Symptoms
You receive the following error when adding or editing an Ingest data source:
Error in command: 'Add Data Source...'. Service request failed: Access is denied Module: TimeXtender.ODX.Engine TimeXtender.ODX.Engine.ODXFaultException
Cause
Check to see if a policy in Windows Defender Exploit Guard is blocking an Ingest Service operation.
Troubleshooting
service log may show the following error:
Service request failed: System.ComponentModel.Win32Exception (0x80004005): Access is denied at System.Diagnostics.Process.StartWithCreateProcess(ProcessStartInfo startInfo) at DynamicProcessEngine.DynamicProcessClient.StartProcess(String serverName, Boolean x64BitVersion) at DynamicProcessEngine.DynamicProcessClient.StartPipelineServer(Boolean x64BitVersion)
Some configuration on this machine is blocking the Ingest Service from starting new processes and communicating with those.
Examine errors and warnings in Event Viewer:
Application and Services Log
Microsoft -> Windows -> Windows Defender -> Operational
Below is an example warning:
Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator. For more information please contact your IT administrator. ID: 01443614-CD74-433A-B99E-2ECDC07BFC25 Detection time: 2021-11-17T19:36:41.903Z User: <name> Path: C:\Program Files\TimeXtender\TimeXtender 20.10.25.64\ExecutionEngine_x64.exe Process Name: C:\Windows\explorer.exe ......
Resolution
Work with your IT team to review Windows Defender Exploit Guard policies, to whitelist (bypass) TimeXtender and Ingest Service installation folders.
