Password Manager SPE Troubleshooting Guide (147450)

Actions to perform on the Password manager Server:

1. Enable verbose logging on the Password Manager Admin site. This will log all Password Manager activity.
2. Enable IIS logging in IIS Manager. This will log all IIS activity to the IIS server where Password Manager is installed.
3. Enable Wireshark (or equivelant) on the server.
   • Although a third-party tool, this may provide a clear indication as to where any latency is occurring
   • This should be investigated with the customer’s networking team
   • A general view should show latency between IP addresses, DNS names, etc…
4. If Wireshark trace indicates that WPAD is enabled, this can cause slowness due to “Proxy auto-discovery” feature being enabled in IE
   • See WPAD protocol.
5. If using a Proxy, remove this temporarily as part of the troubleshooting
6. If using a Network Load Balancer, remove this temporarily as part of the troubleshooting (if possible)

Actions to perform on the Client (running SPE)

1. Confirm if any proxy settings if it’s being used is not on the PC
   • Can use basic GPO troubleshooting (rsop, gpresult) to confirm this.
2. Enable Wireshark on the PC
   • Although a third-party tool, this may provide a clear indication as to where any latency is occurring
   • This should be investigated with the customer’s networking team
   • A general view should show latency between IP addresses, DNS names, etc…
3. Enable SPE logging on PC
   • Logging will be captured for activity from the SPE on the client to the Password Manager Admin site
   • To enable SPE logging click here.
4. If using a NLB (Network Load Balancer), you can add a host file entry on the PC for the Password manager server (bypassing the NLB)

Testing

1. Perform the test from the PC via the SPE component
2. Perform the same test directly from IE from the PC
3. Restart the PC, Perform the same test directly from IE from the PC, but using the URL from the SPE log.
   • The URL is different in the SPE because Password Manager has to perform actions on the logon DC for the workstation.
4. Run IE in system mode. (instructions via this link)
5. Run IE using psexec with IE logging on the PC. This requires pressing F12 developer tools

You may notice the delay in the QPM_SPE log file…

1. PID = 1124, TID = 1336, date: 09.12.2014, time: {16:19:10:961} (UTC -4:0): Navigate( http://win-6uf1ij9psi7.2008r2.com/QPMUser/EntryPoint/?ActionName=Register&IdentificationDomain=%32%30%30%38%72%32%2e%63%6f%6d&IdentificationAccount=&DCName=%57%49%4e%2d%36%55%46%31%49%4a%39%50%53%49%37%2e%32%30%30%38%72%32%2e%63%6f%6d&AcceptLanguage=en-us&CurrentLanguage=en-us&Application=GINA ) passed
2. PID = 1124, TID = 1336, date: 09.12.2014, time: {16:19:10:961} (UTC -4:0): CHtmlStrippedDlg::OnInitDialog() Out : ret (BOOL) = 1
3. PID = 1124, TID = 1336, date: 09.12.2014, time: {16:19:22:133} (UTC -4:0): CHtmlStrippedDlg::OnNavigateComplete(http://win-6uf1ij9psi7.2008r2.com/QPMUser/) immediate ret

You can see there is a 12 second delay in this example.

1. Basically what is happening is SPE attempting to navigate to the Web Page and then return the contents back to the client.
   • SPE uses IE component to display content of the web page.
   • Navigate basically initiates navigation of IE component to the web page.
   • OnNavigateComplete is a callback which is called when IE component fully loaded the content.
2. How the URL appears in the SPE...
   http://win-6uf1ij9psi7.2008r2.com/QPMUser/EntryPoint/?ActionName=Register&IdentificationDomain=%32%30%30%38%72%32%2e%63%6f%6d&IdentificationAccount=&DCName=%57%49%4e%2d%36%55%46%31%49%4a%39%50%53%49%37%2e%32%30%30%38%72%32%2e%63%6f%6d&AcceptLanguage=en-us&CurrentLanguage=en-us&Application=GINA
3. Broken down it is this..

• http://win-6uf1ij9psi7.2008r2.com/QPMUser/EntryPoint/?
• ActionName=Register
• IdentificationDomain=%32%30%30%38%72%32%2e%63%6f%6d
  • This actually resolves to: IdentificationDomain=2008r2%2ecom
• IdentificationAccount=
• DCName=%57%49%4e%2d%36%55%46%31%49%4a%39%50%53%49%37%2e%32%30%30%38%72%32%2e%63%6f%6d
  • This actually resolves to: DCName=WIN-6UF1IJ9PSI7%2e2008r2%2ecom
• AcceptLanguage=en-us
• CurrentLanguage=en-us
• Application=GINA