Forum Discussion
AATPSensor stuck in start pending and AATPSensorUpdater logging errors
AndreBaker The sensor log always get stuck on the line with "PcapLibraryHelper Verify" ?
What happens if you kill the sensor process from task manager? does it restart the sequence and gets stuck again on the exact same line ?
If yes, most likely Npcap was installed on the machine with /admin_only option, and we don’t support it.
uninstall npcap, and reinstall with the supported attributes.
https://docs.microsoft.com/en-us/defender-for-identity/technical-faq#how-do-i-download-and-install-the-npcap-driver
MicrosoftAndreBaker The sensor log always get stuck on the line with "PcapLibraryHelper Verify" ?
What happens if you kill the sensor process from task manager? does it restart the sequence and gets stuck again on the exact same line ?
If yes, most likely Npcap was installed on the machine with /admin_only option, and we don’t support it.
uninstall npcap, and reinstall with the supported attributes.
https://docs.microsoft.com/en-us/defender-for-identity/technical-faq#how-do-i-download-and-install-the-npcap-driver
EliOfek Yes, the sensor log always get stuck at this line when we kill the service and it starts again.
Warn PcapLibraryHelper Verify [pcapProductLibrary=Npcap pcapProductVersion=1.0]
We uninstalled npcap:
"c:\Program Files\Npcap\Uninstall.exe" /S
Then installed with the recommended params:
npcap\npcap-1.00-oem.exe /S /loopback_support=no /winpcap_mode=yes
Then terminated the Microsoft.Tri.Sensor.exe & Microsoft.Tri.Sensor.Updater.exe service processes.
Now the AATPSensor and AATPSensorUpdater are both running without issues and are showing up in the ATP sensors tab as running as well.
Thanks a lot for assisting!