MachPanel Knowledgebase

ADSync – Important Notes and TroubleShooting Details

rehan_waseem — Tue, 03 Mar 2015 23:35:37 GMT

Summary

This article provides you some Important Notes plus Troubleshooting details regarding MachPanel ADSync Utility.

Applies To

Applies to MachPanel v6 and UP, and requires ADSync latest version 4.1

Pre-Requisite

AD sync is a separate module and costs may apply. Kindly contact sales for further information.

ADSync installer can be downloaded from our website www.machsol.com by logging into your account. Please review more details at following KB: http://kb.machsol.com/Knowledgebase/Article/51378

ADSync is installed as per details here: http://kb.machsol.com/Knowledgebase/Article/50350
ADSync is configured as per details here: http://kb.machsol.com/Knowledgebase/Article/50351

Basic Note:

ADSync needs to be installed on Primary Domain Controller and ALL Additional Domain Controllers on Client-AD.
After installation on all Additional Domain Controllers, configure basic information in ADSync Tool on Primary ADSync Server, then copy SyncConfigurations.xml from installation folder on Primary Domain Controller to each Additional Domain Controller. Registry on both types of servers will tell you correct location for configuration file. For old clients the path will be C:\Windows\System32 folder, and for new clients the path to place this file will be C:\Program Files\ADSync. You can confirm/fix the Registry for correct location of SyncConfigurations.xml.
Ensure there are no copies of SyncConfigurations.xml anywhere on the Primary or Additional Domain Controllers. There should be one and only one file on each server named SyncConfigurations.xml.
Make sure “Password must meet Complexity Requirements” is Enabled in Local domain policy.
To start ADSync to function you need to force all users to change password on On-Premises (Local/Client) AD, please do expire all user passwords and restart all domain controllers.
If ADSync User Licenses (AULs) reaches it limit, ADSync will stop User syncing. See detail at troubleshooting note 10.

Important Note 1.

Error / Problem Statement: Access is denied when saving the ADSync configuration or saving user mapping.

Cause: The utility is trying to access a system resource (local file or active directory object) and has no sufficient privileges for read/write operation.

Resolution:

Please check that the user account provided in ‘Admin Login/Admin Password’ fields of ADSync configuration studio has sufficient permissions set to the ADSync installation directory and also to the selected logs folder. If not then provide read/write permission for provided user account
Also check that the utility is running under a user account which has access (read/write) to the installation directory and to the log files directory.
Please check that the user account provided in ‘Admin Login/Admin Password’ fields of ADSync configuration studio has valid permissions in active directory for all the local organizations (OUs) selected in sync profiles.

Important Note 2.

Error / Problem Statement: Authentication Exception when trying to fetch hosted organizations from machpanel control server or hosted organizations are not listing/fetched

Causes:

Sync web service at machpanel control server end is unable to validate the request due to invalid credentials provided for ‘service username or service password’.
For hosted organizations not listing, the service provider may not have enabled the ADSync option from control server (service director > active directory > organizations)

Resolution:

Please provide valid credentials for the fields ‘service username/service password’. These must be the credentials which are used to login to customer portal of machpanel. You can even option control panel URL on the AD server to ensure control panel URL is accessible and that using the credentials you are able to login as End Customer which is owner of organization in question.
Please verify that the organizations under the selected customer are enabled for ADSync from control server (service director > active directory > organizations). You have to login as provider and enable ADSync for the organization.

Important Note 3.

Error / Problem Statement: Information not syncing to the hosted

Causes:

There are several reasons due to which the ADSync may not be syncing information to the hosted active directory:

ADSync service not running on client AD
Sync configuration is corrupted
Data is uploaded but not syncing due to provisioning-svc on control server not running or having some error

Resolution:

There is no single resolution to this situation. Below are some guidelines to trace out the problem.

Please confirm ADSync svc is running on client AD
Re-configure the sync profiles (see below: Re-configure sync profiles)
Share logs with Machsol support from ADSync client logs folder and machpanel control server (ADSyncExceptions) logs folder

Important Note 4.

Error / Problem Statement: All information is syncing other than the password (password not syncing)

Cause: In this case we do have multiple scenarios which are resulting in failure to sync passwords for local users to hosted.

Resolution: Please see below check list for resolution to this problem.

In active directory on client platform “password must meet complexity requirements” under local security policy is set to true
VC++ 2010 runtime is installed (specific to OS platform i.e. x86/x64) on all PDC/ADC
Check that ‘ADSyncPolicy.dll’, ‘ADSync.PolicyLogger.dll’ and ‘ADSync.ClienHelper.dll’ files are placed inside the ‘$windir\System32’ directory on all PDC/ADC
Check that there exists an entry for ‘ADSyncPolicy’ in following registry path ‘HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Notification Packages’ on all PDC/ADC
Are all the PDC and ADCs rebooted after installing and configuring the ADSync tool ?

If all of the above checklists are correct then the reason of issue may be configuration problem. Please perform following steps.

Re-configure the ADSync/Sync Profiles:

Delete all instances of the 'SyncConfigurations.xml' file from ADSync host on all PDC/ADC. Even look for this file on other location because those instances may create issues too. You have to be sure that only 1 file exists after your configuration is completed. So, if you are looking for a complete fresh configuration, DELETE ALL SyncConfigurations.xml files.
Close ADSync configuration studio, re-open and re-configure sync profiles.
Copy the updated 'SyncConfigurations.xml' file from PDC ADSync installation director to each Additional Domain Controller. Registry on both types of servers will tell you correct location for configuration file. For old clients the path will be C:\Windows\System32 folder, and for new clients the path to place this file will be C:\Program Files\ADSync. You can confirm/fix the Registry for correct location of SyncConfigurations.xml.
Open the user mapping screen and unselect mapping for all the users by clicking twice on ‘select all’ box on top right of the users listing and then press save.
Exit the user mapping screen
Open the user mapping screen again and provide/verify appropriate user mapping and then press save.

Important Note 5.

How does the utility update the information & how it should be operated?

Lets say you update some user information or password on Client-AD, the information will be replicated to Hosted-AD via control panel in around 15 minutes. Below is a step by step process how this utility shall be operated.

Save Basic configurations in utility on Primary DC.
Copy SyncConfigurations.xml file from PDC installation folder to all ADC(s) to appropriate folder. Registry on both types of servers will tell you correct location for configuration file. For old clients the path will be C:\Windows\System32 folder, and for new clients the path to place this file will be C:\Program Files\ADSync. You can confirm/fix the Registry for correct location of SyncConfigurations.xml.
Provide On-Premises to Hosted user mapping using the ADSync config studio.
After providing the mapping, modify the On-Premises Active Directory user account information (Including password).
To force the sync process to start immediately, Press Sync Now from ADSync Configuration tool, or simply restart the ADSyncSvc using Services.MSC (Windows Services Manager) on PDC.
This shall update the information to the control server.
From there, control server uses its Provisioning Service to update the data on associated backend Hosted active directory server. You can also force the control server to process records instantly by restarting provisioning service on control panel server.
Normally it should take a maximum of 15 minutes to updated the information from On-Premises to Hosted server. To force immediate update, restart ADSyncSvc on Client AD and "MachPanel Provisioning Service" on control server.

This should update the On-Premises active directory user information to the Hosted active directory user.

In case of any issues, you should Enable Logging from configuration studio of ADSync Tool and review that for any problems. Similar logs need to be review on MachPanel Control Server to see if there is any issue in processing of ADSync related data. You can also send the log files generated from inside the selected folder to us for review.

Important Note 6.

General Troubleshooting Notes:

1. Is logging enabled in ADSync Client Configuration Screen?
2. Does there exist “ADSyncPolicy, ADSync.ClientHelper, ADSync.PolicyLogger” dll files in “$windir\System32” folder?
3. Has the client enabled “Password Must meet complexity requirements” in user account policy?
4. Does there exist an entry for “ADSyncPolicy” in[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages]
5. Is ADSync utility installed on Primary Domain Controller and all Additional Domain Controllers?
6.    Is Client using “DSA.msc” to change the password?
7.    Does ADSync working fine for all the attributes other than password?
8. Does the user provided in ADSync Config Studio for “Local Admin” field has read/write permissions in local AD?
9.    Does the Operating user of ADSync Utility has read/write permissions on installation directory and the directory specified for logging?
10. Is LDAP URL correct.
11. Does the On premises admin user have sufficient administrative rights?
12. Does the On Premises Admin user have rights on the installation directory of MachPanel and on the .XML file?

Important Note 7.

Security and Password Policy: Please note that password policy shall remain consistent between source(client) AD and Hosted (Cloud) AD, meaning that both ADs should have similar password policies. Best to have Complex Password Policy. Also there is no need to select the ‘reversible password’ option in source(client) AD for syncing password.

Password for a user account is secured by modern encryption schemes and is stored in a secured place.

To make communication even more secure, one must apply/enable SSL certificate for MachPanel Control Panel website and use the ADSync Web Service address as https:// (like https://cp.providerdomain.com/webservices/Adsyncsvc.asmx)

Important Note 8.

You will face following issue if Log path in ADSync Registry is incorrect: i.e. it should be same as C:\Program Files\ADSync\Logs as shown in the snapshots below:

Important Note 9.

Scenario:

If ADSync User Licenses (AULs) limit reaches at “/PCC/System/Licenses.aspx” , User syncing will stop (at local AD: as data of user 5611 being sent normally but not being synced)

Resolution:

In this case you have to look into logs at control server at C:\Program Files\MachSol\MachPanel Control Server\Logs (File: ADSyncExceptions)

ADSync Error: ADSync license error: ADSync user license limit reached.

Contact MachSol Support\Machsol Sales to update licenses. After updating licenses, User syncing will start working again as per ADSync Configuration.

Important Note 10.

Problem:

Password sync working from PDC but not working from ADC.

Verification to Resolve issue.

Verify configuration file path in registry and file location in windows.
Confirm Notification packages entry in registry
Confirm Microsoft Visual C++ 10 Runtime installed
Confirm ADC is rebooted
Confirm ADSync files exists in system32 folder.

Important Note 11.

Problem:

Utility prompts to restart the machine: ADSync config studio, on application load verifies the required VC++ 10 module installation and custom module registration in windows filters, If either the VC++ 10 installation missing or custom module registration is missing, the utility prompts to restart the machine.

Verification to Resolve issue.

Check in windows program & features that VC++ 10 is installed and no other version is installed (if there exist multiple versions and are required, then the VC++ 10 installation shall be later one)
Run 'msinfo32' command in windows command then navigate to 'software components' then to 'loaded modules'. See if 'ADSyncPolicy' module is listed in the loaded modules

Solution:

If 'ADSyncPolicy' module is not present in loaded modules, then perform following steps

Verify and make sure that ‘ADSyncPolicy.dll’, ‘ADSync.PolicyLogger.dll’ and ‘ADSync.ClienHelper.dll’ files are placed inside the ‘$windir\System32’
Verify and make sure that there exists an entry for ‘ADSyncPolicy’ in following registry path ‘HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Notification Packages’
If both of the above are verified, then reboot the system and perform the step 2 described in verification process to verify the module is loaded

Important Note 12.

Scenario:

Using default OU 'Users' under sync profile.

Details:

‘Users’ container ‘ObjectCategory’ is ‘Container’ and is system/DC created container whereas admin created container/Ous have ‘ObjectCategory’ is ‘Organizational-Unit’. This is why its available in selection list.

However there’s a way around as below.

Workaround:

Open/Edit ‘SyncConfigurations.xml’ file of ADSync
Delete all sync profiles (Inside SyncProfiles). Save and re-open ADSync Config Studio
Add a profile with some random Local OU selection without “Auto Mapping On”, and do not do manual mapping too and Save
Close Adsync Configuration Studio
Find and replace highlighted part with ‘distinguishedName’ attribute value of ‘User’ container and Save

Error on application trust level

mudesira.munir — Mon, 09 Feb 2015 08:12:37 GMT

Summary

This article provides a summary on how to fix error regarding Application trust level when applying hot-fixes.

Applies To

This article applies to all Versions of MachPanel.

Symptoms Or Error MSG:

The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file.

Steps to Resolve

It occurs when system settings locked the files that you have downloaded to apply the fix. To resolve this issue you will have to unlock the files in MachPanel directory please follow the steps below:

Download the Streams.exe from http://technet.microsoft.com/en-us/sysinternals/bb897440.aspx
Place the Streams.exe inside MachPanel installation directory which is usually C:\Program Files\MachSol\MachPanel Control Server
Open windows command prompt
Change directory to the folder where you have copied Streams.exe, you can use command cd C:\Program Files\MachSol\”MachPanel Control Server”
Execute this command streams.exe -s -d *.*
Perform IISRESET.
Check your issue again.

BlackBerry 5.0 Activation Error - Java.lang.NoClassDefFoundError.com/rim/bes/brk/besuseradmin/BESUserAdminMain Exception In Thread "Main"

fawad.khan — Tue, 26 Jan 2010 07:03:20 GMT

Summary

This article provides information about how to successfully activate BlackBerry v.5.0 services in MachPanel.

Applies To

MachPanel all versions.

BES v.5.0

Symptoms

Getting the ERROR message,

java.lang.NoClassDefFoundError.com/rim/bes/brk/besuseradmin/BESUserAdminMain Exception in Thread "main" while attempting to activate the BlackBerry 5.0 Service under the Wireless Service Activation tab found in Wireless Account under Wireless Services in MachPanel.

Solution

To successfully activate the BlackBerry v.5.0 Services, kindly perform the following steps.

Step 1: Navigating to the following Path

After the successful installation of BlackBerry Enterprise Server User Administration Tool Setup, navigate to the following path:

C:\Program Files\Research In Motion\BlackBerry Enterprise Server Resource Kit\BlackBerry Enterprise Server User Administration Tool\

Step 2: Copying the file BESUserAdmin.jar

Copy the file BESUserAdmin.jar as shown in the Attachment

Step 3: Pasting the copied file

Paste the copied file into the following folder:

• C:\Windows\System32 (for 32-bit installation)

• C:\Windows\SysWOW64 (for 64-bit installation)

Remoting Exception: Exception Has Been Thrown By The Target Of An Invocation.

mudesira.munir — Mon, 22 Dec 2008 05:51:02 GMT

Summary

This article entails steps how to resolve Remoting Exception : Exception has been thrown by the target of an invocation.

Applies To

MachPanel

Solution

To resolve this error please follow the steps given below:

Step 1: Check MachPanel Provisioning Service

The very first thing that needs to be checked is to see if the MachPanel Provisioning Service on remote server is running properly.

Step 2: Allow communication on remote server on Port:7860
The next thing to check is to ensure that communication on Port:7860 is allowed on remote server. Please check your firewall settings on remote server and ensure that Port:7860 is not blocked.

Step 3: Follow installation guides
Please follow the installation guides properly for successful deployment and update to the same version as that of Control panel. To successfully deploy services to be managed from MachPanel, you should consult the deployment guides at following link:

For New Exchange server you first need to install remote agent.
If you already have remote agent installed, you just need to update the remote agent.

Our product knowledge-base is constantly updated. If you encounter an error during installation and configuration, please search https://kb.machsol.com/Knowledgebase/50268/Update-MachPanel-Remote-Server-to-Latest-Version

Step 4: Adjust MachPanel Provisioning Service properties on remote server
Please note that you have to adjust MachPanel Provisioning Service properties. Following points need your attention. All this has been explained clearly in installation guides already:

Please create MPAdmin on AD.
Give appropriate permissions to MPAdmin i.e. make it member of administrator group.
Go to Run and type services.msc
On Services Manager Go to properties of MachPanel Provisioning Service.
Click on Log On tab.
Select the option This Account and enter login/password of account created above i.e. MPAdmin and its password.

Note: The service account must have Read/Write/Delete (full access) on Remote Server folder and sub folders.

Create Portal Failed. Remoting exception: Exception has been thrown by the target of an invocation.

fawad.khan — Mon, 24 Nov 2008 05:33:27 GMT

Summary
Hardware Node: [1] Dedicated Server
Provider: SharePoint 3.0
»» Getting Portal Information
»» Creating Portal.
»» Create portal Failed. Detail: Remote Server license not found or expired. Error Details: Remoting exception: Exception has been thrown by the target of an invocation.

Applies To
MachPanel all versions

Solution
This is a mix of two errors:

Remote Server license not found or expired.
Remoting exception: Exception has been thrown by the target of an invocation.

Please check following points for resolution.

1. In the first part the remote server license is not found or is expired. Every remote server requires a remote license to communicate with MachPanel. Please check your MachPanel licenses inventory to see how many remote licenses you have purchased and how much you are using. The error may occur in case you originally have less number of remote licenses than you are using. Please contact the sales department to purchase more remote licenses.

You can check for the total number of licenses from following navigation path:
Home » System Configuration » License Management » Enterprise Extensions

2. The solution for "Remoting Exception" requires some understanding of how SharePoint works. The very first thing that needs to be checked is to see if the "MachPanel Provisioning Service" on remote server is running properly.

3. The next thing to check is to ensure that communication on Port # 7860 is allowed on remote server. Please check your firewall settings on remote server and ensure that Port # 7860 is not blocked.

4. Please follow the installation guides properly for successful deployment. To successfully deploy services to be managed from MachPanel, you should consult the deployment guides at following link:

http://kb.machsol.com/Downloads/6

Please contact the sales department for password to the installation / deployment manuals.

Our product knowledgebase is constantly updated. If you encounter an error during installation and configuration, please search http://kb.machsol.com/Knowledgebase/

5. Please note that you have to adjust "MachPanel Provisioning Service" properties according to user under which the "windows sharepoint service" was installed. This part is tricky as one has to ensure proper work flow for integration between MachPanel and SharePoint.

Following points need your attention:

The planning starts before installing Sharepoint. All this has been explained clearly in installation guides already.

Please create "Administrator2" on AD.
Give appropriate permissions to "Administrator2" i.e. make it member of administrator group.
Logon to the server using "Administrator2".
Install Sharepoint.
Install MachPanel Remote Server.
Go to Run and type services.msc
On "Services Manager" Go to properties of "MachPanel Provisioning Service".
Click on "Log On" tab.
Select the option "This Account" and enter login/password of account under which the sharepiont service was installed i.e. "Administrator2" and its password in this case.

Note: In case you have already installed SharePoint then you must set the user through which SharePoint was installed in place of administrator2 on above steps.

Create Portal Failed - Error Creating Portal, [COM Exception] There Is No Such Object On Server

fawad.khan — Wed, 12 Nov 2008 02:21:35 GMT

Summary
Single machine was acting as multiple server roles (e.g. Domain Controller + SQL Database + MachPanel Control Server + DNS + WSS 3.0) and following exception was thrown during Windows SharePoint Services (WSS) 3.0 configuration with MachPanel Provisioning System:
Create Portal Failed.
Detail: Error Creating Portal
Details: [COM Exception]. There is no such Object on the server

Applies To
MachPanel all versions
Hosted SharePoint Extension (SPE)

Solution
The resolution for the above error is available at:
http://kb.machsol.com/Knowledgebase/Article/50063

Important:
Please make sure that for smooth, seamless and successful provisioning by MachPanel the RECOMMENDED SETUP for service preparation should be followed.
http://kb.machsol.com/Knowledgebase/Article/50062

Remoting Exception Has Been Thrown By The Target Of An Invocation

mudesira.munir — Thu, 30 Oct 2008 01:56:40 GMT

Summary
Hosted Exchange Extension (HEE) shows following exception:
Remoting exception: Exception has been thrown by the target of an invocation

Applies To
MachPanel all versions
Hosted Exchange Extension (HEE)

Cause
This problem can occurs due to two reasons.
Firstly, when MachPanel remote Server is not installed at Exchange Server i.e. other than the server where MachPanel is installed. Or it is installed but the MachPanel Provisioning Service is not running.
Secondly, a firewall can block the port 7860 for MachPanel Provisioning Service disabling it to communicate properly.

Solution
Let us consider an example scenario for this which is as under:

Example Scenario
Server1: Active Directory (AD01)
Server2: Exchange Server 2007 SP1
Server3: MachPanel Control Server

This explanation is for above server setup scenario.

Case 1: Remote Server not installed or MachPanel Provisioning Service not running

Step1: Install MachPanel Remote Server
You need to install the MachPanel Remote Server on Exchange server and then configure it in MachPanel Control Center properly. Here Exchange server is Server2.
Please consult Exchange installation/configuration guides at:
http://kb.machsol.com/Downloads/6
Note: These settings are for Stand Alone Exchange Module of MachPanel.

Step2: Setup Active Directory Domains and Domain Administrator Login:
In your MachPanel Control Center login, Navigate to Home » Service Director » Active Directory Domains
• Domain administrator login: This will be the user responsible for connecting with Active Directory.
• It is recommended that you create a new user “administrator2” and call it the Domain Administrator Login.

Please refer to:http://kb.machsol.com/KnowledgebaseArticle50017.aspx for creation of administrator2 login for MachPanel.

Step3: Domain Administrator Login Permissions:
The Domain User (i.e administrator2) which is used for MachPanel should be member of certain groups for Standalone Exchange. For assigning related permissions please see http://kb.machsol.com/KnowledgebaseArticle50017.aspx

Step4: Configuring Hosted Exchange Extension (HEE)
In MachPanel Provider Control Center (PCC), navigate to:
Home » Service Director » Exchange Hosting » Server Groups » Edit Exchange Server

Set the following attributes:

Server alias: This should be complete server name e.g Exch01.Fabrikam.com. Complete name of Server2 with Domain Name.
IP: This should be IP of Server2. This same IP has to be in registry of remote server. To ensure this, follow these steps:
- Click Start >> Run
- Type regedit
- navigate to HKEY_LOCAL_MACHINE\SOFTWARE\MachSol\MachPanel
- Ensure that the string RemoteServerPublicIP is set to the same IP address as for Server2. If not, please make it same here
Server Name: This should be complete server name like Exch01.Fabrikam.com

Step5: Set MachPanel Remote Service identity

Update identity of MachPanel Provisioning Service. i.e. Server2 in this scenario. For this, follow these steps:
- Click Start >> Run
- Type services.msc
- Microsoft Windows Services screen will pop up
- Double Click on MachPanel Provisioning Service
- Select Log On tab
- Click Browse and Select the Domain Administrator Login (from Step3) from Active Directory Users
- Set Password of user.

Step6
Restart MachPanel Provisioning Service

Click Start >> Run
Type services.msc
Microsoft Windows Services screen will pop up
Double Click on MachPanel Provisioning Service and click Start

Alternatively, you can also start and stop MachPanel Services using Configuration Studio. For example, to start MachPanel Provisioning Service, please open Configuration Studio and go to Configure >> Services and click Start All Services button. Similarly for stopping all services click Stop All Services button

CASE 2: A Firewall is blocking the port for MachPanel Provisioning Service
A firewall has blocked MachPanel Provisioning Service to communicate appropriately, please disable firewall or allow port 7860 which is used by MachPanel Provisioning Service.