Troubleshooting Authentication in Server Logs

Results in the authentication log

• If the Authentication.log file on the Endpoint Security server shows:

  ERROR: Config file contains no principals.

  The database was cleaned or the process to include authentication in the client package was faulty.

  To fix:

  1. Repeat the process to configure Active Directory authentication.

  2. Make a new client package.

  3. Restart the Endpoint Security server.

• If the Authentication.log file on the Endpoint Security server shows:

  Permission denied in replay cache code

  Restart the Endpoint Security server.

• If the Authentication.log file on the Endpoint Security server shows:

  Clock skew too great

  • Make sure that the Endpoint Security server and all clients are synchronized with the Active Directory server.

  • Make sure that in the Windows Date and Time Properties window, the Automatically adjust clock for daylight saving changes option has the same value (selected or cleared) for all computers in the system, including the Active Directory server.

  • The following workaround is not recommended, for security reasons, but is offered if you cannot fix the clock skew error with synchronization changes.

    To ensure that authentication occurs even if the clocks of the client, the Endpoint Security server and the Active Directory server are out of synch, define an acceptable skew.

    By default, the authentication clock skew is 3600 seconds. You can change the Endpoint Security settings.

    In the $UEPMDIR/engine/conf/global.properties file , add this line:

    authentication.clockSkew.secs=<<i>Allowed Number of Seconds for Clock Skew</i>>

• If the Authentication.log file on the Endpoint Security server shows:

  Key version number for principal in key table is incorrect

  Update the Key version number in the Active Directory SSO Configuration window.

  You might have changed the user that is mapped to the ktpass service.