Microsoft Security Tech Accelerator
Dec 06 2023, 07:00 AM - 12:00 PM (PST)
Microsoft Tech Community

Cannot get ADFS ATP Sensor service to start

Copper Contributor

I have the sensors installed and working on both of my domain controllers (Server 2016), however, when I install the ADFS sensor on my ADFS server (also 2016) the service refuses to start. I get the following error. I have tried everything I can conceive, including deleting the instance and starting over, trying different accounts/credentials/formats (both the single label domain vs. the .com suffix format) to no avail. The error is as follows:


2021-03-18 20:22:05.6369 Error DomainNetworkCredentialsManager Microsoft.Tri.Infrastructure.ExtendedException: DomainControllerDnsNames is empty or not configured
at void Microsoft.Tri.Sensor.DomainNetworkCredentialsManager.UpdateConfigurations(ConfigurationCollection configurations)
at Func<Task> Microsoft.Tri.Infrastructure.ActionExtension.ToAsyncFunction(Action action)+(TItem _) => { }
at async Task Microsoft.Tri.Infrastructure.ConfigurationManager.RegisterConfigurationAsync(Func<ConfigurationCollection, Task> onConfigurationsUpdateAsync, Type[] configurationTypes)
at void Microsoft.Tri.Infrastructure.TaskExtension.Await(Task task)
at object lambda_method(Closure, object[])
at object Autofac.Core.Activators.Reflection.ConstructorParameterBinding.Instantiate()
at void Microsoft.Tri.Infrastructure.ModuleManager.AddModules(Type[] moduleTypes)
at new Microsoft.Tri.Sensor.SensorModuleManager()
at ModuleManager Microsoft.Tri.Sensor.SensorService.CreateModuleManager()
at async Task Microsoft.Tri.Infrastructure.Service.OnStartAsync()
at void Microsoft.Tri.Infrastructure.TaskExtension.Await(Task task)
at void Microsoft.Tri.Infrastructure.Service.OnStart(string[] args)


Any help is greatly appreciated!



4 Replies
best response confirmed by amayo21 (Copper Contributor)
Go to the sensors tab in the MDI portal, click on the registered ADFS sensor, and add to the list a fully qualified DC name this sensor can contact to resolve AD entities. once you do that and press sav, within 10 min the sensor should overcome this error.

@Eli Ofek This resolved the issue! Thank you so much - I couldn't find anything online to help!

@Eli Ofek 
We do have the same issue, and we wanted to follow your solution here, but for unknown reasons the 'Domain controller (FQDN)' field on the 'Manage sensor' is read only.
Any hints on that?

Any chance this machine is also a domain controller ?