Hi guys,
I nested AD groups inside of the LANDesk Managment suite group and im getting a Domain\User is not a member of the LANDesk® Management Suite Group. (User Authentication Error -500) . From my understanding If I changed the com+ objects to a domain account that LANDesk will be able to enumerate group membership. It seems to work for the Web console but not for the 32-bit. I dragged the AD groups into the active directory section under users aswell.
Am I missing a step?
Thanks in advance!
Are your users logging on to the console with the full "domain\username" syntax?
yes. All users are using domain\user
Have you logged into the console, gone to Tools -
Administration - Users - All Users and clicked the refresh button?
This did not fix the problem.. Its begining to become a big issue alot of users are calling up with the same error. As soon as we drop there individual accounts into the group it works fine.. Any other ideas?
Global or Local security group? I know with 8.6 we had some problems whereby Landesk refused to enumerate any members of Local groups but was quite happy with Global ones.
All of my groups are global Security groups.. Should they be distribution?
I opened the uservalidatorerrlog.txt and I noticed the following:
GetGroupUsers() : NetGroupGetUsers failed with an ERROR_LOGON_FAILURE code. IIS may not have permission to query the domain for group information.
The webconsole works fine and the Com+ object is configured with a domain account... ? ?:|
Simple but crucial item to check - have you ensured that the COM+ credentials are not locked out and/or the pw is entered correctly? I say this only because I've seen this happen before, e.g., the account's password was modified and nobody told the LANDesk admin.
The account is not locked out and the password is set to never expire. It was not changed. Thanks anyways..
Really the only answer is that the Com+ objects have to run as a user that can enumerate the groups in a domain.
I have often seen the change to a username not work until after a reboot even though I stopped and started the objects. You probably already rebooted though.
It looks like you are doing things right and if those Com+ objects are correct, the Domain\User and password are correct and working, and a reboot didn't fix it, then you have done nothing wrong at all. It is probably something like a poorly registered .NET Framework or a problem with the Core Server's domain membership.
Again, you are doing it right, it should be working.
Yah.. It just does not make any sence.. We rebooted.. I did not re register .net but whats the odds of it being broken on 5 cores.. Does the COM object cache any credentials? Ill try and remove the COM object credentials reboot and Re add them..
Looks like you are doing everything correct. I have to ask <grin>, have you changed the credentials on both COM+ objects? Also just to be sure it is not a account issue (some weird GPO restriction), change the credentials to your username and password, just for S&Gs.
whats the odds of it being broken on 5 cores..
Exactly.
I just changed the COM+ users password changed it on all of the cores and rebooted.. Still the same Issue. Why would the error log state that IIS does not have permission? Could permissions on IIS be hosed? Whats the process the console uses to enumerate the NT group. Does it have anything to do with the APPPool credentials? Its local service.. ?
| ||||||
