Forum Discussion

felixbrandsva's avatar
felixbrandsva
Copper Contributor
Apr 20, 2022

Defender for Identity Sensor throwing seemingly internal errors

Hey folks,   today I installed MDI sensors on some Windows Server 2022 DCs with .NET 4.8 installed. All of the setups ran just fine, however two of the DCs threw the following errors.   Directory...
  • EliOfek's avatar
    EliOfek
    Apr 25, 2022
    This is what I suspected.
    Something installed on the failing one the assembly with this specific version:
    4.0_4.0.2.0
    this shouldn't be there.
    if you uninstall this version from GAC the sensor should work.
    The problem is that I don't know which app decided to install it there and it might break if you remove it.
    What 3rd party apps do you have there which are not on the working machine ?

    See here for instructions how to correctly uninstall this assembly for this specific version (the other one should remain there)
    https://docs.microsoft.com/en-us/dotnet/framework/app-domains/how-to-remove-an-assembly-from-the-gac
felixbrandsva's avatar
felixbrandsva
Copper Contributor
EliOfek it is a fresh installation on all DCs. Never had MDI running on them.
EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Apr 20, 2022
I am guessing you have a weird assembly deployed in your gac that collides with the sensor expectation.
I suggest to open a support ticket.
Make a list of 3rd party software installed on this machine.
  • EliOfek's avatar
    EliOfek
    Icon for Microsoft rankMicrosoft
    Apr 21, 2022
    Try to open an elevated cmd on the failing machine and run this command:
    dir /S /B %windir%\Microsoft.NET\assembly | findstr ValueTuple

    Please paste the output here. it might help to make some progress.
    • felixbrandsva's avatar
      felixbrandsva
      Copper Contributor
      Apr 25, 2022

      Hi EliOfek, I ran the suggested command on one of the malfunctioning DCs and compared it to a well-functioning one.

      Output malfunctioning DC

       

      C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.2.0__cc7b13ffcd2ddd51
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.2.0__cc7b13ffcd2ddd51\System.ValueTuple.dll

       

       

      Output well-functioning DC

       

      C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll

       


      Best
      Felix

      • EliOfek's avatar
        EliOfek
        Icon for Microsoft rankMicrosoft
        Apr 25, 2022
        This is what I suspected.
        Something installed on the failing one the assembly with this specific version:
        4.0_4.0.2.0
        this shouldn't be there.
        if you uninstall this version from GAC the sensor should work.
        The problem is that I don't know which app decided to install it there and it might break if you remove it.
        What 3rd party apps do you have there which are not on the working machine ?

        See here for instructions how to correctly uninstall this assembly for this specific version (the other one should remain there)
        https://docs.microsoft.com/en-us/dotnet/framework/app-domains/how-to-remove-an-assembly-from-the-gac

Resources