Azure自动化Runbook无法更新VM注册表值问题求助

核心问题 #

你的脚本在更新VM注册表时存在三个关键错误：

• Invoke-AzVMRunCommand参数误用：-ScriptPath用于指定本地脚本文件路径，无法直接传递内存中的脚本块，需改用-ScriptString传递脚本内容字符串。
• 注册表项名称错误：你将$RegistrationToken整个对象赋值给RegistryName，但RDInfraAgent要求的注册表项名称是固定的RegistrationToken，并非令牌对象本身。
• 缺少令牌存在性判断：若主机池不存在，$RegistrationToken为空值，此时执行注册表更新会引发无意义错误，需增加判断逻辑。

修正后的完整脚本 #

try {
    "Logging in to Azure..."
    Connect-AzAccount -Identity
}
catch {
    Write-Error -Message $_.Exception
    throw $_.Exception
}

# Set the subscription (if not already set)
Set-AzContext -SubscriptionId "xxxxxxxxxxxxxxxx"

$ResourceGroupName = "xxxxx1"
$HostPoolName = "wpxxxxxxxxx"
$VMName = "001"

# Check if the host pool exists
$Hostpool = Get-AzWvdHostPool -Name $HostPoolName -ResourceGroupName $ResourceGroupName -ErrorAction SilentlyContinue

if (!$Hostpool) {
    Write-Host '', "Hostpool '$($HostPoolName)' doesn't exist. It will be created by TF"
} else {
    try {
        # Create token
        $RegistrationToken = New-AzWvdRegistrationInfo -ResourceGroupName $ResourceGroupName `
            -HostPoolName $HostPoolName `
            -ExpirationTime (Get-Date).ToUniversalTime().AddHours(2).ToString('yyyy-MM-ddTHH:mm:ss.fffffffZ')

        Write-Host '', "Token created"
        Write-Output $RegistrationToken
    } catch {
        throw $_.Exception
    }
}

# 仅当令牌创建成功时执行注册表更新
if ($RegistrationToken) {
    # 定义注册表更新脚本内容（转换为字符串）
    $ScriptContent = @"
        param (
            [string]`$RegistryPath,
            [string]`$RegistryName,
            [string]`$NewRegistryValueData
        )

        # Check if registry key exists, create if not
        if (-not (Test-Path `$RegistryPath)) {
            try {
                New-Item -Path `$RegistryPath -Force -ErrorAction Stop
                Write-Output "Registry key '`$RegistryPath' created successfully."
            } catch {
                Write-Error "Failed to create registry key '`$RegistryPath': `$_"
            }
        }

        # Update registry value
        try {
            Set-ItemProperty -Path `$RegistryPath -Name `$RegistryName -Value `$NewRegistryValueData -ErrorAction Stop
            Write-Output '', "Registry value updated"
        } catch {
            Write-Error -Message "Failed to update registry value: `$_"
        }
"@

    # Define parameters for the script
    $Params = @{
        RegistryPath = "HKLM:\SOFTWARE\Microsoft\RDInfraAgent"
        RegistryName = "RegistrationToken"  # 固定注册表项名称
        NewRegistryValueData = $RegistrationToken.Token
    }

    try {
        # 调用VM运行命令，使用ScriptString传递脚本内容
        $Result = Invoke-AzVMRunCommand -ResourceGroupName $ResourceGroupName `
            -VMName $VMName `
            -CommandId 'RunPowerShellScript' `
            -ScriptString $ScriptContent `
            -Parameter $Params

        # 输出执行结果
        Write-Host "VM命令执行结果:"
        Write-Output $Result.Value[0].Message
    } catch {
        Write-Error "执行VM命令失败: $_"
        throw $_.Exception
    }
} else {
    Write-Host "未创建注册令牌，跳过VM注册表更新"
}

额外检查项 #

• Azure VM Agent状态：在Azure门户的VM概述页面，确认"Azure VM Agent"显示为"正在运行"，无此组件无法执行RunCommand。
• 自动化账户权限：给自动化账户分配Virtual Machine Contributor角色（或自定义包含Microsoft.Compute/virtualMachines/runCommand/action权限的角色）到VM所在资源组。
• 网络连通性：确保自动化账户能访问VM的443端口，若VM在私有网络，需启用Azure自动化混合工作器或配置虚拟网络集成。

内容的提问来源于stack exchange，提问作者Madhu