[ZBX-22758] Cannot start Zabbix Agent 2 on Domain Controllers Created: 2023 May 02  Updated: 2024 Apr 24  Resolved: 2023 Aug 25

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G)
Affects Version/s: 5.0.35, 6.0.16, 6.0.18, 6.4.3
Fix Version/s: 6.0.22rc1, 6.4.7rc1, 7.0.0alpha4, 7.0 (plan)

Type: Problem report Priority: Major
Reporter: Asahi Charron Assignee: Aleksejs Sestakovs (Inactive)
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Windows Server 2019/2022

Attachments: PNG File Screenshot 2023-05-09 at 12.15.55.png     JPEG File zabbix_agent_2_cannot_start_agent.jpg     JPEG File zabbix_agent_2_cannot_start_agent_expected_behavior.jpg     JPEG File zabbix_agent_2_cannot_start_agent_pwsh.jpg    
Issue Links:
Duplicate
Team: Team B
Sprint: Sprint 103 (Aug 2023)
Story Points: 0.125

 Description   

Steps to reproduce:

  1. Install the Zabbix Agent 2 version 6.0.13 using the MSI on Windows Servers that are running as Domain Controllers
  2. Start the Zabbix Agent 2 service using the Windows Services Manager (services.msc)
  3. Start the Zabbix Agent 2 using the command line

This issue is specific to servers that are running Windows Server and have the Domain Controller role. Other servers are able to run Zabbix Agent 2 version 6.0.13 succesfully.

Result:
Agent installation using the MSI completes successfully in all cases.

Starting the Zabbix Agent 2 service using the Windows Services Manager (services.msc) gives the following result:

Starting the Zabbix Agent 2 service using the command line (in this case Powershell), gives the following result:

I use the following commands to start the agent and check to see if the agent is running:

& 'C:\Program Files\Zabbix Agent 2\zabbix_agent2.exe' --start --config 'C:\Program Files\Zabbix Agent 2\zabbix_agent2.conf' ; Get-Service 'Zabbix Agent 2' ; Start-Sleep -Seconds 2 ; Get-Service 'Zabbix Agent 2'

As seen in the screenshot above, the cmdlet "Get-Service" shows the agent service is "Starting" right after the zabbix_agent2.exe command ran, however after 2 seconds it switches to the "Stopped" state.

The Zabbix Agent 2 log file found in C:\Program Files\Zabbix Agent 2\zabbix_agent2.log shows the following:

2023/05/02 17:29:42.335474 Starting Zabbix Agent 2 (6.0.13)
2023/05/02 17:29:42.335474 OpenSSL library (OpenSSL 3.0.8 7 Feb 2023) initialized
2023/05/02 17:29:42.335474 using configuration file: C:\Program Files\Zabbix Agent 2\zabbix_agent2.conf
2023/05/02 17:29:42.335474 using plugin 'Agent' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'Ceph' (built-in) providing following interfaces: exporter, runner, configurator
2023/05/02 17:29:42.335474 using plugin 'Cpu' (built-in) providing following interfaces: exporter, collector, runner
2023/05/02 17:29:42.335474 using plugin 'DNS' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'File' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 using plugin 'Log' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 using plugin 'MQTT' (built-in) providing following interfaces: watcher, configurator
2023/05/02 17:29:42.335474 using plugin 'Memcached' (built-in) providing following interfaces: exporter, runner, configurator
2023/05/02 17:29:42.335474 using plugin 'Memory' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'Modbus' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 using plugin 'Mysql' (built-in) providing following interfaces: exporter, runner, configurator
2023/05/02 17:29:42.335474 using plugin 'NetIf' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'Oracle' (built-in) providing following interfaces: exporter, runner, configurator
2023/05/02 17:29:42.335474 using plugin 'Proc' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'Redis' (built-in) providing following interfaces: exporter, runner, configurator
2023/05/02 17:29:42.335474 using plugin 'Smart' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 using plugin 'Swap' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'SystemRun' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 using plugin 'TCP' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 using plugin 'UDP' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 using plugin 'Uname' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'Uptime' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'Users' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 using plugin 'VFSDir' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'VMemory' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'VfsFs' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'WebCertificate' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 using plugin 'WebPage' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 using plugin 'WindowsEventlog' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 lowering the plugin WindowsPerfInstance capacity to 1 as the configured capacity 100 exceeds limits
2023/05/02 17:29:42.335474 using plugin 'WindowsPerfInstance' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'WindowsPerfMon' (built-in) providing following interfaces: exporter, collector, runner
2023/05/02 17:29:42.335474 using plugin 'WindowsServices' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'Wmi' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'ZabbixAsync' (built-in) providing following interfaces: exporter
2023/05/02 17:29:42.335474 using plugin 'ZabbixStats' (built-in) providing following interfaces: exporter, configurator
2023/05/02 17:29:42.335474 lowering the plugin ZabbixSync capacity to 1 as the configured capacity 100 exceeds limits
2023/05/02 17:29:42.335474 using plugin 'ZabbixSync' (built-in) providing following interfaces: exporter
2023/05/02 17:29:43.165157 Plugin communication protocol version is 6.0.13
2023/05/02 17:29:43.165157 Zabbix Agent2 hostname: [REDACTED]
2023/05/02 17:29:43.167786 cannot start agent: open \\.\pipe\agent.sock: The system cannot find the path specified.
2023/05/02 17:29:44.013516 Zabbix Agent 2 stopped. (6.0.13)

It seems that the agent cannot find (or start) the \\.\pipe\agent.sock. It is unclear to me what this component does and what could possibly prevent the agent from finding/starting this component.

The zabbix_agent2.conf file contains the following settings:

LogFile=C:\Program Files\Zabbix Agent 2\zabbix_agent2.log
Server=REDACTED
ServerActive=REDACTED
Hostname=REDACTED
Include=C:\Program Files\Zabbix Agent 2\zabbix_agent2.d\
ControlSocket=\\.\pipe\agent.sock
Include=.\zabbix_agent2.d\plugins.d\*.conf

These settings are the same for all our servers (except for the Hostname, which of course differs from server to server).

Expected:

We would expect the Agent service to run. This is also the behavior we see on other (non-Domain Controller) Windows Servers running Windows Server 2019 as well as servers running Windows Server 2016:

 

 Comments   
Comment by Edgar Akhmetshin [ 2023 May 09 ]

Hello Asahi,

Could you please confirm if access to the named pipes is restricted on this Servers with Group Policy?

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously

Regards,
Edgar

Comment by Asahi Charron [ 2023 May 09 ]

Hi Edgar,

The "Network access: Restrict anonymous access to Named Pipes and Shares" policy is "Enabled" using a Group Policy on the servers that have this issue.

However this is also the case on other servers where the Zabbix Agent 2 is able to start successfully and is able to report data to our Zabbix server.

Comment by Asahi Charron [ 2023 May 09 ]

I just realized I never included the error as text in the description. To make this issue easier to find for people how are facing the same/a similar issue, this is the error that is shown when starting the service using the Window Services Manager (services.msc):

Error: 1067: The process terminated unexpectedly
Comment by Edgar Akhmetshin [ 2023 May 09 ]

Hello Asahi,

I've tested on clean PDC controller with Windows 2019 with latest Agents 2 6.0.17 and 6.4.2 - issues is not reproducible.

Please provide information how to reproduce the issue.

Regards,
Edgar

Comment by Asahi Charron [ 2023 May 19 ]

I'm currently working on trying to reproduce the issue in a test environment, no luck so far. I hope to have more concrete results next week.

Also note that we are currently running version 6.0.13 of the Zabbix Agent 2. I will also have a look to to see if using version 6.0.17 of the Zabbix Agent 2 will provide different results.

Comment by Asahi Charron [ 2023 May 24 ]

First of all, I have tried installing version 6.0.17 of the Zabbix Agent 2 in our Production environment on the servers where we see this issue, this produces the same result.

I have also been able to reproduce the issue in a test environment. The test environment has a PDC that runs on Windows Server 2022 (Version 21H2) running the Zabbix Agent 2 version 6.0.17. I am able to start the agent on a "clean" environment (with no custom Group Policies applied). First I have copied the policies which are active on Domain Controllers in our Production environment. After applying these policies and restarting the Windows Server the agent is not able to start, starting the service results in the same error (Error: 1067: The process terminated unexpectedly).

I have been able to isolate which policies cause the issue. The issue occurs in our test environment when the following policies are active:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
System objects: Require case insensitivity for non-Windows subsystems
Set to "Disabled"

Computer Configuration\Windows Settings\Security SettingsEvent Log
Prevent local guests group from accessing application log
Set to "Enabled"
Prevent local guests group from accessing security log
Set to "Enabled"
Prevent local guests group from accessing system log
Set to "Enabled"

I have noticed the following while trying to isolate this issue:

  • The issue occurs as soon as one of the 3 "Prevent local guests group from accessing application/security/system log" policies are active, so it is not necessary for all 3 of them to be active simultaneously.
  • It is necessary for both the "System objects: Require case insensitivity for non-Windows subsystems" and one of the "Prevent local guests group from accessing application/security/system log" policies to be active. If only the "System objects: Require case insensitivity for non-Windows subsystems" policy is active or if only one of the "Prevent local guests group from accessing application/security/system log" policies is active the agent seems to function as expected. Therefor it seems that the combination of these policies being active prevents the agent from starting.
Comment by Asahi Charron [ 2023 May 24 ]

I did some more tests and just noticed that the issue occurs when "System objects: Require case insensitivity for non-Windows subsystems" is set both to Enabled or Disabled. When this setting is not defined the issue does not occur.

Comment by Asahi Charron [ 2023 May 25 ]

I have also tested this in our production enviroment. The Zabbix Agent 2 service can start successfully whenever the "System objects: Require case insensitivity for non-Windows subsystems" is not defined. This means that we have found a workaround for this issue.

Is this the only way for us to achieve this result? Or is there another solution for this issue?

Comment by Edgar Akhmetshin [ 2023 Jun 27 ]

Hello Asahi,

Thank you for the detailed information provided. Confirmed. 

Regards,

Edgar

Comment by Aleksejs Sestakovs (Inactive) [ 2023 Aug 24 ]

Available in versions:

Generated at Tue Jul 08 08:19:36 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.