Forum Discussion
Solved
Azure ATP Sensor install failing (Updater Service do not start)
Hello All! We try to install the Azure ATP Sensor on a DC, setup wizard is running until this point ...then do some retries for about 3 minutes, during this time the service "Azure Advanced T...
Actually, the solution in our case was to use Silent Installation (https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-silent-installation#proxy-authentication) and provide the Proxy Information in the commandline.
Thank you all for helping and advising!!!
I am getting exactly the same error at my client's site. Identical configuration used each time, majority of DCs installation works fine, but on those that don't I see exactly the same issue as you describe.
While the install is proceeding (or stuck mid point as you are seeing), the sensor appears in the console in a stopped state (it is even possible to configure the update settings), but when the client install eventually times out with the error, the sensor gets cleared out of the console as well. The only other symptom I have noticed is the multiple 'unexpected restart' entries in the system log and the ATP Sensor updater service usually stuck in the 'starting state'. I have not found any issues with the WMI performance adaptor either, something I checked because it is a dependency of the Sensor updater service.
EliOfek
Microsoft
MicrosoftRichard Adams , a bit confused, are you getting the same error during deployment or service start?
Hi,
Same as the poster's original screenshot. The installation gets stuck (about midway through according to the GUI). After a long wait it removes the sensor from the console, backs out the client install and displays the installation failure error (0x80070643) which suggests proxy issues, but if this was the case how would the client register in Security Center in the first place? I am using exactly the same installation process on all my Client's DCs, so far I have had 15 successful and another 5 or so fail.
Richard
- EliOfek
Richard Adams The screenshot alone does not mean it's the same issue.
And you are right, if you managed to see it registers and removed, then it's most likely something else.
You will need to take a look at the logs to know why.
see