Forum Discussion

JPaul's avatar
JPaul
Copper Contributor
Oct 02, 2024

MDI Sensor failing to install on ADCS Server

Hello,

 

I am trying to install a MDI Sensor on an ADCS server. This server has all outbound internet access blocked. I created an outbound rule for Azure Advanced Threat Protection to allow the MDI Sensor.

 

Is this correct?

 

These are the errors I am getting when installing a MDI Sensor on an ADCS server.

 

Microsoft.Tri.Sensor.Deployment.Deployer

2024-10-02 10:04:25.1391 Info  Program Main Deployer started [arguments=r7gvAnpYDNqZBFeN0Z9CiA==]
2024-10-02 10:04:25.2641 Debug InstallActionGroup Apply started
2024-10-02 10:04:25.2641 Debug CreateCertificateAction Apply started [suppressFailure=False]
2024-10-02 10:04:40.7257 Debug CreateCertificateAction Apply finished
2024-10-02 10:04:40.7257 Debug CreateSensorAction Apply started [suppressFailure=False]
2024-10-02 10:04:41.4288 Info  CreateSensorAction ApplyInternal Adfs installation research log [adfsCommandOutput=Get-Command : The term 'Get-AdfsProperties' is not recognized as the name of a cmdlet, function, script file, or 
operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try 
again.
At line:1 char:2
+ (Get-Command Get-AdfsProperties).Source
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-AdfsProperties:String) [Get-Command], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException,Microsoft.PowerShell.Commands.GetCommandCommand
 
 adfssrv state=null user=SERVER\NAME]
2024-10-02 10:04:41.4288 Info  CreateSensorAction ApplyInternal Sense machine id registry value: <HIDDEN>
2024-10-02 10:04:41.4445 Debug InstallActionGroup Revert started
2024-10-02 10:04:41.4445 Warn  InstallActionGroup Revert reverting [rollbackAction=CreateCertificateAction index=0 count=1]
2024-10-02 10:04:41.4445 Debug CreateCertificateAction Revert started
2024-10-02 10:04:41.4601 Debug CreateCertificateAction Revert finished
2024-10-02 10:04:41.4601 Debug InstallActionGroup Revert finished
2024-10-02 10:04:41.5538 Error DnsName Deployer failed [arguments=HIDDEN]
Microsoft.Tri.Infrastructure.ExtendedException: Failed to parse DnsName [name=HIDDEN]
   at DnsName Microsoft.Tri.Common.DnsName.Parse(string name, bool shouldRequireDomainName)
   at bool Microsoft.Tri.Sensor.Deployment.Deployer.CreateSensorAction.ApplyInternal()
   at void Microsoft.Tri.Sensor.Common.DeploymentAction.Apply(bool suppressFailure)
   at void Microsoft.Tri.Sensor.Common.DeploymentActionGroup.Apply(bool suppressFailure)
   at int Microsoft.Tri.Sensor.Deployment.Deployer.Program.Main(string[] commandLineArguments)

 

Can anyone help me why the sensor is failing to install?

1 Reply

  • JPaul This is not a connection issue.
    The code is failing when we call GetComputerNameEx with ComputerNameDnsFullyQualified,

    But for some reason we are unable to parse the result as a standard Dns address.
    Can you send the value of "name=HIDDEN" in a private message ?
    This indicates the value we got back from the call but were unable to parse.
    Another option is to open a support case, but make sure to send the real data without hiding through the secured workspace there.

    Eli

Resources