Forum Discussion

ppgd2019's avatar
ppgd2019
Copper Contributor
Sep 26, 2019

Azure ATP sensor install failing

I've installed the sensor on 4 DCs, but this fifth one is failing (same domain etc.)

 

During the installation the entry appears briefly in the ATP portal, but it seems the updater service is failing to start and the installation is rolled back. 

 

The DC is running Windows Server 2008 R2 SP1 which is supported.

 

I looked at the logs produced but can't figure out what is causing this. ANy idea how to resolve this?

 

Microsoft.Tri.Sensor.Updater-Errors.log

2019-09-26 16:01:27.9930 Error PerformanceCounterLib System.InvalidOperationException: Category does not exist.
   at CategorySample System.Diagnostics.PerformanceCounterLib.GetCategorySample(string machine, string category)
   at string[] System.Diagnostics.PerformanceCounterCategory.GetCounterInstances(string categoryName, string machineName)
   at new Microsoft.Tri.Infrastructure.MetricManager(IConfigurationManager configurationManager)
   at object lambda_method(Closure, object[])
   at object Autofac.Core.Activators.Reflection.ConstructorParameterBinding.Instantiate()
   at void Microsoft.Tri.Infrastructure.ModuleManager.AddModules(Type[] moduleTypes)
   at ModuleManager Microsoft.Tri.Sensor.Updater.SensorUpdaterService.CreateModuleManager()
   at async Task Microsoft.Tri.Infrastructure.Service.OnStartAsync()
   at void Microsoft.Tri.Infrastructure.TaskExtension.Await(Task task)
   at void Microsoft.Tri.Infrastructure.Service.OnStart(string[] args)

 

Microsoft.Tri.Sensor.Deployment.Deployer_20190926160120.log

2019-09-26 16:02:25.7817 Error ServiceControllerExtension Failed to change service status [name=AATPSensorUpdater status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.
   at System.ServiceProcess.ServiceController.WaitForStatus(ServiceControllerStatus desiredStatus, TimeSpan timeout)
   at Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String name, ServiceControllerStatus status, TimeSpan timeout, Nullable`1 awaitedStatus)]
2019-09-26 16:03:26.8468 Error ServiceControllerExtension Failed to change service status [name=AATPSensorUpdater status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.
   at System.ServiceProcess.ServiceController.WaitForStatus(ServiceControllerStatus desiredStatus, TimeSpan timeout)
   at Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String name, ServiceControllerStatus status, TimeSpan timeout, Nullable`1 awaitedStatus)]
2019-09-26 16:04:28.0100 Error ServiceControllerExtension Failed to change service status [name=AATPSensorUpdater status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.
   at System.ServiceProcess.ServiceController.WaitForStatus(ServiceControllerStatus desiredStatus, TimeSpan timeout)
   at Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String name, ServiceControllerStatus status, TimeSpan timeout, Nullable`1 awaitedStatus)]
2019-09-26 16:05:29.3451 Error ServiceControllerExtension Failed to change service status [name=AATPSensorUpdater status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.
   at System.ServiceProcess.ServiceController.WaitForStatus(ServiceControllerStatus desiredStatus, TimeSpan timeout)
   at Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String name, ServiceControllerStatus status, TimeSpan timeout, Nullable`1 awaitedStatus)]
2019-09-26 16:06:30.4882 Error ServiceControllerExtension Failed to change service status [name=AATPSensorUpdater status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.
   at System.ServiceProcess.ServiceController.WaitForStatus(ServiceControllerStatus desiredStatus, TimeSpan timeout)
   at Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String name, ServiceControllerStatus status, TimeSpan timeout, Nullable`1 awaitedStatus)]

2019-09-26 16:06:32.6254 Error ServiceControllerExtension Failed to change service status [name=AATPSensorUpdater status=Stopped Exception=System.InvalidOperationException: Cannot stop AATPSensorUpdater service on computer '.'. ---> System.ComponentModel.Win32Exception: The service has not been started
   --- End of inner exception stack trace ---
   at System.ServiceProcess.ServiceController.Stop()

2019-09-26 16:06:32.9975 Error DeploymentAction Deployer failed
Microsoft.Tri.Infrastructure.ExtendedException: Apply failed [Type=StartServiceAction]
   at void Microsoft.Tri.Sensor.Common.DeploymentAction.Apply(bool suppressFailure)
   at void Microsoft.Tri.Sensor.Common.DeploymentActionGroup.Apply(bool suppressFailure)
   at int Microsoft.Tri.Sensor.Deployment.Deployer.Program.Main(string[] commandLineArguments)

 

Azure Advanced Threat Protection Sensor_20190926170047_000_MsiPackage.log

MSI (s) (0C:54) [17:01:08:912]: Note: 1: 2205 2:  3: Error

2019-09-26 16:06:33.2935 Error DeploymentAction Microsoft.Tri.Infrastructure.ExtendedException: Apply failed [Type=RunDeployerMajorDeploymentAction]
   at Microsoft.Tri.Sensor.Common.DeploymentAction.Apply(Boolean suppressFailure)
   at Microsoft.Tri.Sensor.Common.DeploymentActionGroup.Apply(Boolean suppressFailure)
   at Microsoft.Tri.Sensor.Deployment.Package.Actions.CustomActions.RunActionGroup(DeploymentActionGroup deploymentActionGroup, Session session)

2019-09-26 16:06:33.2965 Debug CustomActions InstallActionGroup finished [result=Failure]
CustomAction InstallCustomAction returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

  • ppgd2019 

    The "Network Interface" performance counter category is missing on this machine.

    Use perfmon.exe to verify.  you need to fix it so this category is working (a counters rebuild might be required if it wasn't disabled in the registry).

    Once it it fixed, the deployment should work...

     

    Eli

    • cheapscotsman1320's avatar
      cheapscotsman1320
      Copper Contributor

      EliOfek 

      I had the issue the installation would not work on a windows 2019 with teaming and installing the npcap filter first. Had to uninstall the npcap filter, install the ATP sensor and it work but the ATP site would complain about the teaming. Uninstall the ATP sensor, install the npcap filter, then the sensor again.

Resources