DGE Agent Error: "The externally generated group membership document could not be loaded. XML document must have a top level element." (4315821)

Data Governance Agent returns the below error when attempting to run:

"The externally generated group membership document could not be loaded.  XML document must have a top level element."

The Remote Agent runs code inside the "BWAgentLogReader.exe" application, which all DGE agents use, to obtain the Local Groups from the NetApp filer.  This is achieved by using a standard API called "NetLocalGroupEnum".  This API may fail due to numerous network related issue's, one of which is the required security negotiation settings of the "Workstation service" found under the "LanmanWorkstation Parameters".

Altering the "RequireSecureNegotiate" parameter to a value of "2" enables the optional use of a signed response from the target system.  Depending on the target, responses may, or may not be signed upon return causing a refusal from the host.

One Identity does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it.  For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support.

Modify or Create the Registry Key

1. Login to your Windows 2012 Server.
2. Open the Start Menu.
3. Search by typing: "regedit".
4. Open the registry by left clicking the "regedit" executable.
   • If prompted, click "Yes" to allow the Registry Editor to make changes to this computer.
5. From the Navigation Pane, expand these containers:
   • HKEY_LOCAL_MACHINE
   • SYSTEM
   • CurrentControlSet
   • Services
   • LanmanWorkstation
6. Open the "Parameters" container.
7. If the DWORD value named "RequireSecureNegotiate" exists:
   • Double (left) Click "RequireSecureNegotiate".
   • Under "Value data", in the text box, change or set the value to 2.
   • Click "OK".
8. If the DWORD value named "RequireSecureNegotiate" does NOT exist:
   • Right Click in the white space below the list of registry entries.
   • Click "New".
   • Click "DWORD (32-bit) Value".
   • Name the new DWORD Value: "RequireSecureNegotiate".
   • Press "Enter".
   • Double (left) Click the new DWORD value "RequireSecureNegotiate".
   • Under "Value data", in the text box, change or set the value to 2.
   • Under "Base", confirm or activate the radio button next to "Hexadecimal".
   • Click "OK".
9. Exit the Registry Editor.
   • Click "File" at the top left of the Registry Editor window.
   • Click "Exit" at the bottom of the File menu.

A restart of the server is required for the change to take effect.