UNC Failures

sadek76 · Post by **sadek76** » Wed Dec 29, 2004 12:06 pm

I'm running W2K server SP3 with Hostmon version 4.86. I have a UNC "Alert when resource is unavailable" test setup. The test fails, I receive "Logon failure: unknown user name or bad password". I have HM started as a service and in the Options section I have "Use account" selected. If I go into this section and click "Save" I receive the message that the username that I have in the box is logged on. If I change this option to "Local system account" the test fails with "Access denied". In a command prompt window if I run the following command: net use \\165.168.17.11\hostmon$ /user:bsna\_IT-NASMON * Which prompts me for the password, which I put in and receive "The command completed successfully". The username and password that I used in the manual command is what I have set up in the UNC test for Connect as. This test works fine on another machine only "when I don't start it as a service".

KS-Soft · Post by **KS-Soft** » Wed Dec 29, 2004 10:42 pm

As I understand "_IT-NASMON" account exists on "bsna" system but local system does not have this account? What if you create the same account (with the same password) on local system? Or probably better use domain user account...

Regards
Alex

sadek76 · Post by **sadek76** » Thu Dec 30, 2004 10:00 am

Correct "_IT-NASMON" is an account on the "bsna" domain and not local to the server being checked. I tried creating a local account "manager", changed the test to use this account, but it still failed. Why does it work when the application is not running as a service?
I also changed the application "Start>Service Use account" to use my own account and changed the UNC test to connect using my account. Now I receive "A duplicate name exists on the network" in the reply field.

KS-Soft · Post by **KS-Soft** » Thu Dec 30, 2004 2:26 pm

Correct "_IT-NASMON" is an account on the "bsna" domain and not local to the server being checked. I tried creating a local account "manager", changed the test to use this account, but it still failed. Why does it work when the application is not running as a service?

What account do you use when start HostMonitor as application?
If you want to monitor systems located in different domain, I would recommend to install Remote Monitoring Agent (RMA) on some system in that domain and use RMA to perform tests for HostMonitor.

I also changed the application "Start>Service Use account" to use my own account and changed the UNC test to connect using my account. Now I receive "A duplicate name exists on the network" in the reply field.

This error means 2 (or more) systems in the network has the same name. Can you check that?
Also, I would recommend to change account specified in the Service applet back to "local system" and provide admins account on Service page in the Options dialog (HostMonitor's Options dialog).

Regards
Alex

sadek76 · Post by **sadek76** » Thu Dec 30, 2004 5:16 pm

What account do you use when start HostMonitor as application?

I use "manager" account when I start the HostMonitor application

If you want to monitor systems located in different domain

These machines are in the same domain.

This error means 2 (or more) systems in the network has the same name. Can you check that?

No two systems have the same name in the network. Also these checks are being performed by IP address, not name.

Also, I would recommend to change account specified in the Service applet back to "local system" and provide admins account on Service page in the Options dialog (HostMonitor's Options dialog).

This was done, with no change.

Why does it work when the application is not running as a service?

KS-Soft · Post by **KS-Soft** » Fri Dec 31, 2004 3:11 pm

Why does it work when the application is not running as a service?

I don't know

I know how HostMonitor works because I have source codes, but I don't have source codes for Windows. Theoretically service and application that are started under same account should work in the same manner. And usually it does...

Could you try to create account with the same name/password (_IT-NASMON) on local system and start HostMonitor under this account? Or if you are using "manager" account to start HostMonitor, allow access to the resource for this user.

Regards
Alex

sadek76 · Post by **sadek76** » Mon Jan 03, 2005 3:29 pm

I tried this with both accounts and got the same results for each.

What command is the hostmon application using to make the unc connection?

I tried net use * \\165.168.17.11\hostmon$ /user:bsna\_it-nasmon * from the command prompt and it worked. Using the first * lets me map to my next available drive letter. I then went to that drive did a dir and found out that the admin had shared the entire C: drive instead of just a blank folder called hostmon$. I'm having the admin recreate the share the correct way and will let you know the results.

KS-Soft · Post by **KS-Soft** » Mon Jan 03, 2005 7:48 pm

HostMonitor uses WNetAddConnection2 function
http://msdn.microsoft.com/library/defau ... ction2.asp
I have not find any notes specific to service mode...

Regards
Alex

Marcus · Post by **Marcus** » Tue Jan 04, 2005 2:41 am

If you still get the "logon failure: unknown user name or bad password", then check the security log on the remote system. It will tell you with which account hostmonitor tries to log on to the system (which could be different from what you think it should be).

We monitor many servers on many different domains (and forrests) and have no problem. This is how we have setup HostMonitor:

- Installed HostMonitor as a service
- Configured the start-up account for the HostMonitor service to a monitoring account (hmmon)
- Configured the same start-up account (hmmon) on the options dialog.
- Configured the same start-up account (hmmon) on every server. This should be a local account for non domain controllers!

We then log on to the server running HostMonitor, using the start-up account (hmmon), stop the service, start HostMonitor as an application, make our modifications (and save them), stop HostMonitor and start HostMonitor as a service (do you stop the HostMonitor service before you make modifications?)

But first: Check the remote security log!

sadek76 · Post by **sadek76** » Tue Jan 04, 2005 12:08 pm

Checked the security log and it showed that Success Audit for the user "manager" and in a different test "Success Audit" for user "_IT-NASMON." But the hostmon application still showed that the test failed. And before you ask, "I don't have Reverse Alert box checked"

(do you stop the HostMonitor service before you make modifications?)

No I don't, I have 1130 tests on this server and have never did before.

I tried making changes using your procedure with stopping and starting the application and service, I even rebooted the server after saving the changes. I also had the admin at the remote site walk thru everything on the remote server with me(Server is in Dallas). We did find that the "manager" account didn't exist on one of the servers, but the _IT-NASMON account did. We created it, but now I'm receiving: "A duplicate name exists on the network" The remote server that I'm testing has 7 nic cards installed. The tests that I have setup are accessing the server by IP address. I have 6 other tests setup for this server and they are passing the hostmon UNC check. I've seen this before and found out that if I let the tests sit for a few days, they will eventually start passing...? I also had two different people verify that my parameters were the same between a failing test and a passing one.

If this is a feature, then this feature sucks!

KS-Soft · Post by **KS-Soft** » Tue Jan 04, 2005 1:02 pm

As I understand you have this problem with single system? What if you simply install RMA on that system?

Regards
Alex

sadek76 · Post by **sadek76** » Tue Jan 04, 2005 2:08 pm

As I understand you have this problem with single system?

No, I have two hostmon servers that check other servers. Both of my hostmon servers were failing tests to 4 servers.

I copied a working test (4 times), changed the IP's of each test to point to the servers that were failing the tests. And now they are passing!

Maybe I should have deleted the tests once I got the permissions on the servers corrected, then re-added the tests. And again, I didn't make the changes then restart the application or service. I did everything with the service running.

I haven't looked into using RMA yet, but I'll check it out.

Thanks for all of your help!

KS-Soft · Post by **KS-Soft** » Wed Jan 05, 2005 8:53 pm

I copied a working test (4 times), changed the IP's of each test to point to the servers that were failing the tests. And now they are passing!

H'm.. its strange. Why system accept connection after several attempts but does not accept 1st attempt? Timeout issue? In this case system should report error like "RPC server unavailable" or something like that. But you have received "Access denied" error...

No, I have two hostmon servers that check other servers. Both of my hostmon servers were failing tests to 4 servers.

All 4 servers located in the same remote site? In this case single RMA can help to monitor all servers for both HostMonitors

Thanks for all of your help!

I am afraid I was not really helpful..

I dream Windows developer from Microsoft visit our forum and help to explain various problems

Regards
Alex