Azure Local: Update Failure During Secure Boot CAU Run — Storage Maintenance Mode Issue

Hi @Testing Account ,

Thanks for sharing the details of the Azure Local update failure.

Since the node drained but failed to enter storage maintenance mode during the Secure Boot Cluster-Aware Updating (CAU) process, focus on why storage maintenance mode was blocked rather than trying another manual drain.

Azure Local updates coordinate workload movement, maintenance operations, and node reboots. A successful node drain doesn't necessarily confirm that all storage maintenance prerequisites have been satisfied.

Recommended troubleshooting:

1. Validate the cluster and storage state

Since you've already run Test-AzStackHciConnectivity and Get-ClusterNode, don't repeat those checks unless the cluster state has changed.

Instead, review the cluster's storage health, including any active repair or resynchronization operations. Also check whether the affected node has any outstanding storage alerts.

This is important because a cluster can appear healthy at a high level while an underlying storage condition prevents a maintenance operation.

2. Review the failed update operation

Examine the Azure Local update history and identify the specific CAU step that failed.

Look for the first error preceding DrainMgr error 1359, particularly any message related to storage maintenance mode, disk health, or storage operations.

The complete error details are important because error 1359 alone doesn't establish which component prevented the maintenance transition.

3. Avoid forcing storage maintenance mode

Microsoft provides documented procedures for suspending Azure Local nodes during planned maintenance. However, manually draining a node isn't equivalent to successfully completing the storage maintenance sequence managed by Azure Local updates.

I don't recommend forcing disk maintenance, using Suspend-ClusterResource, or bypassing CAU checks without first identifying the underlying failure.

These actions could affect Cluster Shared Volumes and running workloads.

4. Validate Secure Boot update prerequisites

Since the failure occurs during a Secure Boot CAU run, also review Microsoft's Secure Boot update guidance for Azure Local.

Confirm that the Lenovo hardware and firmware configuration meets the applicable Secure Boot requirements and that no conflicting firmware update is being applied during the same maintenance cycle.

I recommend separating Secure Boot certificate updates from firmware updates to avoid conflicting reboot and update operations.

5. Escalate if the maintenance transition continues to fail

If storage health checks don't reveal an issue, I recommend opening a Microsoft Azure Local support case and involving Lenovo support if you suspect a hardware or firmware dependency.

Provide the failed update correlation details, CAU logs, relevant cluster events, Lenovo hardware model, firmware versions, and the exact storage maintenance error.

Could you confirm:

• How many nodes are in your Azure Local cluster?
• What is the complete error message associated with DrainMgr error 1359?
• Are there any storage repair or resynchronization operations in progress?
• Does the issue occur on one specific node or multiple nodes?

These details should help determine whether the failure relates to storage readiness, the node maintenance workflow, or Secure Boot update orchestration.

Avoid another update attempt or manual maintenance-mode change until the specific storage maintenance failure is understood, especially if production VMs are affected.

Hope this helps narrow down the issue.

References:

Suspend and resume Azure Local machines for maintenance

Manage Secure Boot updates in Azure Local

Manage Azure Local update settings

Suspend-ClusterResource

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.