ATP sensor installation failed

[Anderson Lacruz]

After several tries in order to install Azure ATP sensor on the first domain controller I get an error about ATP service but without clue what it could be the issue. I reviewed event logs, logs from ATP installation. All pre-requisites are ok. Here some information

Domain Controller is Windows 2012 R2

[1054:1058][2018-06-21T13:07:56]e000: Error 0x80070643: Failed to install MSI package.
[1054:1058][2018-06-21T13:07:56]e000: Error 0x80070643: Failed to execute MSI package.
[0158:0EF8][2018-06-21T13:07:56]e000: Error 0x80070643: Failed to configure per-machine MSI package.
[0158:0EF8][2018-06-21T13:07:56]i000: 2018-06-21 17:07:56.4824 Error DeploymentProgress [\[]methodName=BootstrapperApplication_ExecutePackageComplete status=-2147023293 exception=[\]]
[0158:0EF8][2018-06-21T13:07:56]i319: Applied execute package: MsiPackage, result: 0x80070643, restart: None

2018-06-21 17:03:48.5340 Error ServiceControllerExtension Failed to change service status [name=AATPSensorUpdater status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.

MSI (s) (84:AC) [13:07:56:447]: Note: 1: 1708
MSI (s) (84:AC) [13:07:56:447]: Note: 1: 2205 2:  3: Error
MSI (s) (84:AC) [13:07:56:447]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1708
MSI (s) (84:AC) [13:07:56:447]: Note: 1: 2205 2:  3: Error
MSI (s) (84:AC) [13:07:56:447]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709
MSI (s) (84:AC) [13:07:56:447]: Product: Azure Advanced Threat Protection Sensor -- Installation failed.

Any information about it will be helpful. I was researching on the web and I didn´t find anything related.

Regards and thanks

[#2]

---

@Anderson Lacruz wrote:

After several tries in order to install Azure ATP sensor on the first domain controller I get an error about ATP service but without clue what it could be the issue. I reviewed event logs, logs from ATP installation. All pre-requisites are ok. Here some information

Domain Controller is Windows 2012 R2

[1054:1058][2018-06-21T13:07:56]e000: Error 0x80070643: Failed to install MSI package.
[1054:1058][2018-06-21T13:07:56]e000: Error 0x80070643: Failed to execute MSI package.
[0158:0EF8][2018-06-21T13:07:56]e000: Error 0x80070643: Failed to configure per-machine MSI package.
[0158:0EF8][2018-06-21T13:07:56]i000: 2018-06-21 17:07:56.4824 Error DeploymentProgress [\[]methodName=BootstrapperApplication_ExecutePackageComplete status=-2147023293 exception=[\]]
[0158:0EF8][2018-06-21T13:07:56]i319: Applied execute package: MsiPackage, result: 0x80070643, restart: None

2018-06-21 17:03:48.5340 Error ServiceControllerExtension Failed to change service status [name=AATPSensorUpdater status=Running Exception=System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.

MSI (s) (84:AC) [13:07:56:447]: Note: 1: 1708
MSI (s) (84:AC) [13:07:56:447]: Note: 1: 2205 2:  3: Error
MSI (s) (84:AC) [13:07:56:447]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1708
MSI (s) (84:AC) [13:07:56:447]: Note: 1: 2205 2:  3: Error
MSI (s) (84:AC) [13:07:56:447]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709
MSI (s) (84:AC) [13:07:56:447]: Product: Azure Advanced Threat Protection Sensor -- Installation failed.

Any information about it will be helpful. I was researching on the web and I didn´t find anything related.

Regards and thanks

---

The issue was DNS resolution with the ATP WorkSpace from domain controller. I followed this link to solve the issue:

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/configure-proxy

More details and errors were gotten from logs generated in ATP folder during installation / Deployment.and before the rollback.

[#3]

ATP sensor installation failed in DC Win2008 R2 AZURE ATP 

[1CEC:1A74][2018-08-24T15:14:38]i001: Burn v3.11.0.1701, Windows v6.1 (Build 7601: Service Pack 1), path: C:\Users\~AGUTI~1\AppData\Local\Temp\{8FE602E4-C369-4C08-B978-3FF7FFC48C23}\.cr\Azure ATP Sensor Setup.exe
[1CEC:1A74][2018-08-24T15:14:38]i000: Initializing hidden variable 'AccessKey'
[1CEC:1A74][2018-08-24T15:14:38]i000: Initializing string variable 'NetFrameworkCommandLineArguments' to value '/passive /showrmui'
[1CEC:1A74][2018-08-24T15:14:38]i009: Command Line: '"-burn.clean.room=C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\Azure ATP Sensor Setup.exe" -burn.filehandle.attached=204 -burn.filehandle.self=212'
[1CEC:1A74][2018-08-24T15:14:38]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\Azure ATP Sensor Setup.exe'
[1CEC:1A74][2018-08-24T15:14:38]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\'
[1CEC:1A74][2018-08-24T15:14:38]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438.log'
[1CEC:1A74][2018-08-24T15:14:38]i000: Setting string variable 'WixBundleName' to value 'Azure Advanced Threat Protection Sensor'
[1CEC:1A74][2018-08-24T15:14:38]i000: Setting string variable 'WixBundleManufacturer' to value 'Microsoft Corporation'
[1CEC:1A74][2018-08-24T15:14:38]i000: Loading prerequisite bootstrapper application because managed host could not be loaded, error: 0x80131700.
[1CEC:2324][2018-08-24T15:14:39]i000: Setting numeric variable 'WixStdBALanguageId' to value 1033
[1CEC:2324][2018-08-24T15:14:39]i000: Setting version variable 'WixBundleFileVersion' to value '2.0.0.0'
[1CEC:1A74][2018-08-24T15:14:39]i100: Detect begin, 5 packages
[1CEC:1A74][2018-08-24T15:14:39]i000: Setting numeric variable 'Kb4019990Windows2008R2Exists' to value 1
[1CEC:1A74][2018-08-24T15:14:39]i000: Registry key not found. Key = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Package_1_for_KB4019990~31bf3856ad364e35~amd64~~6.2.1.1'
[1CEC:1A74][2018-08-24T15:14:39]i000: Setting numeric variable 'Kb4019990Windows2012Exists' to value 0
[1CEC:1A74][2018-08-24T15:14:39]i000: Setting string variable 'NetFrameworkRegistryValue' to value '379893'
[1CEC:1A74][2018-08-24T15:14:39]i000: Registry key not found. Key = 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels'
[1CEC:1A74][2018-08-24T15:14:39]i000: Registry key not found. Key = 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels'
[1CEC:1A74][2018-08-24T15:14:39]i052: Condition 'Kb4019990Windows2008R2Exists' evaluates to true.
[1CEC:1A74][2018-08-24T15:14:39]i052: Condition 'Kb4019990Windows2012Exists' evaluates to false.
[1CEC:1A74][2018-08-24T15:14:39]i052: Condition 'NetFrameworkRegistryValue >= 460798' evaluates to false.
[1CEC:1A74][2018-08-24T15:14:39]i052: Condition 'NetFrameworkRegistryValue >= 460798' evaluates to false.
[1CEC:1A74][2018-08-24T15:14:39]i101: Detected package: Kb4019990Windows2008R2Package, state: Present, cached: None
[1CEC:1A74][2018-08-24T15:14:39]i101: Detected package: Kb4019990Windows2012Package, state: Absent, cached: None
[1CEC:1A74][2018-08-24T15:14:39]i101: Detected package: NetFrameworkPackageServer, state: Absent, cached: None
[1CEC:1A74][2018-08-24T15:14:39]i101: Detected package: NetFrameworkPackageServerCore, state: Absent, cached: None
[1CEC:1A74][2018-08-24T15:14:39]i101: Detected package: MsiPackage, state: Absent, cached: None
[1CEC:1A74][2018-08-24T15:14:39]i199: Detect complete, result: 0x0
[1CEC:1A74][2018-08-24T15:14:41]i200: Plan begin, 5 packages, action: Install
[1CEC:1A74][2018-08-24T15:14:41]i052: Condition 'VersionNT64 = v6.1' evaluates to true.
[1CEC:1A74][2018-08-24T15:14:41]i052: Condition 'VersionNT64 = v6.1' evaluates to true.
[1CEC:1A74][2018-08-24T15:14:41]w321: Skipping dependency registration on package with no dependency providers: Kb4019990Windows2008R2Package
[1CEC:1A74][2018-08-24T15:14:41]i052: Condition 'VersionNT64 = v6.2' evaluates to false.
[1CEC:1A74][2018-08-24T15:14:41]i052: Condition 'VersionNT64 = v6.2' evaluates to false.
[1CEC:1A74][2018-08-24T15:14:41]w321: Skipping dependency registration on package with no dependency providers: Kb4019990Windows2012Package
[1CEC:1A74][2018-08-24T15:14:41]i052: Condition 'ServerLevelsServerCoreRegistryValue <> 1 OR ServerLevelsServerGuiShellRegistryValue = 1' evaluates to true.
[1CEC:1A74][2018-08-24T15:14:41]i052: Condition 'ServerLevelsServerCoreRegistryValue <> 1 OR ServerLevelsServerGuiShellRegistryValue = 1' evaluates to true.
[1CEC:1A74][2018-08-24T15:14:41]w321: Skipping dependency registration on package with no dependency providers: NetFrameworkPackageServer
[1CEC:1A74][2018-08-24T15:14:41]i000: Setting string variable 'NetFrameworkLogPath' to value 'C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438_000_NetFrameworkPackageServer.log'
[1CEC:1A74][2018-08-24T15:14:41]i052: Condition 'ServerLevelsServerCoreRegistryValue = 1 AND ServerLevelsServerGuiShellRegistryValue <> 1' evaluates to false.
[1CEC:1A74][2018-08-24T15:14:41]i052: Condition 'ServerLevelsServerCoreRegistryValue = 1 AND ServerLevelsServerGuiShellRegistryValue <> 1' evaluates to false.
[1CEC:1A74][2018-08-24T15:14:41]w321: Skipping dependency registration on package with no dependency providers: NetFrameworkPackageServerCore
[1CEC:1A74][2018-08-24T15:14:41]i201: Planned package: Kb4019990Windows2008R2Package, state: Present, default requested: Present, ba requested: Present, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[1CEC:1A74][2018-08-24T15:14:41]i201: Planned package: Kb4019990Windows2012Package, state: Absent, default requested: Absent, ba requested: None, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[1CEC:1A74][2018-08-24T15:14:41]i201: Planned package: NetFrameworkPackageServer, state: Absent, default requested: Present, ba requested: Present, execute: Install, rollback: None, cache: Yes, uncache: No, dependency: None
[1CEC:1A74][2018-08-24T15:14:41]i201: Planned package: NetFrameworkPackageServerCore, state: Absent, default requested: Absent, ba requested: None, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[1CEC:1A74][2018-08-24T15:14:41]i201: Planned package: MsiPackage, state: Absent, default requested: Present, ba requested: None, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[1CEC:1A74][2018-08-24T15:14:41]i299: Plan complete, result: 0x0
[1CEC:1A74][2018-08-24T15:14:41]i300: Apply begin
[1CEC:1A74][2018-08-24T15:14:41]i010: Launching elevated engine process.
[1CEC:1A74][2018-08-24T15:14:41]i011: Launched elevated engine process.
[1CEC:1A74][2018-08-24T15:14:42]i012: Connected to elevated engine.
[1CAC:21A8][2018-08-24T15:14:42]i358: Pausing automatic updates.
[1CAC:21A8][2018-08-24T15:14:42]i359: Paused automatic updates.
[1CAC:21A8][2018-08-24T15:14:42]i360: Creating a system restore point.
[1CAC:21A8][2018-08-24T15:14:42]i362: System restore disabled, system restore point not created.
[1CAC:21A8][2018-08-24T15:14:42]i370: Session begin, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{be78eaf0-acf4-4553-89be-9e85e2457915}, options: 0x7, disable resume: No
[1CAC:21A8][2018-08-24T15:14:42]i000: Caching bundle from: 'C:\Users\~AGUTI~1\AppData\Local\Temp\{8288E200-A8EA-4FA0-8AF9-E67477E64A3D}\.be\Azure ATP Sensor Setup.exe' to: 'C:\ProgramData\Package Cache\{be78eaf0-acf4-4553-89be-9e85e2457915}\Azure ATP Sensor Setup.exe'
[1CAC:21A8][2018-08-24T15:14:42]i320: Registering bundle dependency provider: {be78eaf0-acf4-4553-89be-9e85e2457915}, version: 2.0.0.0
[1CAC:21A8][2018-08-24T15:14:42]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{be78eaf0-acf4-4553-89be-9e85e2457915}, resume: Active, restart initiated: No, disable resume: No
[1CAC:1AD8][2018-08-24T15:14:42]i305: Verified acquired payload: NetFrameworkPackageServer at path: C:\ProgramData\Package Cache\.unverified\NetFrameworkPackageServer, moving to: C:\ProgramData\Package Cache\76054141A492BA307595250BDA05AD4E0694CDC3\NDP47-KB3186497-x86-x64-AllOS-ENU.exe.
[1CAC:21A8][2018-08-24T15:14:42]i301: Applying execute package: NetFrameworkPackageServer, action: Install, path: C:\ProgramData\Package Cache\76054141A492BA307595250BDA05AD4E0694CDC3\NDP47-KB3186497-x86-x64-AllOS-ENU.exe, arguments: '"C:\ProgramData\Package Cache\76054141A492BA307595250BDA05AD4E0694CDC3\NDP47-KB3186497-x86-x64-AllOS-ENU.exe" /passive /showrmui /norestart /ChainingPackage "Azure Advanced Threat Protection Sensor" /log "C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438_000_NetFrameworkPackageServer.log.html"'
[1CEC:1A74][2018-08-24T15:18:21]i319: Applied execute package: NetFrameworkPackageServer, result: 0x0, restart: Initiated
[1CAC:21A8][2018-08-24T15:18:21]i372: Session end, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{be78eaf0-acf4-4553-89be-9e85e2457915}, resume: Reboot Pending, restart: Initiated, disable resume: No
[1CAC:21A8][2018-08-24T15:18:21]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{be78eaf0-acf4-4553-89be-9e85e2457915}, resume: Reboot Pending, restart initiated: Yes, disable resume: No
[1CEC:1A74][2018-08-24T15:18:21]i399: Apply complete, result: 0x0, restart: Initiated, ba requested restart: No
[1CEC:1A74][2018-08-24T15:20:50]i500: Shutting down, exit code: 0x669
[1CEC:1A74][2018-08-24T15:20:50]i000: The prerequisites scheduled a restart. The bootstrapper application will be reloaded after the computer is restarted.
[1CEC:1A74][2018-08-24T15:20:50]i004: Bootstrapper application requested restart at shutdown. Planned to restart already: No.
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: Kb4019990Windows2008R2Exists = 1
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: Kb4019990Windows2012Exists = 0
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: NetFrameworkCommandLineArguments = /passive /showrmui
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: NetFrameworkLogPath = C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438_000_NetFrameworkPackageServer.log
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: NetFrameworkRegistryValue = 379893
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: VersionNT64 = 6.1.0.0
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleAction = 5
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleElevated = 1
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleFileVersion = 2.0.0.0
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleForcedRestartPackage = NetFrameworkPackageServer
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleLog = C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438.log
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleManufacturer = Microsoft Corporation
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleName = Azure Advanced Threat Protection Sensor
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleOriginalSource = C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\Azure ATP Sensor Setup.exe
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleOriginalSourceFolder = C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleProviderKey = {be78eaf0-acf4-4553-89be-9e85e2457915}
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleSourceProcessFolder = C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleSourceProcessPath = C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\Azure ATP Sensor Setup.exe
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleTag =
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleUILevel = 4
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixBundleVersion = 2.0.0.0
[1CEC:1A74][2018-08-24T15:20:50]i410: Variable: WixStdBALanguageId = 1033
[1CEC:1A74][2018-08-24T15:20:50]i007: Exit code: 0x669, restarting: Yes
[1CEC:1A74][2018-08-24T15:20:50]w005: Restarting computer...
=======================================
[16B0:16AC][2018-08-24T15:24:01]i001: Burn v3.11.0.1701, Windows v6.1 (Build 7601: Service Pack 1), path: C:\ProgramData\Package Cache\{be78eaf0-acf4-4553-89be-9e85e2457915}\Azure ATP Sensor Setup.exe
[16B0:16AC][2018-08-24T15:24:01]i000: Initializing hidden variable 'AccessKey'
[16B0:16AC][2018-08-24T15:24:01]i000: Initializing string variable 'NetFrameworkCommandLineArguments' to value '/passive /showrmui'
[16B0:16AC][2018-08-24T15:24:01]i009: Command Line: '"-burn.clean.room=C:\ProgramData\Package Cache\{be78eaf0-acf4-4553-89be-9e85e2457915}\Azure ATP Sensor Setup.exe" -burn.filehandle.attached=204 -burn.filehandle.self=212 /burn.log.append "C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438.log"'
[16B0:16AC][2018-08-24T15:24:01]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438.log'
[16B0:16AC][2018-08-24T15:24:02]i000: Setting string variable 'WixBundleManufacturer' to value 'Microsoft Corporation'
[16B0:16AC][2018-08-24T15:24:04]i000: Loading managed bootstrapper application.
[16B0:16AC][2018-08-24T15:24:08]i000: Creating BA thread to run asynchronously.
[16B0:16AC][2018-08-24T15:24:13]i100: Detect begin, 5 packages
[16B0:16AC][2018-08-24T15:24:13]i000: 2018-08-24 21:24:13.0254 Debug DeploymentModel DetectBegin [\[]Installed=False[\]]
[16B0:16AC][2018-08-24T15:24:13]i000: Setting numeric variable 'Kb4019990Windows2008R2Exists' to value 1
[16B0:16AC][2018-08-24T15:24:13]i000: Registry key not found. Key = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Package_1_for_KB4019990~31bf3856ad364e35~amd64~~6.2.1.1'
[16B0:16AC][2018-08-24T15:24:13]i000: Setting numeric variable 'Kb4019990Windows2012Exists' to value 0
[16B0:16AC][2018-08-24T15:24:13]i000: Setting string variable 'NetFrameworkRegistryValue' to value '460805'
[16B0:16AC][2018-08-24T15:24:13]i000: Registry key not found. Key = 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels'
[16B0:16AC][2018-08-24T15:24:13]i000: Registry key not found. Key = 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels'
[16B0:16AC][2018-08-24T15:24:13]i052: Condition 'Kb4019990Windows2008R2Exists' evaluates to true.
[16B0:16AC][2018-08-24T15:24:13]i052: Condition 'Kb4019990Windows2012Exists' evaluates to false.
[16B0:16AC][2018-08-24T15:24:13]i052: Condition 'NetFrameworkRegistryValue >= 460798' evaluates to true.
[16B0:16AC][2018-08-24T15:24:13]i052: Condition 'NetFrameworkRegistryValue >= 460798' evaluates to true.
[16B0:16AC][2018-08-24T15:24:13]i101: Detected package: Kb4019990Windows2008R2Package, state: Present, cached: None
[16B0:16AC][2018-08-24T15:24:13]i101: Detected package: Kb4019990Windows2012Package, state: Absent, cached: None
[16B0:16AC][2018-08-24T15:24:13]i101: Detected package: NetFrameworkPackageServer, state: Present, cached: Complete
[16B0:16AC][2018-08-24T15:24:13]i101: Detected package: NetFrameworkPackageServerCore, state: Present, cached: Complete
[16B0:16AC][2018-08-24T15:24:13]i101: Detected package: MsiPackage, state: Absent, cached: None
[16B0:16AC][2018-08-24T15:24:13]i199: Detect complete, result: 0x0
[16B0:179C][2018-08-24T15:24:13]i000: 2018-08-24 21:24:13.1582 Debug DeploymentModel [\[]DeploymentAction=Install[\]]
[16B0:179C][2018-08-24T15:24:13]i000: 2018-08-24 21:24:13.5059 Debug DeploymentModel [\[]IsAfterRestartAndConfigured=False[\]]
[16B0:179C][2018-08-24T15:26:14]i000: 2018-08-24 21:26:14.7250 Info InteractiveDeploymentManager ValidateCreateSensorAsync returned [\[]validateCreateSensorResult=Success[\]]
[16B0:179C][2018-08-24T15:26:14]i000: Setting string variable 'IsConfigured' to value 'True'
[16B0:179C][2018-08-24T15:26:14]i000: Setting hidden variable 'AccessKey'
[16B0:179C][2018-08-24T15:26:14]i000: Setting string variable 'InstallationPath' to value 'C:\Program Files\Azure Advanced Threat Protection Sensor'
[16B0:16AC][2018-08-24T15:26:14]i200: Plan begin, 5 packages, action: Install
[16B0:16AC][2018-08-24T15:26:14]i052: Condition 'VersionNT64 = v6.1' evaluates to true.
[16B0:16AC][2018-08-24T15:26:14]w321: Skipping dependency registration on package with no dependency providers: Kb4019990Windows2008R2Package
[16B0:16AC][2018-08-24T15:26:14]i052: Condition 'VersionNT64 = v6.2' evaluates to false.
[16B0:16AC][2018-08-24T15:26:14]w321: Skipping dependency registration on package with no dependency providers: Kb4019990Windows2012Package
[16B0:16AC][2018-08-24T15:26:14]i052: Condition 'ServerLevelsServerCoreRegistryValue <> 1 OR ServerLevelsServerGuiShellRegistryValue = 1' evaluates to true.
[16B0:16AC][2018-08-24T15:26:14]w321: Skipping dependency registration on package with no dependency providers: NetFrameworkPackageServer
[16B0:16AC][2018-08-24T15:26:14]i052: Condition 'ServerLevelsServerCoreRegistryValue = 1 AND ServerLevelsServerGuiShellRegistryValue <> 1' evaluates to false.
[16B0:16AC][2018-08-24T15:26:14]w321: Skipping dependency registration on package with no dependency providers: NetFrameworkPackageServerCore
[16B0:16AC][2018-08-24T15:26:14]i000: Setting string variable 'WixBundleRollbackLog_MsiPackage' to value 'C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438_000_MsiPackage_rollback.log'
[16B0:16AC][2018-08-24T15:26:14]i000: Setting string variable 'WixBundleLog_MsiPackage' to value 'C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438_000_MsiPackage.log'
[16B0:16AC][2018-08-24T15:26:14]i201: Planned package: Kb4019990Windows2008R2Package, state: Present, default requested: Present, ba requested: Present, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[16B0:16AC][2018-08-24T15:26:14]i201: Planned package: Kb4019990Windows2012Package, state: Absent, default requested: Absent, ba requested: Absent, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[16B0:16AC][2018-08-24T15:26:14]i201: Planned package: NetFrameworkPackageServer, state: Present, default requested: Present, ba requested: Present, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[16B0:16AC][2018-08-24T15:26:14]i201: Planned package: NetFrameworkPackageServerCore, state: Present, default requested: Absent, ba requested: Absent, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[16B0:16AC][2018-08-24T15:26:14]i201: Planned package: MsiPackage, state: Absent, default requested: Present, ba requested: Present, execute: Install, rollback: Uninstall, cache: Yes, uncache: No, dependency: Register
[16B0:16AC][2018-08-24T15:26:14]i299: Plan complete, result: 0x0
[16B0:16AC][2018-08-24T15:26:14]i300: Apply begin
[16B0:16AC][2018-08-24T15:26:14]i010: Launching elevated engine process.
[16B0:16AC][2018-08-24T15:26:14]i011: Launched elevated engine process.
[16B0:16AC][2018-08-24T15:26:15]i012: Connected to elevated engine.
[0680:17E4][2018-08-24T15:26:15]i358: Pausing automatic updates.
[0680:17E4][2018-08-24T15:26:15]i359: Paused automatic updates.
[0680:17E4][2018-08-24T15:26:15]i360: Creating a system restore point.
[0680:17E4][2018-08-24T15:26:15]i362: System restore disabled, system restore point not created.
[0680:17E4][2018-08-24T15:26:15]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{be78eaf0-acf4-4553-89be-9e85e2457915}, resume: Active, restart initiated: No, disable resume: No
[16B0:1480][2018-08-24T15:26:15]i336: Acquiring container: WixAttachedContainer, copy from: C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\Azure ATP Sensor Setup.exe
[16B0:1480][2018-08-24T15:26:15]i000: Setting string variable 'WixBundleLastUsedSource' to value 'C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\'
[0680:0C88][2018-08-24T15:26:15]i305: Verified acquired payload: MsiPackage at path: C:\ProgramData\Package Cache\.unverified\MsiPackage, moving to: C:\ProgramData\Package Cache\{6DF515FA-FB74-49E6-90FD-174E9C7D5751}v2.0.0.0\Microsoft.Tri.Sensor.Deployment.Package.msi.
[0680:17E4][2018-08-24T15:26:15]i323: Registering package dependency provider: {6DF515FA-FB74-49E6-90FD-174E9C7D5751}, version: 2.0.0.0, package: MsiPackage
[0680:17E4][2018-08-24T15:26:15]i301: Applying execute package: MsiPackage, action: Install, path: C:\ProgramData\Package Cache\{6DF515FA-FB74-49E6-90FD-174E9C7D5751}v2.0.0.0\Microsoft.Tri.Sensor.Deployment.Package.msi, arguments: ' ARPSYSTEMCOMPONENT="1" MSIFASTINSTALL="7" ACCESSKEY="*****" InstallationPath="C:\Program Files\Azure Advanced Threat Protection Sensor" InstalledVersion="" WixBundleOriginalSourceFolder="C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\"'
[0680:17E4][2018-08-24T15:32:42]e000: Error 0x80070643: Failed to install MSI package.
[0680:17E4][2018-08-24T15:32:42]e000: Error 0x80070643: Failed to execute MSI package.
[16B0:16AC][2018-08-24T15:32:42]e000: Error 0x80070643: Failed to configure per-machine MSI package.
[16B0:16AC][2018-08-24T15:32:42]i000: 2018-08-24 21:32:42.7319 Error DeploymentProgress [\[]methodName=BootstrapperApplication_ExecutePackageComplete status=-2147023293 exception=[\]]
[16B0:16AC][2018-08-24T15:32:42]i319: Applied execute package: MsiPackage, result: 0x80070643, restart: None
[16B0:16AC][2018-08-24T15:32:42]e000: Error 0x80070643: Failed to execute MSI package.
[0680:17E4][2018-08-24T15:32:42]i318: Skipped rollback of package: MsiPackage, action: Uninstall, already: Absent
[16B0:16AC][2018-08-24T15:32:42]i319: Applied rollback package: MsiPackage, result: 0x0, restart: None
[0680:17E4][2018-08-24T15:32:42]i329: Removed package dependency provider: {6DF515FA-FB74-49E6-90FD-174E9C7D5751}, package: MsiPackage
[0680:17E4][2018-08-24T15:32:42]i351: Removing cached package: MsiPackage, from path: C:\ProgramData\Package Cache\{6DF515FA-FB74-49E6-90FD-174E9C7D5751}v2.0.0.0\
[0680:17E4][2018-08-24T15:32:42]i372: Session end, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{be78eaf0-acf4-4553-89be-9e85e2457915}, resume: None, restart: None, disable resume: No
[0680:17E4][2018-08-24T15:32:42]i330: Removed bundle dependency provider: {be78eaf0-acf4-4553-89be-9e85e2457915}
[0680:17E4][2018-08-24T15:32:42]i352: Removing cached bundle: {be78eaf0-acf4-4553-89be-9e85e2457915}, from path: C:\ProgramData\Package Cache\{be78eaf0-acf4-4553-89be-9e85e2457915}\
[0680:17E4][2018-08-24T15:32:42]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{be78eaf0-acf4-4553-89be-9e85e2457915}, resume: None, restart initiated: No, disable resume: No
[16B0:16AC][2018-08-24T15:32:42]i399: Apply complete, result: 0x80070643, restart: None, ba requested restart: No
[16B0:179C][2018-08-24T15:35:53]i000: 2018-08-24 21:35:53.5496 Debug SensorBootstrapperApplication Engine.Quit [\[]deploymentResultStatus=-2147023293 isRestartRequired=False[\]]
[16B0:16AC][2018-08-24T15:35:53]i500: Shutting down, exit code: 0x80070643
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: AccessKey = *****
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: InstallationPath = C:\Program Files\Azure Advanced Threat Protection Sensor
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: IsConfigured = True
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: Kb4019990Windows2008R2Exists = 1
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: Kb4019990Windows2012Exists = 0
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: NetFrameworkCommandLineArguments = /passive /showrmui
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: NetFrameworkRegistryValue = 460805
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: RebootPending = 0
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: VersionNT64 = 6.1.0.0
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleAction = 5
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleElevated = 1
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleLastUsedSource = C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleLog = C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438.log
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleLog_MsiPackage = C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438_000_MsiPackage.log
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleManufacturer = Microsoft Corporation
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleName = Azure Advanced Threat Protection Sensor
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleOriginalSource = C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\Azure ATP Sensor Setup.exe
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleOriginalSourceFolder = C:\Users\XXXXUSER\Desktop\share\Azure ATP Sensor Setup\
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleProviderKey = {be78eaf0-acf4-4553-89be-9e85e2457915}
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleRollbackLog_MsiPackage = C:\Users\~AGUTI~1\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20180824151438_000_MsiPackage_rollback.log
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleSourceProcessFolder = C:\ProgramData\Package Cache\{be78eaf0-acf4-4553-89be-9e85e2457915}\
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleSourceProcessPath = C:\ProgramData\Package Cache\{be78eaf0-acf4-4553-89be-9e85e2457915}\Azure ATP Sensor Setup.exe
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleTag =
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleUILevel = 4
[16B0:16AC][2018-08-24T15:35:53]i410: Variable: WixBundleVersion = 2.0.0.0
[16B0:16AC][2018-08-24T15:35:53]i007: Exit code: 0x80070643, restarting: No

[#4]

Hi @Anderson Lacruz 

Try to execute the steps described here: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/configure-proxy#configure-the-prox...

[#5]

Thanks @Nickbk 

This issue was solved long time ago. Sorry if nothing was posted it. This error is very generic.

At least in this case the issue was related with the proxy configuration and internet connection. The DC was not able to reach AATP url.

Regards

A.L