Troubleshooting Guide

Transcription

1 . All right reserved. For more information about Specops Reset and other Specops products, visit

2 Copyright and Trademarks Specops Password Reset is a trademark owned by Specops Software. All other trademarks used in this document belong to their respective owners. 2

3 Contents Common Issues 4 Always get prompted for windows credentials when opening the Helpdesk/Reporting page 4 Access denied message when enrolling with an admin account 4 When the user follows the enrollment reminder link, they are told that they do not have a configured enrollment policy 5 User receives the certificate revocation list server could not be reached message when they click the reset password link at the logon screen, but not when they browse to the reset page when logged in. 5 The Reset Password link does not appear on the logon page after reboot 6 Identity check failed for outgoing message error when accessing any Password Reset Webpage after an upgrade or opening the Configuration tool. 6 Event Logging 8 Specops Password Reset Server events 8 Debug Logging 11 3

4 Common issues Always get prompted for windows credentials when opening the Helpdesk/Reporting page Possible cause You have not added the FQDN of the server (or *.mydomain.com) to the local intranet site using the GPO site to Zone Assignment. Possible solution You will need to complete the steps under Enabling authentication to the Password Reset Web Server in the Specops Password Reset Installation Guide. Access denied message when enrolling with an admin account Possible cause Admin accounts are affected by the adminsdholder rule, which resets the security permissions on privileged AD accounts every 15 minutes. Possible solution If you want your administrative accounts to be able to use Specops Password Reset, you must manually add permissions for the service account to the AdminSDHolder container. 1. Log in with an account with Domain Admin permissions and run the following command: dsacls "CN=AdminSDHolder, CN=System, <Domain DN>" /G "<ServiceAccount>:CCDC;classStore;" "<ServiceAccount>:LC;;" "<ServiceAccount>:CA;Reset Password;" "<ServiceAccount>:RP;userAccountControl;" "<ServiceAccount>:RPWP;mobile;" "<ServiceAccount>:RPWP;pwdLastSet;" "<ServiceAccount>:RPWP;lockoutTime;" Example: dsacls "CN=AdminSDHolder, CN=System, DC=example, DC=com" /G "EXAMPLE\sprsvc:CCDC;classStore;" "EXAMPLE\sprsvc:LC;;" "EXAMPLE\sprsvc:CA;Reset Password;" "EXAMPLE\sprsvc:RP;userAccountControl;" "EXAMPLE\sprsvc:RPWP;mobile;" "EXAMPLE\sprsvc:RPWP;pwdLastSet;" "EXAMPLE\sprsvc:RPWP;lockoutTime;" 2. Replace <domaindn> and <serviceaccount> with the domain components of your domain and the name of the SPR service account. 4

5 Note: Allowing Specops Password Reset to work with account with administrative permissions is not best practice for security reasons. Enable these settings only if it is required by the practical reality of your organization. For more information, read Understanding Privileged Accounts and the AdminSDHolder at When the user follows the enrollment reminder link, they are told that they do not have a configured enrollment policy Possible cause The service account has lost permissions to read the Specops Password Reset Group Policy Object. Possible solution From the Group Policy Management Console, add the service account to the Delegation Tab of the Specops Password Reset Group Policy Object with Read rights. User receives the certificate revocation list server could not be reached message when they click the reset password link at the logon screen, but not when they browse to the reset page when logged in. Possible cause User is not connected to the internet at the logon screen. Possible solution You can use one of the following three options below to solve this issue: 1. Add a new rule to your proxy that allows domain computers to reach the CRL servers on the internet. The rule will look similar to the example below: Source: internal network Destination: IP address of CRL server Port: 80 Access Group: Domain Computers 2. Disable the CRL check on the client. Note: 5

6 This will disable CRL checking on all certificates. If you visit a site that had its certificate revoked, this would allow the creation of a secure connection, unless the certificate had expired. 3. If you have an internal Certificate Authority system, use an internal certificate, instead of a public certificate. Note: A public certificate is a good choice if you plan on allowing users to reset their passwords externally. The Reset Password link does not appear on the logon page after reboot Possible cause The computer is booting before the network stack has been brought up. This is common when systems are used with wireless or gigabit connected NIC s. Possible solution You may want to disable Fast Logon Optimization. You can do this with Group Policy, using the Always wait for the network at computer startup and logon policy setting. You can find this setting under Computer Configuration/ Administrative Templates/ System/ Logon. If you are using Windows 7, you can do this with Group Policy using the Startup Policy Processing Wait Time policy setting. You can find this setting under Computer Configuration/Administrative Templates/ System/ Group Policy. Identity check failed for outgoing message error when accessing any Password Reset Webpage after an upgrade or opening the Configuration tool. Note: Complete message reads: Identity check failed for outgoing message. The expected DNS identity of the remote endpoint was servername.domain.com but the remote endpoint provided DNS claim webserveralias.domain.com. If this is a legitimate endpoint, you can fix the problem by explicitly specifying DNS identity webserveralias.domain.com as the identity property of EndpointAddress when creating channel proxy. Possible cause During installation, you may have used the web server certificate when installing the server component instead of the web component. 6

7 Possible solution The server component requires a certificate with a CN (common name) that matches the FQDN of the server. This is required for Windows Identity Foundation to work correctly. A self-signed certificate or a certificate with a CN, either public or private, can be used for this function 7

8 Event logging The Specops Password Reset Server component logs the operations that have been performed to the application log on the appropriate server. Specops Password Reset Server events Information events ID Description 100 Service starting. 101 Service started. 103 Service stopped. 104 License verification entry. Contains the license count information which is collected nightly. 105 Reporting database migration started. Only logged if the service discovers an existing database stored in the old xml-format. 106 Reporting database migration completed successfully. Only logged if the service discovers an existing database stored in the old xml format. 110 Enrollment successful. Logged every time a user enrolls. 111 Reset successful. Logged every time a user has successfully reset their password. 112 Unlock successful. Logged every time a user successfully unlocked their user account. 113 Change successful. Logged every time a user has successfully changed their password. 114 Change failed. Logged every time a user tried to change their password, but failed as a result of the password policy rules. Warning events ID Description 202 Too many failed user named. 8

9 Logged when the call throttling feature has blocked a client request. 203 Too many verification code requests. 205 Ignore password rules on reset found in policy. Logged when Specops Password Reset discovers a user with a Specops Password Policy configured to be ignored on password reset operations. This setting should not be enabled in environment where Specops Password Reset is used because it allows users to bypass their password policy. 206 Password reset detected from user with the password not required flag set. 207 Password not required flag discovered on an enrolled user. 208 Failed to impersonate user. 210 Enrollment failed. 212 Unlock failed. 214 Wrong answer submitted during user authentication. 215 Wrong verification code submitted during user authentication. 216 User was locked out from Specops Password Reset. 220 License warning. Logged when the license is close to being exceeded. 221 User failed to reset their password. 222 User failed to change their password. 241 Failed to parse polling time from registry. 245 Failed to contact domain. 277 Failed to send enrollment reminder. Error events ID Description 300 Service failed to start. Logged if the server component fails to starts. 301 Service failed to stop. 305 No Specops Password Reset Policy found. 306 Wrong number of questions. 310 Reporting database migration failed. Logged if the service fails to migrate an existing database stored in the old xml-format. 9

10 320 License error detected. 332 Failed to get password reset package. 334 Failed to send mobile verification code. 335 Failed to get next secret question. 336 Failed to get password policy for user. 337 Server failed to unlock user account. 338 Server failed to reset user password. 346 Failed to send Failed to send mobile verification code from Helpdesk tool. 349 Failed to send new user password from helpdesk. 385 Failed to add data to the reporting database. 386 Failed to clear user data from the reporting database. 10

11 Debug logging You can configure the components of Specops Password Reset to log their internal activity to a verbose debug log. The debug log allows you to follow the events leading up to the error. Debug logging is enabled by changing the relevant registry key from 0 to 1. Additional logging will be returned by using the higher debug levels 2 or 3. Registry key Password Policy\Client\Debug Password Reset\Administration\Debug Password Reset\Administration\LogFilePath Description Enables and disables debug logging for the Specops Password Client. Note: The default path to the client log is: %TEMP%\SppClient [SppClient].log. This cannot be changed. Enables and disables debug logging for the Specops Password Reset Administration Tool. Specifies the log file path for the Specops Password Administration Tool log. Default value= %USERPROFILE%\Local Settings\Application Data\SpecopsSoft\SpecopsPasswordReset.log Password Reset\Server\Debug Password Reset\Server\LogFilePath Password Reset\Web\Debug Password Reset\Web\LogFilePath Note: This value does not exist in the registry by default. If you want to change it, add LogFilePath as a reg_sz [string value]. Enables and disables debug logging for the Specops Password Reset Server. Specifies the log file path for the Specops Password Reset Server log. Default value = C:\SpecopspasswordResetServer.log Enables and disables debug logging for the Specops Password Reset Web. Specifies the log file path for the Specops Password Reset Server log. Default value = C:\Temp\SpecopspasswordResetWeb.log 11

12 Note: Do not leave the debug logging turned on unless you need it. Verbose logging over an extended amount of time can create large log files which have the potential of filling your system disk partition. You can find a complete list of registry settings in the Specops Password Reset Administration Guide. 12

13 Support If you are unable to resolve a product related issue, contact Specops Support for assistance. Online We recommend submitting your case directly on our website at: Telephone International Monday - Friday: 09:00-17:00 CET North America SPECOPS ( ) Monday - Friday: 09:00-17:00 EST 13