Defender for Identity Sensor throwing seemingly internal errors

[felixbrandsva]

Hey folks,

today I installed MDI sensors on some Windows Server 2022 DCs with .NET 4.8 installed. All of the setups ran just fine, however two of the DCs threw the following errors.

DirectoryServicesClient System.MissingMethodException: Method not found: 'System.Threading.Tasks.Task'

DirectoryServicesResolver System.MissingMethodException: Method not found: 'Void Microsoft.Tri.Common.UpdateDirectoryServicesClientAccountIdsRequest..ctor

Both of those errors made me scratch my head so hard my hair fell out. Maybe some of you guys have had this issue before.

BR Felix

[#2]

@felixbrandsva Did the sensor worked before in previous versions? If so, which version started to break with missing method?

[#3]

@EliOfek it is a fresh installation on all DCs. Never had MDI running on them.

[#4]

I am guessing you have a weird assembly deployed in your gac that collides with the sensor expectation.
I suggest to open a support ticket.
Make a list of 3rd party software installed on this machine.

[#5]

Try to open an elevated cmd on the failing machine and run this command:
dir /S /B %windir%\Microsoft.NET\assembly | findstr ValueTuple

Please paste the output here. it might help to make some progress.

[#6]

Hi @EliOfek, I ran the suggested command on one of the malfunctioning DCs and compared it to a well-functioning one.

Output malfunctioning DC

C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.2.0__cc7b13ffcd2ddd51
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.2.0__cc7b13ffcd2ddd51\System.ValueTuple.dll

Output well-functioning DC

C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll

Best
Felix

[#7 · Accepted solution]

This is what I suspected.
Something installed on the failing one the assembly with this specific version:
4.0_4.0.2.0
this shouldn't be there.
if you uninstall this version from GAC the sensor should work.
The problem is that I don't know which app decided to install it there and it might break if you remove it.
What 3rd party apps do you have there which are not on the working machine ?

See here for instructions how to correctly uninstall this assembly for this specific version (the other one should remain there)
https://docs.microsoft.com/en-us/dotnet/framework/app-domains/how-to-remove-an-assembly-from-the-gac

[#8]

Hi @EliOfek, let me try to find out which application installed the assembly. I will keep you updated!

[#9]

UPDATE: @Eli_Ofek I have not found the respective application using the ValueTuple.dll of version 4.0.2.0. However I renamed the .dll-File and no application is showing any issues. I will keep track of the applications. Thanks for helping me out on this one! Appreciate it!

Best
Felix