Azure ATP Service Fails to Start

EliOfek 

I'd like to add to this thread, I'm seeing seemingly the exact same error when deploying to production.

For context, we deployed to a test environment (each environment looks like: Two forests, primary forest has company.com and two child.company.com domains, second forest has an external trust) with only a single account in the primary child domain, and that worked fine.

However, when trying to install a standalone sensor, I get the same error as in the first screenshot here:

2019-07-03 18:30:29.2434 Error Enumerable System.InvalidOperationException: Sequence contains no elements
at TSource System.Linq.Enumerable.First<TSource>(IEnumerable<TSource> source)
at void Microsoft.Tri.Sensor.DomainNetworkCredentialsManager.UpdateConfigurations(ConfigurationCollection configurations)
at Func<Task> Microsoft.Tri.Infrastructure.ActionExtension.ToAsyncFunction(Action action)+(TItem _) => { }
at async Task Microsoft.Tri.Infrastructure.ConfigurationManager.RegisterConfigurationAsync(Func<ConfigurationCollection, Task> onConfigurationsUpdateAsync, Type[] configurationTypes)
at void Microsoft.Tri.Infrastructure.TaskExtension.Await(Task task)
at new Microsoft.Tri.Sensor.DomainNetworkCredentialsManager(IConfigurationManager configurationManager)
at object lambda_method(Closure, object[])
at object Autofac.Core.Activators.Reflection.ConstructorParameterBinding.Instantiate()
at void Microsoft.Tri.Infrastructure.ModuleManager.AddModules(Type[] moduleTypes)
at ModuleManager Microsoft.Tri.Sensor.SensorService.CreateModuleManager()
at async Task Microsoft.Tri.Infrastructure.Service.OnStartAsync()
at void Microsoft.Tri.Infrastructure.TaskExtension.Await(Task task)
at void Microsoft.Tri.Infrastructure.Service.OnStart(string[] args)

We have the account for both the child.testcompany.com and child.company.com domains listed in the ATP domain services config.

According to the https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-multi-forest

• Add credentials on the Directory services page for all forests in your environment.
  • One credential is required per forest with two-way trust.
  • Additional credentials are required for each forest with non-Kerberos trust or no trust.

If I'm reading this right, we should only need two credentials per environment.  One for the primary forest 'company.com' and its child domains, as well as one for the external trusted domain?

If I have all that right, I'm wondering two things:

1. Why this worked in test?
   1. The only difference is that we started with the Domain controller sensors in test, but in prod we are installing a standalone sensor to start with.  We do not have a standalone sensor in test.
2. How are you supposed to configure this if you have external trusts to forests you don't have any control over, and can't create an account in?

meliss0215 , you most likely missed this step in the system configuration:

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step2

so the sensor does not have the needed info to start properly.