Forum Discussion
Error installing ATP Sensor on 2019 DC
I tried to install the ATP sensor on a 2019, i have the following issue:
2022-02-03 04:12:40.8978 Warn JsonSerializerSettingsExtension+JsonSerializationBinder UpdateCurrentDomainAssemblyTypes GetSerializableMembers failed [AssemblyQualifiedName=Microsoft.Tri.Common.RemediationActionData, Microsoft.Tri.Common, Version=2.171.14934.11377, Culture=neutral, PublicKeyToken=null AssemblyQualifiedName=Microsoft.Tri.Common.RemediationActionData, Microsoft.Tri.Common, Version=2.171.14934.11377, Culture=neutral, PublicKeyToken=null exception.Message=Could not load file or assembly 'Microsoft.Azure.Security.Detection.AlertContracts, Version=5.3.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.]
2022-02-03 04:12:41.5541 Info Program Main Deployer started [arguments=VGmKamZFKTHijyHvdXBC+Q==]
2022-02-03 04:12:41.6322 Debug PcapLibraryHelper IsNpcapRunning npcap service exist
2022-02-03 04:12:41.6322 Debug InstallActionGroup Apply started
2022-02-03 04:12:41.6322 Debug CreateCertificateAction Apply started [suppressFailure=False]
2022-02-03 04:12:42.1322 Debug CreateCertificateAction Apply finished
2022-02-03 04:12:42.1322 Debug CreateSensorAction Apply started [suppressFailure=False]
2022-02-03 04:12:42.2885 Warn JsonSerializerSettingsExtension+JsonSerializationBinder UpdateCurrentDomainAssemblyTypes GetExportedTypes failed [assembly=Microsoft.AspNetCore.Http.Abstractions, Version=2.2.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60 exception.Message=Could not load file or assembly 'Microsoft.AspNetCore.Http.Features, Version=2.2.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60' or one of its dependencies. The system cannot find the file specified.]
2022-02-03 04:12:42.3353 Warn JsonSerializerSettingsExtension+JsonSerializationBinder UpdateCurrentDomainAssemblyTypes GetSerializableMembers failed [AssemblyQualifiedName=Microsoft.Tri.Common.RemediationActionData, Microsoft.Tri.Common, Version=2.171.14934.11377, Culture=neutral, PublicKeyToken=null AssemblyQualifiedName=Microsoft.Tri.Common.RemediationActionData, Microsoft.Tri.Common, Version=2.171.14934.11377, Culture=neutral, PublicKeyToken=null exception.Message=Could not load file or assembly 'Microsoft.Azure.Security.Detection.AlertContracts, Version=5.3.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.]
2022-02-03 04:12:42.8354 Warn JsonSerializerSettingsExtension+JsonSerializationBinder UpdateCurrentDomainAssemblyTypes GetExportedTypes failed [assembly=Microsoft.AspNetCore.Http.Abstractions, Version=2.2.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60 exception.Message=Could not load file or assembly 'Microsoft.AspNetCore.Http.Features, Version=2.2.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60' or one of its dependencies. The system cannot find the file specified.]
2022-02-03 04:12:42.8822 Warn JsonSerializerSettingsExtension+JsonSerializationBinder UpdateCurrentDomainAssemblyTypes GetSerializableMembers failed [AssemblyQualifiedName=Microsoft.Tri.Common.RemediationActionData, Microsoft.Tri.Common, Version=2.171.14934.11377, Culture=neutral, PublicKeyToken=null AssemblyQualifiedName=Microsoft.Tri.Common.RemediationActionData, Microsoft.Tri.Common, Version=2.171.14934.11377, Culture=neutral, PublicKeyToken=null exception.Message=Could not load file or assembly 'Microsoft.Azure.Security.Detection.AlertContracts, Version=5.3.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.]
2022-02-03 04:12:43.1406 Debug CreateSensorAction Apply finished
2022-02-03 04:12:43.1406 Debug SaveSensorMandatoryConfigurationAction Apply started [suppressFailure=False]
2022-02-03 04:12:43.1719 Debug SaveSensorMandatoryConfigurationAction Apply finished
2022-02-03 04:12:43.1719 Debug CreateServicesActionGroup Apply started
2022-02-03 04:12:43.1719 Debug CreateServiceAction Apply started [suppressFailure=False]
2022-02-03 04:12:43.1875 Debug CreateServiceAction Apply finished
2022-02-03 04:12:43.1875 Debug SetServiceDescriptionAction Apply started [suppressFailure=False]
2022-02-03 04:12:43.2031 Debug SetServiceDescriptionAction Apply finished
2022-02-03 04:12:43.2031 Debug ConfigureServiceAction Apply started [suppressFailure=False]
2022-02-03 04:12:43.2188 Debug ConfigureServiceAction Apply finished
2022-02-03 04:12:43.2188 Debug SetServicePreshutdownTimeoutAction Apply started [suppressFailure=False]
2022-02-03 04:12:43.2344 Debug SetServicePreshutdownTimeoutAction Apply finished
2022-02-03 04:12:43.2344 Debug CreateServiceAction Apply started [suppressFailure=False]
2022-02-03 04:12:43.2344 Debug CreateServiceAction Apply finished
2022-02-03 04:12:43.2344 Debug SetServiceDescriptionAction Apply started [suppressFailure=False]
2022-02-03 04:12:43.2344 Debug SetServiceDescriptionAction Apply finished
2022-02-03 04:12:43.2344 Debug ConfigureServiceAction Apply started [suppressFailure=False]
2022-02-03 04:12:43.2500 Debug ConfigureServiceAction Apply finished
2022-02-03 04:12:43.2500 Debug SetServicePreshutdownTimeoutAction Apply started [suppressFailure=False]
2022-02-03 04:12:43.2656 Debug SetServicePreshutdownTimeoutAction Apply finished
2022-02-03 04:12:43.2656 Debug CreateServicesActionGroup Apply finished
2022-02-03 04:12:43.2656 Debug ConfigureVirtualServiceAccountAction Apply started [suppressFailure=False]
2022-02-03 04:12:43.3281 Debug InstallActionGroup Revert started
2022-02-03 04:12:43.3281 Warn InstallActionGroup Revert reverting [rollbackAction=CreateServicesActionGroup index=0 count=4]
2022-02-03 04:12:43.3281 Debug CreateServicesActionGroup Revert started
2022-02-03 04:12:43.3281 Warn CreateServicesActionGroup Revert reverting [rollbackAction=SetServicePreshutdownTimeoutAction index=0 count=8]
2022-02-03 04:12:43.3281 Debug SetServicePreshutdownTimeoutAction Revert started
2022-02-03 04:12:43.3281 Debug SetServicePreshutdownTimeoutAction Revert finished
2022-02-03 04:12:43.3281 Warn CreateServicesActionGroup Revert reverting [rollbackAction=ConfigureServiceAction index=1 count=8]
2022-02-03 04:12:43.3281 Debug ConfigureServiceAction Revert started
2022-02-03 04:12:43.3281 Debug ConfigureServiceAction Revert finished
2022-02-03 04:12:43.3281 Warn CreateServicesActionGroup Revert reverting [rollbackAction=SetServiceDescriptionAction index=2 count=8]
2022-02-03 04:12:43.3281 Debug SetServiceDescriptionAction Revert started
2022-02-03 04:12:43.3281 Debug SetServiceDescriptionAction Revert finished
2022-02-03 04:12:43.3281 Warn CreateServicesActionGroup Revert reverting [rollbackAction=CreateServiceAction index=3 count=8]
2022-02-03 04:12:43.3281 Debug CreateServiceAction Revert started
2022-02-03 04:12:43.3750 Debug ServiceControllerExtension DeleteService succeeded [name=AATPSensor]
2022-02-03 04:12:43.3750 Debug CreateServiceAction Revert finished
2022-02-03 04:12:43.3750 Warn CreateServicesActionGroup Revert reverting [rollbackAction=SetServicePreshutdownTimeoutAction index=4 count=8]
2022-02-03 04:12:43.3750 Debug SetServicePreshutdownTimeoutAction Revert started
2022-02-03 04:12:43.3750 Debug SetServicePreshutdownTimeoutAction Revert finished
2022-02-03 04:12:43.3750 Warn CreateServicesActionGroup Revert reverting [rollbackAction=ConfigureServiceAction index=5 count=8]
2022-02-03 04:12:43.3750 Debug ConfigureServiceAction Revert started
2022-02-03 04:12:43.3750 Debug ConfigureServiceAction Revert finished
2022-02-03 04:12:43.3750 Warn CreateServicesActionGroup Revert reverting [rollbackAction=SetServiceDescriptionAction index=6 count=8]
2022-02-03 04:12:43.3750 Debug SetServiceDescriptionAction Revert started
2022-02-03 04:12:43.3750 Debug SetServiceDescriptionAction Revert finished
2022-02-03 04:12:43.3750 Warn CreateServicesActionGroup Revert reverting [rollbackAction=CreateServiceAction index=7 count=8]
2022-02-03 04:12:43.3750 Debug CreateServiceAction Revert started
2022-02-03 04:12:43.4063 Debug ServiceControllerExtension DeleteService succeeded [name=AATPSensorUpdater]
2022-02-03 04:12:43.4063 Debug CreateServiceAction Revert finished
2022-02-03 04:12:43.4063 Debug CreateServicesActionGroup Revert finished
2022-02-03 04:12:43.4063 Warn InstallActionGroup Revert reverting [rollbackAction=SaveSensorMandatoryConfigurationAction index=1 count=4]
2022-02-03 04:12:43.4063 Debug SaveSensorMandatoryConfigurationAction Revert started
2022-02-03 04:12:43.4063 Debug SaveSensorMandatoryConfigurationAction Revert finished
2022-02-03 04:12:43.4063 Warn InstallActionGroup Revert reverting [rollbackAction=CreateSensorAction index=2 count=4]
2022-02-03 04:12:43.4063 Debug CreateSensorAction Revert started
2022-02-03 04:12:43.4063 Warn JsonSerializerSettingsExtension+JsonSerializationBinder UpdateCurrentDomainAssemblyTypes GetExportedTypes failed [assembly=Microsoft.AspNetCore.Http.Abstractions, Version=2.2.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60 exception.Message=Could not load file or assembly 'Microsoft.AspNetCore.Http.Features, Version=2.2.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60' or one of its dependencies. The system cannot find the file specified.]
2022-02-03 04:12:43.4219 Warn JsonSerializerSettingsExtension+JsonSerializationBinder UpdateCurrentDomainAssemblyTypes GetSerializableMembers failed [AssemblyQualifiedName=Microsoft.Tri.Common.RemediationActionData, Microsoft.Tri.Common, Version=2.171.14934.11377, Culture=neutral, PublicKeyToken=null AssemblyQualifiedName=Microsoft.Tri.Common.RemediationActionData, Microsoft.Tri.Common, Version=2.171.14934.11377, Culture=neutral, PublicKeyToken=null exception.Message=Could not load file or assembly 'Microsoft.Azure.Security.Detection.AlertContracts, Version=5.3.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.]
2022-02-03 04:12:43.9376 Debug CreateSensorAction Revert finished
2022-02-03 04:12:43.9376 Warn InstallActionGroup Revert reverting [rollbackAction=CreateCertificateAction index=3 count=4]
2022-02-03 04:12:43.9376 Debug CreateCertificateAction Revert started
2022-02-03 04:12:43.9376 Debug CreateCertificateAction Revert finished
2022-02-03 04:12:43.9376 Debug InstallActionGroup Revert finished
2022-02-03 04:12:44.0626 Error EventLogException Deployer failed [arguments=VGmKamZFKTHijyHvdXBC+Q==]
System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
at void System.Diagnostics.Eventing.Reader.EventLogException.Throw(int errorCode)
at void System.Diagnostics.Eventing.Reader.NativeWrapper.EvtSaveChannelConfig(EventLogHandle channelConfig, int flags)
at bool Microsoft.Tri.Sensor.Deployment.Deployer.ConfigureVirtualServiceAccountAction.ApplyInternal()
at void Microsoft.Tri.Sensor.Common.DeploymentAction.Apply(bool suppressFailure)
at void Microsoft.Tri.Sensor.Common.DeploymentActionGroup.Apply(bool suppressFailure)
at int Microsoft.Tri.Sensor.Deployment.Deployer.Program.Main(string[] commandLineArguments)
13 Replies
I found a solution to this issue by running the installer within SYSTEM privileges. I did it with a Task Schedule on both of my failing servers successfully.
Carl_ChabotThank you! That solved our issue with the installation on 2019 domain controllers in Google Cloud
- Martin_Schvartzman
Microsoft
ChordRagingMoon Carl_Chabot MaximeRastello ZantenB
https://docs.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-release-2173
We've released the updated installation package. Please note it may take a couple of days to reach your sensor download page.
- Martin_Schvartzman
Carl_Chabot Mlourh MaximeRastello ZantenB
We already added this to our documentation:
https://docs.microsoft.com/en-us/defender-for-identity/troubleshooting-known-issues#problem-installing-the-sensor-on-windows-server-2019-with-kb5009557-installed
The updated installer should be released sometime next week, or the one after that.
- Martin_Schvartzman
We've seen this a couple of times now. It occurs only on Windows Server 2019, with kb5009557 installed.
We'll release an update to the sensor installation probably next week to address this issue too.Martin_Schvartzman same issue here with KB5009616 installed on my 2019 DC in Azure.
Martin_Schvartzman Please keep us in the loop, I'm encountering the same issues here, and really need this, to continue with DC deployment. Using 2019 server as well...
And kb5009557 is present..
PS C:\windows\system32> Get-WUHistory | ? { $_.title -match 'kb5009557' } ComputerName Operationname Result Date Title ------------ ------------- ------ ---- ----- <DCNAME> Installation Succeeded 1/21/2022 12:31:... 2022-01 Cumulative Update for Windows Server 2019 (1809) for x64-based Systems (KB5009557)
