Unable to deploy security extension agents via Azure Arc

Question

Unable to deploy security extension agents via Azure Arc

Michael Johnson 20

I am trying to deploy security extension agents via Azure Arc onto on-premises Windows Servers but I am getting the following issue:

"Exit code 1603 (Install Failure)" On checking System32\config\systemprofile it shows permission restrictions applied by default CIS benchmarks...

My agent installation is running, but service contexts need adjustment for seamless Arc extension orchestration. In my deployment logs it shows extensions fail to install on all servers...But default CIS benchmarks are applied across the system..

So can you help me to resolve this.

0 comments

1 answer

Your answer

Answer 1

hi @Michael Johnson exit code 1603 is a generic Windows Installer error, so the underlying cause usually needs to be identified from the extension and agent logs.

Since you mentioned that CIS benchmarks have applied additional permission restrictions, I'd first verify whether those policies are preventing the Azure Arc extension service from accessing the required directories or running under the expected service context.

As a starting point, I recommend:

Verify that the Azure Connected Machine agent is healthy by running azcmagent show.
Check the extension service logs under C:\ProgramData\GuestConfig\ext_mgr_logs and the extension logs in C:\ProgramData\GuestConfig for the specific failure.
Retry the extension installation after reviewing the logs.
Review whether the applied CIS hardening policies restrict the service account or required file system permissions used by Azure Arc extensions.

Microsoft also provides a troubleshooting guide for Azure Arc VM extensions that covers common installation failures and the relevant log locations:

https://learn.microsoft.com/azure/azure-arc/servers/troubleshoot-vm-extensions

If you can share the relevant log entries from gc_ext.log or the extension installation log around the 1603 error, it will be easier to determine whether this is a permission issue caused by the CIS baseline or another installation prerequisite.