How can remove azure disk encryption on vm if AzureDiskEncryption extension is deleted.

Mahitha 21 Reputation points
2020-07-10T09:44:22.18+00:00

I am trying to remove encryption on one VM but mistakenly extension is deleted first . I am unable to disable encryption as I am getting errors while removing the encryption on the VM.

Is there any solution for this. Below is the error.

Disable-AzVMDiskEncryption : Operation 'PUT Extension' is not allowed on VM extension 'AzureDiskEncryption' since it is marked for
deletion. You can only retry the Delete operation (or wait for an ongoing one to complete).
ErrorCode: OperationNotAllowed
ErrorMessage: Operation 'PUT Extension' is not allowed on VM extension 'AzureDiskEncryption' since it is marked for deletion. You
can only retry the Delete operation (or wait for an ongoing one to complete).
ErrorTarget:
StatusCode: 409
ReasonPhrase: Conflict

Azure Disk Encryption
Azure Disk Encryption
An Azure service for virtual machines (VMs) that helps address organizational security and compliance requirements by encrypting the VM boot and data disks with keys and policies that are controlled in Azure Key Vault.
162 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sumarigo-MSFT 43,806 Reputation points Microsoft Employee
    2020-07-10T17:18:56.777+00:00

    @64001d11-31c5-4b62-a8a4-95b290b96cee Did you tried to stop the Azure VM( deallocate)and try to disable and let me know the status.

    If the issue still persist try installing the extension again.

    Hope this helps!

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please don’t forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    0 comments
  2. JamesTran-MSFT 36,456 Reputation points Microsoft Employee
    2020-07-10T18:47:12.893+00:00

    @64001d11-31c5-4b62-a8a4-95b290b96cee
    For your issue, please follow the below steps:

    1- Re-install the extension. You can use the sequence version scripts to do so. Keep in mind, if you used a KEK to encrypt, you'll have to use the KEK encryption script pointing to the same key you used to encrypt your VM initially. All other variables will be the original ones used to encrypt the VM, i.e. (Key Vault, Keys).

    2- If re-installing the extension works, please go ahead with the recommended workflow to Decrypt & Remove the ADE extension.

    If the re-installation of your extension doesn't work please let me know.

    As an additional note, I tried repro'ing your issue and wasn't able to. Which means, the error message you provided might be correct when it says "or wait for an ongoing one to complete."

    Reproduction Steps Taken:
    -I encrypted my VM, removed the ADE extension, and tried to decrypt the VM. However, as you can see, the Disable command ended up working.
    11750-disableade.jpg

    -For this second repro, I ended up re-installing the ADE extension using the same variables I used to encrypt my VM originally. I was able to Disable/Remove the extension.
    11808-removeadeextrepro.jpg
    11809-adestatus.jpg

    Please let me know if you run into any issues.