Forum Discussion

marioschaupp's avatar
marioschaupp
Copper Contributor
Apr 16, 2020

Azure ATP service not starting

Hello,   after installing the ATP sensor on one of my client's domain controllers I can see in the Azure ATP portal, that the service is not starting.   I use a group managed service account whic...
cjohnston's avatar
cjohnston
Brass Contributor
Jul 07, 2020

sophiavega I can't speak for anyone else, but we had a security policy GPO that limited what user accounts could log in as a service. By adding NT SERVICE/ALL SERVICES to that list of groups/users that were allowed to log in as a service, we were able to get the ATP sensor to start up.

19873306's avatar
19873306
Copper Contributor
Sep 21, 2020

cjohnston is  NT SERVICE/ALL SERVICES required for 'login in as service'?  Could the individual gMSA account be assigned access to 'log on as service' via group policy?

 

  • jurowley's avatar
    jurowley
    Former Employee
    May 18, 2021

    19873306 - The recommended configuration for the "Log On as a Service" setting is to use a Security Group containing all the DCs with Sensors hosted. This enables those machines to retrieve the gMSA account. 

    You can also use the individual hostname of the DC. 

  • Kiwi01's avatar
    Kiwi01
    Copper Contributor
    Dec 07, 2020

    We had the same GPO setting which was stopping the ATP service from staring. Adding the Group Managed Service Account to the list of accounts allowed to logon locally fixed the issue.
    It's wasn't necessary to allow all services.