Azure Arc enabled server abnormal network traffic

gc_worker.log

Hello Kenneth Chan - Admin

The Azure Arc Guest Configuration (gc_service.exe and gc_extension_service.exe) causing excessive outbound traffic, especially when:

The assigned policy set is large (e.g., “AzureWindowsBaseline”).

The agent is unable to converge to a compliant state, resulting in repeated compliance checks and large report uploads.

The log shows repeated cycles of DSC “Get” operations and warnings about oversized compliance reports being trimmed and resent

Your log matches this pattern exactly: The Guest Configuration agent is stuck in a loop, generating and uploading large compliance reports every few minutes, which is the root cause of your high outbound traffic.

Disabling or Updating the Extension

Disabling the Guest Configuration extension will immediately stop this traffic. This extension is only required for Azure Policy compliance reporting and does not affect Microsoft Defender for Cloud’s core protection or threat detection.

Updating the extension

Microsoft has released fixes in recent versions of the Arc agent and Guest Configuration extension to address this looped behavior. If you need compliance reporting, update to the latest version.

No impact on Defender

Defender for Cloud uses its own agents (MMA/AMA) and does not depend on Guest Configuration for threat protection.

Usage of Azure Arc Guest Configuration

Purpose: Provides in-guest policy compliance and configuration auditing for hybrid servers (on-prem, AWS, GCP, etc.), reporting compliance status to Azure Policy.

If you only use AWS Control Tower for compliance and do not need Azure Policy reporting, you can safely disable the Guest Configuration extension.

Network Configuration

The log confirms that the agent is uploading compliance reports to Azure endpoints (e.g., https://canadacentral-gas.guestconfiguration.azure.com/...).

If you keep Guest Configuration enabled, ensure only the required endpoints are open and monitor for excessive traffic. If you disable it, this traffic will stop.

Recommendation

If you do not need Azure Policy compliance reporting on AWS EC2:

Disable the Azure Arc Guest Configuration extension on the affected instance(s).

If you need compliance reporting:

Update the Arc agent and Guest Configuration extension to the latest version to resolve the traffic loop.

Please let me know if you face any challenge here, I can help you to resolve this issue further

If the comment was helpful, please click "Upvote"

Hi Rahul,

Thanks so much for your detailed explanation
I would like to further ask something about the gc extension

From the impacted server, the extension status is not normal

It show updating and creating

May i know how to fix this?

And if i want to disable the gc extension directly
Do i need to use powershell manually? Or i can do it directly on the console side?

Thanks
Kenneth

Hello Kenneth Chan - Admin

Try the Azure Portal First

Go to the Arc-connected server’s “Extensions + applications” blade in the Azure Portal.

For each extension stuck in “Updating” or “Creating,” try: Uninstall.

If “Uninstall” fails, proceed to PowerShell.

Use PowerShell on the Server

Open an elevated PowerShell prompt on the server.

List all extensions:

azcmagent extension list

Remove the stuck extension:

azcmagent extension remove --name "WindowsAgent.SqlServer"
azcmagent extension remove --name "MDE.Windows"

Restart the Arc agent:

Restart-Service -Name "AzureConnectedMachineAgent" -Force

Reference Link

https://learn.microsoft.com/en-us/azure/azure-arc/servers/security-extensions

https://learn.microsoft.com/en-us/azure/azure-arc/servers/manage-vm-extensions

Please let me know if you face any challenge here, I can help you to resolve this issue further

If the comment was helpful, please click "Upvote"