Unable to install host defender on Windows AD Server

Unable to install host defender on Windows AD Server

3297
Created On 06/20/24 08:17 AM - Last Modified 03/31/25 07:16 AM


Symptom


We were getting the following error on installing the defender on the host. 
Get-LocalGroup : Group S-1-5-32-544 was not found.
At C:\Program Files\defender.ps1:214 char:14
+ $group = Get-LocalGroup -SID "S-1-5-32-544"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (S-1-5-32-544:SecurityIdentifier) [Get-LocalGroup], GroupNotFoundException
+ FullyQualifiedErrorId : GroupNotFound,Microsoft.PowerShell.Commands.GetLocalGroupCommand
 


Environment


Prisma Cloud

Cause


This error was because, in an AD server, there are no "Local Groups" which results in the following error message:
Get-LocalGroup : Group S-1-5-32-544 was not found.


Resolution


Here is the workaround for the issue:
To fix this issue, we will have to make a small edit to the defender.ps1 script that was run. That script should still be left behind in your Windows VM after the previous failed install. It is located in 'C:/Program Files/' as mentioned in the error message.
Please edit this file and locate the function "get-admin-group-name".  This is what the function would look like:

function get-admin-group-name {
# Built-in SID for the Administrators group
$group = Get-LocalGroup -SID "S-1-5-32-544"
return $group.Name
}


Please modify the function so that it looks like this:

function get-admin-group-name {
# Built-in SID for the Administrators group
# $group = Get-LocalGroup -SID "S-1-5-32-544"
$group = Get-ADGroup -Identity S-1-5-32-544 -Properties member
return $group.Name
}


Finally, save the changes and manually install the defender by first ensuring you are in the correct directory by running the following command in Powershell:
cd 'C:/Program Files/'
And then running the following command:

.\defender.ps1 -type serverWindows -consoleCN [xxx].cloud.twistlock.com -install

(change the xxx with the console path)



Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000scOECAY&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language