The following forum(s) are migrating to a new home on Microsoft Q&A (Preview): Azure Virtual Machines!

Ask new questions on Microsoft Q&A (Preview).
Interact with existing posts until December 13, 2019, after which content will be closed to all new and existing posts.

Learn More

 none
Installation of Antimalware for Azure on Win2k8 R2 VM failed - Error code 52 RRS feed

  • Question

  • Hi,

    Installation of Antimalware for Azure on Win2k8 R2 VM (I know, don't ask) fails on serveral VM's with error code 52, not documented. Anyone seen this before? No clue with procmon either with filtering on mpclient.dll

    Contents logfile:

    [10/07/2019 03:00:59.08] Executing: C:\Packages\Plugins\Microsoft.Azure.Security.IaaSAntimalware\1.5.5.9\AntimalwareConfig.exe -enable

    [10/07/2019 03:01:48.78] Execution Complete.
    ######
    Execution Output:
    Microsoft Antimalware Configuration Utility
    Version 1.5.5.9
    Please refer this TSG: 
    https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/iaas-antimalware-windows
    - Current UTC time: 7-10-2019 3:00:59
    - Getting InvalidOperationException when trying to find is MSMPSvc running, we will move on to check if WinDefend is running 7-10-2019 3:01:32
    - Trying to find is Defender installed... 7-10-2019 3:01:32
    - Getting Configuration 7-10-2019 3:01:32
    - Getting Configuration Schema Type 7-10-2019 3:01:32
    - Configuration settings file found: C:\Packages\Plugins\Microsoft.Azure.Security.IaaSAntimalware\1.5.5.9\RuntimeSettings\0.settings 7-10-2019 3:01:32
    - Getting json Configuration 7-10-2019 3:01:33
    - Deserializing Json Cfg 7-10-2019 3:01:33
    - Enabling antimalware 7-10-2019 3:01:33
    - Checking Is Defender or Camp Installed 7-10-2019 3:01:33
    - Trying to find is Defender installed... 7-10-2019 3:01:33
    - Defender Installed, ServiceName WinDefend 7-10-2019 3:01:33
    - Checking Is Service Running 7-10-2019 3:01:33
    - Getting InvalidOperationException when trying to find is MSMPSvc running, we will move on to check if WinDefend is running 7-10-2019 3:01:33
    - Service is not Running, start enabling steps 7-10-2019 3:01:33
    - Initializing CampEngine 7-10-2019 3:01:33
    - Creating Engine Configurator 7-10-2019 3:01:33
    - Register Microsoft Update For Mep 7-10-2019 3:01:33
    - Start the registration script for Microsoft Update 7-10-2019 3:01:33
    - End the registration script for Microsoft Update 7-10-2019 3:01:33
    - Registered to receive antimalware updates via Microsoft Update 7-10-2019 3:01:48
    - Start Enable AntiMalware for Engine Configurator Api 7-10-2019 3:01:48
    - Fail to EnableAntiMalware::System.DllNotFoundException: Unable to load DLL 'MpClient.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)
       at Microsoft.Azure.Security.MpClient.MpManagerOpen(UInt32 dwReserved, IntPtr& pMpHandle)
       at Microsoft.Azure.Security.EngineConfiguratorApi.EnableAntiMalware(String ServiceName) 7-10-2019 3:01:48
    * ERROR: Enable step getting DllNotFoundException: System.DllNotFoundException: Unable to load DLL 'MpClient.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)
       at Microsoft.Azure.Security.MpClient.MpManagerOpen(UInt32 dwReserved, IntPtr& pMpHandle)
       at Microsoft.Azure.Security.EngineConfiguratorApi.EnableAntiMalware(String ServiceName)
       at Microsoft.Azure.Security.CampEngine.Enable(AntimalwareConfig newConfig)


    Execution Error:

    ######
    Command C:\Packages\Plugins\Microsoft.Azure.Security.IaaSAntimalware\1.5.5.9\AntimalwareConfig.exe of Microsoft.Azure.Security.IaaSAntimalware has exited with Exit code: 52

    Monday, October 7, 2019 7:05 AM

All replies

  • Hi Dennis,

    Can you check the state of this service on that system  MSMPSvc.exe

    Please make sure its running and set its startup state to automatic.

    Also make sure this "C:\Program Files\Microsoft Security Client" path is in the PATH environment variable
    Monday, October 7, 2019 8:31 AM
    Moderator
  • Hi jakaruna-MSFT,

    msmpsvc.exe is not listed as an existing or running service.
    Added the path to env variable.

    Monday, October 7, 2019 9:14 AM
  • Hi Dennis, 

    We need to install SCEP(System center Endpoint protection) for 2008R2 and 2012 R2.


    2016 and above has windows defender enabled by default.

    The extension used them on the background.  

    Will you be able to install SCEP on your machine?

    Once SCEP is installed, Then run the extension again. That should fix the problem.  You can also consider adding the SCEP installation on the image.

    This link has the executable to install the management pack for security center,

    But i am unable to find the download link for system center endpoint protection 2008.

    Monday, October 7, 2019 9:57 AM
    Moderator
  • Also check if you have the dll in C:\Program Files\Microsoft Security Client
    Monday, October 7, 2019 10:07 AM
    Moderator
  • Hi Dennis,

    Are you able to install the SCEP?

    Thursday, October 10, 2019 5:40 AM
    Moderator
  • Hi Dennis,

    Is there any update

    Monday, October 14, 2019 5:38 AM
    Moderator
  • Hi,

    I was able to manually install scepinstall_230274d8b20bbe30fb94a287fd82670af0309ea4.exe

    Below output from the CommandExecution.log located at C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.Security.IaaSAntimalware\1.5.5.9

    Still the same error but the MsMpSvc (Microsoft Antimalware Service) is running af installation!
    I'm able to open the console and configure settings.

    Checked the MpClient.dll, this is found at C:\Program Files\Microsoft Security Client

    Any ideas left?

    [10/26/2019 12:01:14.87] Executing: C:\Packages\Plugins\Microsoft.Azure.Security.IaaSAntimalware\1.5.5.9\AntimalwareConfig.exe -enable
    [10/26/2019 12:01:17.87] Execution Complete.
    ######
    Execution Output:
    Microsoft Antimalware Configuration Utility
    Version 1.5.5.9
    Please refer this TSG: 
    https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/iaas-antimalware-windows
    - Current UTC time: 26-10-2019 12:01:15
    - Getting Configuration 26-10-2019 12:01:16
    - Getting Configuration Schema Type 26-10-2019 12:01:16
    - Configuration settings file found: C:\Packages\Plugins\Microsoft.Azure.Security.IaaSAntimalware\1.5.5.9\RuntimeSettings\0.settings 26-10-2019 12:01:16
    - Getting json Configuration 26-10-2019 12:01:17
    - Deserializing Json Cfg 26-10-2019 12:01:17
    - Enabling antimalware 26-10-2019 12:01:17
    - Checking Is Defender or Camp Installed 26-10-2019 12:01:17
    - Trying to find is Defender installed... 26-10-2019 12:01:17
    - Defender Installed, ServiceName WinDefend 26-10-2019 12:01:17
    - Checking Is Service Running 26-10-2019 12:01:17
    - Checking the basic sanity for new antimalware config 26-10-2019 12:01:17
    - Applying config 26-10-2019 12:01:17
    - Initializing CampEngine with newConfig 26-10-2019 12:01:17
    - Initializing CampEngine 26-10-2019 12:01:17
    - Creating Engine Configurator 26-10-2019 12:01:17
    - Getting Real Time Protection 26-10-2019 12:01:17
    - Configured Real Time Protection (Enabled=True) 26-10-2019 12:01:17
    - Getting Scheduled Scan Settings 26-10-2019 12:01:17
    - Getting Exclusion Settings 26-10-2019 12:01:17
    - Configured file extension exclusion (.mdf) 26-10-2019 12:01:17
    - Configured file extension exclusion (.ldf) 26-10-2019 12:01:17
    - Configured file extension exclusion (.edb) 26-10-2019 12:01:17
    - Configured path exclusion ("C:\inetpub\logs\LogFiles\") 26-10-2019 12:01:17
    - Configured path exclusion ("C:\inetpub\temp\IIS Temporary Compressed Files") 26-10-2019 12:01:17
    - Configured path exclusion ("C:\pagefile.sys") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\Deploy") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\HealthMon") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\ICA Client\Cache") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\ICA Client\ssonsvr.exe") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\Independent Management Architecture") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\Licensing") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\RadeCache") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\Secure Gateway") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\Server Resource Management") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\Streaming Client") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\system32") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\XTE") 26-10-2019 12:01:17
    - Configured path exclusion ("%ProgramFiles%\Citrix\Group Policy") 26-10-2019 12:01:17
    - Configured path exclusion ("%SYSTEMROOT%\Security\Database\") 26-10-2019 12:01:17
    - Configured path exclusion ("%SYSTEMROOT%\SoftwareDistribution\Datastore") 26-10-2019 12:01:17
    - Configured path exclusion ("%SYSTEMROOT%\SoftwareDistribution\Datastore\Logs") 26-10-2019 12:01:17
    - Configured path exclusion ("%SYSTEMROOT%\SYSMSI\SSEE\MSSQL.2005\MSSQL\Backup") 26-10-2019 12:01:17
    - Configured path exclusion ("%SYSTEMROOT%\SYSMSI\SSEE\MSSQL.2005\MSSQL\DATA") 26-10-2019 12:01:17
    - Configured path exclusion ("%SYSTEMROOT%\System32\Inetsrv\config") 26-10-2019 12:01:17
    - Configured path exclusion ("%SYSTEMROOT%\system32\LServer") 26-10-2019 12:01:17
    - Configured path exclusion ("%SYSTEMROOT%\system32\spool\PRINTERS") 26-10-2019 12:01:17
    - Configured path exclusion ("D:\Data\TSProfile") 26-10-2019 12:01:17
    - Configured path exclusion ("D:\pagefile.sys") 26-10-2019 12:01:17
    - Configured path exclusion ("D:\WSUS\UpdateServicesDbFiles") 26-10-2019 12:01:17
    - Configured process exclusion (winlogon.exe) 26-10-2019 12:01:17
    - Configured process exclusion (userinit.exe) 26-10-2019 12:01:17
    - Configured process exclusion (spoolsv.exe) 26-10-2019 12:01:17
    - Configured process exclusion (smss.exe) 26-10-2019 12:01:17
    - Configured process exclusion (csrss.exe) 26-10-2019 12:01:17
    - Applying Configurations for EngineConfiguratorApi API 26-10-2019 12:01:17
    * ERROR: DllNotFoundException during ApplyConfiguration
    * ERROR: Enable step getting DllNotFoundException: System.DllNotFoundException: Unable to load DLL 'MpClient.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)
       at Microsoft.Azure.Security.MpClient.MpConfigInitialize()
       at Microsoft.Azure.Security.EngineConfiguratorApi.ApplyConfiguration()
       at Microsoft.Azure.Security.CampEngine.Enable(AntimalwareConfig newConfig)


    Execution Error:

    ######
    Command C:\Packages\Plugins\Microsoft.Azure.Security.IaaSAntimalware\1.5.5.9\AntimalwareConfig.exe of Microsoft.Azure.Security.IaaSAntimalware has exited with Exit code: 52

    Same error from the Azure portal in the extensions blade:

    Enable failed for plugin (name: Microsoft.Azure.Security.IaaSAntimalware, version 1.5.5.9) with exception Command C:\Packages\Plugins\Microsoft.Azure.Security.IaaSAntimalware\1.5.5.9\AntimalwareConfig.exe of Microsoft.Azure.Security.IaaSAntimalware has exited with Exit code: 52

    Enable failed for plugin (name: Microsoft.Azure.Security.IaaSAntimalware, version 1.5.5.9) with exception Command C:\Packages\Plugins\Microsoft.Azure.Security.IaaSAntimalware\1.5.5.9\AntimalwareConfig.exe of Microsoft.Azure.Security.IaaSAntimalware has exited with Exit code: 52
    Enable failed for plugin (name: Microsoft.Azure.Security.IaaSAntimalware, version 1.5.5.9) with exception Command C:\Packages\Plugins\Microsoft.Azure.Security.IaaSAntimalware\1.5.5.9\AntimalwareConfig.exe of Microsoft.Azure.Security.IaaSAntimalware has exited with Exit code: 52


    Saturday, October 26, 2019 12:07 PM
  • Hi Dennis,

    Can you try again after a reboot or in a new shell.

    If that didnt work,

    Please send me your subscription id to this email AzCommunity@Microsoft.com along with this thread URL.

    I will enable a one time free support for your subscription.

    Wednesday, October 30, 2019 9:22 AM
    Moderator