Forum Discussion
Azure ATP Sensor install failing (Updater Service do not start)
Actually, the solution in our case was to use Silent Installation (https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-silent-installation#proxy-authentication) and provide the Proxy Information in the commandline.
Thank you all for helping and advising!!!
No - there is no SSL inspection on the proxy... and in the proxy logs no blocks for this server. Very strange.
Local Firewall is switched off. So for this SSL connection to localhost on port 444, i cannot see any reasons that this should be not possible.
MicrosoftPhilippFoeckeler , Any chance you can temporary bypass this proxy just to see if it resolves the issue?
At least for the error sample you published, the problem is going to the azure backend, not to localhost.
EliOfek , First of all Thank you so much for the help so far!!
Unfortunately, we are still stuck at the same point - the system is sensitive and Risk and Security Team do not allow to connect directly to the internet, even if it's temporary..
What we tried in the meantime:
We enabled routing to another Proxy which is used by other Domain Controllers (where the ATP sensor could be installed without any problems).... Proxy can be used in the browser, proxy was set as system proxy.... same issue - no blocks whatsoever are visible at the proxy.
We disabled local endpoint protection for this server (Cisco AMP) during the install....same issue.
I think i will open a Premier Support Ticket so that a MS Engineer can have a look in a remote session on this server....
I am getting exactly the same error at my client's site. Identical configuration used each time, majority of DCs installation works fine, but on those that don't I see exactly the same issue as you describe.
While the install is proceeding (or stuck mid point as you are seeing), the sensor appears in the console in a stopped state (it is even possible to configure the update settings), but when the client install eventually times out with the error, the sensor gets cleared out of the console as well. The only other symptom I have noticed is the multiple 'unexpected restart' entries in the system log and the ATP Sensor updater service usually stuck in the 'starting state'. I have not found any issues with the WMI performance adaptor either, something I checked because it is a dependency of the Sensor updater service.
- EliOfek
Richard Adams , a bit confused, are you getting the same error during deployment or service start?
Vishal_Sharma_4224PhilippFoeckeler So the issue has been resolved now 🙂
