One of our company's clients is implementing ATP on a dozen or so domain controllers. After installation, all of them are running into the same problem: the AATPSensor service is stuck in "Starting" status and the error logs under C:\Program Files\Azure Advanced Threat Protection Sensor\<version number>\Logs all throw the following:
2019-02-08 20:21:23.0620 Error DirectoryServicesClient+<CreateLdapConnectionAsync>d__33 Microsoft.Tri.Infrastructure.ExtendedException: CreateLdapConnectionAsync failed [DomainControllerDnsName=[redacted for client privacy]]
at async Task<LdapConnection> Microsoft.Tri.Sensor.DirectoryServicesClient.CreateLdapConnectionAsync(DomainControllerConnectionData domainControllerConnectionData, bool isGlobalCatalog, bool isTraversing)
at async Task<bool> Microsoft.Tri.Sensor.DirectoryServicesClient.TryCreateLdapConnectionAsync(DomainControllerConnectionData domainControllerConnectionData, bool isGlobalCatalog, bool isTraversing)
2019-02-08 20:21:23.0620 Error DirectoryServicesClient Microsoft.Tri.Infrastructure.ExtendedException: Failed to communicate with configured domain controllers
at new Microsoft.Tri.Sensor.DirectoryServicesClient(IConfigurationManager configurationManager, IDomainNetworkCredentialsManager domainNetworkCredentialsManager, IMetricManager metricManager, IWorkspaceApplicationSensorApiJsonProxy workspaceApplicationSensorApiJsonProxy)
at object lambda_method(Closure, object[])
at object Autofac.Core.Activators.Reflection.ConstructorParameterBinding.Instantiate()
at void Microsoft.Tri.Infrastructure.ModuleManager.AddModules(Type[] moduleTypes)
at ModuleManager Microsoft.Tri.Sensor.SensorService.CreateModuleManager()
at async Task Microsoft.Tri.Infrastructure.Service.OnStartAsync()
at void Microsoft.Tri.Infrastructure.TaskExtension.Await(Task task)
at void Microsoft.Tri.Infrastructure.Service.OnStart(string[] args)
Unfortunately, I do not have direct access to the client's ATP portal to get in and gather additional information, but do have access to the DCs to troubleshoot. On the portal side, the client is seeing the following errors:
Sensor stopped communicating
There has not been communication from the Sensor [dc name] for a day. Last communication was on [date and time sensor was installed]
Recommendations
- Check that the Sensor service is up and running.
- Check the communications between the Sensor to [client portal address]
Has anyone encountered this before or know what may be causing this? Based on the error, it appears it can't establish an LDAP connection, but to my knowledge there shouldn't be any issues with ports.
Could it possibly have something to do with the domain trusts? nltest /domain_trusts output is the following:
List of domain trusts:
0: [client domain 4] (NT 5) (Direct Outbound) (Direct Inbound) ( Attr: 0x8 )
1: [MSP domain] (NT 5) (Direct Outbound) (Direct Inbound) ( Attr: quarantined )
2: [MSP domain] (NT 5) (Direct Outbound) ( Attr: 0x8 )
3: [client domain 3] (NT 5) (Direct Outbound) ( Attr: 0x8 )
4: [client domain 2] (NT 5) (Direct Outbound) (Direct Inbound) ( Attr: 0x8 )
5: [client domain 1] (NT 5) (Forest Tree Root) (Primary Domain) (Native)
The command completed successfully
