owner or RDS Contributor permissions to the user?

@stgeorgi
Copy link
Contributor

Its in the documentation New-RdsRoleAssignment -TenantName $tenant -UserPrincipalName $userName -RoleDefinitionName "RDS Contributor"

@ricardo-maestas
Copy link

ricardo-maestas commented May 5, 2019 •
edited

Can anyone recommend further troubleshooting steps to those still experiencing a 'dscextension’ error, even after switching from a user UPN to a service principal? I still receive the same error message as the OP:

VM has reported a failure when processing extension ‘dscextension’. Error message: DSC Configuration ‘FirstSessionHost’ completed with error(s). Following are the first few: PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: One or more errors occurred. The SendConfigurationApply function did not succeed.

I've tried deploying the host pool through the Azure web UI, via powershell script, and have even read through some of the scripts saved onto the WVD Host VM under C:\WindowsAzure and C:\Packages folder, nothing jumps out at me to explain why the deployment continually fails on this step.

I am deploying a single host, I run a single DC with AAD Connect as an Azure VM, and that is essentially it for my test environment.

Edit: Resolved by creating Hostpool manually using Powershell:

https://docs.microsoft.com/en-us/azure/virtual-desktop/create-host-pools-powershell

@ChristianMontoya
Copy link
Contributor

@r-maestas : Glad your issue got resolved. We'll continue to monitor feedback to understand how to have the automated deployment mechanisms (Azure Marketplace and GitHub ARM template) can have more consistency. We also edited the order of these docs, so that should help. https://docs.microsoft.com/en-us/azure/virtual-desktop/tenant-setup-azure-active-directory

@ChristianMontoya
Copy link
Contributor

#please-close

@shashishailaj shashishailaj self-assigned this May 9, 2019
@shashishailaj
Copy link
Member

Closing as per author comments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@shashishailaj shashishailaj

@Heidilohr Heidilohr

Labels
assigned-to-author product-question triaged virtual-desktop/svc
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests