A number of our W2019 domain controllers have the AATSensor service in "Start pending".
Yesterday AATPSensors appeared to have updated, but we have seen some domain controllers with a AATPService in "Start pending" for a while.
On one of the domain controller we tried to remove npcap, then Azure ATP Sensor. The uninstall of the software terminated in a generic MSI error 1603/0x643. Attempts to install Azure ATP Sensor failed with the same generic error 1603 again. We also tried rebooting or to install using the SYSTEM account to no avail.
We are not sure where to look next. Any pointers are appreciated.
The Microsoft.Tri.Sensor.log logs:
2022-05-09 15:41:38.3048 Debug DirectoryServicesClient SetState Creating
2022-05-09 15:41:38.3517 Info DirectoryServicesClient CreateLdapConnectionAsync failed to connect [DomainControllerDnsName=domaincontroller.thisdomain.com Domain=thisdomainforest.com UserName=ATPAccount ResultCode=82]
2022-05-09 15:41:38.5392 Error DirectoryServicesClient+<CreateLdapConnectionAsync>d__41 Microsoft.Tri.Infrastructure.ExtendedException: CreateLdapConnectionAsync failed [DomainControllerDnsName=domaincontroller.thisdomain.com]
at ....
2022-05-09 15:41:38.5392 Error DirectoryServicesClient Microsoft.Tri.Infrastructure.ExtendedException: Failed to communicate with configured domain controllers
at ...
The Microsoft.Tri.Sensor-Errors.log:
2022-05-09 15:41:04.2470 Error DirectoryServicesClient+<CreateLdapConnectionAsync>d__41 Microsoft.Tri.Infrastructure.ExtendedException: CreateLdapConnectionAsync failed [DomainControllerDnsName=domaincontroller.thisdomain.com]
at ...
2022-05-09 15:41:04.2626 Error DirectoryServicesClient Microsoft.Tri.Infrastructure.ExtendedException: Failed to communicate with configured domain controllers
at ...
Microsoft.Tri.Sensor.Updater.log
2022-05-09 15:32:45.9405 Error ServiceControllerExtension ChangeServiceStatus failed to change service status [name=AATPSensor status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.
at System.ServiceProcess.ServiceController.WaitForStatus(ServiceControllerStatus desiredStatus, TimeSpan timeout)
at Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String name, ServiceControllerStatus status, TimeSpan timeout, Nullable`1 awaitedStatus)]
2022-05-09 15:32:45.9405 Debug SoftwareUpdater RunTaskAsync Task completed [name=CheckSoftwareUpdatesAsync Elapsed=00:01:00.2699091]
2022-05-09 15:38:46.0738 Error ServiceControllerExtension ChangeServiceStatus failed to change service status [name=AATPSensor status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.
at System.ServiceProcess.ServiceController.WaitForStatus(ServiceControllerStatus desiredStatus, TimeSpan timeout)
at Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String name, ServiceControllerStatus status, TimeSpan timeout, Nullable`1 awaitedStatus)]
2022-05-09 15:38:46.0738 Debug SoftwareUpdater RunTaskAsync Task completed [name=CheckSoftwareUpdatesAsync Elapsed=00:01:00.1244165]
Microsoft.Tri.Sensor.Updater-Errors.log
2022-05-09 15:32:45.9405 Error ServiceControllerExtension ChangeServiceStatus failed to change service status [name=AATPSensor status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.
at System.ServiceProcess.ServiceController.WaitForStatus(ServiceControllerStatus desiredStatus, TimeSpan timeout)
at Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String name, ServiceControllerStatus status, TimeSpan timeout, Nullable`1 awaitedStatus)]
2022-05-09 15:38:46.0738 Error ServiceControllerExtension ChangeServiceStatus failed to change service status [name=AATPSensor status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.
at System.ServiceProcess.ServiceController.WaitForStatus(ServiceControllerStatus desiredStatus, TimeSpan timeout)
at Microsoft.Tri.Infrastructure.ServiceControllerExtension.ChangeServiceStatus(String name, ServiceControllerStatus status, TimeSpan timeout, Nullable`1 awaitedStatus)]
Microsoft.Tri.Sensor.Deployment.Deployer_20220508083018.log
2022-05-08 08:30:31.1356 Error ServiceControllerExtension ChangeServiceStatus failed to change service status [name=AATPSensor status=Stopped Exception=System.InvalidOperationException: Cannot stop AATPSensor service on computer '.'. ---> System.ComponentModel.Win32Exception: The service has not been started
--- End of inner exception stack trace ---
at ...
Uninstalled Azure Advanced Threat Protection. Then tried install again.
Azure Advanced Threat Protection Sensor_20220509160047.log
[1148:1E90][2022-05-09T16:00:48]i000: 2022-05-09 14:00:48.4236 Error DeploymentManager ShowErrorMessage System.ArgumentNullException: Value cannot be null.
Parameter name: path1
at ...
[1148:1E90][2022-05-09T16:00:48]i000: 2022-05-09 14:00:48.4236 Debug SensorBootstrapperApplication Run Engine.Quit [\[]deploymentResultStatus=1603 isRestartRequired=False[\]]
[1148:0E0C][2022-05-09T16:00:48]i500: Shutting down, exit code: 0x643
...
[1148:0E0C][2022-05-09T16:00:48]i007: Exit code: 0x643, restarting: No
