Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

Defender for Identity Sensor throwing seemingly internal errors

Copper Contributor

Hey folks,

 

today I installed MDI sensors on some Windows Server 2022 DCs with .NET 4.8 installed. All of the setups ran just fine, however two of the DCs threw the following errors.

 

DirectoryServicesClient System.MissingMethodException: Method not found: 'System.Threading.Tasks.Task'

 

DirectoryServicesResolver System.MissingMethodException: Method not found: 'Void Microsoft.Tri.Common.UpdateDirectoryServicesClientAccountIdsRequest..ctor

 

Both of those errors made me scratch my head so hard my hair fell out. Maybe some of you guys have had this issue before.

BR Felix

8 Replies

@felixbrandsva Did the sensor worked before in previous versions? If so, which version started to break with missing method?

@Eli Ofek it is a fresh installation on all DCs. Never had MDI running on them.
I am guessing you have a weird assembly deployed in your gac that collides with the sensor expectation.
I suggest to open a support ticket.
Make a list of 3rd party software installed on this machine.
Try to open an elevated cmd on the failing machine and run this command:
dir /S /B %windir%\Microsoft.NET\assembly | findstr ValueTuple

Please paste the output here. it might help to make some progress.

Hi @Eli Ofek, I ran the suggested command on one of the malfunctioning DCs and compared it to a well-functioning one.

Output malfunctioning DC

 

C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.2.0__cc7b13ffcd2ddd51
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.2.0__cc7b13ffcd2ddd51\System.ValueTuple.dll

 

 

Output well-functioning DC

 

C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51
C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll

 


Best
Felix

best response confirmed by felixbrandsva (Copper Contributor)
Solution
This is what I suspected.
Something installed on the failing one the assembly with this specific version:
4.0_4.0.2.0
this shouldn't be there.
if you uninstall this version from GAC the sensor should work.
The problem is that I don't know which app decided to install it there and it might break if you remove it.
What 3rd party apps do you have there which are not on the working machine ?

See here for instructions how to correctly uninstall this assembly for this specific version (the other one should remain there)
https://docs.microsoft.com/en-us/dotnet/framework/app-domains/how-to-remove-an-assembly-from-the-gac
Hi @Eli Ofek, let me try to find out which application installed the assembly. I will keep you updated!
UPDATE: @Eli_Ofek I have not found the respective application using the ValueTuple.dll of version 4.0.2.0. However I renamed the .dll-File and no application is showing any issues. I will keep track of the applications. Thanks for helping me out on this one! Appreciate it!

Best
Felix
1 best response

Accepted Solutions
best response confirmed by felixbrandsva (Copper Contributor)
Solution
This is what I suspected.
Something installed on the failing one the assembly with this specific version:
4.0_4.0.2.0
this shouldn't be there.
if you uninstall this version from GAC the sensor should work.
The problem is that I don't know which app decided to install it there and it might break if you remove it.
What 3rd party apps do you have there which are not on the working machine ?

See here for instructions how to correctly uninstall this assembly for this specific version (the other one should remain there)
https://docs.microsoft.com/en-us/dotnet/framework/app-domains/how-to-remove-an-assembly-from-the-gac

View solution in original post