Error deploying MDI sensor

[tipper1510]

Hi All,

First time working with this functionality.

Get the following error when trying to deploy sensor onto a domain controller:

2021-03-16 12:59:53.8664 Debug CreateCertificateAction Revert started
2021-03-16 12:59:53.8664 Debug CreateCertificateAction Revert finished
2021-03-16 12:59:53.8664 Debug InstallActionGroup Revert finished
2021-03-16 12:59:53.9446 Error DnsName Deployer failed [arguments=0qX02CRDgX2zoOt1xmrJLQ==]
Microsoft.Tri.Infrastructure.ExtendedException: Failed to parse DnsName

Any help would be much appreciated...

Thanks,

Tim

[#2]

Please paste the full callstack, this is not enough to understand where exactly things gone wrong...

[#3]

Sure, thanks.
Here it is:

2021-03-16 12:14:40.4054 Warn JsonSerializerSettingsExtension+JsonSerializationBinder GetTypeFromName [typeName=InstallDeploymentArguments]
2021-03-16 12:14:40.5773 Warn JsonSerializerSettingsExtension+JsonSerializationBinder GetTypeFromName [typeName=EndpointData]
2021-03-16 12:14:40.7335 Info Program Main Deployer started [arguments=0qX02CRDgX2zoOt1xmrJLQ==]
2021-03-16 12:14:40.8116 Debug InstallActionGroup Apply started
2021-03-16 12:14:40.8116 Debug CreateCertificateAction Apply started [suppressFailure=False]
2021-03-16 12:14:46.0686 Debug CreateCertificateAction Apply finished
2021-03-16 12:14:46.0686 Debug CreateSensorAction Apply started [suppressFailure=False]
2021-03-16 12:14:46.0843 Debug InstallActionGroup Revert started
2021-03-16 12:14:46.0843 Warn InstallActionGroup Revert reverting [rollbackAction=CreateCertificateAction index=0 count=1]
2021-03-16 12:14:46.0843 Debug CreateCertificateAction Revert started
2021-03-16 12:14:46.0999 Debug CreateCertificateAction Revert finished
2021-03-16 12:14:46.0999 Debug InstallActionGroup Revert finished
2021-03-16 12:14:46.1780 Error DnsName Deployer failed [arguments=0qX02CRDgX2zoOt1xmrJLQ==]
Microsoft.Tri.Infrastructure.ExtendedException: Failed to parse DnsName [name=YShX24X2FGcaJdDDXZy3bQ==]
at DnsName Microsoft.Tri.Common.DnsName.Parse(string name, bool shouldRequireDomainName, bool isStrict)
at bool Microsoft.Tri.Sensor.Deployment.Deployer.CreateSensorAction.ApplyInternal()
at void Microsoft.Tri.Sensor.Common.DeploymentAction.Apply(bool suppressFailure)
at void Microsoft.Tri.Sensor.Common.DeploymentActionGroup.Apply(bool suppressFailure)
at int Microsoft.Tri.Sensor.Deployment.Deployer.Program.Main(string[] commandLineArguments)

Regards,

Tim

[#4]

Can you send me the fully qualified name of the machine you are installing the sensor on?
(You can do so in a private message)
Is it a domain controller?

[#5]

Hi All, Got the sensor installed... Hostname was too long before... Now the sensor service is continually trying to start. Where can I find the logs for that? Many thanks, Tim

[#6]

See https://docs.microsoft.com/en-us/defender-for-identity/troubleshooting-using-logs

[#7]

Hi All,

Ok the latest is ,created a gmsa and that seems to be ok. Using that for the directory service conditionals in the portal.

Service still not starting:

2021-03-17 14:13:00.1104 Error DirectoryServicesClient+<CreateLdapConnectionAsync>d__38 Microsoft.Tri.Infrastructure.ExtendedException: CreateLdapConnectionAsync failed [DomainControllerDnsName=def365pdc.ad.def365p.local]
at async Task<LdapConnection> Microsoft.Tri.Sensor.DirectoryServicesClient.CreateLdapConnectionAsync(DomainControllerConnectionData domainControllerConnectionData, bool isGlobalCatalog, bool isTraversing)
at async Task<bool> Microsoft.Tri.Sensor.DirectoryServicesClient.TryCreateLdapConnectionAsync(DomainControllerConnectionData domainControllerConnectionData, bool isGlobalCatalog, bool isTraversing)
2021-03-17 14:13:00.1417 Error DirectoryServicesClient Microsoft.Tri.Infrastructure.ExtendedException: Failed to communicate with configured domain controllers
at new Microsoft.Tri.Sensor.DirectoryServicesClient(IConfigurationManager configurationManager, IDomainNetworkCredentialsManager domainNetworkCredentialsManager, IRemoteImpersonationManager remoteImpersonationManager, IMetricManager metricManager, IWorkspaceApplicationSensorApiJsonProxy workspaceApplicationSensorApiJsonProxy)
at object lambda_method(Closure, object[])
at object Autofac.Core.Activators.Reflection.ConstructorParameterBinding.Instantiate()
at void Microsoft.Tri.Infrastructure.ModuleManager.AddModules(Type[] moduleTypes)
at new Microsoft.Tri.Sensor.SensorModuleManager()
at ModuleManager Microsoft.Tri.Sensor.SensorService.CreateModuleManager()
at async Task Microsoft.Tri.Infrastructure.Service.OnStartAsync()
at void Microsoft.Tri.Infrastructure.TaskExtension.Await(Task task)
at void Microsoft.Tri.Infrastructure.Service.OnStart(string[] args)

Regards,

Tim

[#8]

Take a look on the lines before this specific one, there should be more errors before that, either indicating a problem with gMsa, or a problem with opening a connection to the DC with a specific error code from LDAP.

[#9]

2021-03-17 15:29:29.6270 Error DirectoryServicesClient Microsoft.Tri.Infrastructure.ExtendedException: Failed to communicate with configured domain controllers
at new Microsoft.Tri.Sensor.DirectoryServicesClient(IConfigurationManager configurationManager, IDomainNetworkCredentialsManager domainNetworkCredentialsManager, IRemoteImpersonationManager remoteImpersonationManager, IMetricManager metricManager, IWorkspaceApplicationSensorApiJsonProxy workspaceApplicationSensorApiJsonProxy)
at object lambda_method(Closure, object[])
at object Autofac.Core.Activators.Reflection.ConstructorParameterBinding.Instantiate()
at void Microsoft.Tri.Infrastructure.ModuleManager.AddModules(Type[] moduleTypes)
at new Microsoft.Tri.Sensor.SensorModuleManager()
at ModuleManager Microsoft.Tri.Sensor.SensorService.CreateModuleManager()
at async Task Microsoft.Tri.Infrastructure.Service.OnStartAsync()
at void Microsoft.Tri.Infrastructure.TaskExtension.Await(Task task)
at void Microsoft.Tri.Infrastructure.Service.OnStart(string[] args)

[#10]

Nothing before that ???

[#11]

yes, the other log Microssoft.Tri>sensor

2021-03-17 15:52:08.0841 Warn DirectoryServicesClient CreateLdapConnectionAsync failed to retrieve group managed service account password.[ ]

[#12]

The sensor is failing to get the password for the gMsa. most likely permissions issue.