Defender for Identity (MDI)

MDI lab – DC running out of memory

This is just a quick tip, as I encountered this issue when configuring one of my lab environments. Ensure you have enough memory; otherwise, your MDI sensor on the DC will not start. You can end up with the following error in the event viewer.

General: Service cannot be started. System.OutOfMemoryException: Exception of type ‘System.OutOfMemoryException’ was thrown.
at Microsoft.Tri.Infrastructure.ExceptionHandler.Handle(Exception exception, String exceptionDetails, Dictionary`2 additionalDimensionNameToValueMapping, Boolean shouldFlush)
at Microsoft.Tri.Infrastructure.Service.OnStart(String[] args)
at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Source: AATPSensor
Event ID: 0

You just need to add more memory to your DC and the service will start smoothly after this.

Tiago Souza

Tiago Souza

Security Technical Specialist
Cyber Security Technical Specialist at Microsoft | Cloud Security & Threat Protection | Blog content creator at CyberGeeks.Cloud - https://linktr.ee/tiagovf