Forum Discussion

marioschaupp's avatar
marioschaupp
Copper Contributor
Apr 16, 2020

Azure ATP service not starting

Hello,   after installing the ATP sensor on one of my client's domain controllers I can see in the Azure ATP portal, that the service is not starting.   I use a group managed service account whic...
marioschaupp's avatar
marioschaupp
Copper Contributor
Apr 16, 2020

Hi,

 

I was able to resolve the issue myself. A Default Domain Controller Policy GPO had overwritten the default settings for the security policy "log on as service". „NT SERVICE\ALL SERVICES“ was missing and after adding this group, the service was able to start

 

sophiavega's avatar
sophiavega
Copper Contributor
Jul 02, 2020

marioschaupp where exactly do you modify the settings?  I am having issues with some sensors on some servers and have been trying everything I find online.  I am about to open a ticket, but wanted to give this a shot.

  • cjohnston's avatar
    cjohnston
    Brass Contributor
    Jul 07, 2020

    sophiavega I can't speak for anyone else, but we had a security policy GPO that limited what user accounts could log in as a service. By adding NT SERVICE/ALL SERVICES to that list of groups/users that were allowed to log in as a service, we were able to get the ATP sensor to start up.

    • 19873306's avatar
      19873306
      Copper Contributor
      Sep 21, 2020

      cjohnston is  NT SERVICE/ALL SERVICES required for 'login in as service'?  Could the individual gMSA account be assigned access to 'log on as service' via group policy?

       

      • jurowley's avatar
        jurowley
        Former Employee
        May 18, 2021

        19873306 - The recommended configuration for the "Log On as a Service" setting is to use a Security Group containing all the DCs with Sensors hosted. This enables those machines to retrieve the gMSA account. 

        You can also use the individual hostname of the DC. 

Resources