Troubleshooting

If you experience connectivity problems between your domain controllers and Identity Awareness Gateway/Log Servers, perform the following troubleshooting steps:

Connectivity Issues

1. Ping the domain controller from the Identity Awareness Gateway and Log Server.
2. Ping the Identity Awareness Gateway and Log Server from your domain controller.
3. Perform standard network diagnostics as required.
4. Check the Logs tab of the Logs & Monitor view and see if there are drops between a Security Gateway defined with AD Query (Source) and the domain controller (Destination). If there are drops, see Configuring the Firewall and sk58881.

Use wbemtest to Verify WMI

To use the Microsoft wbemtest utility to verify that WMI is functional and accessible.

1. Click Start > Run.
2. Enter wbemtest.exe in the Run window.
3. In the Windows Management Instrumentation Tester window, click Connect.
4. In the Connect window, in the first field, enter the Domain controller, in this format: \\<IP address>\root\cimv2
5. In the Credentials > User field, enter the fully qualified AD user name. For example: ad.company.com\admin
6. Enter a password for the user.
7. Click Connect.
8. If the Windows Management Instrumentation Tester window re-appears with its buttons enabled, WMI is fully functional.

If the connection fails, or you get an error message, check for these conditions:

• Connectivity problems
• Incorrect domain administrator credentials.
• WMI service is not running
• A Firewall is blocking traffic between the Identity Awareness Gateway or Log Server and domain controller.

Domain administrator Credentials

To verify your domain administrator credentials:

1. Click Start > Run.
2. In the Run window, enter \\<domain controller IP address>\c$

   For example: \\11.22.33.44\c$

3. In the Logon window, enter your domain administrator user name and password.
4. If the domain controller root directory appears, this indicates that your domain administrator account has sufficient privileges. An error message may indicate that:
   1. If the user does not have sufficient privileges, this indicates that he is not defined as a domain administrator. Obtain a domain administrator credentials.
   2. You entered the incorrect user name or password. Check and retry.
   3. The domain controller IP address is incorrect or you are experiencing connectivity issues.

Verify the WMI Service

To verify if the WMI service is running on the domain controller:

1. Click Start > Run.
2. Enter services.msc in the Run window.
3. Find the Windows Management Instrumentation service and see that the service started.

   If it did not start, right-click this service and select Start.

Configuring the Firewall

If a Firewall is located between the Identity Awareness Gateway or Log Server, and the Active Directory controller, configure the Firewall to allow WMI traffic.

To create Firewall rules for WMI traffic:

1. In SmartConsole, from the Security Policies view, open the Access Control Policy.
2. Create a rule that allows ALL_DCE_RPC traffic:
   • Source = Security Gateways that run AD Query
   • Destination = Domain Controllers
   • Service = ALL_DCE_RPC
   • Action = Accept
3. Save the policy and install it on Security Gateways.

   Note - If there are connectivity issues on DCE RPC traffic after this policy is installed, see sk37453 for a solution.

Confirm that Security Event Logs are Recorded

If you have checked connectivity but still do not see identity information in logs, make sure that the necessary event logs are being recorded to the Security Event Log.

AD Query reads these events from the Security Event log:

• For Windows Server 2003 domain controllers - 672, 673, 674
• For Windows Server 2008 and above domain controllers - 4624, 4769, 4768, 4770

Make sure you see the applicable events in the Event Viewer on the domain controller (My computer > Manage > Event Viewer > Security).

If the domain controller does not generate these events (by default they are generated), refer to Microsoft Active Directory documentation for instructions on how to configure these events.