Work Folders client setup errors: No prompt for AD credentials & Lockscreen policies not applied.

Hi everyone.
I've recently set up a test environment for Work Folders (Server 2012 R2). I'm only testing inside my network so no internet access is required. I have encountered two issues:
When setting up a domain-joined client using a GPO everything works fine, except for the lockscreen/password policy settings. If I enable this on the fileserver the sync fails claiming that the PC
doesn't comply with my organization's security policies. This is very weird since Work Folders is responsible for configuring these policies.
There's no Apply GPO option available in the Control Panel item.
When setting up a non-domain-joined client for Work Folders I'm not prompted for AD credentials. The setup fails with the error:
You 're not set up on the server. However, if I open the workfolders URL in Internet Explorer I do
get prompted for my AD credentials.
Here's some details about the environment:
Server 2012 R2 DC. No other GPO's than the work folder GPO.
DNS alias called workfolders.<domain>.local configured.
Fileserver set up with self-signed certificate (SSC) bound to default website. The certificate is either manually installed on the clients or distributed via the GPO. The certificate is made with server name workfolders.<domain>.local.
Work Folder GPO on client OU:
- Certificate distribution of SSC
- Loopback Policy enabled
- Work Folders enabled with Force automatic setup
Both servers and clients are VMs. Non-domain-joined client logged in as local administrator.
Has anyone else encountered these issues? Can anyone shed some light on how to resolve this?
Thanks in advance!
MicaH

Roberto, I don't have a W3SVC1 folder containing log files, so no dice. I did find out through event logs that the account that's used to authenticate is the fileservers' local administrator account! Then I remembered that my local Administrator
accounts' password on my client is the same as on the fileserver (it's a test environment). So I changed the clients local admin password and it finally worked!
I still have issues with the Device Policies, though. Any thought on that subject?
Edit: The issue with the device policies is caused by my testuser not being a local admin on the client. I had adjusted my powerplan settings so I could keep my RDP session to the client open and without admin rights the work folders policies cannot be applied.
Does anyone know how to set these policies using GPO?

Similar Messages

Crystal Report doesn't prompt for SAP credentials / errors out on refresh

2 Environments tested with same results:

BOE XI 3.1 SP2 & BOE XI 3.1 SP2 FP2.5 
SAP Intg Kit on mirrored SP/FP levels in each environment.

We've been successfully creating Crystal Reports against BEx queries in BW for months now as well as ECC master data. We've also built universes and have WebI reports actively working against similar BEx queries in the same. However, we're getting some curious behavior when we refresh the Crystal Reports against BEx queries in BW. Verified all necessary transports and authorizations have been provided for both authoring, as well as refreshing/viewing on demand, etc.

We've setup all the Crystal Reports we're testing to:

a) Use custom database logon information specified here. 
b) Specify a custom driver, leveraging the crdb_bwmdx driver 
c) Prompt the user for database login

We have not enabled SNC as of yet.

1) When we refresh a WebI report hitting a BEx query with security applied, it doesn't prompt for the credentials, but we confirmed through tracing on the SAP side that if the user hits a paramater it has access to, the data comes through and when we hit a paramater they do not have access to, we can clearly see SAP reject it and it spits out a logical error on the BO side in InfoView and in the WebI logs on the BO server.

2) When we refresh a Crystal Report hitting ECC data, we are prompted for the SAP credentials and everything works as expected

However:

3) When we refresh a Crystal Report hitting a BEx query in BW, we are not promtped for SAP credentials. We immediately get the "LOV" prompts. Now, if we use a test user in SAP that has NO SECURITY restrictions at all and open access to the query, the data comes through. However, as soon as any security is applied to the query level, even if it is SAP ALL, we cannot retrieve the data. Tracing is also strange, as we can see on the SAP side it buffer the selected paramaters, but unlike with the WebI reports, it never shows it reaching the point where it checks each paramater against what the role has access to. An error is then spit back. We run the same queries with the same users within SAP and get normal behavior. It's as though as soon as we apply security to the query the mdx driver doesn't like it. Dependant on the type of InfoView viewer we use, the errors we consistently get on the BO side are:

Interactive Viewer: "Error in File %reportname%: Encapsulating Page Failed" 
Java Viewer: "Error in File %reportname%: Database Connection Error"

Nothing glaring in the event logs on the BO servers or in the Crystal logs that I can see, however just because it isn't spitting a specific error in the crystal logs doesn't mean I'm not missing something because I don't know what to look for behavior wise. To reduce the liklihood that it has to do with the way the report was built, we've tried against the same query by building a report using standard methods, as well as the SAP Toolbar using a very plain jane report. Same behavior.

Thoughts?
Edited by: Jay Riddle on Mar 1, 2010 8:55 PM

Hi,
1) When we refresh a WebI report hitting a BEx query with security applied, it doesn't prompt for the credentials, but we confirmed through tracing on the SAP side that if the user hits a paramater it has access to, the data comes through and when we hit a paramater they do not have access to, we can clearly see SAP reject it and it spits out a logical error on the BO side in InfoView and in the WebI logs on the BO server.
>> Which authentication are you using to logon to InfoView ? Whats the configuration in the Universe Connection for Authentication ?
2) When we refresh a Crystal Report hitting ECC data, we are prompted for the SAP credentials and everything works as expected
>> The user is using which authentication ? and against which system does he log on ?
However:
3) When we refresh a Crystal Report hitting a BEx query in BW, we are not promtped for SAP credentials. We immediately get the "LOV" prompts. Now, if we use a test user in SAP that has NO SECURITY restrictions at all and open access to the query, the data comes through. However, as soon as any security is applied to the query level, even if it is SAP ALL, we cannot retrieve the data. Tracing is also strange, as we can see on the SAP side it buffer the selected paramaters, but unlike with the WebI reports, it never shows it reaching the point where it checks each paramater against what the role has access to. An error is then spit back. We run the same queries with the same users within SAP and get normal behavior. It's as though as soon as we apply security to the query the mdx driver doesn't like it. Dependant on the type of InfoView viewer we use, the errors we consistently get on the BO side are:
>> The user is using which authentication ? and against which system does he log on ?
>> You mentioned security restrictions and I assume we talk about BI authorizations in form of data level security. If so - does the BW query include the authorization variables ?
Ingo

Registry Key / Setting to decrease the work folders client polling interval from 10 minutes

Hi,
We would like to be able to decrease the interval that the Work Folders client checks for SMB updates on the our Work Folders server. We have reduced the time limit on the server successfully via powershell, but the client can still take around 10 minutes
before it check with the server for updates. We have found a reg key:
Reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WorkFolders /v PollingInterval /t REG_DWORD /d 5
From:
http://www.networksteve.com/?p=7929
But this key does not appear to have any effect. Does it still work? Is there a alternative? We are using Windows 8.1 clients.
Kind Regards,
Matt

Hi,
After apply the registry setting, have you tried to restart the client to make sure that it can take effect? After reboot, check the sync status to see whether it take effects.
or monitor the detailed work folder as mentione in the link below to get more information
http://blogs.technet.com/b/filecab/archive/2013/10/15/monitoring-windows-server-2012-r2-work-folders-deployments.aspx
Yolanda Zhu
TechNet Community Support

CR prompts for user credentials after refresh even though I'm using SSO

Hello Experts,
We have a problem with a customeru2019s project concerning Crystal Reportu2019s Single Sign On feature:
Even though weu2019re using SSO, Crystal Reports prompts for user credentials every time a refresh is performed manually in the browser.
We already checked SAP note [1214594 - How to avoid database login prompts when refreshing reports in Crystal Reports|http://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/oss_notes_boj/sdn_oss_boj_bi/sap%28bd1lbizjptawmq==%29/bc/bsp/spn/scn_bosap/notes%7B6163636573733d36393736354636443646363436353344333933393338323636393736354637333631373036453646373436353733354636453735364436323635373233443330333033303331333233313334333533393334%7D.do]. The note suggests using Microsoft Windows authentication (trusted connection or operating system authentication) u2013 unfortunately we cannot use this kind of authentication in our project.
Do you have any hint, idea or suggestions?
Thank you in advance!

Hello,
What kind of Project are you developing? Search for Post Back in the SDK forum and Kbase system so you can keep the log on token active. Likely what is happening is the Token or connection times out after 20 minutes, which is IIS's default timeout. Using the postback method is one way of keeping the SSO connection active.
Thank you
Don

Error:Account determination for entry 1000 KBS 0001 not possible

Hi all,
i created one project PO account assignment category Q ,with out master data ,material text , material group , i entered W.B.S ,
P.O . created ,while doing GR , i am getting following error Account determination for entry 1000 KBS 0001 not possible
regards
vijju

Dear Viju,
                                                                                The error M8 147(Account determination for entry XXX KBS
not possible)is because of the corresponding entry mismatch in T030
table .For resolving this we need to make a corresponding entry in
transaction OBYC (the menu path in SPRO is as follows)
Materials Management
-> Valuation and Account Assignment
   -> Account Determination
      -> Account Determination Without Wizard
         -> Configure Automatic Postings
Please also review
Note 364570 M8147,KBS posting when assigning accnt to GR for PO
Regards
V V

Users are being prompted for Admin credentials when they attempt to print.

Hello! I am a Tech assistant at a public school and we have run into an issue with our students and their MacBooks & MacBook Pros.
Whenever our students attempt to print to any printer in their school building they are prompted for administrator credentials. I have attached examples of the message they are getting:
We are not sure how to go about tackling this issue. We are getting this message on both MacBooks and MacBook Pros. They are all running Mountain Lion. Last year they were all on Lion and we never had this issue. Could this possibly be a known issue with Mountain Lion??? Once we type in the administrator credentials for the students they are able to print from then on. Many of the students are also seeing this message when they try to print at their homes. It seems to have something to do with printing permissions but we're just not sure. Any help would be very much appreciated!
Thanks!

You used Workgroup Manager, Profile Manager, or Parental Controls to restrict users from printing or adding a print queue. Remove or modify those restrictions the same way.

My ipod touch 2gn wont turn on after being charged in a ipod dock...it's been 3 weeks now and i've tried everything and noting has worked! Apple, you better expect paying for this because i am not wasting my money again!

my ipod touch 2gn wont turn on after being charged in a ipod dock...it's been 3 weeks now and i've tried everything and noting has worked! Apple, you better expect paying for this because i am not wasting my money again!

Have you tried a reset?
Stedman

I have two faults! 1, an error comes up in Ps CC 2014 "could not apply the saved panel configuration, restring to default and my tools have disappeared completely and anything ive tried I cannot get them back not even the drop down menu in 'window' helps

I have two faults! 1, an error comes up in Ps CC 2014 "could not apply the saved panel configuration, restring to default and my tools have disappeared completely and anything ive tried I cannot get them back not even the drop down menu in 'window' helps at all. And 2, Lr everytime I load it up it gives me the option to retry or switch to and it takes a while for me to even get anywhere with it I think it has something to do with the catalogs? I've been using these programs for a few years now on a Mac...no problem but when I use a PC when I'm away coz it's the (only) comp available these happen PC's are so useless! Please can anyone help??...

I can give a few suggestions on Photoshop CC 2014, but Lightroom is a separate forum and you should ask Lr questions there.
First close Photoshop.
Then start Photoshop by double-clicking on it's icon and very quickly after that, hold down the ctrl-alt-shift keys until you see the reset dialog. answer "Yes" to delete settings, and let Photoshop continue to load.
It's tricky to do and may take a few tries, but at least it should reset Photoshop CC 2014 to defaults.
Gene

Work Folders: An unexpected error occurred 0x80041293

Hi,
We are using Work Folders and it works for almost all. Since we had a lot of problems with the server complaining about file rights, we have replace the original server. But one user with W8.1 (of about 50) can't make the connection to the new server work,
he gets an error. When I remove the "force" option in the group policy so he can set it up manually, he get's this error:
There was a problem setting up Work Folders. Please try again. (Details: An unexpected error occured. (0x80041293)
When I change him back to the old server, it starts to work again. Environment: Both servers are 2012R2 and the clients are W8.1/W7 and as I wrote earlier, it works for all other clients. I haven't found anything on the www with that error code (am I first
with this problem?).
Br Linus Hellsing

Yes, I believe you are the first with this problem.
That error code (SYNC_E_METADATA_STORE_VERSION_MISMATCH) is an indicator that something is wrong with the synchronization database, likely on the file server and not on the client. The thing that is unusual is that the error indicates the entire database
could not be opened. Because there is one database per sync share, I would expect all users configured against this sync share to fail in this way, rather than just one user of ~50.
Can you check your server configuration, to identify if you have more than one Sync Share setup on this server? My thought is that there may be more than one SyncShare configured, which has a DB problem, and for some reason this is the only user being
routed to the problem sync share.
Additionally, check the eventlog on the server. You can see this by opening 'Event Viewer', and navigating to 'Applications and Services'-->'Microsoft'-->'Windows'-->'SyncShare'-->'Operational'. If there is an event that looks correlated
to this failure, post its details which may give further hints.
Thanks,
Jason Shay [MSFT]

Kerberos - client has TGT, but prompted for password when accessing share.

I'm getting ready to deploy Leopard to my client base and I'm doing final testing. I have a magic triangle/cylinder of destiny situation, using Active Directory and Open Directory running on 10.5.2.
With a 10.5.2 client bound to both directories, I can log in to the client machine with an AD account, however when I try to connect to a file share, I am prompted for name & password. I checked /System/Library/CoreServices/Kerberos, and I have a TGT.
I'm stumped as to why I'm being prompted when I have a TGT. Any ideas?

Go back to the basics. Time and DNS. Make sure all servers are using the same time server (OD box points to AD domain controller - use ntpq -p to confirm time sync). Make sure forward and reverse resolve works for all servers in the chain. If this all checks out, then look at your AFP service settings or temporarily launch SMB and see if it will issue a service ticket.
You are talking to two different machines but with a common auth point. The first process, getting the TGT is entirely devoted to communication with the AD domain. The KDC in AD agreed that you are who you claim to be and that you can be trusted, thus granting you access to domain resources. The next step is attempting to access a resource on a server that you believe to be part of the trust. In this case, an OS X Server running AFP (assumably). In this case, the OD system needs to be configured as a domain member of the AD environment and all services "Kerberized". This is an area in which Apple needs a little work under Leopard. Tiger was so easy. I've had better luck using dsconfigad's enablesso than with the GUI tools.
However, assuming that you performed all the usual steps, first review the contents of your edu.mit.kerberos file and make sure that Leopard did not rewrite the file and place the OD system in as the KDC. That is all wrong. Next, take a look at your principles by using klist -k. Is the realm information correct? And finally, review the settings in the afp configuration file. The realm information in that file is often messed up if you launch AFP before you have the server bound up properly.
My guess is that the OD box thinks it is the KDC and you will likely need to manually edit the edu.mit.kerberos file and force the file to be static (remove the third and fourth lines). This is common if you joined the AD domain and then promoted the server to OD Master.
Hope this helps

Shared VHDX on CSV... Error opening handle for initiator The request is not supported.

Hi. Im having an issue in my lab testing out the shared vhdx functionality of 2012 R2.
The hardware is as follows2x HP DL380G5 with 2xHP P800 Smart Array controllers 2x500GB SATA SSD 2x1TB SATA HDD. Ive used Starwind to create 2 Cluster Shared Volumes on which my shared VHDX files are.
The issue im having is that after the creation of shared vhdx files (3-4 hours) any failover change in the vm configuration will result in Error opening handle for initiator. Initiator: {460b2b45-2f5a-485f-b045-60b68b655895}. Hostname: HYPERV1. File: \SQL QUORUM.VHDX:SHAREDVIRTUALDISK.
Error: The request is not supported..
Ive set the ISCSI sync adapters to "dont allow cluster and client communication" and prevented it being registered in dns (nslookup only shows one ip) yet every shared vhdx has this issue.
Can anyone suggest if this is a hardware issue or software ? It is such a timesaver compared to multipath io and iscsi on the guests id like to get it working.

Ok I figured out how to fix this issue, After searching the code online I found a post about someone trying to use this feature and getting the same error code with the vhds on the iscsi disks of a consumer nas which didn't support kerberos authentication.
Even though I had the cluster setup so the iscsi sync network was set to "do not allow cluster communication" and not used for live migration it was still trying to use this network for the shared vhdx.
The cause was the network binding order which had the iscsi nic above the server one. After putting the 10.0.0.x server adapter on top and rebooting no more messages appeared in the shared vhdx event log section and failover of the guest
clusters worked.
Hope this helps anyone else who has this problem.

Exchange Management Shell prompt for connection credentials?

Some time ago I came across an article where a couple of modifications to the shortcut to the EMS would allow a connection to a specific server and then prompt for credentials for that connection.
Removing the -auto and replacing with -serverFQDN [servername] covers the 1st part, but I can't recall what allowed the prompt for credentials to the other machine.
I'm looking do do this from a Win7 machine, where I must login with one account but another account has Exchange permissions.
It's driving me nuts, because I had it working and lost the shortcut in a machine reload and can't recall what I had done.

Slightly modified, but nothing important was removed.
C:\Users\[loginid]>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ver sion 2.0 -noexit -command ". 'C:\Program Files\Microsoft\Exchange Server\V14\bin \RemoteExchange.ps1'; Connect-ExchangeServer -ServerFQDN [servername] -Credential (Get-Credential)"
 Welcome to the Exchange Management Shell!
<tip snipped>
cmdlet Get-Credential at command pipeline position 1 Supply values for the following parameters:
Credential
VERBOSE: Connecting to [servername]
[servername] Connecting to remote server failed with the following error message : Access is denied. For more informati on, see the about_Remote_Troubleshooting Help topic.
 + CategoryInfo
: OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [], PSRemotingTransportExc
 eption
 + FullyQualifiedErrorId : PSSessionOpenFailed Failed to connect to an Exchange server in the current site.
Enter the server FQDN where you want to connect.:
Doing a New-PSSessoin using the same credentials is successful.
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri
http://[servername]/PowerShell/ -Authentication Kerberos -Credential $UserCredential import-pssession $Session
cmdlet Get-Credential at command pipeline position 1 Supply values for the following parameters:
Credential
WARNING: Some imported command names include unapproved verbs which might make them less discoverable.
Use the Verbose parameter for more detail or type Get-Verb to see the list of approved verbs.
ModuleType Name
ExportedCommands
Script tmp_e9ed0738-3c62-458b-bdc8-7451...
PS C:\
Using CAC login, or domain/username/password produces the same results.

Reverse GR error:Account determination for entry GCOA...not possible

Hi!
If we encounter the error Account determination for entry GCOA PRD 0002 ___ ZRO1 not possible when reversing GR, does this have something to do with the number of available stocks of the materials?
In our other servers, the transaction key PRD is blank. but we ca reverse GRs.. but in our production server, PRD is also blank but we cannot reverse the GR. The error Account determination for entry GCOA PRD 0002 ___ ZRO1 not possible comes up.
What could be the reason for this?
Appreciate your help..thanks so much!
Regards,
Paula

Please specify below:
1. what's the price control for problem material? S or V? And what's the price unit?
Price control is V, price unit is PC
There is no change in PO price.. the price is 40.
2. what's the movement type for the material document posted? What's the quantity
in the material document?
mvt type in GR is 101.. PO qty is 3996 pc and GR qty is 3996 pc.
3. what's the accounting doucment posted during the goods movement. Please list all the lines
in FI document with transaction key information(BSX/WRX...)
89 - BSX
96- WRX
4. what's the current stock/stock value for the problem material, i.e. the stock/stock value before
posting the GR reversal?
current stock is 6,383.000 pc
GR reversal has not been done yet...
Thanks so much for your time..
Regards,
Paula

Error: Data element for InfoObject AUFNR 0PM_ORDER could not be created(QA)

Hi Experts,
I am trying to Transport a request from DEV to QA,which consists Transaction Infosources, afetr the inport the TR is failed with return code 8. and the error message in the log is as follows.....
Error when determining a number from object BI_TSDTEL and number 01
Object name can only contain characters from syntactical character set
Data element for InfoObject AUFNR 0PM_ORDER could not be created
Data element for InfoObject KOKRS 0CO_AREA could not be created
Data element for InfoObject KOKRS 0CO_AREA could not be created
Errors occurred during post-handling RS_AFTER_IMPORT for ISCS L
Data element for InfoObject TXTMD could not be created
Errors occurred during post-handling RS_AFTER_IMPORT for IOBJ L
please Could anyone give the Inputs to solve this , I'll be greatful to you.
Thanks & regards
SK

hello AJ,
Till now the problem is not solved , Please provide some inputs.
here I'm getting this problem for TXTMD, 0CO_AREA, 0PM_ORDER, 0DATE, 0PLANT, 0ORDER_CURR, 0LOC_CURRCY
Error when determining a number from object BI_TSDTEL and number 01
Object name can only contain characters from syntactical character set
Object name can only contain characters from syntactical character set
Data element for InfoObject KOKRS 0CO_AREA could not be created
Data element for InfoObject KOKRS 0CO_AREA could not be created
Transfer structure 0CO_OM_NTW_1_SB activated under the name 0CO_OM_NTW_1_SA
It is not necessary to copy dependent objects for transfer structure 0CO_OM_NTW_1_SA
Data element for InfoObject KOKRS 0CO_AREA could not be created
Activating Transfer Rules 0CO_OM_NTW_1_SA ...
23 Transfer Rule(s) of the transfer structure 0CO_OM_NTW_1_SA removed from control table
23 InfoObject(s) of the transfer structure 0CO_OM_NTW_1_SA removed from control table
Formulas have been saved
PLEASE PROVIDE SOME INPUTS.........
Message was edited by:
S K

Error : Maintenance dialog for ztable is incomplete or not defined

Hi Gurus
While maintaining the ztable through SM30 got the following error.
Maintenance dialog for ztable is incomplete or not defined
I have to add new enteries in the previously created ztable.
Please suggest
Manvir

Go to SE11, give the table name and click on change. Then Go to utilities--> Table
maintenance generator.
In the table maintenance generator screen, we should give Authorization Group,
Function Group name (Function Group name can be same as table name),
Maintenance type can be one step or two step, usually we will create with one
step. we should give maintenance screen number. After clicking on create button,
a table maintenance generator will be created.
To check it go to SM30 . In SM30, we find display, Maintain options.
We can view the table contents by choosing Display and we can create table
entries by choosing Maintain.

Work Folders client setup errors: No prompt for AD credentials & Lockscreen policies not applied.

Similar Messages

Maybe you are looking for