topic Re: Firepower User Agent 2.3 Not Running in Network Security

Firepower User Agent 2.3 Not Running

noisey_uk — Tue, 12 Mar 2019 13:54:41 GMT

Firepower User Agent 2.3 installed on Windows Server 2012 R2 (clean install)

SQL Server Compact 3.5 SP2 32-bit Installed

SQL Server Compact 3.5 SP2 64-bit Installed

.NET Framework 4.0 not required due to OS version

Added into FMC

All is fine until I add the FMC details to the User Agent. The FMC changes to Available then (silently) the Service stops. When I try to restart the service it changes to Running for 1-2 seconds then back to Not Running. Event Viewer shows two errors:

Faulting application name: AgentService.exe, version: 1.0.0.0, time stamp: 0x55b90ea6
Faulting module name: KERNELBASE.dll, version: 6.3.9600.18938, time stamp: 0x5a7ddf0a
Exception code: 0xe0434352
Fault offset: 0x0000000000008eac
Faulting process id: 0x598
Faulting application start time: 0x01d43a50ee5987a6
Faulting application path: C:\Program Files (x86)\Cisco Systems, Inc\Cisco Firepower User Agent for Active Directory\AgentService.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: 2c33609c-a644-11e8-80cc-005056a31829
Faulting package full name:
Faulting package-relative application ID:

Application: AgentService.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.ArgumentNullException
at System.Threading.Monitor.Enter(System.Object)
at SFCommon.SFUtil.CopyHash(System.Collections.Hashtable)
at Service.DataSynchronizer.BringSourcefireDCUpToDate(System.String, System.String, System.Collections.Hashtable, System.String)
at Service.DCReporter.CheckDCStatuses(System.Collections.ArrayList, System.Collections.Hashtable, System.String)
at Service.ServiceSimulator.SourcefireDCCheckerWork()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()

I've tried uninstalling and reinstalling everything but no luck. Any ideas?

Re: Firepower User Agent 2.3 Not Running

Greg Smalley — Thu, 23 Aug 2018 13:56:08 GMT

The account you use to run the Agent requires "Logon as a service" rights as well as the ability to write to C:\ which can be obtained my making it an administrator of the local machine.

Open up Windows services (services.msc)
Find the "Cisco Firepower User" service
Change Service Logon to service account user you will be using. This will grant Log on as a service right
Open your Windows User Accounts
Open the Local Administrators group
Add your service account the local administrators
Your Service Account must also have the ability to monitor Event logs on your domain controllers. This can be accomplished by adding your service account to the built in Domain group "Event Log Readers".

Re: Firepower User Agent 2.3 Not Running

noisey_uk — Thu, 23 Aug 2018 16:27:17 GMT

Thanks for your suggestions Greg. Unfortunately I already tried all of those too. In addition to the service stopping when FMC is added, it refuses to add an AD server. I've used ldp.exe to check that a bind works from that machine using the same credentials and it's fine. I've had to open a TAC case.

Re: Firepower User Agent 2.3 Not Running

Greg Smalley — Thu, 23 Aug 2018 16:35:50 GMT

Have you tried stopping the service and deleting "C:\UserEncryptionBytes.bin" ?

Re: Firepower User Agent 2.3 Not Running

noisey_uk — Thu, 23 Aug 2018 16:40:11 GMT

I have. I did that as part of the reinstallation steps too.

Re: Firepower User Agent 2.3 Not Running

alex.fritzsche — Tue, 27 Aug 2019 07:27:22 GMT

Hey,

how did you get the problem solved?