Voltar
-
Título
Error: "No computer name verification will be required." when Testing Windows system -
Descrição
From 2.5.916 on the "Windows" or "Windows Desktop" platforms, when Checking or Resetting account passwords, TPAM will compare the value set in System | Details | Information tab | Computer Name, against the actual NETBIOS name returned from the target system using RPC / WMIIf TPAM is unable to get the current NETBIOS name from the target system (because RPC is available, firewalled etc) TPAM will revert to pre- 2.5.916 behavior and not validate these match.The logs may show the following, when the NETBIOS name cannot be validated:The results from the test of system windows7.yourdomain.com follow (all times are Server Time):[02/01/2017 16:15:12] Gathering the information necessary to perform a check of windows7.yourdomain.com...[02/01/2017 16:15:12] Checking the Windows System windows7.yourdomain.com(192.168.0.6) using win...[02/01/2017 16:15:12] Using NETBIOSNAME[02/01/2017 16:15:12] Starting GetComputerName2[02/01/2017 16:15:12] Connecting to 192.168.0.6 as yourdomain.com\administrator...[02/01/2017 16:15:46] WMI ConnectServer error: OLE exception from "SWbemLocator":The RPC server is unavailable.Win32::OLE(0.1709) error 0x800706ba: "The RPC server is unavailable"in METHOD/PROPERTYGET "ConnectServer"[02/01/2017 16:15:46] No computer name verification will be required.[02/01/2017 16:15:46] Functional account yourdomain.com\administrator[02/01/2017 16:16:10] The test of system [windows7.yourdomain.com] was successful.[02/01/2017 16:16:10] ComputerName: NETBIOSNAME[02/01/2017 16:16:11] Processed the system check on windows7.yourdomain.com in 61.0751953 secondsResults from the password check follow (all times are Server Time):[02/01/2017 16:09:07] Gathering the check details for localuser on windows7.yourdomain.com...[02/01/2017 16:09:07] Checking the password for localuser on windows7.yourdomain.com(Windows System) using win...[02/01/2017 16:09:40] No computer name verification will be required.[02/01/2017 16:09:40] Checking account object, connecting as yourdomain.com\administrator...[02/01/2017 16:10:04] The password for localuser on windows7.yourdomain.com was checked successfully.[02/01/2017 16:10:05] Processed the password check for localuser on windows7.yourdomain.com in 60.9736328 seconds
Results from the password reset follow (all times are Server Time):[02/01/2017 16:13:28] Gathering the change details for localuser on windows7.yourdomain.com...[02/01/2017 16:14:01] No computer name verification will be required.[02/01/2017 16:14:01] Setting the new (Windows) password for localuser on windows7.yourdomain.com (192.168.0.6) using yourdomain.com\administrator and win...[02/01/2017 16:14:14] Checking managed account before changing password. Success[02/01/2017 16:14:38] The password for localuser on windows7.yourdomain.com was successfully changed.[02/01/2017 16:14:40] Processed the password change for localuser on windows7.yourdomain.com in 74.2197266 seconds -
Resolução
RESOLUTION 1
This issue can be ignored. TPAM will revert to legacy behaviour, and not validate the NETBIOS names match
RESOLUTION 2
If you want TPAM to validate the NETBIOS name, ensure the firewall accepts WMI / RPC traffic from the DPA / TPAM.
WMI / RPC uses TCP port 135 to initiate the communication to the target. The subsequent conversation then continues on a random negotiated port.On Windows 2003/XP this would be in the range 1025 - 5000 or on Windows 7/Windows 2008 and above : 49152 - 65535.
To limit the ports that can be used by WMI/DCOM refer to the following Microsoft KB, How to configure RPC dynamic port allocation to work with firewalls.
Or the following Microsoft MSDN document: Setting Up a Fixed Port for WMI.