TFS 2017 agent error (lost communication with the server) - tfs

Question

I have TFS2017 installed on Windows Server 2008 R2 virtual machine. Yes, it's a weird combination, but it is what it is.
Also I installed agent(vsts-agent-win7-x64-2.117.2) on the same virtual machine. Agent is successfully installed as a service, it's up and running, I can see it in Default pool(showing as Online, Idle).
The problem starts when I request new build. It's always failing with error:
The agent agent3 lost communication with the server. Verify the machine is running and has a healthy network connection. For more information, see: https://go.microsoft.com/fwlink/?linkid=846610
I also checked logs in _diag folder:
[2018-02-27 09:33:48Z INFO JobDispatcher] Retrying lock renewal for jobrequest 9. Job is still locked for: 10 seconds.
[2018-02-27 09:33:58Z ERR JobDispatcher] Catch exception during renew agent jobrequest 9.
[2018-02-27 09:33:58Z ERR JobDispatcher] Microsoft.VisualStudio.Services.WebApi.VssServiceResponseException: Not Found
at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.HandleResponse(HttpResponseMessage response)
at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.d__48.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()
at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__451.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()
at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__271.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()
at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__261.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.VisualStudio.Services.Agent.Listener.JobDispatcher.d__12.MoveNext()
[2018-02-27 09:33:58Z INFO JobDispatcher] Lock renewal has run out of retry, stop renew lock for jobrequest 9.
[2018-02-27 09:33:58Z INFO JobDispatcher] Unable to renew job request for job 88ba8e32-bdca-402c-8a94-d1e39f95819b for the first time, stop dispatching job to worker.
Seems that agent can't update item in job queue for some reason.
I checked firewall - it's off, and moreover TFS and agent are installed on the same machine.
Any ideas?
Update.
Screenshot of Services:
I tried to create different agents running under different users - NETWORK Service or current user, which is logged into TFS. Also I always check that service is started.
Update 2.
I tried to install another agent on another VM in the same network. It was installed and appeared in Default pool. But when it goes to build, same error occurs. Btw, another VM works under Windows Server R2.

Answer 1

Wow,
That was a real nightmare. But it's finally solved.
The root of the issue is a tool called UrlScan. It was installed on the server and by default it blocks all http verbs except GET/POST/OPTIONS.
Enabling all known verbs didn't help, because seems that Agent use some custom http header. The only way was to uninstall UrlScan completely.
Good luck.