domain account login issue to member server of domain

[Anon Anon]

1. Env
1) AD with domain jp.com
- Windows 2008 R2 Enterprise sp1
- CA ControlMinder 12.8

2) Member server of Domain jp.com
- Windows 2008 R2 Enterprise sp1
- CA ControlMinder 12.8

3) Client PC
- Windows 7

 

2. test case
1) Client PC Login to the member server as domain account osf remote desktop users group using Remote Desktop
2) Got the error as follows
- "Login failure: user account restriction. Possible reasons are blank passwords not allowed, logon hour restrictions, or a policy restriction has been enforced"

[Adam Roll]

jpjung.1 Good morning. Want to make sure understanding the context of your issue. Is this SAM related utilizing Proxy server? Is this issue that after deploying the 12.8 Agent on the Windows member server you are no longer able to login with a domain account? If the latter is login successful once the agent is shutdown? What logs if any are you able to get from the PIM agent when a login attempt is made/native event system logs?

[Anon Anon]

this issue is the latter. Login successful if stopped the agent on the AD Server.

when started the agent on the AD and tried to login to member server, there is no log on both pim agent log and system event log  on the member server.

[Adam Roll]

The behavior as noted in additional replies is extremely unusual for an default agent deployment. Are there any post installation configurations you performed i.e. rule modifications? Are you already working with support on this item in which configurations have been uploaded?

 

To better evaluate:

 

Turn on tracing on endpoint

Attempt login

Turn off tracing on endpoint

 

This will expose if the interaction is taking place at the agent and what the response would be. I'm a bit perplexed that the seaudit log is showing no entry as by default a Login action (Permit or Deny) should be getting logged. Further review of the trace and endpoint configuration would be needed to pinpoint the issue.

 

I'll touch base against after the holiday see if made any headway.

[Wael AbdelWahab]

Hello jpjung.1

what is the policies applied on the TCP or LOGINAPPL in the ControlMinder environment ..

out-of-the-box rules does not block any access and the _default rule for everything is permit ...

if stopping the agent solve the issue , so it must be some rule that prevent RDP.

 

thanks

[Anon Anon]

No, not any policies on tcp, loginappl, terminal.

 

thanks,

[Wael AbdelWahab]

well this does not happened by usual installation of the CA ControlMinder ,,, the _default in all class action is permit...

try to remove all policies you have applied in order to filter what drive the endpoint to act like that

[Lluis Domenech]

jpjung.1, is your question answered? If yes, can you please mark it as answered?