Forum Discussion

marioschaupp's avatar
marioschaupp
Copper Contributor
Apr 16, 2020

Azure ATP service not starting

Hello,   after installing the ATP sensor on one of my client's domain controllers I can see in the Azure ATP portal, that the service is not starting.   I use a group managed service account whic...
sophiavega's avatar
sophiavega
Copper Contributor
Jul 02, 2020

marioschaupp where exactly do you modify the settings?  I am having issues with some sensors on some servers and have been trying everything I find online.  I am about to open a ticket, but wanted to give this a shot.

cjohnston's avatar
cjohnston
Brass Contributor
Jul 07, 2020

sophiavega I can't speak for anyone else, but we had a security policy GPO that limited what user accounts could log in as a service. By adding NT SERVICE/ALL SERVICES to that list of groups/users that were allowed to log in as a service, we were able to get the ATP sensor to start up.

  • 19873306's avatar
    19873306
    Copper Contributor
    Sep 21, 2020

    cjohnston is  NT SERVICE/ALL SERVICES required for 'login in as service'?  Could the individual gMSA account be assigned access to 'log on as service' via group policy?

     

    • jurowley's avatar
      jurowley
      Former Employee
      May 18, 2021

      19873306 - The recommended configuration for the "Log On as a Service" setting is to use a Security Group containing all the DCs with Sensors hosted. This enables those machines to retrieve the gMSA account. 

      You can also use the individual hostname of the DC. 

    • Kiwi01's avatar
      Kiwi01
      Copper Contributor
      Dec 08, 2020

      We had the same GPO setting which was stopping the ATP service from staring. Adding the Group Managed Service Account to the list of accounts allowed to logon locally fixed the issue.
      It's wasn't necessary to allow all services.

Resources