Unable to install host defender on Windows AD Server
3297
Created On 06/20/24 08:17 AM - Last Modified 03/31/25 07:16 AM
Symptom
We were getting the following error on installing the defender on the host.
Get-LocalGroup : Group S-1-5-32-544 was not found. At C:\Program Files\defender.ps1:214 char:14 + $group = Get-LocalGroup -SID "S-1-5-32-544" + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (S-1-5-32-544:SecurityIdentifier) [Get-LocalGroup], GroupNotFoundException + FullyQualifiedErrorId : GroupNotFound,Microsoft.PowerShell.Commands.GetLocalGroupCommand
Environment
Prisma Cloud
Cause
This error was because, in an AD server, there are no "Local Groups" which results in the following error message:
Get-LocalGroup : Group S-1-5-32-544 was not found.
Resolution
Here is the workaround for the issue:
To fix this issue, we will have to make a small edit to the defender.ps1 script that was run. That script should still be left behind in your Windows VM after the previous failed install. It is located in 'C:/Program Files/' as mentioned in the error message.
Please edit this file and locate the function "get-admin-group-name". This is what the function would look like:
function get-admin-group-name {
# Built-in SID for the Administrators group
$group = Get-LocalGroup -SID "S-1-5-32-544"
return $group.Name
}
Please modify the function so that it looks like this:
function get-admin-group-name {
# Built-in SID for the Administrators group
# $group = Get-LocalGroup -SID "S-1-5-32-544"
$group = Get-ADGroup -Identity S-1-5-32-544 -Properties member
return $group.Name
}
Finally, save the changes and manually install the defender by first ensuring you are in the correct directory by running the following command in Powershell:
cd 'C:/Program Files/'
And then running the following command:
.\defender.ps1 -type serverWindows -consoleCN [xxx].cloud.twistlock.com -install
(change the xxx with the console path)