Share via

Guest assignment error :- Resource instance with id 'AzureWindowsBaseline' is not found in DSC document.

Amit Raghav 20 Reputation points
2026-05-06T13:29:23.13+00:00

All of sudden, guest assignments are failing in GCCH tenants. gc_agent.log file seems to suggest something is missing in downloaded package. Is this temporary microsoft issue? Is there a fix for it?

[2026-05-05 03:54:35.211] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Tagged Features :

[2026-05-05 03:54:35.211] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'AuditSecureProtocol'.

[2026-05-05 03:54:35.211] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'AzureWindowsBaseline'.

[2026-05-05 03:54:35.212] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Managed identity not provided, defaulting to sas uri token

[2026-05-05 03:54:35.212] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Download assignment package for : AzureWindowsBaseline from public blob

[2026-05-05 03:54:35.212] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Downloading package to C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline.zip location from https://oaasguestconfigusgts1.blob.core.usgovcloudapi.net/builtinconfig/AzureWindowsBaseline/AzureWindowsBaseline_1.53.0.0.zip uri.

[2026-05-05 03:54:35.214] [PID 6916] [TID 9036] [GC_UTILITIES_LOGGER] [INFO] [00000000-0000-0000-0000-000000000000] Config file not found at path: C:\ProgramData\AzureConnectedMachineAgent\Config\localconfig.json

[2026-05-05 03:54:35.214] [PID 6916] [TID 9036] [GC_UTILITIES_LOGGER] [INFO] [00000000-0000-0000-0000-000000000000] 'https_proxy' env variable not set or empty.

[2026-05-05 03:54:35.214] [PID 6916] [TID 9036] [PULL_CLIENT_CERT_HELPER] [INFO] [00000000-0000-0000-0000-000000000000] Proxy settings are disabled. Proxy settings 'https_proxy' environment variable is empty.

[2026-05-05 03:54:40.073] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Package downloaded to C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline.zip location C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline .

[2026-05-05 03:54:40.073] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Unzipping package C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline.zip to C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline location.

[2026-05-05 03:54:43.104] [PID 6916] [TID 9036] [PACKAGE_VALIDATOR] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Validating package: 'C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline'

[2026-05-05 03:54:43.133] [PID 6916] [TID 9036] [PACKAGE_VALIDATOR] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] The file: 'C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline\AzureWindowsBaseline.cat' is signed and the signature was verified.

[2026-05-05 03:54:43.135] [PID 6916] [TID 9036] [PACKAGE_VALIDATOR] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Validating catalog: 'C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline\AzureWindowsBaseline.cat'

[2026-05-05 03:54:44.179] [PID 6916] [TID 9036] [PACKAGE_VALIDATOR] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Catalog: 'C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline\AzureWindowsBaseline.cat' is valid

[2026-05-05 03:54:44.179] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Assignment validated.

[2026-05-05 03:54:44.180] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Package contains custom meta config file. Updating meta configuration with data from file C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline\AzureWindowsBaseline.metaconfig.json.

[2026-05-05 03:54:44.180] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Assignment 'AzureWindowsBaseline' is of category 'Policy'

[2026-05-05 03:54:44.181] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Executing pre-install PowerShell script.

[2026-05-05 03:54:54.881] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Raw pre-install JSON output: VERBOSE: Pre-install started with: {}

{"IsOverrideAllowed":false}

[2026-05-05 03:54:54.882] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Captured structured pre-install output.

[2026-05-05 03:54:56.065] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Initializing pull client.

[2026-05-05 03:54:56.095] [PID 6916] [TID 9036] [METADATA_INFO] [INFO] [00000000-0000-0000-0000-000000000000] Getting msi info from Fairfax region for vm located in 'USGovArizona' location.

[2026-05-05 03:54:56.095] [PID 6916] [TID 9036] [METADATA_INFO] [INFO] [00000000-0000-0000-0000-000000000000] Connecting to MSI endpoint: http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.core.usgovcloudapi.net%2F

[2026-05-05 03:54:56.107] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] [GAS IPs: Public IPv4: 20.140.151.75]

[2026-05-05 03:54:56.107] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] [GAS IPs: Public IPv4: 20.140.151.75] Sending report for 'AzureWindowsBaseline' to 'https://usgovtexas-gas.guestconfiguration.azure.us/virtualMachines/dfafb388-2835-4824-8bcd-e36e18ce54e3/assignments/AzureWindowsBaseline/reports?api-version=2020-11-08'

[2026-05-05 03:54:56.109] [PID 6916] [TID 9036] [GC_UTILITIES_LOGGER] [INFO] [00000000-0000-0000-0000-000000000000] Config file not found at path: C:\ProgramData\AzureConnectedMachineAgent\Config\localconfig.json

[2026-05-05 03:54:56.109] [PID 6916] [TID 9036] [GC_UTILITIES_LOGGER] [INFO] [00000000-0000-0000-0000-000000000000] 'https_proxy' env variable not set or empty.

[2026-05-05 03:54:56.109] [PID 6916] [TID 9036] [PULL_CLIENT_CERT_HELPER] [INFO] [00000000-0000-0000-0000-000000000000] Proxy settings are disabled. Proxy settings 'https_proxy' environment variable is empty.

[2026-05-05 03:54:56.529] [PID 6916] [TID 9036] [Pull Client] [ERROR] [8dbae8d5-371b-4770-b513-88d4f518cda6] [C:__w\1\s\src\dsc\gc_pullclient\dsc_pull_client.cpp:381] Resource instance with id 'AzureWindowsBaseline' is not found in DSC document.

[2026-05-05 03:54:56.529] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'PasswordMustMeetComplexityRequirements'.

[2026-05-05 03:54:56.529] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'MinimumPasswordLength@pid5tmekyzwudgyk'.

[2026-05-05 03:54:56.530] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'AdministratorsGroupMembersToExclude'.

[2026-05-05 03:54:56.530] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'AdministratorsGroupMembersToInclude'.

[2026-05-05 03:54:56.530] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'WindowsDefenderExploitGuard'.

[2026-05-05 03:54:56.531] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'StorePasswordsUsingReversibleEncryption'.

[2026-05-05 03:54:56.531] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'EnforcePasswordHistory@pidvvpa5a72nh2o6'.

[2026-05-05 03:54:56.531] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'AzureBaseline_SecurityOptionsNetworkSecurity'.

[2026-05-05 03:54:56.531] [PID 6916] [TID 9036] [Timer Manager] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Recieved 9 assignment(s).

[2026-05-05 03:54:56.532] [PID 6916] [TID 9036] [Timer Manager] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Publishing assignment(s).

[2026-05-05 03:54:56.532] [PID 6916] [TID 9036] [Assignment Manager] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Publishing 9 assignments

Thanks

/Amitguestassignment

Azure Policy
Azure Policy

An Azure service that is used to implement corporate governance and standards at scale for Azure resources.

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Suchitra Suregaunkar 14,435 Reputation points Microsoft External Staff Moderator
    2026-05-06T17:43:26.17+00:00

    Hello Amit Raghav,

    Thank you for sharing the detailed gc_agent.log .

    Your logs show that the Guest Configuration agent on the GCCH VM (Admin-VM-1, region USGovArizona) is successfully completing every step for the AzureWindowsBaseline assignment — downloading version 1.53.0.0 from the GCCH blob storage, extracting, verifying the package signature and catalog, and executing the pre-install script but then fails at the final processing step with:

    [Pull Client] [ERROR] Resource instance with id 'AzureWindowsBaseline' is not found in DSC document.

    Importantly, your other 8 built-in assignments (AuditSecureProtocol, PasswordMustMeetComplexityRequirements, WindowsDefenderExploitGuard, etc.) continue to process without errors. This confirms the issue is isolated to the AzureWindowsBaseline package content itself.

    The AzureWindowsBaseline is a built-in guest configuration package that is fully authored, published, and maintained by Microsoft. As documented on the Azure Policy built-in packages page, baseline packages (including AzureWindowsBaseline) are written in C++ rather than PowerShell DSC, and their content is hosted on Microsoft-managed blob storage, customers do not have control over the package contents or the ability to modify them.

    Since the package is downloading and validating correctly (signature and catalog both pass), but the internal DSC document does not contain the expected resource instance, this indicates an issue with the package version currently published to the GCCH blob storage by Microsoft. This is not something that can be resolved from the customer side.

    Recommended next steps:

    1. Open a Microsoft support request - I will request few details via private message, please share it with us.
    2. Check Azure Service Health: In the Azure Government portal, navigate to Service Health to check for any active advisories related to Azure Policy or Machine Configuration in the USGov regions.

    (Optional) Verify on the VM — You can inspect the downloaded package at C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline\ and check the contents of the .mof file to confirm whether it contains a resource instance matching the expected ID AzureWindowsBaseline.

    Thanks,

    Suchitra.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Vinodh247-1375 43,101 Reputation points Volunteer Moderator
    2026-05-06T15:37:15.8666667+00:00

    Hi ,

    Thanks for reaching out to Microsoft Q&A.

    This is very likely a temp issue and a Microsoft-side issue in GCCH. The built-in AzureWindowsBaseline package (v1.53.0.0) has a DSC mismatch - the expected resource is missing inside the package.

    Action: Wait for Microsoft fix or temporarily disable this baseline. Not a VM or config problem.

    The logs clearly show:

    • Package download succeeds
    • Signature validation succeeds
    • Extraction succeeds
    • Failure happens during DSC execution phase

    The key error is:

    Resource instance with id 'AzureWindowsBaseline' is not found in DSC document

    What this actually means?

    The assignment name and DSC configuration inside the package are out of sync.

    In simple terms:

    • The Guest Configuration agent expects a DSC resource named AzureWindowsBaseline
    • The downloaded package does not contain that resource definition
    • That is why it fails at runtime, not during validationour logs clearly show:
      • Package download succeeds
      • Signature validation succeeds
      • Extraction succeeds
      • Failure happens during DSC execution phase
      The key error is:

      Resource instance with id 'AzureWindowsBaseline' is not found in DSC document

     

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.