Post Automox Install fail

Hi, @crosner -- is this happening on any specific OS or various? 

It’s happening on windows 10 see the error below. 

What can we do to resolve this?

I actually just ran into the same problem.  I just installed the Automox agent on a couple of systems here.  I get the same error window you get, and looking at the log file I notice:

They all seem to fail the post configuration.  There's a 404 error when they reach out to the site https://api.automox.com/install to verify the compatibility/do the health check.  The Trust Root Configuration is successful, they register successfully, the agent recovery options are successfully configured, and the agent service starts successfully.  Plenty of free space on the system. Powershell 5.x is installed on the systems, they are running Windows  10 Pro  21H2 February update.    When I login to the portal, I see no devices in there. Using the .msi installer downloaded from the portal.

I have quite a few devices to get enrolled by this Friday so I need to know how to resolve this issue.

Thanks for any help !

Kind regards

Val

I figured out that the sites were being blocked by either a filter or contact filtering. I had to ensure that all the sites it needed to reach were Allowed/unblocked.

Do you know what all the sties are?  The documentation only lists 2 automox sites and the Microsoft sites, all of which we can get to.  I checked the IPs for api.automox.com and they are all AmazonAWS IPs. Those are all allowed in my firewall.  I think this is an issue with my ISP, as a tracert does not complete to the targeted IP. I’ll contact them with a ticket.

Thanks for your help!

Val

I’ve used this list for firewall allow-listing. https://support.automox.com/help/agent-firewall-allowlisting-rules

Thanks, Jack for that information.  😁

I had already used that and verified all is allowed. I can see the test system reaching the IP but no response.

It appears that it could be related to the fact that I have a demo account, not a full account. They are working on changing that.  I had already opened a ticket with the ISP as we do get out but not all the way to the server IP in a tracert, so it could also be something in their router someplace.

Kind regards,

Val Feehan

If you suspect firewall or some other failure in communication here are some neat techniques to try --

With Sysmon installed and a Packet Capture using Wireshark in progress, I ran this command amagent.exe --checkcompat just like in the error message above. Here is what the output looked like --

2022/04/07 15:23:54 Setting for AUTOMOX_API_BASE_URL:https://api.automox.com
2022/04/07 15:23:55 Checking agent compatibility against https://api.automox.com
2022/04/07 15:23:55 Posting /compatibilitycheck ...
2022/04/07 15:23:55 POST https://api.automox.com/compatibilitycheck
2022/04/07 15:23:55 No proxy found. Using direct connection
Successfully verified system compatibility

In this example I’m using sysmon, which I setup using this guide https://github.com/SwiftOnSecurity/sysmon-config, to figure out what IP address is being used with api.automox.com by reviewing the event logs generated by sysmon. That will produce a list of IPs. 

If not IPs from that list are in the packet capture. Then its likely a app issue.

If there is a network issue with the ISP, you won’t see these

• three-way TCP handshake
• TLS negotiations
• Payload
• Terminating the TCP connection

Here is an example of all that in action