-
Title
Error message "Remote procedure call failed" trying to log into Defender Desktop Login -
Description
When an Administrator or Local Administrator on the Exceptions List or all forms of tokens (yubikey, e-mail, and soft token (android)) user attempts to log into a Defender Desktop Login protected system they receive an error message "Remote procedure call failed". -
Cause
Due to “Remote Procedure Call” service not running. This is cause by one or both of the following network providers: ZenCredManager and LCredMgr. These are used to capture single-sign on information for Novell ZenWorks. ZenCredManager.dll and LCredMgr.dll seem to not be able to handle an event initiated by the Defender provider during login and causes lsass.exe (netlogon service) to crash, without the netlogon service running the computer restarts.
Horizon View is impacted also by these network providers: (wsauth,vmhgfs)
-
Resolution
1. Check the string key "ProviderOrder" located in the following registry path:
HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order(the default value on a windows 7 computer is string "RDPNP,LanmanWorkstation,webclient")
- Any other network provider listed besides the default above can be by passed in Defender using the following steps:
2. Add the string key "Blocked Network Providers" to the following registry path:HKLM\SOFTWARE\Policies\PassGo Technologies\Defender\Defender GINA- The value for the string key will include the names of network providers that need to be blocked, multiple network provider names can be separated by commas for example:For Novell ZenWorks, network providers include: ZenCredManager and LCredMgr.Blocked Network Providers=ZenCredManager,LCredMgrFor Horizon View network providers include: wsauth and vmhgfsBlocked Network Providers=wsauth,vmhgfs- The last step is to reboot the machine and test login