Time out when creating Windows VM from an Image

Hi Handinata Tanudjaja,

A provisioning failure happens when the OS image fails to load either due to incorrect preparatory steps or because of selecting the wrong settings during the image capture from the portal.

Azure requires the image to be generalized when using it to create a new VM. Without generalization, the provisioning agent can’t complete its work (like setting up networking, hostnames, user credentials, etc.).https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/linux/troubleshoot-deployment-new-vm-linux#why-do-provisioning-failures-occur

Windows
After you have run Sysprep on a VM, that VM is considered generalized and cannot be restarted. The process of generalizing a VM is not reversible. If you need to keep the original VM functioning, you should create a snapshot of the OS disk, create a VM from the snapshot, and then generalize that copy of the VM.

Sysprep requires the drives to be fully decrypted. If you have enabled encryption on your VM, disable encryption before you run Sysprep.

If you plan to run Sysprep before uploading your virtual hard disk (VHD) to Azure for the first time, make sure you have prepared your VM.

Also please note, Azure Disk Encryption does not work for the following scenarios, features, and technology:

Creating an image or snapshot of an encrypted VM and using it to deploy additional VMs.

https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-windows#restrictions

If you're not tied to snapshots, you can create the image directly from the VM after generalizing: https://learn.microsoft.com/en-us/azure/virtual-machines/capture-image-portal

Let me know if you have any further queries!

If the comment is helpful, please click "upvote" to let us know!

Hi @Mounika Reddy Anumandla ,
Thank you for the response.
I forgot to mention that this is for Windows VM.For the route I took in creating a VM image from a OS disk snapshot, there's no option whether it needs to generalized or specialized.
However the option to generalized or specialized is available when we are trying to create a VM image from a VM.

I think what you explained here is for capturing VM image from a VM but I am actually confused why it has to be generalized?
Why couldn't we do the specialized?

And thank you for pointing this out "Creating an image or snapshot of an encrypted VM and using it to deploy additional VMs."
So with my situation, this means the snapshot I created from an encrypted OS disk will not be able to be used for new VMs.
Is this correct?

Thank you

Hi Handinata Tanudjaja,

Thank you for replying back to us!
Yes, you're correct, when you create an image directly from an OS disk snapshot, you do not have the option to specify whether it should be generalized or specialized. This is because the disk snapshot is just a backup of the disk, not a full image with VM-specific configurations.

Azure Disk Encryption for Windows virtual machines (VMs) use the BitLocker feature of Windows to provide full disk encryption of the OS disk and data disk. Additionally, it provides encryption of the temporary disk when the VolumeType parameter is All.

Azure Disk Encryption is integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets. For an overview of the service, see Azure Disk Encryption for Windows VMs.

Creating an image or snapshot of an encrypted VM and using it to deploy additional VMs. So, yes, you are correct: the snapshot you created from an encrypted OS disk will not be usable for deploying new VMs due to the encryption keys not being included in the snapshot. As per my understanding, that might be the reason provisioning fails.

To prepare a VM for creating a reusable image, you need to generalize it. This process removes machine-specific information, allowing the image to be used for deploying multiple VMs.https://docs.azure.cn/en-us/virtual-machines/vm-generalized-image-version?tabs=cli%2Ccli2

When you create a new VM from a specialized image, the new VM retains the computer name of the original VM. Other computer-specific information, like the CMID, is also kept. This duplicate information can cause issues.

"Why couldn't we just do specialized?"

You can, but only if:

• You're not trying to scale or deploy to many instances
• You're okay with identical system state and credentials
• You're not using Azure Disk Encryption (ADE) — because encrypted disks can't be snapshotted or imaged for reuse even in specialized mode.
• https://docs.azure.cn/en-us/virtual-machines/vm-specialized-image-version

Hope this helps!

Let me know if you have any further queries!

Hi @Mounika Reddy Anumandla ,

Thank you very much! That's very helpful!
We do want to deploy many VMs using an image that we would like to create.

I would like to know your step by step instruction on how to make a generalized image route, here's our situation:

1. The VM we have is being used in production.
2. The OS disk is ADE encrypted.

How do we make a generalized image without making our production VM not functioning?
And we would like to avoid the OS disk from being decrypted when making a generalized image.

Thank you again!

Hi Handinata Tanudjaja,

As mentioned in Azure documentation https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-windows Azure Disk Encryption does not support the following scenarios:

• Creating an image or snapshot of an encrypted VM and using it to deploy additional VMs. You cannot create a deployable image directly from an ADE-encrypted OS disk. Here's a comparison of Disk Storage SSE, ADE, encryption at host, and Confidential disk encryption.
  For full details,https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-overview

Hope it helps!