08-22-2018 12:58 PM - edited 03-12-2019 06:54 AM
Firepower User Agent 2.3 installed on Windows Server 2012 R2 (clean install)
SQL Server Compact 3.5 SP2 32-bit Installed
SQL Server Compact 3.5 SP2 64-bit Installed
.NET Framework 4.0 not required due to OS version
Added into FMC
All is fine until I add the FMC details to the User Agent. The FMC changes to Available then (silently) the Service stops. When I try to restart the service it changes to Running for 1-2 seconds then back to Not Running. Event Viewer shows two errors:
Faulting application name: AgentService.exe, version: 1.0.0.0, time stamp: 0x55b90ea6
Faulting module name: KERNELBASE.dll, version: 6.3.9600.18938, time stamp: 0x5a7ddf0a
Exception code: 0xe0434352
Fault offset: 0x0000000000008eac
Faulting process id: 0x598
Faulting application start time: 0x01d43a50ee5987a6
Faulting application path: C:\Program Files (x86)\Cisco Systems, Inc\Cisco Firepower User Agent for Active Directory\AgentService.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: 2c33609c-a644-11e8-80cc-005056a31829
Faulting package full name:
Faulting package-relative application ID:
Application: AgentService.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.ArgumentNullException
at System.Threading.Monitor.Enter(System.Object)
at SFCommon.SFUtil.CopyHash(System.Collections.Hashtable)
at Service.DataSynchronizer.BringSourcefireDCUpToDate(System.String, System.String, System.Collections.Hashtable, System.String)
at Service.DCReporter.CheckDCStatuses(System.Collections.ArrayList, System.Collections.Hashtable, System.String)
at Service.ServiceSimulator.SourcefireDCCheckerWork()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
I've tried uninstalling and reinstalling everything but no luck. Any ideas?
08-23-2018 06:56 AM
The account you use to run the Agent requires "Logon as a service" rights as well as the ability to write to C:\ which can be obtained my making it an administrator of the local machine.
08-23-2018 09:27 AM
08-23-2018 09:35 AM
Have you tried stopping the service and deleting "C:\UserEncryptionBytes.bin" ?
08-23-2018 09:40 AM
08-27-2019 12:27 AM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide