地端VM升級至Windows Server 2022後，MDE.Windows Extension部署失敗

Azure Arc系例文章：

1. 如何在Azure Arc加入多台地端VM伺服器
2. 如何為地端伺服器安裝Azure Monitor Agent
3. 如何在Azure Arc加入地端MS SQL Server伺服器
4. 如何將地端Kubernets叢集加入Azure Arc，以Kind為例
5. 如何將地端Kubernets叢集加入Azure Arc，以MicroK8s叢集為例
6. 如何將地端Kubernets叢集加入Azure Arc，以Kubeadm建立的Kubernetes叢集為例
7. 將Azure ExpressRoute with Microsoft Peering環境下的Windows VM加入Azure Arc管理清單
8. 將Azure ExpressRoute with Microsoft Peering下Linux VM加入Azure Arc管理清單
9. 解決ExpressRoute下agentserviceapi.guestconfiguration.azure.com無法連線造成azcmagent連線失敗
10. 取消Azure Arc自動安裝SQL Extension Agent的行為
11. 地端VM升級至Windows Server 2022後，MDE.Windows Extension部署失敗

我們將地端 VM 進行作業系統（OS）升級，由 Windows Server 2016 升級至 Windows Server 2022，升級之後發現，Azure Arc 裡的 MDE.Windows Extensions 有點不太正常。

備註，MDE.Windows Extension 只支援 Windows Server 2019 之後的作業系統。例如，Windows Server 2016 那麼是不會被安裝此 Extension。

在嘗試了幾次 MDE.Windows 移除與重新安裝後都一樣是失敗的情況。更甚至把整個地端 Windows Server 從 Machines - Azure Arc 清單移除，連 VM 都重新加入也是一樣。

Extension Message: Failed to configure Microsoft Defender for Endpoint: Error during prepare defenderForEndpointOnboardingScript Onboarding blob signature is not valid, executionlog: [2024-08-23 01:18:45Z][Information] Signature verification result: True
[2024-08-23 01:18:45Z][Information] base chain cetificate is valid
[2024-08-23 01:19:00Z][Information] Certificate C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Secure Server CA 2011 is valid: False
[2024-08-23 01:19:00Z][Information] Certificate C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011 is valid: True
[2024-08-23 01:19:00Z][Information] Chain valid: False
[2024-08-23 01:19:00Z][Information] Certificate chain verification result: False
[2024-08-23 01:19:00Z][Error] Onboarding blob signature is not valid
[2024-08-23 01:19:00Z][Error] Error during prepare defenderForEndpointOnboardingScript Onboarding blob signature is not valid
[2024-08-23 01:19:00Z][Error] Failed to configure Microsoft Defender for Endpoint: Error during prepare defenderForEndpointOnboardingScript Onboarding blob signature is not valid
[2024-08-23 01:19:00Z][Information] Set handler status (C:\Packages\Plugins\Microsoft.Azure.AzureDefenderForServers.MDE.Windows\1.0.10.3\status\0.status), Status=error, Code=888, Message='Failed to configure Microsoft Defender for Endpoint: Error during prepare defenderForEndpointOnboardingScript Onboarding blob signature is not valid'

Extension Error:

C:\Packages\Plugins\Microsoft.Azure.AzureDefenderForServers.MDE.Windows\1.0.10.3>Powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass C:\Packages\Plugins\Microsoft.Azure.AzureDefenderForServers.MDE.Windows\1.0.10.3\\MdeExtensionHandlerWrapper.ps1 -Action enable
VERBOSE: [2024-08-23 01:18:40Z][Information] Start executing handler action: enable
VERBOSE: [2024-08-23 01:18:40Z][Information] Set handler status
(C:\Packages\Plugins\Microsoft.Azure.AzureDefenderForServers.MDE.Windows\1.0.10.3\status\0.status),
Status=transitioning, Code=1, Message='Configuration In Progress'
VERBOSE: [2024-08-23 01:18:40Z][Information] Invoking MdeExtensionHandler.ps1 in background process in order to
install/configuration/onboard MDE
VERBOSE: [2024-08-23 01:18:41Z][Information] End executing handler action: enable with exit code: 0
C:\Packages\Plugins\Microsoft.Azure.AzureDefenderForServers.MDE.Windows\1.0.10.3>Powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass C:\Packages\Plugins\Microsoft.Azure.AzureDefenderForServers.MDE.Windows\1.0.10.3\\MdeExtensionHandlerWrapper.ps1 -Action install
VERBOSE: [2024-08-23 01:18:37Z][Information] Start executing handler action: install
VERBOSE: [2024-08-23 01:18:37Z][Information] MDE installation/configuration/onboarding occurs / will occur in 'enable'
VERBOSE: [2024-08-23 01:18:37Z][Information] End executing handler action: install with exit code: 0

從 Azure 提供的錯誤訊息來看，問題比較可能是這裡。

[2024-08-23 01:19:00Z][Information] Certificate C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Secure Server CA 2011 is valid: False
[2024-08-23 01:19:00Z][Information] Certificate C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011 is valid: True

因為我從本機查詢 azcmagent extension 的狀態，可以看到 MDE.Windows 是 State: ENABLED

PS C:\> azcmagent extension list

INFO    Stopping and disabling service: Extension Service
Extension: MDE.Windows
Version: 1.0.10.3
Extension Path: C:\Packages\Plugins\Microsoft.Azure.AzureDefenderForServers.MDE.Windows
State: ENABLED

Extension: AzureMonitorWindowsAgent
Version: 1.29.0.0
Extension Path: C:\Packages\Plugins\Microsoft.Azure.Monitor.AzureMonitorWindowsAgent
State: ENABLED

INFO    Enabling and starting service: Extension Service

由於 MDE.Windows 是 Azure Arc 自動化安裝與設定，我並沒有任何處理的能力，最後只好開 Azure Support 請求支援。經過 Azure Support 提供情境與產品組確認，是 MDE.Windows extension 本身的問題。

等 Update available 有新版出現，重跑一次移除等重新安裝的流程，系統升級造成的問題就解決了。