Guest assignment error :- Resource instance with id 'AzureWindowsBaseline' is not found in DSC document.

Amit Raghav 40 Reputation points

All of sudden, guest assignments are failing in GCCH tenants. gc_agent.log file seems to suggest something is missing in downloaded package. Is this temporary microsoft issue? Is there a fix for it?

[2026-05-05 03:54:35.211] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Tagged Features :

[2026-05-05 03:54:35.211] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'AuditSecureProtocol'.

[2026-05-05 03:54:35.211] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'AzureWindowsBaseline'.

[2026-05-05 03:54:35.212] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Managed identity not provided, defaulting to sas uri token

[2026-05-05 03:54:35.212] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Download assignment package for : AzureWindowsBaseline from public blob

[2026-05-05 03:54:35.212] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Downloading package to C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline.zip location from https://oaasguestconfigusgts1.blob.core.usgovcloudapi.net/builtinconfig/AzureWindowsBaseline/AzureWindowsBaseline_1.53.0.0.zip uri.

[2026-05-05 03:54:35.214] [PID 6916] [TID 9036] [GC_UTILITIES_LOGGER] [INFO] [00000000-0000-0000-0000-000000000000] Config file not found at path: C:\ProgramData\AzureConnectedMachineAgent\Config\localconfig.json

[2026-05-05 03:54:35.214] [PID 6916] [TID 9036] [GC_UTILITIES_LOGGER] [INFO] [00000000-0000-0000-0000-000000000000] 'https_proxy' env variable not set or empty.

[2026-05-05 03:54:35.214] [PID 6916] [TID 9036] [PULL_CLIENT_CERT_HELPER] [INFO] [00000000-0000-0000-0000-000000000000] Proxy settings are disabled. Proxy settings 'https_proxy' environment variable is empty.

[2026-05-05 03:54:40.073] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Package downloaded to C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline.zip location C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline .

[2026-05-05 03:54:40.073] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Unzipping package C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline.zip to C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline location.

[2026-05-05 03:54:43.104] [PID 6916] [TID 9036] [PACKAGE_VALIDATOR] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Validating package: 'C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline'

[2026-05-05 03:54:43.133] [PID 6916] [TID 9036] [PACKAGE_VALIDATOR] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] The file: 'C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline\AzureWindowsBaseline.cat' is signed and the signature was verified.

[2026-05-05 03:54:43.135] [PID 6916] [TID 9036] [PACKAGE_VALIDATOR] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Validating catalog: 'C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline\AzureWindowsBaseline.cat'

[2026-05-05 03:54:44.179] [PID 6916] [TID 9036] [PACKAGE_VALIDATOR] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Catalog: 'C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline\AzureWindowsBaseline.cat' is valid

[2026-05-05 03:54:44.179] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Assignment validated.

[2026-05-05 03:54:44.180] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Package contains custom meta config file. Updating meta configuration with data from file C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline\AzureWindowsBaseline.metaconfig.json.

[2026-05-05 03:54:44.180] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Assignment 'AzureWindowsBaseline' is of category 'Policy'

[2026-05-05 03:54:44.181] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Executing pre-install PowerShell script.

[2026-05-05 03:54:54.881] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Raw pre-install JSON output: VERBOSE: Pre-install started with: {}

{"IsOverrideAllowed":false}

[2026-05-05 03:54:54.882] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Captured structured pre-install output.

[2026-05-05 03:54:56.065] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Initializing pull client.

[2026-05-05 03:54:56.095] [PID 6916] [TID 9036] [METADATA_INFO] [INFO] [00000000-0000-0000-0000-000000000000] Getting msi info from Fairfax region for vm located in 'USGovArizona' location.

[2026-05-05 03:54:56.095] [PID 6916] [TID 9036] [METADATA_INFO] [INFO] [00000000-0000-0000-0000-000000000000] Connecting to MSI endpoint: http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.core.usgovcloudapi.net%2F

[2026-05-05 03:54:56.107] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] [GAS IPs: Public IPv4: 20.140.151.75]

[2026-05-05 03:54:56.107] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] [GAS IPs: Public IPv4: 20.140.151.75] Sending report for 'AzureWindowsBaseline' to 'https://usgovtexas-gas.guestconfiguration.azure.us/virtualMachines/dfafb388-2835-4824-8bcd-e36e18ce54e3/assignments/AzureWindowsBaseline/reports?api-version=2020-11-08'

[2026-05-05 03:54:56.109] [PID 6916] [TID 9036] [GC_UTILITIES_LOGGER] [INFO] [00000000-0000-0000-0000-000000000000] Config file not found at path: C:\ProgramData\AzureConnectedMachineAgent\Config\localconfig.json

[2026-05-05 03:54:56.109] [PID 6916] [TID 9036] [GC_UTILITIES_LOGGER] [INFO] [00000000-0000-0000-0000-000000000000] 'https_proxy' env variable not set or empty.

[2026-05-05 03:54:56.109] [PID 6916] [TID 9036] [PULL_CLIENT_CERT_HELPER] [INFO] [00000000-0000-0000-0000-000000000000] Proxy settings are disabled. Proxy settings 'https_proxy' environment variable is empty.

[2026-05-05 03:54:56.529] [PID 6916] [TID 9036] [Pull Client] [ERROR] [8dbae8d5-371b-4770-b513-88d4f518cda6] [C:__w\1\s\src\dsc\gc_pullclient\dsc_pull_client.cpp:381] Resource instance with id 'AzureWindowsBaseline' is not found in DSC document.

[2026-05-05 03:54:56.529] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'PasswordMustMeetComplexityRequirements'.

[2026-05-05 03:54:56.529] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'MinimumPasswordLength@pid5tmekyzwudgyk'.

[2026-05-05 03:54:56.530] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'AdministratorsGroupMembersToExclude'.

[2026-05-05 03:54:56.530] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'AdministratorsGroupMembersToInclude'.

[2026-05-05 03:54:56.530] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'WindowsDefenderExploitGuard'.

[2026-05-05 03:54:56.531] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'StorePasswordsUsingReversibleEncryption'.

[2026-05-05 03:54:56.531] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'EnforcePasswordHistory@pidvvpa5a72nh2o6'.

[2026-05-05 03:54:56.531] [PID 6916] [TID 9036] [Pull Client] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Processing 'Builtin' assignment : 'AzureBaseline_SecurityOptionsNetworkSecurity'.

[2026-05-05 03:54:56.531] [PID 6916] [TID 9036] [Timer Manager] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Recieved 9 assignment(s).

[2026-05-05 03:54:56.532] [PID 6916] [TID 9036] [Timer Manager] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Publishing assignment(s).

[2026-05-05 03:54:56.532] [PID 6916] [TID 9036] [Assignment Manager] [INFO] [8dbae8d5-371b-4770-b513-88d4f518cda6] Publishing 9 assignments

Thanks

/Amit👁 guestassignment

  1. Suchitra Suregaunkar 14,595 Reputation points • Microsoft External Staff • Moderator

    Hello Amit Raghav,

    I hope the details shared above helped in addressing your concern.

    If the suggested resolution resolved the issue, kindly consider marking the answer as "Accepted" and "Upvote" it. This helps other community members who may encounter a similar issue in the future.

    If you’re still experiencing the problem or need further clarification, please feel free to share additional information so we can continue investigating and assist you further.

    Thanks,

    Suchitra.

Sign in to comment

2 answers

  1. Suchitra Suregaunkar 14,595 Reputation points • Microsoft External Staff • Moderator

    Hello Amit Raghav,

    Thank you for sharing the detailed gc_agent.log .

    Your logs show that the Guest Configuration agent on the GCCH VM (Admin-VM-1, region USGovArizona) is successfully completing every step for the AzureWindowsBaseline assignment — downloading version 1.53.0.0 from the GCCH blob storage, extracting, verifying the package signature and catalog, and executing the pre-install script but then fails at the final processing step with:

    [Pull Client] [ERROR] Resource instance with id 'AzureWindowsBaseline' is not found in DSC document.

    Importantly, your other 8 built-in assignments (AuditSecureProtocol, PasswordMustMeetComplexityRequirements, WindowsDefenderExploitGuard, etc.) continue to process without errors. This confirms the issue is isolated to the AzureWindowsBaseline package content itself.

    The AzureWindowsBaseline is a built-in guest configuration package that is fully authored, published, and maintained by Microsoft. As documented on the Azure Policy built-in packages page, baseline packages (including AzureWindowsBaseline) are written in C++ rather than PowerShell DSC, and their content is hosted on Microsoft-managed blob storage, customers do not have control over the package contents or the ability to modify them.

    Since the package is downloading and validating correctly (signature and catalog both pass), but the internal DSC document does not contain the expected resource instance, this indicates an issue with the package version currently published to the GCCH blob storage by Microsoft. This is not something that can be resolved from the customer side.

    Recommended next steps:

    1. Open a Microsoft support request - I will request few details via private message, please share it with us.
    2. Check Azure Service Health: In the Azure Government portal, navigate to Service Health to check for any active advisories related to Azure Policy or Machine Configuration in the USGov regions.

    (Optional) Verify on the VM — You can inspect the downloaded package at C:\ProgramData\GuestConfig\downloads\AzureWindowsBaseline\ and check the contents of the .mof file to confirm whether it contains a resource instance matching the expected ID AzureWindowsBaseline.

    Thanks,

    Suchitra.

    0 comments No comments
    Sign in to comment
  2. Vinodh247-1375 43,181 Reputation points • Volunteer Moderator

    Hi ,

    Thanks for reaching out to Microsoft Q&A.

    This is very likely a temp issue and a Microsoft-side issue in GCCH. The built-in AzureWindowsBaseline package (v1.53.0.0) has a DSC mismatch - the expected resource is missing inside the package.

    Action: Wait for Microsoft fix or temporarily disable this baseline. Not a VM or config problem.

    The logs clearly show:

    • Package download succeeds
    • Signature validation succeeds
    • Extraction succeeds
    • Failure happens during DSC execution phase

    The key error is:

    Resource instance with id 'AzureWindowsBaseline' is not found in DSC document

    What this actually means?

    The assignment name and DSC configuration inside the package are out of sync.

    In simple terms:

    • The Guest Configuration agent expects a DSC resource named AzureWindowsBaseline
    • The downloaded package does not contain that resource definition
    • That is why it fails at runtime, not during validationour logs clearly show:
      • Package download succeeds
      • Signature validation succeeds
      • Extraction succeeds
      • Failure happens during DSC execution phase
      The key error is:

      Resource instance with id 'AzureWindowsBaseline' is not found in DSC document

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

    0 comments No comments
    Sign in to comment
Sign in to answer

Your answer