Forum Discussion

Copper Contributor

Dec 04, 2019

Solved

Error Communication WebClient

We are deploying Azure ATP Sensor on a DC and are getting the following error: 2019-12-04 15:06:10.3678 Error CommunicationWebClient+<SendWithRetryAsync>d__8`1 Microsoft.Tri.Infrastructure.Extend...

EliOfek
Dec 06, 2019
Both SamName and full UPN formats should work. Set the dc domain of the account. This is if all domains have full 2 way trust.

EliOfek

Microsoft

Dec 05, 2019

tanves

Just 443, both to azure, and to localhost.

(The sensor service is communicating with the updater service via localhsot 443 as well).

tanves

Copper Contributor

Dec 06, 2019

EliOfek

Thanks for your assistance so far! We had traffic on 443 getting dropped on our Perimeter Firewall. Once the DC IP was allowed to communicate over that port, we saw a new set of errors.

These errors have been discussed in the Tech Community

https://techcommunity.microsoft.com/t5/Microsoft-Advanced-Threat/Azure-Advanced-Thread-Protection-Sensor-service-failed-to-start/m-p/293855

In our case, we have a forest where the root domain is root.com with two child domains, partner.root.com and partner1.root.com (I have used example names). We are testing ATP sensor install on partner.root.com. We are using an account which is created in partner1.root.com as that is our user domain. Questions I had were, under Directory Services config on the portal:

- In the user name do I put just the SAM account or the UPN excluding the domain name

- In the domain, do I put partner1.root.com or partner.root.com or root.com

Any help on this matter would be greatly appreciated!

EliOfek
Microsoft
Dec 06, 2019
Both SamName and full UPN formats should work. Set the dc domain of the account. This is if all domains have full 2 way trust.
- Amin7RDR
  Copper Contributor
  Feb 19, 2020
  EliOfek
  
  I tried the silent installation but it doesnt install or give any error.
  Tried UPN in the silent installation as below:
  
  .\"Azure ATP sensor Setup.exe" /quiet NetFrameworkCommandLineArguments="/q" AccessKey="xxxxxxxxxxxxxxxxxxxxxxxxx==" ProxyUrl="https://proxy.corp.abc.com:8080" ProxyUserName="xxxxxxx@corp.abc.com" ProxyUserPassword="xxxxxxxxx"
  
  Is it correct?
  - EliOfek
    Microsoft
    Feb 19, 2020
    Amin7RDR The format is correct, I can only guess that the values are correct as well 🙂
    
    In order to sww what went wrong you need the deployment logs, the interactive console/ UI won't tell you much without the logs.
- tanves
  Copper Contributor
  Dec 06, 2019
  EliOfek
  
  Thanks a bunch for all your guidance! We entered the UPN as per your advice along with the DC Domain and all communications started working!