RoboHelp Server 8/Active Directory

Hi again,
After moving my install of RoboHelp Server from our Windows Server 2008 R2 server to an older Windows Server 2003 Web Edition box, I was able to get RoboHelp Server talking to SQL Server 2008 through ODBC. Now on to the next problem. I've been trying to configure LDAP authentication against Active Directory, which I can see from a post from NSC_Gillis last August, it looks like there's a problem here.
My setup now consists of:
RoboHelp Server 8 installed on Windows Server 2003 Web Edition with Tomcat 6.0.26 and JRE 1.6.20.
The relevant config section from my <context_name>_server.properties file:
#To use LDAP authentication , uncomment the following...
authtype = ldap
ldapURL = ldap://<subdomain>.<domain>.com:389
usersearchbase = DC=<subdomain>,DC=<domain>,DC=com
rolesearchbase = DC=<subdomain>,DC=<domain>,DC=com
useridkey = uid
rolename = cn
rolesearch = member
DefAdminUid = <UidOfAdmin>
DefAdminPwd =
This yields one of ththe following two results when attempting to subsequently log in to the Web Administrator interface:
Error in LDAP authentication.
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db0
Error in LDAP authentication.
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 325, v1772
Both of these errors indicate that when RoboHelp Server is attempting ldap_bind(), that it is doing so with bad credentials. When it comes to Active Directory, these credentials have to be in the form of a valid User Principal Name (UPN) and a password, which given the configuration data above, we're never able to provide one. And since I've been able to configure Tomcat itself to use a JNDI Realm for authentication successfully against the same said Active Directory, I have to assume RoboHelp Server is attempting to do an anonoymous ldap_bind() which just won't work with Active Directory.
If someone can provide some guidance at this point, I'd be grateful.
I admit, for a product that is released only for use on the Windows platform, to include LDAP functionality, but then break it so it won't work with Active Directory, or at least to provide little to no guidance/documentation on how to get it to work, seems patience testing at the least.
If we cannot get this resolved, we will be forced to review our future use of the RoboHelp/RoboHelp Server products as a whole.
Thanks,
Scott

Hi Scott,
RoboHelp Server doesn't do an anoymouse LDAP bind. It uses the ldap user id and password provided in the properties file. Please note that for RoboHelp Server configured with LDAP, "DefAdminUid" property in robohelp_server.properties should be set to a valid LDAP user principal and "DefAdminPwd" property should be set to LDAP password of that user principal.
Regards
Tulika.

Similar Messages

Download issue when Windows 7 Pro joins a Windows Server 2008 Active Directory

Hi,
I purchased 2 new Dell OptiPlex 3010 desktop computers that came with Windows 7 Professional operating system with SP1.
There were no Microsoft updates installed yet. After I added one of these Dell computers to the Windows Server 2008 Active Directory, I was not able to download several items.
Below are several examples:
1) I downloaded the Norton anti-virus installation file. This file is not the full installation of Norton; it is more of a file where you execute it and it will download the full installation from the Internet like from their Norton web
site. So when I executed this installation file, it does not download the full installation files.
It just hung at the screen saying “Downloading” and it will finally stop with an error (don’t remember the error message).
Note: If I have the full Norton installation file then I am able to install it on this computer with no problems.
2) I downloaded the Adobe Reader installation file. This file is not the full installation of Adobe Reader; it is more of a file where you execute it and it will download the full installation from the Internet like from their Adobe web
site. So when I executed this installation file, it hung at the downloading part and then it will error out with a “Actionlist Not Found” message.
Note: If I have the full Adobe Reader installation file then I am able to install it on this computer with no problems.
3) I installed Microsoft Office 2010 Standard version on this computer.
I configured Microsoft Outlook to retrieve emails from my email provider (pop and smtp settings).
After configuring Microsoft Outlook, I was able to send emails through Microsoft Outlook successfully (and very quickly), but he was unable to retrieve my emails. The progress bar for the Receiving in the "Outlook Send/Receive Progress" box
shows no progress. The Progress bar is not moving. There is a message at the bottom of Microsoft Outlook stating "Receiving message 1 of 6 (x.xx KB of x.xx MB)" and it is very slow. My new emails were not being retrieved at all.
I tried various pop and smtp servers that was available for my email provider, but all had the same effect.
4) I can access certain web sites (e.g.
www.yahoo.com, www.cnn.com) while I cannot access other web sites like
www.usatoday.com, my web hosting email site.
Note: I had a Dell computer with Windows XP Professional operating system and this computer does not have any of the above issues.
The above are only a few examples that I have experienced.
If I removed this Dell OptiPlex 3010 computer from the Windows Server 2008 Active Directory then I still experience the same issue.
So as another test, I setup the other new Dell OptiPlex 3010 with the same Windows 7 Professional OS with SP1.
This time, I did not join the Windows Server 2008 Active Directory and I was able to successfully download the full Norton installation files, download the full Adobe Reader installation files, download my emails from Microsoft Outlook 2010, etc.
But once I joined this computer to the Windows Server 2008 Active Directory then I am not able to download these files and emails at all.
It seems like there might be some group policy or a security setting that is preventing these downloads so I disabled the group policy on the Windows Server 2008 AD and Windows 7 Profession OS, but it didn’t resolve the issue.
I disabled all of the firewall programs on this Windows 7 Professional OS, but it still did not resolve the issue.
Since the Windows Server 2008 AD did not have DHCP installed, I installed DHCP and setup a scope.
Then configured the Windows 7 Professional OS to obtain an IP address, but it didn’t resolve the issue.
If I move this Windows 7 Professional computer to another network where it did not have any Active Directory; it just had a wireless router serving DHCP then everything works on the Windows 7 Pro computer.
Any ideas what is the root cause when a Windows 7 Professional computer join a Windows Server 2008 AD?
Thanks,
wl_tech

Hi,
Could you please tell some information for the AD environment and how it connect to the internet?
Regarding 3rd party installlers didn't work as expected, please also seek help in their offical website.
For outlook not receiving emails, could you please take a look in
Event Viewer and see if there are any special errors logged there?
And when trying to access the website like
www.usatoday.com, any special errors IE showed out?
Best regards
Michael Shao
TechNet Community Support

Upgrade from Windows Server 2012 Active Directory to Windows Server 2012 R2 Active Directory

We are currently running Windows Server 2012 Active Directory and would like to upgrade to Windows Server 2012 R2 AD. Is it OK to just do an in-place upgrade, or is it advisable to build new domain controllers on R2? Are there any guides or articles anyone
can recommend?

Hi Ginandtonic,
To upgrade DC(Domain Controller) from windows server 2012 to windows server 2012 r2, please refer to these articles:
Upgrade from windows Server 2012 to 2012 R2
Upgrade Active Directory from 2012 to 2012 R2
I hope this helps.
Best Regards,
Anna

Sun java directory server and Active Directory

We are using two different directory servers Sun java directory server and active directory.
My question is how we can have password synchronization between these two directory servers.
I have checked Sun Java[TM] System Identity Synchronization for Windows 1 2004Q3
http://www.sun.com/download/products.xml?id=41537425
It seems that it's supported platforms is only for solaris and windows , but I have installed my Sun java directory server on linux and obviously it doesn't work for me.
I would be grateful if anyone can suggest a solution to work around this situation.
I have checked identity manager , I would like to know that if I can do this using this product.
http://www.sun.com/software/products/identity_mgr/specs.jsp
--regards.
Sara

Yes RHEL 4 is a supported OS with DSEE 6.0.
Identity Synchronization for Windows is a part of DSEE that allows synchronization of users, passwords and groups between Sun Directory Server and Active Directory bi-directionally without altering the users environments, ie it does not require that users change their current habits.
Identity Manager is a complete identity management solution that is targetting enterprise work flow when it comes to user provisioning and de-provisioning, but also allows to build authentication and password change forms that will provision the passwords to many different systems including Sun Directory Server and Active Directory but also IBM mainframes, legacy applications, databases...
If you are implementing a complete identity management solution, then go with Identity Manager. If you need a lightweight and fast solution for just synchronizing users and passwords between Sun DS and MS AD, Identity Synchronization for Windows should be your choice.
Regards,
Ludovic.

Mac OS X Server and Active Directory Replica

Hello,
Has anyone ever encountered any problems when making a Mac OS X Leopard server an Active Directory Replica? We're working on this project and we want to make sure that we don't mess up our primary AD server when we configure this.
Thanks so much,
Mac man of the Bay

Hi
Not sure what you mean by Active Directory Replica? If you mean you want your Mac Server to be the BDC to a Windows-based PDC then no it won't happen. OSX Server can only perform as a Domain Member when a Windows Server is the PDC. Neither can you have a Windows Server as the BDC when the PDC is an OD Master - as far as I know.
Have you downloaded and read the manual?
http://images.apple.com/server/macosx/docs/OpenDirectory_Admin_v10.5_2ndEd.pdf
Briefly: OD Master/Replica relationship can also be PDC/BDC only if both boxes are OSX.
Tony

Os x server loses active directory binding

I am running an open directory/active directory network. Authentication is from the Windows server 2003 active directory. It has worked fine until the last month. Now clients stop authenticating & when I check the AD plugin it says network accounts are not available. I can force the server to unbind, then renew the binding & everything works great.
Is there any work around or fix for this other than upgrading the windows server to 2008?
Thanks

Yes. You are likely experiencing one of two common issues. 1: You time skew is too large (although an unbind/bind will not solve this) or 2: you are failing to properly set the random machine password.
Try this command on the server:
sudo dsconfigad -passinterval 0
Then:
sudo dsconfigad -show
to confirm the setting. This will prevent the machine from refeshing its machine password with the domain every 14 days (default setting). The issue is that Apple's plugin does not properly catch an exception. What happens is the plugin detects that it should re-randomize the machine password so it creates a new one, records it to the config file, and THEN tries to write it to the domain. When the write to the domain fails, the system then sends the new password already recorded in the config file and now they mismatch. This is a common AD integration issue and is likely associated with your binding rights in AD.
As for time, make sure you are pointing all your Macs to the DC for time info or to a mutually agreed upon external server.
Hope this helps. Easy to fix.

Require list of all events for Windows Server 2008 Active Directory

Hi all,
I require list of all events for Windows Server 2008 Active Directory. Event Log name for Active Directory log is "Directory Service".
Regards,
SR

Hi,
Thanks for your posting.
Do you mean you want to list all Active Directory logs into one file named “Directory Services”?
If that, it’s hard to achieve. There are kinds of Active Directory logs stored in different locations and they have different file formats. It’s hard
to collect them into one file.
Active directory records events in the directory services log in Event Viewer. By default, Active Directory records only critical error events. To instruct Active
Directory to record other events in the directory services log, we need to modify registry.
For more information please refer to following MS articles:
Active Directory Diagnostic Logging
http://technet.microsoft.com/en-us/library/cc961809.aspx
How to configure Active Directory diagnostic event log
http://support.microsoft.com/kb/314980
Lawrence
TechNet Community Support

Project Server 2010 - Active Directory Enterprise Resource Pool Synchronization limitations

Greetings again.
I have a quick question about the limitations of Active Directory Enterprise Resource Pool Synchronization. Specifically, what has your experience
been with extremely large numbers of users (10k plus). Is anyone aware of a
practical limit of users in your AD group you would recommend when using the
Schedule Synchronization feature on a nightly or weekly basis?
There is a caveat to this question however. The client has decided (perhaps for some misinformed reasons) to allow access for every user, to every
project site, within their PWA environment. They’ve selected the View Project Site option within the
Categories for the Team Members PWA Group for which 90% of their intended users reside. So when we ran a couple test syncs in DEV with a smaller AD group of about 8,000 users, the sync understandably
lasted upwards of 18 hours. Obviously unacceptable for a PROD environment on a nightly basis and not necessarily ideal for a weekly sync either.
Experience in addition to documents like these, “Best
practices for managing a large number of resources in Project Server 2010” tell me that we are way over the practical limit of a scheduled resource pool synchronization...IF
the client really desires that all users access all their sites. But before I submit my recommendations, I wanted to check with the community just in case others may have found a way to synchronize large numbers of users (10k plus) on a nightly or weekly
basis, within a reasonable time frame AND allowed all users to access all sites within PWA.
What do you think?
As always, thanks for your help.
Chris Addis - MCTS

Hello Hrishi.
My delayed response has been due to a large amount of testing we have been performing on this particular topic. Here is an update, please feel free to provide feedback.
We went back to testing and spent more time reviewing the documents:
Best practices for managing a large number of resources in Project Server 2010 and
SharePoint Server 2010 capacity management: Software boundaries and limits. Our team interpreted those documents as saying, 1,000 security
scopes per site is a recommended limit. It does not say it’s a hard limit, just a recommended limit. “When the recommended unique security scope boundaries are exceeded, performance issue can occur.”
So we decided to perform some tests (31 in total) to try and get a gage of what we are seeing.
We needed to establish a baseline first. So we performed a series of 23 Active Directory Resource Pool Synchronizations with various settings in a clean, Out of the Box, environment in order to see some consistent numbers. Here is it’s summary:
Our AD group of 8,000 users took about 32 minutes, on average, every time to sync. The difference between the first sync and last sync differed only by 1-3 minutes.
Adding 40 project sites increased the average sync time from 32 to 120 minutes.
Adding 100 users to each of those 40 project sites, did not increase the sync times.
One setting (identified at this time) reduced the synchronization time. It was the
Project Site Permissions check box found within the Project Web App > Server Settings > Project Site Provisioning Settings area. By deselecting this check box we reduced or synchronization time back to the 32 minute
average.
The View Project Site check box within the Project Web App > Server Settings > Manage Groups > Team Members group had no apparent effect on the sync times besides what we had gleaned from the Microsoft documentation.
Naturally, this left us with a problem. As I’m sure you know, by deselecting the check box (Project Site Permissions), our project sites are now (figuratively speaking) orphans with no connection to the parent site. This generates
a new set of issues. For example:
Newly created project sites cannot be accessed by the owner and team members. They will require someone like the farm admin to come in behind them and add the intended users to the project site along with their required permissions.
All current and futures sites will no longer have users added via the standard method of building a team and publishing the project, but will have to be added manually.
You can use the Synchronize option found within Project Web App > Server Settings > Project Sites page, but that kinda defeats the purpose. It would require constant updating on a per site basis to keep up with
PM changes. Not very sensible, but it does work.
With this baseline information, we moved our tests into our DEV environment which somewhat mimics our PROD environment. This environment has 352 project sites and we performed 8 tests. This is where we had some large sync time numbers.
Here is the DEV test summary:
With the Project Site Permissions check box cleared, our AD group of 8,000 users took on average 30 minutes to sync. This was in line with our baseline times. With the exception of one test sync that took 99 minutes to complete.
That anomaly is acquiescent with what I’ve seen over the years. Sometimes syncs do some unusual things.
With the Project Site Permissions check box selected, our AD group of 8,000 users took on average 690 minutes (11.5 hours) to sync. Unacceptable of course.
So here’s what we’ve learned when dealing with extremely large numbers of active directory users in your Resource Pool sync:
We did not see a decrease in subsequent sync times after the initial Active Directory Resource Pool Synchronization as some might expect.
Our attempt to decrease sync time via the option of removing the View Project Sites was not successful. (Unless we interpreted Microsoft's document incorrectly.)
However, our interpretation of the recommended software boundaries and limits of SharePoint Server 2010 as it pertains to security scopes per site at 1,000, appears to be correct.
Using the option of clearing the Project Site Permissions does produce a reduction in AD sync time, but at a cost segregating your project sites and thus the creation of new processes of maintaining them.
I’ll remind others that these results are particular to our environments, there may still be exceptions yet to discover. Others may see numbers contrary to ours.
The biggest surprise to some members on our team (myself excluded) was that we did not see a reduced sync time after any of our initial syncs. Some are under the impression that after your initial sync, you should see reduced sync times. I haven’t
found that to be the absolute case in all situations, just in some situations. The reason for this still eludes me. Any thoughts would be appreciated.
I’ll let this sit a bit longer, but if no one disagrees with the results, I think we have our answer:
The number of project sites directly affects your Active Directory Resource Pool Synchronizations if you are using the
Project Site Permissions option. If you plan on synchronizing over 1,000 users
and you have a large number of project sites, proceed with the knowledge that you may have performance issues and long sync times.
As always, I’d love to hear from you or others just in case I’m missing something.
Chris Addis - MCTS

Project Server 2010 Active Directory Synchronization - duplicate Windows Name - Event ID 7734

Environment: SharePoint Server 2010, Project Server 2010, SP2, DEC 2013 CU (Farm Build number: 14.0.7113.5001)
Scenario:
Domain user has been added to the Active Directory group being synchronized with Project Server for the Team Members group.
That user has participated as a team member in numerous projects, added documents, been assigned tasks, typical project stuff...
Employee quits.
AD account is deleted. (NOT deactivated or moved into another OU)
Time passes...
Employee gets rehired. NEW AD account is set up: same display name, SamAccountName, email address, different GUID of course.
Daily Active Directory job runs again and throws event ID 7734 and the sync ends with a partial fail.
I understand why this is happening. Solutions I've found point me to deleting the Enterprise Object resource in Project Server and then rerunning the sync. Sure, this works BUT won't all of the previous documents, tasks,
etc. be disassociated from that user? If so, this is not ideal.
2 questions:
Is there a better way to deal with the fixing of the resource in Project Server to somehow link the old resource to the new resource allowing the sync to run successfully while still leaving the association to all old content intact?
How are other organizations dealing with rehires when they have been added as resources in Project Server? What is the best practice guidance from Microsoft on this? Are other companies not actually deleting AD accounts when users leave organizations
or are they putting them into a "ARCHIVE" OU or something like that? This happens at least half a dozen times a year at my company. We would like to keep our AD as clean as possible, but this appears to change our approach.
Any suggestion/guidance is appreciated.

For the question to relink the new account to the account which is already available in Project Server. You will have to update the WRES_AD_GUID to Null for the the Resource in MSP_RESOURCES table in the published database.
Whenever a users gets synchronized to the PWA his ADGUID, SAMAccountName, Display Name, Email Address and DepartmentName is Synchronized from AD to Project Server. When the user was deleted and recreated the ADGUID got changed. During the next sync, project
found the user with similar properties but different ADGUID which was updated in WRES_AD_GUID column in MSP_RESOURCES table. Hence it says that there is a duplicate account in the table with the same properties but a different ADGUID
Nullifying the WRES_AD_GUID column value in MSP_RESOURCES table should get the user synchronized to Project server in the next sync.
Cheers! Happy troubleshooting !!! Dinesh S. Rai - MSFT Enterprise Project Management Please click Mark As Answer; if a post solves your problem or Vote As Helpful if a post has been useful to you. This can be beneficial to other community members reading
the thread.

Apple Mail Server and Active Directory

Has anyone had any luck in using Active Directory (2003) as the directory service with an Apple Mail Server? We're testing it out, but we're unable to enable mail services for users on teh Mac server.
If anyone has tried this and can offer up some tips, I'd be grateful!
Dell Latitude D620 Other OS

Me too!
I also discovered that Mac users who have valid accounts in AD 2003 can't have an email account in WGM enabled for them (WGM acts like its enabling email but then reverts back to "disabled"). I assume the account must be configured in the Active Directory Users and Groups admin tool before it can be enabled in WGM on the OS X email server, but I havent had any luck getting it to work yet.

Activating TimeMachine Server for Active Directory Users

Currently we'd like to switch to Active Directory and I tried it out with our Test environment, setuped an Active Directory Server and joined a OSX Mavericks Server. So far so good I can manage all my AD users, but when I click on "Edit Access to Services" I can activate anything for my AD user BUT not Time Machine!
Does anyone knows why and if there is any workaround to make it work? For other Network (Open Directory) and Local Users I can activate it.

sorry.. I am soooooo stupid... I have to activate "File Sharing" as well.. for the user everything was already pre-activated, not for the AD users, I just saw the Time Machine checkbox grayed out ...

Windows server 2008 Active Directory with PT8.49

Hi All,
i m using the follwoing:
PeopleTools 8.49
HRMS & Campus Solution 9.0
i wnat to know is Micrososft Window 2008 Server Active Directory supported with peopletools 8.49
Regards,
Irfan

My favorites are RODCs and AD as a service.
Microsoft explains it in detail here:
http://technet.microsoft.com/en-us/library/cc755093(v=WS.10).aspx

Radius Server with Active Directory

I have an XSERVE with 10.6.7. It is an OD Master that is also bound to Active Directory.
I am trying to set up the RADIUS service to provide authentication to users on the wireless network.
So far, I have been able to set it up to the point where the wireless access point is attempting to authenticate to the server. The client is asked for user ID and password. I will even see the self-signed certificate on the client. However, I am never able to connect to the wireless system.
I tried using an Air Port Express with all the automatic settings from the server, and got the same results.
I tried authenticating with a local OD test user, and that did not work, either.
When I tried it on my network at home (no Active Directory), the RADIUS server worked exactly as expected.
Is there some other setting that must be modified to make this work with AD?

Here are some links:
http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a00807917aa.shtml
http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080921f67.shtml
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080665d18.shtml

Cannot register radius server in active directory

Hi All
What I can't do is to register the RADIUS server to the Active Directory service which is located on the same server and stand alone server same problem (see screenshot). I've tried to do this as both domain administrator and local administrator.
How can I fix this problem?
IT Helpdesk

Hi,
Try to use netsh nps add registeredserver
command. This command is used for adding a Network Policy Server (NPS) to the list of registered servers in Active Directory.
The NPS server is registered in AD DS when it is added as a member of the RAS and IAS Servers security group.
For detailed information, please view the link below:
NPS Server Commands
http://technet.microsoft.com/en-us/library/cc754758(WS.10).aspx#BKMK_1
Hope this helps.
Steven Lee
TechNet Community Support
Thank You working to me ;)
IT Helpdesk

OS X Server loses Active Directory Credentials

I'm running Yosemite on a Mac Mini with OS X Server version 4.0.3. The server is bound to an Active Directory forest running Windows Server 2012 R2
In order for the iPad enrollments to work correctly (as well as other server services) I must have the login credentials from AD. However for no apparent reason the OS X Server loses ALL AD credentials. The only way I've found to get them back is to reboot the OS X Server, sometimes it takes several reboots, but eventually I get reconnected with the AD server.
There doesn't seem to be any particular pattern or time when I loose credentials, though I have suspicion it may be related to server load on the AD servers.
Is there anyone out there that can give me some help regarding this issue, a log file, a setting or maybe some setting on the AD servers I might be over looking?

Yes. You are likely experiencing one of two common issues. 1: You time skew is too large (although an unbind/bind will not solve this) or 2: you are failing to properly set the random machine password.
Try this command on the server:
sudo dsconfigad -passinterval 0
Then:
sudo dsconfigad -show
to confirm the setting. This will prevent the machine from refeshing its machine password with the domain every 14 days (default setting). The issue is that Apple's plugin does not properly catch an exception. What happens is the plugin detects that it should re-randomize the machine password so it creates a new one, records it to the config file, and THEN tries to write it to the domain. When the write to the domain fails, the system then sends the new password already recorded in the config file and now they mismatch. This is a common AD integration issue and is likely associated with your binding rights in AD.
As for time, make sure you are pointing all your Macs to the DC for time info or to a mutually agreed upon external server.
Hope this helps. Easy to fix.

RoboHelp Server 8/Active Directory

Similar Messages

Maybe you are looking for