MachPanel Knowledgebase

Error on Subscribing Customer to Exchange Subscription

rehan_waseem — Wed, 18 Sep 2024 07:50:47 GMT

Summary

This article provides solution to the issue which is faced in the Service Queue while subscribing customer to Microsoft Exchange subscription

Applies To

All Versions

Error Details

When customer is subscribe to Exchange subscription then it jobs gets failed inside the Service Queue with below error:

Error: c: Create Offline Address Book: Length Cannot be less than Zero

Resolution

Possible Cause of this Error is that the CAS Internal FQDN input in Exchange Server setting is not set properly.

As mentioned in below screenshot Comma separated list of CAS servers, like CAS1.Domain.com,CAS2.Domain.com. 1st server in list will be treated as default.

Make sure full FQDN is specified not just servername.

Duplicate records causing problem in AD Org Or User listing display

rehan_waseem — Wed, 28 Aug 2024 08:31:36 GMT

Summary

This article provides information about, how to fix the issue of AD organization or AD User listing due to duplicate records exists in the database.

Applies To

MachPanel v7 and above

Issue Details

We have optimized AD Org and User listings by pre-processing records and keeping them in new table. It should work for clients but at times clients have some garbage/duplicate records that can break things and error can be seen on AD Organization or AD User listing like below:

Resolution

Below queries can be used to find duplicates in ADUser and Mailbox table, have to remove and keep only 1 working record in specific table:

--Duplicate in ADirUsers, if found have to keep one record for 1 LDAP url.

Select * from HB_tblADirUsers
Where UserLDAPURL in
(
Select UserLDAPURL from HB_tblADirUsers
Where ADUserID not in (Select ADUserId from HB_tblADirUserGroupJobs Where StatusId not in (2,3))
and UserLDAPURL!=''
Group By UserLdapURL
Having Count(UserLDAPURL) > 1
)
order by UserLDAPURL asc
GO

--Duplicate in tblExchangeMailboxes against UserLDAP, if found have to keep one record for 1 LDAP url.

Select * from HB_tblExchangeMailboxes
Where UserLDAPUrl in
(
Select UserLDAPURL from HB_tblExchangeMailboxes
Where MailboxID not in (Select AccountId from HB_tblExchangeGroupJobs Where AccountType=0 and StatusId not in (2,3))
and UserLDAPURL!=''
Group By UserLdapURL
Having Count(UserLDAPURL) > 1
)
order by UserLDAPURL asc
GO

--Duplicate in tblExchangeMailboxes against ADUserId, if found have to keep one record for 1 ADUserId

Select * from HB_tblExchangeMailboxes
Where ADUserID in
(
Select ADUserID from HB_tblExchangeMailboxes
Where MailboxID not in (Select AccountId from HB_tblExchangeGroupJobs Where AccountType=0 and StatusId not in (2,3))
Group By ADUserID
Having Count(ADUserID) > 1
)
order by MailboxID asc
GO
Once all duplicates are removed, run below script:

Declare @RowsCount int
Set @RowsCount = 1
while @RowsCount != 0
Begin
                Exec CSP_UpdateHostedOrgExtendedData
                Set @RowsCount = @@ROWCOUNT
End
GO

Declare @RowsCount int
Set @RowsCount = 1
while @RowsCount != 0
Begin
                Exec CSP_UpdateHostedUserExtendedData
                Set @RowsCount = @@ROWCOUNT
End
GO

Important: Rules to follow when deleting from aduser:

If AdUser has 2 different CustomerId, keep the record which has highest value for ADUserId.
If CustomerId is same, check for ADUserid in Mailbox table, keep record which is in mailbox table.
- If no enterprise service enable on ADUser, keep latest record.

VMIntegrationService Fails On Host Having Language Other Than English

rehan_waseem — Thu, 22 Aug 2024 09:04:41 GMT

Summary

This article give information about fixing the issue faced when Hyper-V host Server have language other than English, then the VMIntegrationService "Guest Service Interface" fails on it.

Applies to

Applies to MachPanel v7 and above

Details

When Hyper-V host have language other than English, then following command gets failed, as it looks for "Guest Service Interface" and it was not found because of the different language of Hyper-V host

While searching the whole service of the VM it shows this service with different name as shown below

Resolution

To fix this issue below should be done.

Have to set correct name on Hyper-V Host machines in registry. The integration service name can be mentioned in registry path: SOFTWARE\MachSol\MachPanel, new string key: VMIntegrationServiceName, value: "Guest Service Interface". Update the value "Guest Service Interface" in desired Host Machine Language.

VAT Validation Error While Adding Customer

rehan_waseem — Mon, 05 Aug 2024 07:58:53 GMT

Summary

This article provide you details for the resolution of error "VAT" while adding new customer.

Applies To

MachPanel v.7 and above

Error

Company Name input does not match company name against Vat Id, please check company name.

Details

It is because in new build it has EU VAT validation built-in. So, the company name entered must match company name in EU API.

Resolution

Add a new registry string value EUVATCompanyNameVariationTolerance, set value to 7 under HKEY_LOCAL_MACHINE\SOFTWARE\MachSol\MachPanel

For your information do note:

EUVATCompanyNameVariationTolerance = Value between 0 to 10. 0 means 100% difference is allowed 1 means 10% match is allowed, less then 10% will fail. 2 means 20% match is allowed, less then 20% will fail. and so on... 10 means 100% match needed.

Error in Downloading Invoice PDF "Could not find file "C:\Program Files\Control Server\Cache\Temp\Invoice_x_x.pdf"

zohaib.shaikh — Tue, 04 Jun 2024 13:48:41 GMT

Summary

You get error on Invoice when using "Download PDF" and "Email Invoice" operations.

Error message is: "Could not find file 'C:\Program Files\Control Server\Cache\Temp\Invoice_x_x.pdf".

Applies To

May happen with any version of Control Panel. We checked this on 7.x

Issue Verification:

To confirm the cause of issue, open Command Prompt and navigate to: C:\Program Files\MachSol\MachPanel Control Server\bin
Then Run: wkhtmltopdf.exe/?

If you get below errors, perform steps highlighted in "Resolution".

and

Resolution

If you get error related to "MSVCP140.dll" and "VCRUNTIME140.dll" then follow instructions on THIS LINK and download "vc_redist.x86.exe" and install it.

Alternatively, you can download the installer from our website HERE and install it.

After successful install, the output from command prompt will look like this:

Finally you can recheck the issue in panel and you should be able to download your Invoice PDF now.

Microsoft Skype and Teams Admin API Lacks Service Principal

rehan_waseem — Fri, 02 Dec 2022 08:41:43 GMT

Summary:

This article provides fix for the error "Microsoft Skype and Teams Admin API Lacks Service Principal" while granting consent to a Tenant in MachPanel.

Applies to:

This article applies to MachPanel Build Version v7.

Error Message:

AADSTS650052: The app is trying to access a service '48ac35b8-9aa8-4d74-927d-1f4a14a0b239'(Skype and Teams Tenant Admin API) that your organization '500875a1-c354-4332-8968-4df59adc6253' lacks a service principal for. Contact your IT Admin to review the configuration of your service subscriptions or consent to the application in order to create the required service principal.

Reason:

Microsoft Skype and Teams Admin API is not available by default in newly created tenant. We need to add service principal for API manually in the tenant.

Solution:

Please run below command in Microsoft Graph Powershell using Tenant Admin credentials to add missing service principal in tenant and then try again.

Make sure that the latest Microsoft.Graph module is installed on your device before executing the below commands,

To install Microsoft.Graph Module
- Install-Module -Name Microsoft.Graph -RequiredVersion 1.10.0 -Force

Once Microsoft.Graph module is installed then execute following command.

Connect-Graph -Scopes "Application.ReadWrite.All"

$ServicePrincipalID=@{"AppId" = "48ac35b8-9aa8-4d74-927d-1f4a14a0b239"}

New-MgServicePrincipal -BodyParameter $ServicePrincipalId

Microsoft Team Direct Routing Failure

rehan_waseem — Tue, 28 Jun 2022 11:56:16 GMT

Summary

This article will provide steps to resolve Microsoft Team Direct Routing assignment failure.

Applies To

Applies to MachPanel v7.0.25HF1

Pre-Requisites

Make sure you are on latest build 7.0.25 and also HF1 is also deployed on it (7.0.25HF1)
Update MachPanel Control Server to the latest build https://kb.machsol.com/Knowledgebase/50181/Update-MachPanel-Control-Server-to-Latest-Version
Update MachPanel Remote Server to the latest build https://kb.machsol.com/Knowledgebase/50268/Update-MachPanel-Remote-Server-to-Latest-Version
Deploy HF1 on build 7.0.25 https://kb.machsol.com/Knowledgebase/55682/Hotfix-for-MachPanel-Build-v7025-HF1

Error

Microsoft 365 is not ready yet. Please try again later. It can take up to two hours depending on processing times at Microsoft. Status:6 Desc:Error processing command: Processing data from remote server api.interfaces.records.teams.microsoft.com failed with the following error message: Teams PowerShell Module versions older than 4.x.x are retired. Please update to the latest version. More details in https://docs.microsoft.com/en-us/microsoftteams/teams-powershell-supported-versions. For more information, see the about_Remote_Troubleshooting Help topic. CMDExec: Set-CsOnlinePstnUsage -Identity Global -Usage @{Add="kortmannbeton-PstnUsage"}

Resolution

Start PowerShell as an Administrator and run below
- Uninstall-module microsoftteams
- Install-Module MicroSoftTeams

Please note that version 4.4.1 will be installed of Microsoft Teams.

Solution to Active Directory Constraint Violation error

zohaib.shaikh — Thu, 14 Apr 2022 09:06:55 GMT

Summary

This article will provide you the solution for the issue of Active Directory Constraint Violation error

Applies to

All Exchange Versions

Error Message

Error: b: Create Global Address List: An Active Directory Constraint Violation error occurred on Dc01.Provider.local. Additional information: The name reference is invalid. This may be caused by replication latency between Active Directory domain controllers. Active directory response: 000020B5: AtrErr: DSID-03153468, #1: 0: 000020B5: DSID-03153468, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 907ff (globalAddressList2) IP= X.X.X.X

Cause

There is a corrupted GAL on Active Directory.

Solution

Issue the following Powershell script on the Active Directory server

$ad = [ADSI]"LDAP://rootDSE";

$domain = $ad.rootDomainNamingContext;

$obj = New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=Microsoft Exchange,CN=Services,CN=Configuration,$domain");

$count = 0;

$Gals1= $obj.GlobalAddressList;

foreach($g in $Gals1)

{

$g= $g.ToString().ToLower();

if($g.Contains("cn=deleted objects"))

{

Write-Host $g;

$count= $count +1;

}

Write-Host "$Count corrupted GAL entries found in property GlobalAddressList";

$count = 0;

$Gals2= $obj.GlobalAddressList2;

foreach($g in $Gals2)

{

$g= $g.ToString().ToLower();

if($g.Contains("cn=deleted objects"))

{

Write-Host $g;

$count= $count +1;

}

Write-Host "$Count corrupted GAL entries found in property GlobalAddressList2";

the output will be like below:

PS C:\> .\check.ps1

cn=test.com gal\0adel:1b6f6184-3e84-44a9-8905-54dd55a7407a,cn=deleted objects,cn=configuration,dc=provider,dc=local

1 corrupted GAL entries found in property GlobalAddressList

0 corrupted GAL entries found in property GlobalAddressList2

PS C:\>

Remove corrupted GALs from script output (highlighted in example above as cn=test.com gal\0adel:1b6f6184-3e84-44a9-8905-54dd55a7407a,cn=deleted objects,cn=configuration,dc=provider,dc=local) in : ADSI edit utility > Configuration > Services > CN=Microsoft Exchange > Properties > GlobalAddressList
- If there will be corrupted GALs in GlobalAddressList2 - remove them as well.
Re-run the task

Exchange Online connection fails with error: Access is Denied using Basic Authentication

rehan_waseem — Thu, 13 Jan 2022 08:49:36 GMT

Summary

This article provides a summary of "Access is denied" error encountered in connecting to Exchange Online while trying to perform any exchange related operation. Below error is contained in detailed error message: Connecting to remote server outlook.office365.com failed with the following error message : Access is denied.

Applies To

This article applies to:

MachPanel v6 and Later.
MachPanel's Exchange Online extension for its CSP Module.
Exchange Online

Overview

With the introduction of OAuth 2.0 in the year 2020 from Microsoft as an enhanced, more secure and modern authentication system, Microsoft had informed its users that the older Basic Authentication via PowerShell EXO V1 will be discontinued. It is confirmed that by October 2022 the Modern Authentication via OAuth v2.0 (PowerShell EXO v2) will fully replace the older mechanism.

To further speed up the process, Microsoft started identifying the tenants under its O365 cloud which were not using Basic Authentication and have stopped / blocked them from using it. If you have a new tenant for which Security Defaults are enabled, Basic Authentication will seize to work. For existing tenants as well, their Basic Authentication will stop working if detected by Microsoft and you will start facing the above highlighted error if this is done by Microsoft.

The changes affect all operations via Basic Authentication for Exchange Online whether being performed directly via PowerShell EXO v1, or via any 3rd Party App using PowerShell EXO v1.

MachPanel and Exchange Online

MachPanel currently uses PwerShell EXO v1 to communicate with Exchange Online and hence the recent changes by Microsoft as mentioned above will affect control panel's ability to perform operations on a tenant.

While we are working on making changes to our panel to upgrade to PowerShell EXO v2, the current workaround is to allow basic authentication. Please follow steps highlighted in solution section below:

Solution

In the Tenant you can run this Command Get-OrganizationConfig | Format-List basic*

(You will see the entry/value: 255 which stand for All Basic Authentications Blocked i.e. BasicAuthBlockedApps=255)

To change this, you need to login with the Global Admin, then go to the Help section and run this command Diag: Enable Basic Auth in EXO

After That you can activate the basic Authentication.

More details and pictorial illustration given on links below:

https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-june-2021-update/ba-p/2454827
https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-september-2021-update/ba-p/2772210

Some Images:

After activating the Basic Authentication for Exchange Online Remote PowerShell and running this Command Get-OrganizationConfig | Format-List basic*

(You will see the entry/value: 239 which stand for All Basic Authentications Allowed i.e. BasicAuthBlockedApps = 239)

Finally you can now connect via Exchnge Online OAuth v1.0

If steps are completed as highlighted above, then the procedure has been completed and you are done! However, sometimes when you hit "Run Test", you will get a different message. Please review below details to cater that scenario:

After Run test:

If you see following message:

These are the current Basic authentication settings:

The organization configuration is dehydrated. In the Microsoft datacenters, an organization configuration being dehydrated means that it has certain objects consolidated to save space. In this state, configuration cannot be modified. This can be changed by running the Enable-OrganizationCustomization cmdlet.
Note that you are only required to run the Enable-OrganizationCustomization cmdlet once in your Exchange Online organization. If you attempt to run the cmdlet again, you will get an error.

To handle this you have to connect tenant using ExchangeOnlineShell module, run the command: Enable-OrganizationCustomization.

Steps:

Open PowerShell
Install-Module -Name ExchangeOnlineManagement -RequiredVersion 3.2.0
1. (skip if already installed)
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline
1. Login
Enable-OrganizationCustomization

After this perform the above steps again from start.

To make this change, you need to login with the Global Admin, then go to the Help section and run this command Diag: Enable Basic Auth in EXO

How to Disable Security Defaults to be able to disable MFA / 2FA

zohaib.shaikh — Wed, 15 Apr 2020 23:17:51 GMT

Summary

You get an error when trying to enable Direct Routing and creating an App Password. This article describes how to Disable MFA / 2FA if you do not see option to disable it by disabling Security Defaults first so that the option to disable MFA / 2FA is visible.

Applies To

This article applies to MachPanel.

Error Message

2FA must be turned off for admin to be used.

To be able to Disable 2FA, you must disable Security Defaults first.

When try to arrange routing for teams directly. See error below.

Error processing command: System.Management.Automation.RemoteException: Showing a modal dialog box or form when the application is not running in UserInteractive mode is not a valid operation. Specify the ServiceNotification or DefaultDesktopOnly style to display a notification from a service application. System.Management.Automation.RemoteException: One or more errors occurred.: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000002-0000-0000-c000-000000000000'. Trace ID: 7a9b8db4-138e-49cf-beb3-d1fa79a77b00 Correlation ID: 0eaba9ff-d191-4ebd-84bf-82c3b4f5d355 Timestamp: 2020-04-15 10:47:20Z System.Management.Automation.RemoteException: One or more errors occurred. System.Management.Automation.RemoteException: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000002-0000-0000-c000-000000000000'. Trace ID: 7a9b8db4-138e-49cf-beb3-d1fa79a77b00 Correlation ID: 0eaba9ff-d191-4ebd-84bf-82c3b4f5d355 Timestamp: 2020-04-15 10:47:20Z System.Management.Automation.RemoteException: Response status code does not indicate success: 400 (BadRequest). System.Management.Automation.RemoteException: {"error":"interaction_required","error_description":"AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000002-0000-0000-c000-000000000000'.\r\nTrace ID: 7a9b8db4-138e-49cf-beb3-d1fa79a77b00\r\nCorrelation ID: 0eaba9ff-d191-4ebd-84bf-82c3b4f5d355\r\nTimestamp: 2020-04-15 10:47:20Z","error_codes":[50076],"timestamp":"2020-04-15 10:47:20Z","trace_id":"7a9b8db4-138e-49cf-beb3-d1fa79a77b00","correlation_id":"0eaba9ff-d191-4ebd-84bf-82c3b4f5d355","error_uri":"https://login.microsoftonline.com/error?code=50076","suberror":"basic_action"}: Unknown error System.Management.Automation.RemoteException: One or more errors occurred.: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000002-0000-0000-c000-000000000000'. Trace ID: 7a9b8db4-138e-49cf-beb3-d1fa79a77b00 Correlation ID: 0eaba9ff-d191-4ebd-84bf-82c3b4f5d355 Timestamp: 2020-04-15 10:47:20Z CMDExec: Get-MsolDomain

Resolution

2FA must be turned off for admin to be used. To be able to Disable 2FA, you must disable Security Defaults first.

Disable Security Defaults:

Following steps can be used to disable Security Defaults.

Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.
Browse to Azure Active Directory > Properties.
Select Manage security defaults.
Set the Enable security defaults toggle to No.
Select Save.

See below KB article in which this topic is covered in detail:
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults

The key points are:

If this option of Security Defaults is enabled, then MFA status enabled or disabled will act as Enabled.
If this option of Security Defaults is Disabled, then MFA status enabled will act as Enabled, and MFA status disabled will act as disabled.

Dedicated PFM Error due to special character

zohaib.shaikh — Tue, 17 Dec 2019 15:11:58 GMT

Summary

This article provide details how to resolve error when creating dedicated PFM from MachPanel in case of of special characters in OU name like ü.

Applies To

This article applies to MachPanel build version 6 and above.

Error Message

Error creating Dedicated PFM : Unable to find assembly 'System.Management.Automation, Version=3.0.0.0, Culture-neutral, PublicKeyToken=31bf33856ad364e35'

In Exchange_ logs the error is:
Dez-17-2019 12:07:00 : Error processing command: Cannot convert 'somedomainürPFM@somedomain.com' to the type 'Microsoft.Exchange.Data.ProxyAddressCollection' required by parameter 'EmailAddresses'. The address 'somedomainürPFM@somedomain.com' is invalid: "somedomainürPFM@somedomain.com" isn't a valid SMTP address. The domain name can't contain spaces and it has to have a prefix and a suffix, such as example.com.

Dez-17-2019 12:07:00 : CommandDetails: set-mailbox -publicfolder -identity "somedomainür PFM" -emailaddresses "somedomainürPFM@somedomain.com" -confirm:$False

Reason

Email addresses "somedomainürPFM@somedomain.com" is the main issue.
This is populated automatically when creating DEDICATED PFM because OU name is somedomainür

ü should be ue
somedomainürPFM => somedomainuerPFM

Resolution

To resolve this, create Shared PFM and assigned only to 1 (concerned) organization. You will get option to type in name of shared PFM where you can enter somedomainuer (as per example used in this KB).

Attempt to update MachPanel failed. BACKUP DATABASE is terminating abnormally.

rehan_waseem — Fri, 29 May 2015 00:29:44 GMT

Summary

This article describes in detail about resolving error faced during automatic update via MachPanel Configuration Studio.

Applies To

MachPanel build 5.2.10 and above

Error Message

Error Occured. Details: Cannot open backup device 'c:\MachPanel_DbXXXX_YYYYMMDD.BAK'. Operating system error 5(Access is denied.).

BACKUP DATABASE is terminating abnormally.

In configuration studio looks like:

In Configuration Studio Logs the error looks like this:

Solution

The problem is being caused due to permissions / rights restrictions. Please create a new Folder on the SQL Server that hosts your MachPanel database for example “C:\MPDB-Backup” where you would like to create MachPanel database backup and assign “Write” permissions to “Users” group on this folder. After that provide this folder’s path in MachPanel Configuration studio as shown in snapshot below:

Please try updating the system again after above steps. This should resolve the issue.

ADSync – Important Notes and TroubleShooting Details

rehan_waseem — Tue, 03 Mar 2015 23:35:37 GMT

Summary

This article provides you some Important Notes plus Troubleshooting details regarding MachPanel ADSync Utility.

Applies To

Applies to MachPanel v6 and UP, and requires ADSync latest version 4.1

Pre-Requisite

AD sync is a separate module and costs may apply. Kindly contact sales for further information.

ADSync installer can be downloaded from our website www.machsol.com by logging into your account. Please review more details at following KB: http://kb.machsol.com/Knowledgebase/Article/51378

ADSync is installed as per details here: http://kb.machsol.com/Knowledgebase/Article/50350
ADSync is configured as per details here: http://kb.machsol.com/Knowledgebase/Article/50351

Basic Note:

ADSync needs to be installed on Primary Domain Controller and ALL Additional Domain Controllers on Client-AD.
After installation on all Additional Domain Controllers, configure basic information in ADSync Tool on Primary ADSync Server, then copy SyncConfigurations.xml from installation folder on Primary Domain Controller to each Additional Domain Controller. Registry on both types of servers will tell you correct location for configuration file. For old clients the path will be C:\Windows\System32 folder, and for new clients the path to place this file will be C:\Program Files\ADSync. You can confirm/fix the Registry for correct location of SyncConfigurations.xml.
Ensure there are no copies of SyncConfigurations.xml anywhere on the Primary or Additional Domain Controllers. There should be one and only one file on each server named SyncConfigurations.xml.
Make sure “Password must meet Complexity Requirements” is Enabled in Local domain policy.
To start ADSync to function you need to force all users to change password on On-Premises (Local/Client) AD, please do expire all user passwords and restart all domain controllers.
If ADSync User Licenses (AULs) reaches it limit, ADSync will stop User syncing. See detail at troubleshooting note 10.

Important Note 1.

Error / Problem Statement: Access is denied when saving the ADSync configuration or saving user mapping.

Cause: The utility is trying to access a system resource (local file or active directory object) and has no sufficient privileges for read/write operation.

Resolution:

Please check that the user account provided in ‘Admin Login/Admin Password’ fields of ADSync configuration studio has sufficient permissions set to the ADSync installation directory and also to the selected logs folder. If not then provide read/write permission for provided user account
Also check that the utility is running under a user account which has access (read/write) to the installation directory and to the log files directory.
Please check that the user account provided in ‘Admin Login/Admin Password’ fields of ADSync configuration studio has valid permissions in active directory for all the local organizations (OUs) selected in sync profiles.

Important Note 2.

Error / Problem Statement: Authentication Exception when trying to fetch hosted organizations from machpanel control server or hosted organizations are not listing/fetched

Causes:

Sync web service at machpanel control server end is unable to validate the request due to invalid credentials provided for ‘service username or service password’.
For hosted organizations not listing, the service provider may not have enabled the ADSync option from control server (service director > active directory > organizations)

Resolution:

Please provide valid credentials for the fields ‘service username/service password’. These must be the credentials which are used to login to customer portal of machpanel. You can even option control panel URL on the AD server to ensure control panel URL is accessible and that using the credentials you are able to login as End Customer which is owner of organization in question.
Please verify that the organizations under the selected customer are enabled for ADSync from control server (service director > active directory > organizations). You have to login as provider and enable ADSync for the organization.

Important Note 3.

Error / Problem Statement: Information not syncing to the hosted

Causes:

There are several reasons due to which the ADSync may not be syncing information to the hosted active directory:

ADSync service not running on client AD
Sync configuration is corrupted
Data is uploaded but not syncing due to provisioning-svc on control server not running or having some error

Resolution:

There is no single resolution to this situation. Below are some guidelines to trace out the problem.

Please confirm ADSync svc is running on client AD
Re-configure the sync profiles (see below: Re-configure sync profiles)
Share logs with Machsol support from ADSync client logs folder and machpanel control server (ADSyncExceptions) logs folder

Important Note 4.

Error / Problem Statement: All information is syncing other than the password (password not syncing)

Cause: In this case we do have multiple scenarios which are resulting in failure to sync passwords for local users to hosted.

Resolution: Please see below check list for resolution to this problem.

In active directory on client platform “password must meet complexity requirements” under local security policy is set to true
VC++ 2010 runtime is installed (specific to OS platform i.e. x86/x64) on all PDC/ADC
Check that ‘ADSyncPolicy.dll’, ‘ADSync.PolicyLogger.dll’ and ‘ADSync.ClienHelper.dll’ files are placed inside the ‘$windir\System32’ directory on all PDC/ADC
Check that there exists an entry for ‘ADSyncPolicy’ in following registry path ‘HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Notification Packages’ on all PDC/ADC
Are all the PDC and ADCs rebooted after installing and configuring the ADSync tool ?

If all of the above checklists are correct then the reason of issue may be configuration problem. Please perform following steps.

Re-configure the ADSync/Sync Profiles:

Delete all instances of the 'SyncConfigurations.xml' file from ADSync host on all PDC/ADC. Even look for this file on other location because those instances may create issues too. You have to be sure that only 1 file exists after your configuration is completed. So, if you are looking for a complete fresh configuration, DELETE ALL SyncConfigurations.xml files.
Close ADSync configuration studio, re-open and re-configure sync profiles.
Copy the updated 'SyncConfigurations.xml' file from PDC ADSync installation director to each Additional Domain Controller. Registry on both types of servers will tell you correct location for configuration file. For old clients the path will be C:\Windows\System32 folder, and for new clients the path to place this file will be C:\Program Files\ADSync. You can confirm/fix the Registry for correct location of SyncConfigurations.xml.
Open the user mapping screen and unselect mapping for all the users by clicking twice on ‘select all’ box on top right of the users listing and then press save.
Exit the user mapping screen
Open the user mapping screen again and provide/verify appropriate user mapping and then press save.

Important Note 5.

How does the utility update the information & how it should be operated?

Lets say you update some user information or password on Client-AD, the information will be replicated to Hosted-AD via control panel in around 15 minutes. Below is a step by step process how this utility shall be operated.

Save Basic configurations in utility on Primary DC.
Copy SyncConfigurations.xml file from PDC installation folder to all ADC(s) to appropriate folder. Registry on both types of servers will tell you correct location for configuration file. For old clients the path will be C:\Windows\System32 folder, and for new clients the path to place this file will be C:\Program Files\ADSync. You can confirm/fix the Registry for correct location of SyncConfigurations.xml.
Provide On-Premises to Hosted user mapping using the ADSync config studio.
After providing the mapping, modify the On-Premises Active Directory user account information (Including password).
To force the sync process to start immediately, Press Sync Now from ADSync Configuration tool, or simply restart the ADSyncSvc using Services.MSC (Windows Services Manager) on PDC.
This shall update the information to the control server.
From there, control server uses its Provisioning Service to update the data on associated backend Hosted active directory server. You can also force the control server to process records instantly by restarting provisioning service on control panel server.
Normally it should take a maximum of 15 minutes to updated the information from On-Premises to Hosted server. To force immediate update, restart ADSyncSvc on Client AD and "MachPanel Provisioning Service" on control server.

This should update the On-Premises active directory user information to the Hosted active directory user.

In case of any issues, you should Enable Logging from configuration studio of ADSync Tool and review that for any problems. Similar logs need to be review on MachPanel Control Server to see if there is any issue in processing of ADSync related data. You can also send the log files generated from inside the selected folder to us for review.

Important Note 6.

General Troubleshooting Notes:

1. Is logging enabled in ADSync Client Configuration Screen?
2. Does there exist “ADSyncPolicy, ADSync.ClientHelper, ADSync.PolicyLogger” dll files in “$windir\System32” folder?
3. Has the client enabled “Password Must meet complexity requirements” in user account policy?
4. Does there exist an entry for “ADSyncPolicy” in[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages]
5. Is ADSync utility installed on Primary Domain Controller and all Additional Domain Controllers?
6.    Is Client using “DSA.msc” to change the password?
7.    Does ADSync working fine for all the attributes other than password?
8. Does the user provided in ADSync Config Studio for “Local Admin” field has read/write permissions in local AD?
9.    Does the Operating user of ADSync Utility has read/write permissions on installation directory and the directory specified for logging?
10. Is LDAP URL correct.
11. Does the On premises admin user have sufficient administrative rights?
12. Does the On Premises Admin user have rights on the installation directory of MachPanel and on the .XML file?

Important Note 7.

Security and Password Policy: Please note that password policy shall remain consistent between source(client) AD and Hosted (Cloud) AD, meaning that both ADs should have similar password policies. Best to have Complex Password Policy. Also there is no need to select the ‘reversible password’ option in source(client) AD for syncing password.

Password for a user account is secured by modern encryption schemes and is stored in a secured place.

To make communication even more secure, one must apply/enable SSL certificate for MachPanel Control Panel website and use the ADSync Web Service address as https:// (like https://cp.providerdomain.com/webservices/Adsyncsvc.asmx)

Important Note 8.

You will face following issue if Log path in ADSync Registry is incorrect: i.e. it should be same as C:\Program Files\ADSync\Logs as shown in the snapshots below:

Important Note 9.

Scenario:

If ADSync User Licenses (AULs) limit reaches at “/PCC/System/Licenses.aspx” , User syncing will stop (at local AD: as data of user 5611 being sent normally but not being synced)

Resolution:

In this case you have to look into logs at control server at C:\Program Files\MachSol\MachPanel Control Server\Logs (File: ADSyncExceptions)

ADSync Error: ADSync license error: ADSync user license limit reached.

Contact MachSol Support\Machsol Sales to update licenses. After updating licenses, User syncing will start working again as per ADSync Configuration.

Important Note 10.

Problem:

Password sync working from PDC but not working from ADC.

Verification to Resolve issue.

Verify configuration file path in registry and file location in windows.
Confirm Notification packages entry in registry
Confirm Microsoft Visual C++ 10 Runtime installed
Confirm ADC is rebooted
Confirm ADSync files exists in system32 folder.

Important Note 11.

Problem:

Utility prompts to restart the machine: ADSync config studio, on application load verifies the required VC++ 10 module installation and custom module registration in windows filters, If either the VC++ 10 installation missing or custom module registration is missing, the utility prompts to restart the machine.

Verification to Resolve issue.

Check in windows program & features that VC++ 10 is installed and no other version is installed (if there exist multiple versions and are required, then the VC++ 10 installation shall be later one)
Run 'msinfo32' command in windows command then navigate to 'software components' then to 'loaded modules'. See if 'ADSyncPolicy' module is listed in the loaded modules

Solution:

If 'ADSyncPolicy' module is not present in loaded modules, then perform following steps

Verify and make sure that ‘ADSyncPolicy.dll’, ‘ADSync.PolicyLogger.dll’ and ‘ADSync.ClienHelper.dll’ files are placed inside the ‘$windir\System32’
Verify and make sure that there exists an entry for ‘ADSyncPolicy’ in following registry path ‘HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Notification Packages’
If both of the above are verified, then reboot the system and perform the step 2 described in verification process to verify the module is loaded

Important Note 12.

Scenario:

Using default OU 'Users' under sync profile.

Details:

‘Users’ container ‘ObjectCategory’ is ‘Container’ and is system/DC created container whereas admin created container/Ous have ‘ObjectCategory’ is ‘Organizational-Unit’. This is why its available in selection list.

However there’s a way around as below.

Workaround:

Open/Edit ‘SyncConfigurations.xml’ file of ADSync
Delete all sync profiles (Inside SyncProfiles). Save and re-open ADSync Config Studio
Add a profile with some random Local OU selection without “Auto Mapping On”, and do not do manual mapping too and Save
Close Adsync Configuration Studio
Find and replace highlighted part with ‘distinguishedName’ attribute value of ‘User’ container and Save

Download working SmarterMail 13x Installer

mudesira.munir — Wed, 12 Nov 2014 02:56:50 GMT

Summary

This article provides the information about the working installer of SmarterMail 13x with MachPanel.

Applies To

This article applies to MachPanel build v5.1.11

Symptoms

Error MSG: Operation Failed. Details: Server was unable to process the request. --> User not found

Download Information

Please download SmarterMail 13x from the following link and the above error will automatically disappear.

http://www.smartertools.com/Downloads/SmarterMail/CustomBuilds/13.0.5422.18038/SmarterMail13_Setup.exe

Reference

We posted a thread on SmarterMail forum and got response from there:

http://portal.smartertools.com/community/a788/server-was-unable-to-process-request_-user-not-found_.aspx