Forum Discussion
Azure ATP Sensor install failing (Updater Service do not start)
Actually, the solution in our case was to use Silent Installation (https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-silent-installation#proxy-authentication) and provide the Proxy Information in the commandline.
Thank you all for helping and advising!!!
this is log erros
22B8:27F0][2020-06-02T12:20:23]i301: Applying execute package: MsiPackage, action: Install, path: C:\ProgramData\Package Cache\{F288B034-5037-4734-8CBD-B38388555443}v2.0.0.0\Microsoft.Tri.Sensor.Deployment.Package.msi, arguments: ' ARPSYSTEMCOMPONENT="1" MSIFASTINSTALL="7" ACCESSKEY="*****" InstallationPath="C:\Program Files\Azure Advanced Threat Protection Sensor" InstalledVersion="" PROXYCONFIGURATION="*****" WixBundleOriginalSourceFolder="C:\Sources\Azure ATP Sensor Setup\"'
[22B8:27F0][2020-06-02T12:21:09]e000: Error 0x80070643: Failed to install MSI package.
[22B8:27F0][2020-06-02T12:21:09]e000: Error 0x80070643: Failed to execute MSI package.
[229C:1AE8][2020-06-02T12:21:09]e000: Error 0x80070643: Failed to configure per-machine MSI package.
[229C:1AE8][2020-06-02T12:21:09]i319: Applied execute package: MsiPackage, result: 0x80070643, restart: None
[229C:1AE8][2020-06-02T12:21:09]e000: Error 0x80070643: Failed to execute MSI package.
MicrosoftVishal_Sharma_4224 thanks for supporting me
on the physical DC the NIC Teaming it was configured before, but now is not configured,
Which Server OS are you running with?
i have two DCs ( one Physical and one VM on VMWare) both are WS 2012 R2 standard, with DHCP role installed.
i am trying to install NPCAP but i am facing an error
on the physical server
Npf service is running and no Npcap service.
on VM Server
Npf service is stopping and no Npcap service.
- Vishal_Sharma_4224
minah is NIC Teaming enabled on this machine..
In this case, the NPF service is not starting up, which works hand in hand with Winpcap\Npcap to capture the network activities.
Which Server OS are you running with?I 'd suggest you to install npcap which can be downloaded with the help link below (Remove if you are using any other Npcap version than 0.9984)
https://nmap.org/npcap/dist/npcap-0.9984.exeThen,try steps below in the sequential manner:
- Verify current files, Npcap & Npf services exist
In PowerShell:
get-item C:\Windows\System32\drivers\npf.sys
get-item C:\Windows\System32\drivers\npcap.sys
2. Verify service exist
Get-Service Npf | FL
Get-Service Npcap | FL
If npf service is still not started, reboot the sever.3. Install Azure ATP Sensor
Then Try & install the sensor setup . 2020-06-02 09:21:00.9589 Info Program Main Deployer started [arguments=s6RF2dHzFWtQ6a0bV+YdnQ==]
2020-06-02 09:21:01.1129 Debug InstallActionGroup Apply started
2020-06-02 09:21:01.1139 Debug CreateCertificateAction Apply started [suppressFailure=False]
2020-06-02 09:21:02.1310 Debug CreateCertificateAction Apply finished
2020-06-02 09:21:02.1320 Debug CreateSensorAction Apply started [suppressFailure=False]
2020-06-02 09:21:04.7894 Debug CreateSensorAction Apply finished
2020-06-02 09:21:04.7894 Debug SaveSensorMandatoryConfigurationAction Apply started [suppressFailure=False]
2020-06-02 09:21:04.8462 Debug SaveSensorMandatoryConfigurationAction Apply finished
2020-06-02 09:21:04.8462 Debug CreateServicesActionGroup Apply started
2020-06-02 09:21:04.8462 Debug CreateServiceAction Apply started [suppressFailure=False]
2020-06-02 09:21:04.8942 Debug CreateServiceAction Apply finished
2020-06-02 09:21:04.8942 Debug SetServiceDescriptionAction Apply started [suppressFailure=False]
2020-06-02 09:21:04.9102 Debug SetServiceDescriptionAction Apply finished
2020-06-02 09:21:04.9102 Debug ConfigureServiceAction Apply started [suppressFailure=False]
2020-06-02 09:21:04.9312 Debug ConfigureServiceAction Apply finished
2020-06-02 09:21:04.9312 Debug SetServicePreshutdownTimeoutAction Apply started [suppressFailure=False]
2020-06-02 09:21:04.9472 Debug SetServicePreshutdownTimeoutAction Apply finished
2020-06-02 09:21:04.9472 Debug CreateServiceAction Apply started [suppressFailure=False]
2020-06-02 09:21:04.9652 Debug CreateServiceAction Apply finished
2020-06-02 09:21:04.9652 Debug SetServiceDescriptionAction Apply started [suppressFailure=False]
2020-06-02 09:21:04.9842 Debug SetServiceDescriptionAction Apply finished
2020-06-02 09:21:04.9842 Debug ConfigureServiceAction Apply started [suppressFailure=False]
2020-06-02 09:21:05.0032 Debug ConfigureServiceAction Apply finished
2020-06-02 09:21:05.0032 Debug SetServicePreshutdownTimeoutAction Apply started [suppressFailure=False]
2020-06-02 09:21:05.0222 Debug SetServicePreshutdownTimeoutAction Apply finished
2020-06-02 09:21:05.0222 Debug CreateServicesActionGroup Apply finished
2020-06-02 09:21:05.0222 Debug ConfigureVirtualServiceAccountAction Apply started [suppressFailure=False]
2020-06-02 09:21:05.2782 Debug ConfigureVirtualServiceAccountAction Apply finished
2020-06-02 09:21:05.2782 Debug InstallWinPcapAction Apply started [suppressFailure=False]
2020-06-02 09:21:07.3383 Debug ServiceControllerExtension CreateKernelDriver service already exists [name=npf]
2020-06-02 09:21:07.4733 Error ServiceControllerExtension ChangeServiceStatus failed to change service status [name=npf status=Running Exception=System.InvalidOperationException: Cannot start service npf on computer '.'. ---> System.ComponentModel.Win32Exception: The system cannot find the file specified
--- End of inner exception stack trace ---
at System.ServiceProcess.ServiceController.Start(String[] args)
at Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String name, ServiceControllerStatus status, TimeSpan timeout, Nullable`1 awaitedStatus)]
2020-06-02 09:21:07.4783 Debug InstallActionGroup Revert started
2020-06-02 09:21:07.4793 Warn InstallActionGroup Revert reverting [rollbackAction=ConfigureVirtualServiceAccountAction index=0 count=5]
2020-06-02 09:21:07.4793 Debug ConfigureVirtualServiceAccountAction Revert started
2020-06-02 09:21:07.4793 Debug ConfigureVirtualServiceAccountAction Revert finished
2020-06-02 09:21:07.4793 Warn InstallActionGroup Revert reverting [rollbackAction=CreateServicesActionGroup index=1 count=5]
2020-06-02 09:21:07.4793 Debug CreateServicesActionGroup Revert started
2020-06-02 09:21:07.4793 Warn CreateServicesActionGroup Revert reverting [rollbackAction=SetServicePreshutdownTimeoutAction index=0 count=8]
2020-06-02 09:21:07.4793 Debug SetServicePreshutdownTimeoutAction Revert started
2020-06-02 09:21:07.4793 Debug SetServicePreshutdownTimeoutAction Revert finished
2020-06-02 09:21:07.4793 Warn CreateServicesActionGroup Revert reverting [rollbackAction=ConfigureServiceAction index=1 count=8]
2020-06-02 09:21:07.4793 Debug ConfigureServiceAction Revert started
2020-06-02 09:21:07.4793 Debug ConfigureServiceAction Revert finished
2020-06-02 09:21:07.4793 Warn CreateServicesActionGroup Revert reverting [rollbackAction=SetServiceDescriptionAction index=2 count=8]
2020-06-02 09:21:07.4793 Debug SetServiceDescriptionAction Revert started
2020-06-02 09:21:07.4793 Debug SetServiceDescriptionAction Revert finished
2020-06-02 09:21:07.4793 Warn CreateServicesActionGroup Revert reverting [rollbackAction=CreateServiceAction index=3 count=8]
2020-06-02 09:21:07.4793 Debug CreateServiceAction Revert started
2020-06-02 09:21:07.5253 Debug ServiceControllerExtension DeleteService succeeded [name=AATPSensor]
2020-06-02 09:21:07.5253 Debug CreateServiceAction Revert finished
2020-06-02 09:21:07.5253 Warn CreateServicesActionGroup Revert reverting [rollbackAction=SetServicePreshutdownTimeoutAction index=4 count=8]
2020-06-02 09:21:07.5253 Debug SetServicePreshutdownTimeoutAction Revert started
2020-06-02 09:21:07.5253 Debug SetServicePreshutdownTimeoutAction Revert finished
2020-06-02 09:21:07.5253 Warn CreateServicesActionGroup Revert reverting [rollbackAction=ConfigureServiceAction index=5 count=8]
2020-06-02 09:21:07.5253 Debug ConfigureServiceAction Revert started
2020-06-02 09:21:07.5253 Debug ConfigureServiceAction Revert finished
2020-06-02 09:21:07.5253 Warn CreateServicesActionGroup Revert reverting [rollbackAction=SetServiceDescriptionAction index=6 count=8]
2020-06-02 09:21:07.5253 Debug SetServiceDescriptionAction Revert started
2020-06-02 09:21:07.5253 Debug SetServiceDescriptionAction Revert finished
2020-06-02 09:21:07.5253 Warn CreateServicesActionGroup Revert reverting [rollbackAction=CreateServiceAction index=7 count=8]
2020-06-02 09:21:07.5253 Debug CreateServiceAction Revert started
2020-06-02 09:21:07.5743 Debug ServiceControllerExtension DeleteService succeeded [name=AATPSensorUpdater]
2020-06-02 09:21:07.5753 Debug CreateServiceAction Revert finished
2020-06-02 09:21:07.5753 Debug CreateServicesActionGroup Revert finished
2020-06-02 09:21:07.5753 Warn InstallActionGroup Revert reverting [rollbackAction=SaveSensorMandatoryConfigurationAction index=2 count=5]
2020-06-02 09:21:07.5753 Debug SaveSensorMandatoryConfigurationAction Revert started
2020-06-02 09:21:07.5753 Debug SaveSensorMandatoryConfigurationAction Revert finished
2020-06-02 09:21:07.5753 Warn InstallActionGroup Revert reverting [rollbackAction=CreateSensorAction index=3 count=5]
2020-06-02 09:21:07.5753 Debug CreateSensorAction Revert started
2020-06-02 09:21:08.6974 Debug CreateSensorAction Revert finished
2020-06-02 09:21:08.6974 Warn InstallActionGroup Revert reverting [rollbackAction=CreateCertificateAction index=4 count=5]
2020-06-02 09:21:08.6984 Debug CreateCertificateAction Revert started
2020-06-02 09:21:08.7234 Debug CreateCertificateAction Revert finished
2020-06-02 09:21:08.7234 Debug InstallActionGroup Revert finished
2020-06-02 09:21:08.9814 Error DeploymentAction Deployer failed
Microsoft.Tri.Infrastructure.ExtendedException: Apply failed [Type=InstallWinPcapAction]
at void Microsoft.Tri.Sensor.Common.DeploymentAction.Apply(bool suppressFailure)
at void Microsoft.Tri.Sensor.Common.DeploymentActionGroup.Apply(bool suppressFailure)
at int Microsoft.Tri.Sensor.Deployment.Deployer.Program.Main(string[] commandLineArguments)
