SOLVED

Azure ATP Sensor install failing (Updater Service do not start)

%3CLINGO-SUB%20id%3D%22lingo-sub-1078431%22%20slang%3D%22en-US%22%3EAzure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1078431%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20All!%3C%2FP%3E%3CP%3EWe%20try%20to%20install%20the%20Azure%20ATP%20Sensor%20on%20a%20DC%2C%20setup%20wizard%20is%20running%20until%20this%20point%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-left%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F162931iF8C18808ED389AD9%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22ATP%20Sensor.png%22%20title%3D%22ATP%20Sensor.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E...then%20do%20some%20retries%20for%20about%203%20minutes%2C%20during%20this%20time%20the%20service%20%22Azure%20Advanced%20Threat%20Protection%20Sensor%20Updater%22%20is%20several%20times%20on%20state%20%22starting%22%20und%20back%20to%20not%20started.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThen%20setup%20fails%20with%200x80070643%20and%20do%20a%20rollback.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20the%20%22Microsoft.Tri.Sensor.Updater-Errors%22%20log%2C%20we%20find%20this%20error%20every%2010%20seconds%20during%20the%20setup%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3E2019-12-23%2011%3A27%3A37.8384%20Error%20CommunicationWebClient%2B%3CSENDWITHRETRYASYNC%3Ed__8%601%20Microsoft.Tri.Infrastructure.ExtendedException%3A%20Sanitized%20exception%3A%20%5BType%3DSystem.Net.Http.HttpRequestExceptionMessage%3D7INzM3PVZQKggOiiHcWjqw%3D%3DStackTrace%3D%20at%20async%20Task%3CHTTPRESPONSEMESSAGE%3E%20System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task%3CHTTPRESPONSEMESSAGE%3E%20sendTask%2C%20HttpRequestMessage%20request%2C%20CancellationTokenSource%20cts%2C%20bool%20disposeCts)%3C%2FHTTPRESPONSEMESSAGE%3E%3C%2FHTTPRESPONSEMESSAGE%3E%3C%2FSENDWITHRETRYASYNC%3E%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20async%20Task%3CTRESPONSE%3E%20Microsoft.Tri.Common.CommunicationWebClient.SendAsync%3CTRESPONSE%3E(byte%5B%5D%20requestBytes%2C%20int%20offset%2C%20int%20count)%3C%2FTRESPONSE%3E%3C%2FTRESPONSE%3E%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20async%20Task%3CTRESPONSE%3E%20Microsoft.Tri.Common.CommunicationWebClient.SendWithRetryAsync%3CTRESPONSE%3E(byte%5B%5D%20requestBytes%2C%20int%20offset%2C%20int%20count)InnerException%3DMicrosoft.Tri.Infrastructure.ExtendedException%3A%20Sanitized%20exception%3A%20%5BType%3DSystem.Net.WebExceptionMessage%3D5iiWw0iPCPzCGdZStU4OxA%3D%3DStackTrace%3D%20at%20Stream%20System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult%20asyncResult%2C%20out%20TransportContext%20context)%3C%2FTRESPONSE%3E%3C%2FTRESPONSE%3E%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20void%20System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult%20ar)InnerException%3D%5D%5D%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20async%20Task%3CTRESPONSE%3E%20Microsoft.Tri.Common.CommunicationWebClient.SendWithRetryAsync%3CTRESPONSE%3E(byte%5B%5D%20requestBytes%2C%20int%20offset%2C%20int%20count)%3C%2FTRESPONSE%3E%3C%2FTRESPONSE%3E%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20async%20Task%3CTRESPONSE%3E%20Microsoft.Tri.Common.CommunicationWebClient.SendAsync%3CTRESPONSE%3E(IRequestWithResponse%3CTRESPONSE%3E%20request)%3C%2FTRESPONSE%3E%3C%2FTRESPONSE%3E%3C%2FTRESPONSE%3E%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20async%20Task%3CTRESPONSE%3E%20Microsoft.Tri.Sensor.Common.ServiceProxy%3CTWEBCLIENTCONFIGURATION%3E.SendAsync%3CTRESPONSE%3E(IRequestWithResponse%3CTRESPONSE%3E%20request)%3C%2FTRESPONSE%3E%3C%2FTRESPONSE%3E%3C%2FTWEBCLIENTCONFIGURATION%3E%3C%2FTRESPONSE%3E%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20async%20Task%20Microsoft.Tri.Sensor.Updater.SensorUpdaterConfigurationUpdater.UpdateConfigurationAsync(bool%20isStarted)%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20void%20Microsoft.Tri.Infrastructure.TaskExtension.Await(Task%20task)%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20new%20Microsoft.Tri.Sensor.Updater.SensorUpdaterConfigurationUpdater(IConfigurationManager%20configurationManager%2C%20IMetricManager%20metricManager%2C%20ISecretManager%20secretManager%2C%20IWorkspaceApplicationSensorApiJsonProxy%20workspaceApplicationSensorApiJsonProxy)%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20object%20lambda_method(Closure%2C%20object%5B%5D)%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20object%20Autofac.Core.Activators.Reflection.ConstructorParameterBinding.Instantiate()%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20void%20Microsoft.Tri.Infrastructure.ModuleManager.AddModules(Type%5B%5D%20moduleTypes)%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20ModuleManager%20Microsoft.Tri.Sensor.Updater.SensorUpdaterService.CreateModuleManager()%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20async%20Task%20Microsoft.Tri.Infrastructure.Service.OnStartAsync()%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20void%20Microsoft.Tri.Infrastructure.TaskExtension.Await(Task%20task)%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22lucida%20sans%20unicode%2Clucida%20sans%22%20size%3D%221%202%203%204%205%206%207%22%20color%3D%22%23993300%22%3Eat%20void%20Microsoft.Tri.Infrastructure.Service.OnStart(string%5B%5D%20args)%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EA%20proxy%20is%20used%20which%20allows%20access%20to%20*.atp.azure.com%20without%20auth.%20In%20proxy%20logs%2C%20we%20see%20no%20block%20for%20this%20server%2C%20only%20successful%20requests%20from%20this%20DC.%20There%20is%20no%20indication%20that%20443%20would%20be%20blocked%20somewhere%20else...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20AD%20account%20which%20is%20configured%20in%20the%20ATP%20portal%20was%20checked%2C%20domain%20is%20given%20in%20FQDN%20there%20and%20the%20password%20is%20correct.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20ideas%20someone%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1078522%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1078522%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F496863%22%20target%3D%22_blank%22%3E%40PhilippFoeckeler%3C%2FA%3E%26nbsp%3BEffectively%20this%20error%20means%20it%20was%20blocked.%3C%2FP%3E%0A%3CP%3EIs%20your%20proxy%20doing%20SSL%20inspection%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1081417%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1081417%22%20slang%3D%22en-US%22%3E%3CP%3ENo%20-%20there%20is%20no%20SSL%20inspection%20on%20the%20proxy...%20and%20in%20the%20proxy%20logs%20%26nbsp%3Bno%20blocks%20for%20this%20server.%20Very%20strange.%26nbsp%3B%3C%2FP%3E%3CP%3ELocal%20Firewall%20is%20switched%20off.%20So%20for%20this%20SSL%20connection%20to%20localhost%20on%20port%20444%2C%20i%20cannot%20see%20any%20reasons%20that%20this%20should%20be%20not%20possible.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1082467%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1082467%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F496863%22%20target%3D%22_blank%22%3E%40PhilippFoeckeler%3C%2FA%3E%26nbsp%3B%2C%20Any%20chance%20you%20can%20temporary%20bypass%20this%20proxy%20just%20to%20see%20if%20it%20resolves%20the%20issue%3F%3CBR%20%2F%3EAt%20least%20for%20the%20error%20sample%20you%20published%2C%20the%20problem%20is%20going%20to%20the%20azure%20backend%2C%20not%20to%20localhost.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1104443%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1104443%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F106935%22%20target%3D%22_blank%22%3E%40Eli%20Ofek%3C%2FA%3E%26nbsp%3B%2C%20First%20of%20all%20Thank%20you%20so%20much%20for%20the%20help%20so%20far!!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUnfortunately%2C%20we%20are%20still%20stuck%20at%20the%20same%20point%20-%20the%20system%20is%20sensitive%20and%20Risk%20and%20Security%20Team%20do%20not%20allow%20to%20connect%20directly%20to%20the%20internet%2C%20even%20if%20it's%20temporary..%3C%2FP%3E%3CP%3EWhat%20we%20tried%20in%20the%20meantime%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20enabled%20routing%20to%20another%20Proxy%20which%20is%20used%20by%20other%20Domain%20Controllers%20(where%20the%20ATP%20sensor%20could%20be%20installed%20without%20any%20problems)....%20Proxy%20can%20be%20used%20in%20the%20browser%2C%20proxy%20was%20set%20as%20system%20proxy....%20same%20issue%20-%20no%20blocks%20whatsoever%20are%20visible%20at%20the%20proxy.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20disabled%20local%20endpoint%20protection%20for%20this%20server%20(Cisco%20AMP)%20during%20the%20install....same%20issue.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20think%20i%20will%20open%20a%20Premier%20Support%20Ticket%20so%20that%20a%20MS%20Engineer%20can%20have%20a%20look%20in%20a%20remote%20session%20on%20this%20server....%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1171697%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1171697%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F496863%22%20target%3D%22_blank%22%3E%40PhilippFoeckeler%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20getting%20exactly%20the%20same%20error%20at%20my%20client's%20site.%20Identical%20configuration%20used%20each%20time%2C%20majority%20of%20DCs%20installation%20works%20fine%2C%20but%20on%20those%20that%20don't%20I%20see%20exactly%20the%20same%20issue%20as%20you%20describe.%3C%2FP%3E%3CP%3EWhile%20the%20install%20is%20proceeding%20(or%20stuck%20mid%20point%20as%20you%20are%20seeing)%2C%20the%20sensor%20appears%20in%20the%20console%20in%20a%20stopped%20state%20(it%20is%20even%20possible%20to%20configure%20the%20update%20settings)%2C%20but%20when%20the%20client%20install%20eventually%20times%20out%20with%20the%20error%2C%20the%20sensor%20gets%20cleared%20out%20of%20the%20console%20as%20well.%20The%20only%20other%20symptom%20I%20have%20noticed%20is%20the%20multiple%20'unexpected%20restart'%20entries%20in%20the%20system%20log%20and%20the%20ATP%20Sensor%20updater%20service%20usually%20stuck%20in%20the%20'starting%20state'.%20I%20have%20not%20found%20any%20issues%20with%20the%20WMI%20performance%20adaptor%20either%2C%20something%20I%20checked%20because%20it%20is%20a%20dependency%20of%20the%20Sensor%20updater%20service.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1171790%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1171790%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F48229%22%20target%3D%22_blank%22%3E%40Richard%20Adams%3C%2FA%3E%26nbsp%3B%2C%20a%20bit%20confused%2C%20are%20you%20getting%20the%20same%20error%20during%20deployment%20or%20service%26nbsp%3B%20start%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1171849%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1171849%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F106935%22%20target%3D%22_blank%22%3E%40Eli%20Ofek%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3ESame%20as%20the%20poster's%20original%20screenshot.%20The%20installation%20gets%20stuck%20(about%20midway%20through%20according%20to%20the%20GUI).%20After%20a%20long%20wait%20it%20removes%20the%20sensor%20from%20the%20console%2C%20backs%20out%20the%20client%20install%20and%20displays%20the%20installation%20failure%20error%20(0x80070643)%20which%20suggests%20proxy%20issues%2C%20but%20if%20this%20was%20the%20case%20how%20would%20the%20client%20register%20in%20Security%20Center%20in%20the%20first%20place%3F%26nbsp%3B%20I%20am%20using%20exactly%20the%20same%20installation%20process%20on%20all%20my%20Client's%20DCs%2C%20so%20far%20I%20have%20had%2015%20successful%20and%20another%205%20or%20so%20fail.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERichard%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1171912%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1171912%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F48229%22%20target%3D%22_blank%22%3E%40Richard%20Adams%3C%2FA%3E%26nbsp%3BThe%20screenshot%20alone%20does%20not%20mean%20it's%20the%20same%20issue.%3C%2FP%3E%0A%3CP%3EAnd%20you%20are%20right%2C%20if%20you%20managed%20to%20see%20it%20registers%20and%20removed%2C%20then%20it's%20most%20likely%20something%20else.%3C%2FP%3E%0A%3CP%3EYou%20will%20need%20to%20take%20a%20look%20at%20the%20logs%20to%20know%20why.%3C%2FP%3E%0A%3CP%3Esee%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure-advanced-threat-protection%2Ftroubleshooting-atp-using-logs%23azure-atp-deployment-logs%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure-advanced-threat-protection%2Ftroubleshooting-atp-using-logs%23azure-atp-deployment-logs%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1213289%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1213289%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F496863%22%20target%3D%22_blank%22%3E%40PhilippFoeckeler%3C%2FA%3E%20So%20the%20issue%20has%20been%20resolved%20now%20%3A)%3C%2Fimg%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1295036%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1295036%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F496863%22%20target%3D%22_blank%22%3E%40PhilippFoeckeler%3C%2FA%3E%26nbsp%3Bhow%20did%20you%20solve%20this%20issue%3F%20We%20are%20facing%20exactly%20the%20same.%201DC%20cannot%20connect%20to%20endpoint%2C%20all%20others%20can.%20Authentication%20and%20TLS%20inpection%20are%20already%20disabled%20on%20proxy.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1295130%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1295130%22%20slang%3D%22en-US%22%3E%3COL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F615511%22%20target%3D%22_blank%22%3E%40ricklahaye%3C%2FA%3E%20Please%20try%20silent%20install%20and%20use%20proxy%20URL%20in%20the%20command%20used.%20Also%2C%20select%20%3CSTRONG%3Ebypass%20proxy%20server%20for%20local%20server%3C%2FSTRONG%3E%20option%20in%20LAN%20settings%20of%20the%20browser.%26nbsp%3B%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3ESomething%20like%20below%3A-%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%22Azure%20ATP%20sensor%20Setup.exe%22%20%2Fquiet%20ProxyUrl%3D%22%3CA%20href%3D%22http%3A%2F%2Fabc.com%3Aport%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fabc.com%3Aport%3C%2FA%3E%20number%20of%20proxy%22%26nbsp%3BNetFrameworkCommandLineArguments%3D%22%2Fq%22%20AccessKey%3D%22%22%3C%2FFONT%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3ELet%20me%20know%20if%20that%20helps.%26nbsp%3B%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1312909%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1312909%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F544387%22%20target%3D%22_blank%22%3E%40Vishal_Sharma_4224%3C%2FA%3E%26nbsp%3BHI%20Vishal%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20having%20same%20issue%20while%20instilling%20ATP%20sensor%20.%3C%2FP%3E%3CP%3ETried%20to%20install%20silently%20but%20same%20error%20code%20it%20is%20getting.%26nbsp%3B%26nbsp%3B0x80070643%3C%2FP%3E%3CP%3EOur%20DC%20is%20hosted%20on%20private%20LB.%3C%2FP%3E%3CP%3Ewe%20are%20using%20proxy%20settings%20to%20connect%20the%20internet%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1313141%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1313141%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F624618%22%20target%3D%22_blank%22%3E%40Pritam1560%3C%2FA%3E%20Please%20paste%20the%20main%20error%20logs%20here..%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1313301%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1313301%22%20slang%3D%22en-US%22%3EIt%20would%20be%20great%20if%20can%20send%20the%20error%20ligs%20in%20a%20private%20message.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1315410%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1315410%22%20slang%3D%22en-US%22%3EPlease%20let%20me%20know%20what%20exactly%20do%20you%20see%20in%20deployment%5CMSI%20logs..%20Have%20you%20used%20command%20below%20while%20doing%20silent%20install%3F%20%22Azure%20ATP%20sensor%20Setup.exe%22%20%2Fquiet%20ProxyUrl%3D%22%3CA%20href%3D%22http%3A%2F%2Fabc.com%3Aport%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fabc.com%3Aport%3C%2FA%3E%20number%20of%20proxy%22%20NetFrameworkCommandLineArguments%3D%22%2Fq%22%20AccessKey%3D%22%22%20Also%2C%20please%20select%20option%20Bypass%20proxy%20server%20for%20local%20addresses%20in%20browser%20LAN%20settings%20if%20you%20are%20using%20browser%20specific%20proxy.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1315606%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1315606%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F544387%22%20target%3D%22_blank%22%3E%40Vishal_Sharma_4224%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20Vishal%20we%20have%20tried%20with%20silent%20instillation%20with%20bypass%20proxy%20enable%20but%20got%20same%20error.%3C%2FP%3E%3CP%3Ein%20logs%20we%20can%20see%20error%20returning%20code%26nbsp%3B%3C%2FP%3E%3CP%3E%5B20EC%3A2318%5D%5B2020-04-16T20%3A56%3A04%5Di007%3A%20Exit%20code%3A%200x80070643%2C%20restarting%3A%20No%3C%2FP%3E%3CP%3E1.is%20there%20any%20dependencies%20on%20.net%20frameowrk%26nbsp%3B%3C%2FP%3E%3CP%3E2.this%20dc%20is%20configured%20in%20standard%20load%20balencer%20.is%20that%20something%20to%20do%20with%20that%3C%2FP%3E%3CP%3EIn%20other%20DC%20which%20is%26nbsp%3B%20hosted%20in%20Europe%20region%20configured%20in%20Basic%20LB%20there%20ATP%20is%20installing%20properly%20same%20is%20not%20happening%20in%20another%20DC%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1335668%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1335668%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F624618%22%20target%3D%22_blank%22%3E%40Pritam1560%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYes%2C%20this%20is%20a%20dependency%20.NET%20Framework%204.7%20must%20be%20installed%20as%20a%20pre-requisite..%3C%2FP%3E%0A%3CP%3EFor%20all%20the%20pre-requisites%20you%20may%20refer%20link%20below%3A-%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure-advanced-threat-protection%2Fatp-prerequisites%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure-advanced-threat-protection%2Fatp-prerequisites%3C%2FA%3E%3C%2FFONT%3E%20.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1339288%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1339288%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F624618%22%20target%3D%22_blank%22%3E%40Pritam1560%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EWe%20are%20having%20same%20issue%26nbsp%3B%3C%2FSPAN%3E%2C%26nbsp%3B%20are%20you%20solve%20this%20issue%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1346597%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1346597%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F172593%22%20target%3D%22_blank%22%3E%40Mina%20Kamel%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ECould%20you%20please%20let%20us%20know%20what%20error%20are%20you%20witnessing%20in%20the%20Deployer%20logs%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1432945%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1432945%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F544387%22%20target%3D%22_blank%22%3E%40Vishal_Sharma_4224%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethis%20is%20log%20erros%3C%2FP%3E%3CP%3E22B8%3A27F0%5D%5B2020-06-02T12%3A20%3A23%5Di301%3A%20Applying%20execute%20package%3A%20MsiPackage%2C%20action%3A%20Install%2C%20path%3A%20C%3A%5CProgramData%5CPackage%20Cache%5C%7BF288B034-5037-4734-8CBD-B38388555443%7Dv2.0.0.0%5CMicrosoft.Tri.Sensor.Deployment.Package.msi%2C%20arguments%3A%20'%20ARPSYSTEMCOMPONENT%3D%221%22%20MSIFASTINSTALL%3D%227%22%20ACCESSKEY%3D%22*****%22%20InstallationPath%3D%22C%3A%5CProgram%20Files%5CAzure%20Advanced%20Threat%20Protection%20Sensor%22%20InstalledVersion%3D%22%22%20PROXYCONFIGURATION%3D%22*****%22%20WixBundleOriginalSourceFolder%3D%22C%3A%5CSources%5CAzure%20ATP%20Sensor%20Setup%5C%22'%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%5B22B8%3A27F0%5D%5B2020-06-02T12%3A21%3A09%5De000%3A%20Error%200x80070643%3A%20Failed%20to%20install%20MSI%20package.%3C%2FP%3E%3CP%3E%5B22B8%3A27F0%5D%5B2020-06-02T12%3A21%3A09%5De000%3A%20Error%200x80070643%3A%20Failed%20to%20execute%20MSI%20package.%3C%2FP%3E%3CP%3E%5B229C%3A1AE8%5D%5B2020-06-02T12%3A21%3A09%5De000%3A%20Error%200x80070643%3A%20Failed%20to%20configure%20per-machine%20MSI%20package.%3C%2FP%3E%3CP%3E%5B229C%3A1AE8%5D%5B2020-06-02T12%3A21%3A09%5Di319%3A%20Applied%20execute%20package%3A%20MsiPackage%2C%20result%3A%200x80070643%2C%20restart%3A%20None%3C%2FP%3E%3CP%3E%5B229C%3A1AE8%5D%5B2020-06-02T12%3A21%3A09%5De000%3A%20Error%200x80070643%3A%20Failed%20to%20execute%20MSI%20package.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1432968%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1432968%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F172593%22%20target%3D%22_blank%22%3E%40Mina%20Kamel%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPlease%20paste%20the%20sensor%5Cdeployer%20logs..%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1433055%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1433055%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F544387%22%20target%3D%22_blank%22%3E%40Vishal_Sharma_4224%3C%2FA%3E%26nbsp%3Bplease%20find%20the%20attached%20logs%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1433061%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1433061%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F544387%22%20target%3D%22_blank%22%3E%40Vishal_Sharma_4224%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E2020-06-02%2009%3A21%3A00.9589%20Info%20Program%20Main%20Deployer%20started%20%5Barguments%3Ds6RF2dHzFWtQ6a0bV%2BYdnQ%3D%3D%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A01.1129%20Debug%20InstallActionGroup%20Apply%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A01.1139%20Debug%20CreateCertificateAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A02.1310%20Debug%20CreateCertificateAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A02.1320%20Debug%20CreateSensorAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.7894%20Debug%20CreateSensorAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.7894%20Debug%20SaveSensorMandatoryConfigurationAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.8462%20Debug%20SaveSensorMandatoryConfigurationAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.8462%20Debug%20CreateServicesActionGroup%20Apply%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.8462%20Debug%20CreateServiceAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.8942%20Debug%20CreateServiceAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.8942%20Debug%20SetServiceDescriptionAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.9102%20Debug%20SetServiceDescriptionAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.9102%20Debug%20ConfigureServiceAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.9312%20Debug%20ConfigureServiceAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.9312%20Debug%20SetServicePreshutdownTimeoutAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.9472%20Debug%20SetServicePreshutdownTimeoutAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.9472%20Debug%20CreateServiceAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.9652%20Debug%20CreateServiceAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.9652%20Debug%20SetServiceDescriptionAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.9842%20Debug%20SetServiceDescriptionAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A04.9842%20Debug%20ConfigureServiceAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A05.0032%20Debug%20ConfigureServiceAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A05.0032%20Debug%20SetServicePreshutdownTimeoutAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A05.0222%20Debug%20SetServicePreshutdownTimeoutAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A05.0222%20Debug%20CreateServicesActionGroup%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A05.0222%20Debug%20ConfigureVirtualServiceAccountAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A05.2782%20Debug%20ConfigureVirtualServiceAccountAction%20Apply%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A05.2782%20Debug%20InstallWinPcapAction%20Apply%20started%20%5BsuppressFailure%3DFalse%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.3383%20Debug%20ServiceControllerExtension%20CreateKernelDriver%20service%20already%20exists%20%5Bname%3Dnpf%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4733%20Error%20ServiceControllerExtension%20ChangeServiceStatus%20failed%20to%20change%20service%20status%20%5Bname%3Dnpf%20status%3DRunning%20Exception%3DSystem.InvalidOperationException%3A%20Cannot%20start%20service%20npf%20on%20computer%20'.'.%20---%26gt%3B%20System.ComponentModel.Win32Exception%3A%20The%20system%20cannot%20find%20the%20file%20specified%3CBR%20%2F%3E---%20End%20of%20inner%20exception%20stack%20trace%20---%3CBR%20%2F%3Eat%20System.ServiceProcess.ServiceController.Start(String%5B%5D%20args)%3CBR%20%2F%3Eat%20Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String%20name%2C%20ServiceControllerStatus%20status%2C%20TimeSpan%20timeout%2C%20Nullable%601%20awaitedStatus)%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4783%20Debug%20InstallActionGroup%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Warn%20InstallActionGroup%20Revert%20reverting%20%5BrollbackAction%3DConfigureVirtualServiceAccountAction%20index%3D0%20count%3D5%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Debug%20ConfigureVirtualServiceAccountAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Debug%20ConfigureVirtualServiceAccountAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Warn%20InstallActionGroup%20Revert%20reverting%20%5BrollbackAction%3DCreateServicesActionGroup%20index%3D1%20count%3D5%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Debug%20CreateServicesActionGroup%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Warn%20CreateServicesActionGroup%20Revert%20reverting%20%5BrollbackAction%3DSetServicePreshutdownTimeoutAction%20index%3D0%20count%3D8%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Debug%20SetServicePreshutdownTimeoutAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Debug%20SetServicePreshutdownTimeoutAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Warn%20CreateServicesActionGroup%20Revert%20reverting%20%5BrollbackAction%3DConfigureServiceAction%20index%3D1%20count%3D8%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Debug%20ConfigureServiceAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Debug%20ConfigureServiceAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Warn%20CreateServicesActionGroup%20Revert%20reverting%20%5BrollbackAction%3DSetServiceDescriptionAction%20index%3D2%20count%3D8%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Debug%20SetServiceDescriptionAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Debug%20SetServiceDescriptionAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Warn%20CreateServicesActionGroup%20Revert%20reverting%20%5BrollbackAction%3DCreateServiceAction%20index%3D3%20count%3D8%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.4793%20Debug%20CreateServiceAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Debug%20ServiceControllerExtension%20DeleteService%20succeeded%20%5Bname%3DAATPSensor%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Debug%20CreateServiceAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Warn%20CreateServicesActionGroup%20Revert%20reverting%20%5BrollbackAction%3DSetServicePreshutdownTimeoutAction%20index%3D4%20count%3D8%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Debug%20SetServicePreshutdownTimeoutAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Debug%20SetServicePreshutdownTimeoutAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Warn%20CreateServicesActionGroup%20Revert%20reverting%20%5BrollbackAction%3DConfigureServiceAction%20index%3D5%20count%3D8%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Debug%20ConfigureServiceAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Debug%20ConfigureServiceAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Warn%20CreateServicesActionGroup%20Revert%20reverting%20%5BrollbackAction%3DSetServiceDescriptionAction%20index%3D6%20count%3D8%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Debug%20SetServiceDescriptionAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Debug%20SetServiceDescriptionAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Warn%20CreateServicesActionGroup%20Revert%20reverting%20%5BrollbackAction%3DCreateServiceAction%20index%3D7%20count%3D8%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5253%20Debug%20CreateServiceAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5743%20Debug%20ServiceControllerExtension%20DeleteService%20succeeded%20%5Bname%3DAATPSensorUpdater%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5753%20Debug%20CreateServiceAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5753%20Debug%20CreateServicesActionGroup%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5753%20Warn%20InstallActionGroup%20Revert%20reverting%20%5BrollbackAction%3DSaveSensorMandatoryConfigurationAction%20index%3D2%20count%3D5%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5753%20Debug%20SaveSensorMandatoryConfigurationAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5753%20Debug%20SaveSensorMandatoryConfigurationAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5753%20Warn%20InstallActionGroup%20Revert%20reverting%20%5BrollbackAction%3DCreateSensorAction%20index%3D3%20count%3D5%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A07.5753%20Debug%20CreateSensorAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A08.6974%20Debug%20CreateSensorAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A08.6974%20Warn%20InstallActionGroup%20Revert%20reverting%20%5BrollbackAction%3DCreateCertificateAction%20index%3D4%20count%3D5%5D%3CBR%20%2F%3E2020-06-02%2009%3A21%3A08.6984%20Debug%20CreateCertificateAction%20Revert%20started%3CBR%20%2F%3E2020-06-02%2009%3A21%3A08.7234%20Debug%20CreateCertificateAction%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A08.7234%20Debug%20InstallActionGroup%20Revert%20finished%3CBR%20%2F%3E2020-06-02%2009%3A21%3A08.9814%20Error%20DeploymentAction%20Deployer%20failed%3CBR%20%2F%3EMicrosoft.Tri.Infrastructure.ExtendedException%3A%20Apply%20failed%20%5BType%3DInstallWinPcapAction%5D%3CBR%20%2F%3Eat%20void%20Microsoft.Tri.Sensor.Common.DeploymentAction.Apply(bool%20suppressFailure)%3CBR%20%2F%3Eat%20void%20Microsoft.Tri.Sensor.Common.DeploymentActionGroup.Apply(bool%20suppressFailure)%3CBR%20%2F%3Eat%20int%20Microsoft.Tri.Sensor.Deployment.Deployer.Program.Main(string%5B%5D%20commandLineArguments)%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1433975%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1433975%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F172593%22%20target%3D%22_blank%22%3E%40Mina%20Kamel%3C%2FA%3E%26nbsp%3Bis%20NIC%20Teaming%20enabled%20on%20this%20machine..%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20this%20case%2C%20the%20NPF%20service%20is%20not%20starting%20up%2C%20which%20works%20hand%20in%20hand%20with%20Winpcap%5CNpcap%20to%20capture%20the%20network%20activities.%3CBR%20%2F%3E%3CBR%20%2F%3EWhich%20Server%20OS%20are%20you%20running%20with%3F%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20'd%20suggest%20you%20to%20install%20npcap%20which%20can%20be%20downloaded%20with%20the%20help%20link%20below%20(Remove%20if%20you%20are%20using%20any%20other%20Npcap%20version%20than%200.9984)%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fnmap.org%2Fnpcap%2Fdist%2Fnpcap-0.9984.exe%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fnmap.org%2Fnpcap%2Fdist%2Fnpcap-0.9984.exe%3C%2FA%3E%3C%2FP%3E%0A%3CP%3EThen%2Ctry%20steps%20below%20in%20the%20sequential%20manner%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EVerify%20current%20files%2C%20Npcap%20%26amp%3B%20Npf%20services%20exist%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3EIn%20PowerShell%3A%3C%2FP%3E%0A%3CP%3Eget-item%20C%3A%5CWindows%5CSystem32%5Cdrivers%5Cnpf.sys%3C%2FP%3E%0A%3CP%3Eget-item%20C%3A%5CWindows%5CSystem32%5Cdrivers%5Cnpcap.sys%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E2.%20Verify%20service%20exist%3C%2FP%3E%0A%3CP%3EGet-Service%20Npf%20%7C%20FL%3C%2FP%3E%0A%3CP%3EGet-Service%20Npcap%20%7C%20FL%3CBR%20%2F%3E%3CBR%20%2F%3EIf%20npf%20service%20is%20still%20not%20started%2C%20reboot%20the%20sever.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E3.%20Install%20Azure%20ATP%20Sensor%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3E%3CBR%20%2F%3EThen%20Try%20%26amp%3B%20install%20the%20sensor%20setup%20.%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1436434%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1436434%22%20slang%3D%22en-US%22%3EDownload%20the%20Npcap%20version%200.9984%20installer%20from%20%3CA%20href%3D%22https%3A%2F%2Fnmap.org%2Fnpcap%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fnmap.org%2Fnpcap%2F%3C%2FA%3E.%3CBR%20%2F%3EAlternatively%2C%20request%20the%20OEM%20version%20of%20the%20Npcap%20driver%20(that%20supports%20silent%20installation)%20from%20the%20support%20team.%3CBR%20%2F%3ECopies%20of%20Npcap%20do%20not%20count%20towards%20the%20five%20copy%2C%20five%20computer%20or%20fiver%20user%20licensing%20limitation%20if%20they%20are%20installed%20and%20used%20solely%20in%20conjunction%20with%20Azure%20ATP.%20For%20more%20information%2C%20see%20NPCAP%20licensing.%3CBR%20%2F%3EIf%20you%20have%20not%20yet%20installed%20the%20sensor%3A%3CBR%20%2F%3E%3CBR%20%2F%3EUninstall%20WinPcap%2C%20if%20it%20was%20installed.%3CBR%20%2F%3EInstall%20Npcap%20with%20the%20following%20options%3A%20loopback_support%3Dno%20%26amp%3B%20winpcap_mode%3Dyes.%3CBR%20%2F%3EIf%20using%20the%20GUI%20installer%2C%20deselect%20the%20loopback%20support%20and%20select%20WinPcap%20mode.%3CBR%20%2F%3EInstall%20the%20sensor%20package.%3CBR%20%2F%3EIf%20you%20already%20installed%20the%20sensor%3A%3CBR%20%2F%3E%3CBR%20%2F%3EUninstall%20the%20sensor.%3CBR%20%2F%3EUninstall%20WinPcap.%3CBR%20%2F%3EInstall%20Npcap%20with%20the%20following%20options%3A%20loopback_support%3Dno%20%26amp%3B%20winpcap_mode%3Dyes%3CBR%20%2F%3EIf%20using%20the%20GUI%20installer%2C%20deselect%20the%20loopback%20support%20and%20select%20WinPcap%20mode.%3CBR%20%2F%3EReinstall%20the%20sensor%20package.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1436424%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1436424%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F544387%22%20target%3D%22_blank%22%3E%40Vishal_Sharma_4224%3C%2FA%3E%26nbsp%3B%20thanks%20for%20supporting%20me%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eon%20the%20physical%20DC%20the%20NIC%20Teaming%20it%20was%20configured%20before%2C%20but%20now%20is%20not%20configured%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EWhich%20Server%20OS%20are%20you%20running%20with%3F%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3Ei%20have%20two%20DCs%20(%20one%20Physical%20and%20one%20VM%20on%20VMWare)%20both%20are%20WS%202012%20R2%20standard%2C%20with%20DHCP%20role%20installed.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E%26nbsp%3Bi%20am%20trying%20to%20install%20NPCAP%20but%20i%20am%20facing%20an%20error%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CDIV%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22npcap%20error.png%22%20style%3D%22width%3A%20643px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F196200iA3B00053E18CB56B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22npcap%20error.png%22%20alt%3D%22npcap%20error.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3Eon%20the%20physical%20server%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3ENpf%20service%20is%20running%20and%20no%26nbsp%3B%26nbsp%3BNpcap%26nbsp%3B%20service.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3Eon%20VM%20Server%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3ENpf%20service%20is%20stopping%20and%20no%26nbsp%3B%26nbsp%3BNpcap%26nbsp%3B%20service.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1436452%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1436452%22%20slang%3D%22en-US%22%3Ethanks%20Lewis%2C%20i%20have%20issue%20while%20installing%20NPCAP%200.9984%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1438645%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1438645%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F172593%22%20target%3D%22_blank%22%3E%40Mina%20Kamel%3C%2FA%3E%26nbsp%3B%20if%20npcap%20is%20failing%20but%20you%20see%20npf%20service%20is%20running%2C%20that%20means%20you%20most%20likely%20have%20winpcap%20installed%20on%20the%20machine.%3C%2FP%3E%0A%3CP%3Etry%20uninstalling%20it%2C%20and%20if%20there%20is%20no%20reference%20to%20it%2C%20try%20to%20stop%20and%20delete%20the%20npf%20service%3A%3C%2FP%3E%0A%3CP%3Esc%20stop%20npf%3C%2FP%3E%0A%3CP%3Esc%20delete%20npf%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Eand%20try%20the%20npcap%20install%20again.%3C%2FP%3E%0A%3CP%3EIf%20it%20still%20fails%2C%20open%20a%20support%20case%2C%20we%20can%20escalate%20this%20to%20npcap%20support%2C%20and%20we%20will%20need%20the%20full%20npcap%20install%20logs...%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1439855%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1439855%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F106935%22%20target%3D%22_blank%22%3E%40Eli%20Ofek%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20your%20help%2C%20I%20have%20followed%20your%20steps%20with%20no%20Success%2C%20i%20have%20opened%20support%20case%20with%20MS%2C%20but%20support%20engineer%20keep%20sending%20steps%20which%20i%20had%20followed%20before.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1439941%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1439941%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F172593%22%20target%3D%22_blank%22%3E%40Mina%20Kamel%3C%2FA%3E%26nbsp%3B%201st%20tier%20support%20need%20to%20cover%20all%20the%20basics%20before%20they%20can%20escalate...%3CBR%20%2F%3EWhat%20is%20the%20ticket%20number%20%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1443697%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1443697%22%20slang%3D%22en-US%22%3ESupport%20request%20number%3A%20120060224002961%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1443834%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1443834%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F172593%22%20target%3D%22_blank%22%3E%40Mina%20Kamel%3C%2FA%3E%26nbsp%3B%2C%20I%20reviewed%20the%20case%2C%20it%20turns%20out%20that%20you%20actually%20got%20bumped%20directly%20to%20the%20best%20regional%20escalation%20engineer.%3C%2FP%3E%0A%3CP%3EHe%20will%20still%20need%20to%20cover%20the%20basic%20before%20he%20can%20escalate%20further.%3CBR%20%2F%3EWhile%20you%20already%20did%20most%20of%20the%20documented%20steps%20and%20some%20that%20were%20proposed%20here%2C%26nbsp%3B%3CBR%20%2F%3EMost%20customers%20don't%20so%20support%20are%20forced%20to%20make%20sure%20everything%20was%20covered%20correctly%20before%20raising%20it%20more.%20I%20can%20understand%20this%20could%20be%20a%20bit%20frustrating%2C%20please%20bare%20with%20it.%26nbsp%3B%3CBR%20%2F%3EThis%20way%20makes%20sure%20you%20are%20on%20the%20right%20track%20to%20resolution.%3C%2FP%3E%0A%3CP%3EOnce%20all%20the%20basics%20are%20covered%20and%20all%20data%20collected%2C%20it%20will%20be%20ready%20to%20be%20escalated%20to%20AATP%20Engineering.%20and%2For%20npcap%20support.%3CBR%20%2F%3EYou%20are%20in%20good%20hands.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EEli%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1445657%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1445657%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F496863%22%20target%3D%22_blank%22%3E%40PhilippFoeckeler%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETry%20to%20execute%20the%20steps%20described%20here%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure-advanced-threat-protection%2Fconfigure-proxy%23configure-the-proxy%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure-advanced-threat-protection%2Fconfigure-proxy%23configure-the-proxy%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1462777%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1462777%22%20slang%3D%22en-US%22%3E%3CP%3EActually%2C%20the%20solution%20in%20our%20case%20was%20to%20use%20Silent%20Installation%20(%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure-advanced-threat-protection%2Fatp-silent-installation%23proxy-authentication%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure-advanced-threat-protection%2Fatp-silent-installation%23proxy-authentication%3C%2FA%3E)%20and%20provide%20the%20Proxy%20Information%20in%20the%20commandline.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20all%20for%20helping%20and%20advising!!!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1464148%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20Sensor%20install%20failing%20(Updater%20Service%20do%20not%20start)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1464148%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F544387%22%20target%3D%22_blank%22%3E%40Vishal_Sharma_4224%3C%2FA%3E%26nbsp%3BThanks%2C%26nbsp%3B%3CSPAN%3Eworked%20like%20a%20charm.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hello All!

We try to install the Azure ATP Sensor on a DC, setup wizard is running until this point

ATP Sensor.png

...then do some retries for about 3 minutes, during this time the service "Azure Advanced Threat Protection Sensor Updater" is several times on state "starting" und back to not started.

 

Then setup fails with 0x80070643 and do a rollback.

 

In the "Microsoft.Tri.Sensor.Updater-Errors" log, we find this error every 10 seconds during the setup:

 

2019-12-23 11:27:37.8384 Error CommunicationWebClient+<SendWithRetryAsync>d__8`1 Microsoft.Tri.Infrastructure.ExtendedException: Sanitized exception: [Type=System.Net.Http.HttpRequestExceptionMessage=7INzM3PVZQKggOiiHcWjqw==StackTrace= at async Task<HttpResponseMessage> System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task<HttpResponseMessage> sendTask, HttpRequestMessage request, CancellationTokenSource cts, bool disposeCts)
at async Task<TResponse> Microsoft.Tri.Common.CommunicationWebClient.SendAsync<TResponse>(byte[] requestBytes, int offset, int count)
at async Task<TResponse> Microsoft.Tri.Common.CommunicationWebClient.SendWithRetryAsync<TResponse>(byte[] requestBytes, int offset, int count)InnerException=Microsoft.Tri.Infrastructure.ExtendedException: Sanitized exception: [Type=System.Net.WebExceptionMessage=5iiWw0iPCPzCGdZStU4OxA==StackTrace= at Stream System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, out TransportContext context)
at void System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar)InnerException=]]
at async Task<TResponse> Microsoft.Tri.Common.CommunicationWebClient.SendWithRetryAsync<TResponse>(byte[] requestBytes, int offset, int count)
at async Task<TResponse> Microsoft.Tri.Common.CommunicationWebClient.SendAsync<TResponse>(IRequestWithResponse<TResponse> request)
at async Task<TResponse> Microsoft.Tri.Sensor.Common.ServiceProxy<TWebClientConfiguration>.SendAsync<TResponse>(IRequestWithResponse<TResponse> request)
at async Task Microsoft.Tri.Sensor.Updater.SensorUpdaterConfigurationUpdater.UpdateConfigurationAsync(bool isStarted)
at void Microsoft.Tri.Infrastructure.TaskExtension.Await(Task task)
at new Microsoft.Tri.Sensor.Updater.SensorUpdaterConfigurationUpdater(IConfigurationManager configurationManager, IMetricManager metricManager, ISecretManager secretManager, IWorkspaceApplicationSensorApiJsonProxy workspaceApplicationSensorApiJsonProxy)
at object lambda_method(Closure, object[])
at object Autofac.Core.Activators.Reflection.ConstructorParameterBinding.Instantiate()
at void Microsoft.Tri.Infrastructure.ModuleManager.AddModules(Type[] moduleTypes)
at ModuleManager Microsoft.Tri.Sensor.Updater.SensorUpdaterService.CreateModuleManager()
at async Task Microsoft.Tri.Infrastructure.Service.OnStartAsync()
at void Microsoft.Tri.Infrastructure.TaskExtension.Await(Task task)
at void Microsoft.Tri.Infrastructure.Service.OnStart(string[] args)

 

A proxy is used which allows access to *.atp.azure.com without auth. In proxy logs, we see no block for this server, only successful requests from this DC. There is no indication that 443 would be blocked somewhere else...

 

The AD account which is configured in the ATP portal was checked, domain is given in FQDN there and the password is correct.

 

Any ideas someone?

34 Replies
Highlighted

@PhilippFoeckeler Effectively this error means it was blocked.

Is your proxy doing SSL inspection?

Highlighted

No - there is no SSL inspection on the proxy... and in the proxy logs  no blocks for this server. Very strange. 

Local Firewall is switched off. So for this SSL connection to localhost on port 444, i cannot see any reasons that this should be not possible.

Highlighted

@PhilippFoeckeler , Any chance you can temporary bypass this proxy just to see if it resolves the issue?
At least for the error sample you published, the problem is going to the azure backend, not to localhost.

Highlighted

@Eli Ofek , First of all Thank you so much for the help so far!!

 

Unfortunately, we are still stuck at the same point - the system is sensitive and Risk and Security Team do not allow to connect directly to the internet, even if it's temporary..

What we tried in the meantime:

 

We enabled routing to another Proxy which is used by other Domain Controllers (where the ATP sensor could be installed without any problems).... Proxy can be used in the browser, proxy was set as system proxy.... same issue - no blocks whatsoever are visible at the proxy.

 

We disabled local endpoint protection for this server (Cisco AMP) during the install....same issue.

 

I think i will open a Premier Support Ticket so that a MS Engineer can have a look in a remote session on this server.... 

 

Highlighted

@PhilippFoeckeler 

I am getting exactly the same error at my client's site. Identical configuration used each time, majority of DCs installation works fine, but on those that don't I see exactly the same issue as you describe.

While the install is proceeding (or stuck mid point as you are seeing), the sensor appears in the console in a stopped state (it is even possible to configure the update settings), but when the client install eventually times out with the error, the sensor gets cleared out of the console as well. The only other symptom I have noticed is the multiple 'unexpected restart' entries in the system log and the ATP Sensor updater service usually stuck in the 'starting state'. I have not found any issues with the WMI performance adaptor either, something I checked because it is a dependency of the Sensor updater service.

Highlighted

@Richard Adams , a bit confused, are you getting the same error during deployment or service  start?

Highlighted

@Eli Ofek 

Hi,

Same as the poster's original screenshot. The installation gets stuck (about midway through according to the GUI). After a long wait it removes the sensor from the console, backs out the client install and displays the installation failure error (0x80070643) which suggests proxy issues, but if this was the case how would the client register in Security Center in the first place?  I am using exactly the same installation process on all my Client's DCs, so far I have had 15 successful and another 5 or so fail.

 

Richard

Highlighted

@Richard Adams The screenshot alone does not mean it's the same issue.

And you are right, if you managed to see it registers and removed, then it's most likely something else.

You will need to take a look at the logs to know why.

see

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/troubleshooting-atp-using-logs#azu...

Highlighted

@PhilippFoeckeler So the issue has been resolved now :) 

Highlighted

@PhilippFoeckeler how did you solve this issue? We are facing exactly the same. 1DC cannot connect to endpoint, all others can. Authentication and TLS inpection are already disabled on proxy. 

Highlighted
  1. @ricklahaye Please try silent install and use proxy URL in the command used. Also, select bypass proxy server for local server option in LAN settings of the browser. 

Something like below:-

 

"Azure ATP sensor Setup.exe" /quiet ProxyUrl="http://abc.com:port number of proxy" NetFrameworkCommandLineArguments="/q" AccessKey=""
 
Let me know if that helps. 
Highlighted

@Vishal_Sharma_4224 HI Vishal 

We are having same issue while instilling ATP sensor .

Tried to install silently but same error code it is getting.  0x80070643

Our DC is hosted on private LB.

we are using proxy settings to connect the internet 

Highlighted

@Pritam1560 Please paste the main error logs here..

Highlighted
It would be great if can send the error ligs in a private message.
Highlighted
Please let me know what exactly do you see in deployment\MSI logs.. Have you used command below while doing silent install? "Azure ATP sensor Setup.exe" /quiet ProxyUrl="http://abc.com:port number of proxy" NetFrameworkCommandLineArguments="/q" AccessKey="" Also, please select option Bypass proxy server for local addresses in browser LAN settings if you are using browser specific proxy.
Highlighted

@Vishal_Sharma_4224 

 

Hi Vishal we have tried with silent instillation with bypass proxy enable but got same error.

in logs we can see error returning code 

[20EC:2318][2020-04-16T20:56:04]i007: Exit code: 0x80070643, restarting: No

1.is there any dependencies on .net frameowrk 

2.this dc is configured in standard load balencer .is that something to do with that

In other DC which is  hosted in Europe region configured in Basic LB there ATP is installing properly same is not happening in another DC

Highlighted

@Pritam1560 

 

Yes, this is a dependency .NET Framework 4.7 must be installed as a pre-requisite..

For all the pre-requisites you may refer link below:-

 

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-prerequisites .

Highlighted

Hi @Pritam1560 

We are having same issue ,  are you solve this issue?

Highlighted

@Mina Kamel 

 

Could you please let us know what error are you witnessing in the Deployer logs?