Forum Discussion
Error installing ATP Sensor on 2019 DC
I found a solution to this issue by running the installer within SYSTEM privileges. I did it with a Task Schedule on both of my failing servers successfully. 
Carl_ChabotThank you! That solved our issue with the installation on 2019 domain controllers in Google Cloud
- Martin_Schvartzman
Microsoft
ChordRagingMoon Carl_Chabot MaximeRastello ZantenB
https://docs.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-release-2173
We've released the updated installation package. Please note it may take a couple of days to reach your sensor download page.
Martin_Schvartzman has anything changed yet again?
we AGAIN have problems installing the agent on new Domain Controllers
The network connection is tested and ok.
I must say I'm getting a little tired of keeping on troubleshooting the installation of this specific agent while so many other agents install without problems.
why doesn't the agent just install initially, then it can start complaining but at least we have something to work with.
the current error in the setup logfile is :
[2964:292C][2022-07-18T10:13:23]i000: 2022-07-18 08:13:23.7360 Debug DeploymentModel .ctor [\[]IsAfterRestartAndConfigured=False[\]]
[2964:26C8][2022-07-18T10:13:24]i000: 2022-07-18 08:13:24.5014 Error DeploymentModel ValidateCreateSensorAsync Microsoft.Tri.Infrastructure.ExtendedException: Sanitized exception: [\[]Type=System.Net.Http.HttpRequestExceptionMessage=kZbHZ02cunBcHiKyFrnbkg==StackTrace= at async Task<HttpResponseMessage> System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task<HttpResponseMessage> sendTask, HttpRequestMessage request, CancellationTokenSource cts, bool disposeCts)
at async Task<TResponse> Microsoft.Tri.Common.CommunicationWebClient.SendAsync<TResponse>(byte[\[][\]] requestBytes, int offset, int count)
at async Task<TResponse> Microsoft.Tri.Common.CommunicationWebClient.SendWithRetryAsync<TResponse>(byte[\[][\]] requestBytes, int offset, int count)InnerException=Microsoft.Tri.Infrastructure.ExtendedException: Sanitized exception: [\[]Type=System.Net.WebExceptionMessage=YWn4O7TiLMlSvbtZSOMfpg==StackTrace= at Stream System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, out TransportContext context)
at void System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar)InnerException=Microsoft.Tri.Infrastructure.ExtendedException: Sanitized exception: [\[]Type=System.IO.IOExceptionMessage=nBkgxS0EDE8CUEg8Ec4cXw==StackTrace= at void System.Net.TlsStream.EndWrite(IAsyncResult asyncResult)
at void System.Net.PooledStream.EndWrite(IAsyncResult asyncResult)
at void System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)InnerException=Microsoft.Tri.Infrastructure.ExtendedException: Sanitized exception: [\[]Type=System.Net.Sockets.SocketExceptionMessage=kPgB8WP+JwtA6gCzvetX8A==StackTrace= at int System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
at int System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)InnerException=[\]][\]][\]][\]]
at Microsoft.Tri.Common.CommunicationWebClient.<SendWithRetryAsync>d__9`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Tri.Common.CommunicationWebClient.<SendAsync>d__7.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Tri.Sensor.Common.WorkspaceApplicationSensorApiDeploymentProxy.<SendAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Tri.Sensor.Deployment.Bundle.UI.DeploymentModel.<ValidateCreateSensorAsync>d__52.MoveNext() failed connecting to service. The issue can be caused by a transparent proxy configuration [\[]WorkspaceApplicationSensorApiEndpoint=Unspecified/***REMOVED***sensorapi.atp.azure.com:443[\]]note: the 443 port connection to *sensorapi.atp.azure.com is working..
- EliOfek
ZantenB
The sensor installation has 2 phases of connecting to the backend.
The first one is authenticating using the access key supplied to register the sensor machine.
The second one is after the sensor was registered and was issued a certificate, we call
"ValidateCreateSensorAsync" which is the fist time we try to authenticate with the cert the sensor does during runtime via mutual authentication.
According to the stack, this is where you fail, so most likely it's not a matter of connecting to the endpoint, but most likely you have SSL inspection that interferes with the mutual authentication, or missing root certificates that won't allow you to validate certs correctly.
In theory , we could "force install" the sensor and fail with a similar error right after that, how would that give you "something to work with" that we don't get here?
As to why other agents do not fail, I can't comment without knowing their implementation, my guess is that there are not using mutual authentication, but it's just a guess.
