Just Installed - No Network Connections

[Will123]

HI,

I just installed WinGate 7.2.0 build 3409 on a server running Windows Server 2003 Enterprise x64 with SP2. The server is on the domain and I selected the Active Directory Connector. After the management console restarts, it does not ask for my domain credentials also when I go to network connection under wingate control panel - its blank. The server has a fully functional Broadcom BCM5709C NetXtreme II network adapter installed. The navigation panel does not look like images I have seen...

[adrien]

Hi

that minimal user interface is what you see when the AD connector couldn't connect to the AD. 99.999% of the time this is due to DNS config on the WinGate computer.

Is the primary DNS for that computer pointing to an AD server?

Can you enable debug logging for the AD connector, and post what it shows on startup?

Regards

Adrien de Croy

[Will123]

I believe this is what you requested: "Failed to obtain domain information (error 1355), this computer may not be connected to a domain. This provider will not be available."

The preferred DNS was pointing to AD Server and the server was on the domain. I removed it from the domain and added it back... it looks like its working now. I can access the network connections option as well as everything else. Thanks for pointing me in the right direction.

[Will123]

So, I spoke to soon - the issue remains. I installed PureSight, restated the server and am back to getting the minimal user interface.

Log states: Failed to obtain domain information (error 1355), this computer may not be connected to a domain. This provider will not be available.

[adrien]

Hi

check out http://support.microsoft.com/kb/958804, that describes this same error (DsGetDcName returns error 1355). According to that doc, it implies some config issue with your domain.

We also added in 7.2.0 an override option to bypass this particular issue, with a registry setting, but it requires you to discover the GUID of the domain object for your domain.
The overrides are in (since you're on x64)

HKEY_LOCAL_MACHINE\Software\WOW6432Node\Qbik Software\WinGate\Users\ADProvider\Settings

ForceDomain (REG_DWORD): 1=use forced value of domain
DomainOverride (REG_SZ): overridden domain, e.g. qbik.local

ForceDomainGUID (REG_DWORD): 1=use forced value of domain GUID
DomainGUIDOverride (REG_SZ): GUID of your domain object (including curly braces).

I know 2 ways to obtain the GUID of your domain:

1. an LDAP browser (e.g. Softerra LDAP browser).
Connect to your AD server, and browse to the DC=[your domain name] object, and look for the ObjectGUID property

2. in the DNS MMC snapin on the domain controller under
Forward Lookup Zones\[your domain name]\_msdcs\domains - The sub-key name is the GUID (but without curly braces).

Adrien

[Will123]

I determined my GUID with the LDAP browser, but I don't have the registry key setting you advised. I can get to the level of: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Qbik Software\WinGate\Users. This level only has two keys: default and Provider UUID.

[adrien]

Ok

Can you just try creating the subkeys?

Regards
Adrien

[Will123]

I made the keys, but still no joy... Is support available by phone?

The following errors come up now in the log now:

19 1 5/11/2012 14:55:01.390 Active Directory 4756 Error 4 Failed to open Active Directory Search object, error 8007203A
20 2 5/11/2012 14:55:01.390 Active Directory 4756 Error 5 Domain SID query failed (8007203A), this provider will not function
21 3 5/11/2012 14:55:01.390 Active Directory 4756 Error 3 Failed to retrieve domain SID, this provider will not be available

[adrien]

Hi

you could try running the WinGAte service in a domain admin account if it's localsystem, or vice versa if it is already.

It basically looks like there's a problem with your AD config. Did you look through that MS knowledgebase article?

We can do phone support, it's our weekend at the moment.

Regards

Adrien

[Will123]

I did review the article, but I don't see how it applies. I am able to log onto the domain as well as add/remove the server from the domain without any issues. I see the fact that the network connections applet is missing as being the issue. Since WinGate does not see any network connections, it makes since that it will not see the domain. Lets do phone support - I would like to get this resolved in the next day or two so I can decide if its worth purchasing.

[adrien]

Hi

Without a working user database you will never see anything under network connections or a heap of other places

So if you cant get the AD connector talking to your domain, I suggest changing user and group provider to WinGate users and groups

Adrien

[adrien]

Hi

that error 8007203a implies the following

http://support.microsoft.com/kb/325322

I know you can join the domain etc etc, but I'm just saying I've seen this before many times, and every time it turns out to be DNS related.

Even though that article relates to Exchange, it's the same underlying issue.

Something about the DNS setup breaks various APIs we use in the OS to connect to the AD. Other software suffers the same fate (e.g. in this case Exchange).

In that article, they recommend making sure that the DNS settings on the adapter on the domain controller use 127.0.0.1 rather than anything else, and that you use forwarders in the DNS server itself to do remote / internet lookups.

Adrien

[adrien]

Hi

we had another customer with this issue last night.

It turned out to be DNS related like I said all along.

kerberos records were not in the AD DNS server, so the client couldn't find the kerberos server to authenticate to the LDAP server.

We had to manually add the _kerberos and _kpasswd DNS SRV records to the AD DNS server to get it working (for TCP and UDP).

Adrien