Troubleshoot Windows Server 2012 Arc-enabled servers not receiving updates
Tags: azure, windows
Published: 2024-01-16 15:08:41

 ![Troubleshoot Windows Server 2012 Arc-enabled servers not receiving updates](https://www.techielass.com/content/images/2024/01/Troubleshoot-Windows-Server-2012-Arc-enabled-servers-not-receiving-updates.png)

If your Windows Server 2012 servers that are [Arc-enabled](https://www.techielass.com/tags/azure-arc) to receive their Extended Security Updates (ESU) aren’t receiving the updates there are some steps you can take to try and troubleshoot that issue. 

This blog post will explore the steps needed to troubleshoot the issue. 

## Step 1 - Check the Azure Portal

The first step is to check the Azure portal to understand if the server has been assigned an ESU licence. 

Head to [<u>https://portal.azure.com</u>](https://portal.azure.com/?ref=techielass.com)

Launch the Azure Arc blade.

Click on **Machines** down the left-hand side.

![Troubleshoot Windows Server 2012 Arc-enabled servers not receiving updates](https://lh7-us.googleusercontent.com/xAOBNw9NF59XdP9Z_qrLg87llRWwv5u_l6zfVchnIs2Bq6-yem0coX0-iXNeR7r_s40t5edl4UQQ66JlH5e7Cf2xXceRCv3V21xno82R1ysBJpS8NqN3x9JkkaJ0niMt_T3xjGqmLb8btIw9FA6zXZ8)
_Azure Arc blade in the Azure portal_

Find the server that isn’t receiving updates.

Click on the server name. 

When the server information loads, check under capabilities to ensure ESU is **Enabled**. 

![Troubleshoot Windows Server 2012 Arc-enabled servers not receiving updates](https://lh7-us.googleusercontent.com/M_946o1BhQrKhocwreyu7iOBLVy_7Uyaa7tmIlL91yNA4b9DrSa9_qaXRyH-avUMnCAI6V-bUnqttmOqm8hEmNgvaVsYERg5Y9OHyDuduYzAQTbLj1ds6lS_tWO5_HsRzWq-NnuVDA2doR2SvVR7GYY)
_Azure Arc machine status_

If the server states that the ESU capability is **Not Enabled** , assign the correct ESU license to the server to enable it to receive updates. 

![Troubleshoot Windows Server 2012 Arc-enabled servers not receiving updates](https://lh7-us.googleusercontent.com/UB200Yzt6VwvsG6x2r-ecDxzgnZsWhyNYv5OwaXsfppkhxN-yVAS84--9LrnhAfMQ5K-VXka60HKYgaIYxzy8QrCxFGl-mQjS4SQaWL3DTagRnxLMdz9tOej1NAKUtqlIjiR6o58uOL2rAk5ObVCJFM)
_Azure Arc machine status_

If the server states that the ESU capability is **Enabled, move** on to the next troubleshooting step. 

## Step 2 - Check the Azure Arc version installed

The troubleshooting step to check is what version of the Azure Arc agent is installed. 

The ESU capability was enabled on [<u>version 1.34</u>](https://learn.microsoft.com/azure/azure-arc/servers/agent-release-notes?ref=techielass.com#version-134---september-2023) of the Azure Arc agent. That version or above needs to be installed on the server. 

To check the version of the Arc agent log onto the affected server. 

Launch a PowerShell command terminal and type in the following command:

```
azcmagent version

```

![Troubleshoot Windows Server 2012 Arc-enabled servers not receiving updates](https://lh7-us.googleusercontent.com/pIqHy0jVszF5WNMINtk6cIqEXquHaYnXRO-4dlyssX5B_h765BrhjvaN3lvBdYRxedBhGsmfvzarQ9ODk7c_AlA5uK7R14YdyB7ePeOZ61A4FuFLZ8AJgPmCmXVWAXfPR-dGbOTPIMYbb3Izxvs8f94)
_Check Azure Arc version_

If the agent is below version 1.34, [<u>follow the upgrade processes</u>](https://www.techielass.com/updating-the-azure-arc-agent-connected-machine-agent/) to bring the agent to a higher level. 

If the agent is level 1.34 or above move on to step 3. 

## Step 3 - Check the status of the Azure Arc agent

The next step is to ensure the Azure Arc agent is connected and working correctly as expected. 

Launch a PowerShell command terminal and type in the following command:

```
azcmagent show

```

You are looking for two key pieces of information.  The first one is the **Agent status** and **Agent Last Heartbeat.**   They should state Connected and list a time or date close to your current time and date. 

The second piece of information you are looking for is the **Extended Security Updates Status**.  That should read as active. 

![Troubleshoot Windows Server 2012 Arc-enabled servers not receiving updates](https://lh7-us.googleusercontent.com/jI6okcAuZGfIEE0y-1vc7KgCKESIXMbEhepfFW1semcJXVUDpItrAoz-641R39S_3S3YNHQ-ACAOkekZJIjx972XVEfGFoCKNrFrrHDyqiXNDocGQXFxOmZWyy15gsQPiTRYH3hZEBUxJIcSBnNbqYI)
_Azure Arc agent status_

If these areas report as connected and active, then move to troubleshooting step 4.  If the areas reported something else, please go through the Azure Arc agent pre-requisite requirements to ensure the correct networking and firewall rules etc are in place as required.  Also, check if the appropriate ESU license is assigned and active. 

## Step 4 - Check the registry

On the server, we want to confirm the registry setting is configured as it should.  To do this click on the **Windows icon** , then search for **regedit.**

Check registry key: 

**[HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Azure Connected Machine Agent\ArcESU] "Enabled”**

![Troubleshoot Windows Server 2012 Arc-enabled servers not receiving updates](https://lh7-us.googleusercontent.com/jVvsgKStJ-vGa5tmKATty9w-ywhXiGnzPyPw9z_LGmpBUCvm9LYe0NMKkNghGF7ASWPGWRZSDC70L3dTtVG2zbms6MdT6IOQG1_xDrpftldkUdJMF4YBNOhvb-6ObzZ1ujKI7dvBdZGdX0xMCz4C8tA)
_Azure Arc registry settings_

A value of 1 means that the machine can receive the latest Extended Security Update patches.

0 means the server is not enabled for Arc-based ESUs and won’t receive ESUs via that route.

## Step 5 - Check patches

The server needs to be up to date with several patches installed, these are patches from previous updates, so if you’ve been keeping your servers up to these should already be there.  However, it’s worth checking to ensure they have been installed. 

- For _Windows Server 2012 R2_, you must have the servicing stack update (SSU) ([<u>KB5029368</u>](https://support.microsoft.com/help/5029368?ref=techielass.com)) that is dated August 8, 2023 or a later SSU installed. Also ensure the Extended Security Updates (ESU) Licensing Preparation Package dated August 10, 2022 ([<u>KB5017220</u>](https://support.microsoft.com/help/5017220?ref=techielass.com)) is installed. 
- For _Windows Server 2012_, you must have the servicing stack update (SSU) ([<u>KB5029369</u>](https://support.microsoft.com/help/5029369?ref=techielass.com)) that is dated August 8, 2023 or a later SSU installed. Also ensure the Extended Security Updates (ESU) Licensing Preparation Package dated August 10, 2022 ([<u>KB5017221</u>](https://support.microsoft.com/help/5017221?ref=techielass.com)) is installed. 

## The issue is still there

If you’ve checked through all of these steps and you still have an issue my next suggestions would be: 

- Investigate your method of applying updates, for example, is the connection between this server and the WSUS server working correctly? 
- Uninstall and unregistering the server within Azure Arc and starting again from scratch might be a good idea, in case there is some kind of configuration that is blocking the updates from being applied. 
- Log a support ticket with Azure support to offer advice. 

## Conclusion

By following these comprehensive troubleshooting steps, you can proactively address any challenges in the ESU update process, thereby enhancing the security posture of your Windows Server 2012 environments. Regularly monitoring and maintaining the ESU updates will contribute to a robust and resilient infrastructure, safeguarding your systems against potential vulnerabilities.