GateKeeper shows blank

[grazer]

Hi all,

We have downloaded the Wingate product (version as of last week) for trial as a replacement to our old proxy. We are running it on Windows XP Pro, within an AD environment with one single domain and 40 users.

When I setup the product, I encountered problems when selecting the 'use integrated directory' option during installation. I had to fully remove Wingate and reinstall with this option left unticked. I then successfully created a service account with admin rights and used this account as the Service login.

I also successfully enabled the option to integrate into AD from the Users tab and synchronised across all my AD users to Wingate.

On my first login to Gatekeeper, I could use either the service acount name and password or the 'Use current Windows Login' to get connected. (the PC is logged on as the service account).

However, next day when attempting to open the gatekeeper by entering the username and password, I got the error "There was a problem connecting to the server'. When I use the 'Use current Windows Login' tick box, it appears to connect (shows 'Connected to wingate on localhost') but all options are blank.

I tried a few things then removed and reinstalled the software again. Everything looked ok, synced my users again ok, logged on again ok - but going back to login next day again I got the same result as above.

Can someone advise if I'm missing something or doing something wrong. The product looks great, but I need to be reassured that I can connect using AD successfully?

Many thanks,
Graham Elder

[Nev]

Hi,

What you could try is to restart the Qbik Wingate Engine, does it allow a login then?

Can you remove all the unessential logging from all the services, this might help.

[grazer]

Hi Nev - thanks for your reply.

I have tried restarting the Qbik Wingate Engine from both the Gatekeeper and using the Services.msc page directly - neither make any difference.

The problem appears to be related to copying across the AD users and groups - following this process is when I get the problems.


Thanks,

Graham

[labull]

An "empty" GateKeeper is usually caused by logging in with an account that is not a member of the Administrators group.

[grazer]

Hi labull,

At the point I get the 'empty' Gatekeeper, I am attempting to logon using a specifically setup service account on our Domain, which is a member of Administrators and Domain Administrators. I use the tickbox 'use current account' at login.

The previous step to this was to setup the user database to point to our AD server and run a 'Synchronise'. As the names synchronise, I get an 'Access Denied' error - I guess due to being logged onto Gatekeeper as the local Wingate 'Administrator' account at that point, but all my AD accounts come across.

I then close Gatekeeper, change the logon account for the QBIK service to be my specifically setup service account, restart the service and try to start Gatekeeper. It is at this point the Gatekeeper is blank.

Is it something to do with the change from using the 'local' wingate 'Administrator' account to using a domain account? I notice that after the synchronisation, the local account no longer works. Maybe my timing for using certain accounts is wrong?

Thanks,

Graham

[logan]

Hi Grazer,

WinGate 6.x uses an older SDK for synchronising with domains so that it can still support older type domains like Windows NT. As a result, WinGate does not check the unique ID's of users and groups in the active directory and all user and groups are synchronised by name only and group membership information must be enumerated on each startup of the WinGate engine. Here are some things to watch out for because of this.

1) The users that you are trying to login with must be a part of the "Administrators" group in the domain so that WinGate knows that the users are administrators.

2) If you are having difficulty logging on with custom accounts, try logging on with the "Administrator" account specifically. WinGate should automatically recognise a user called "Administrator" as an Administrator user.

[grazer]

Sorry guys,

Thanks for the various advice, but I'm still getting problems. As soon as I set the database options to use AD, then stop and start the service, I cannot login to Gatekeeper (well, I can but it is blank).

1. We dont have an account called 'Administrator' on our AD - could this be the problem? It was removed as part of a security review, and we instead use a different account as the Administrator.

2. Before I stop/start the Wingate service after enabling AD user database, I can use Gatekeeper successfully using my AD account - it even shows as authenticated NTLM. Its only after any stop/start of the service I lose the access.

Is it possible to convert this to a full support call to get a resolution, as my patience is wearing thin on this evaluation.

Many thanks,

Graham

[adrien]

HI Graham

In order to see things in GateKeeper, the rights must be granted for "Users can monitor activity on this server" to the logged in user. The default settings for WinGate 6 grant this right to a group called "Administrators". If you log into GateKeeper with an account that isn't a member of this group, then it will be blank. You've got several options.

1. Add the user you're logging in as to the rights for "Users can monitor activity on this server".
Go to the users tab, edit the System policies, select "Users can monitor activity on this server"

2. Add the domain account you are logging in as to the group Administrators (not Domain Administrators).

3. Change the right granting access to "Administrators" to use another group that the logged in user is a member of.

Adrien

[grazer]

Adrien,

Thank you for your reply.

Although it did not solve the problem immediately, it did set me on the right track of checking the policy permissions.

It was by adding our service account to the 'User can modify system policies' option that both windows became visible in Gatekeeper.

Thank you for that advice - and our system is now working as expected.

Regards,

Graham