Agenex

SBS 2011 Remote Web Workplace "Login attempt failed" bug

admin — Tue, 19 Mar 2013 03:04:17 +0000

A lot of trouble for a little fix.

Last week on Thursday I got a call from a client of ours that the Windows Small Business Server 2011 Remote Web Access (RWA) was no longer allowing the clients the ability to remote into machines located on the network. If you’ve never used RWA before, here’s a brief description.

Remote Web Access, or RWA for short, is a combination of several technologies and a bit of custom work by MS to provide a single web accessible interface into services provided by SBS 2011. This includes the ability for a user to access Outlook Web Access (OWA), the internal company portal provided by SharePoint (http://companyweb), shared folders available on the server, and Remote Desktop access (using RDP) into machines to which you have been granted access. Here’s what is looks like:

The issue that the user called about was regarding no longer being able to remote into networked PCs to which they had access. Its wasn’t just one PC, it was all of them. I told him I would take a look and see what was going on. Very quickly I learned that the issue was not directed at one particular user, it occurred even for the admin account which had access to all PCs. The behavior the existed was the following:

1. A user logs into the RWA home page successfully.

2. The user clicks the connect button for the PC to which they want access.

3. A login prompt appears for credentials.

4. After entering the credentials correctly, the login window would appear again, but with the message, “Login attempt failed.”

So, I checked the usual suspects on the server looking for error, like the event viewer. Unfortunately, I didn’t really find anything of any real user there. So I headed out to the interwebs, first using Google to look for relevant information on this issue. Most of the articles or posts that I cam across referenced either a certificate problem with the Default Website (where the RPC is hosted for remote login), or the authentication methods used to login. I opted to try the certification method first. My first inclination was to look for something in the SBS admin console for where I could configure the certificate. However, the only options I got were to renew the existing certificate, or replace it with an existing one. Given I setup the first certificate, I figured it would be easy to simply rekey the certificate and add it back in. After doing this, I did a quick iisreset to ensure all settings had taken effect, and then logged into RWA and tried to connect to a PC. And what do you know, IT WORKED!

But here’s where the story gets a bit stranger. On Monday of the following week, the same individual reached out to me via text message:

“Remote Access didn’t work over the weekend. What is going on?”

I didn’t read much into the text message, but was curious as to why the behavior reverted back. I hopped back on to see that indeed it was not working, and went ahead and tried to apply the same fix used the previous week. The only difference was that this time the fix did not work. I was perplexed. So, back to the Googles I head, and used a different search phrase this time – “sbs 2011 RWA the login attempt failed”. Its really amazing how a change of a single word in a search can yield totally different results. This search gave me the fruit I was looking for by a guy named Andrew Stock (http://tsbraindump.blogspot.com)

http://tsbraindump.blogspot.com/2012/02/sbs-2011-remote-web-workplace-login.html

So, after reading halfway through the article, the light bulb went off. A few weeks back I was troubleshooting an issue with Outlook Anywhere, and had to make some changes via the Exchange Management Shell to correct the issue. Apparently this had the unintended side effect of breaking RWA remote access. So ran the command as listed in the post;

Get-OutlookAnywhere | Set-OutlookAnywhere –IISAuthenticationMethods: Basic, ntlm

I waited about 5 minutes before trying to login (I actually started this blog post in the hopes not only it would fix it, but then I would have something to share), and it worked. Now the true test will be tomorrow when the same user try to log in. I’m hoping not to see another text!

-The Agenex Team

Snom Release Candidate 8.4.31 Available

admin — Fri, 11 Mar 2011 07:06:49 +0000

Snom, a developer and manufacturer of Voice-over-IP (VoIP) telephones based on open standard for enterprise communications, has just announced the availability of firmware Release Candidate 8.4.31. The notification from Snom reads as follows:

Users running PBXnSIP or SnomOne can autoupdate their phones, by downloading the appropriate firmware for your phones, and entering the URL in the PHP configuration of the PBX. If you have questions about or need assistance updating you Snom phone firmware, please feel free to give us a call! (219) 728-4206.

PBXnSIP Service Procedure

rmoeller — Thu, 14 Oct 2010 05:55:04 +0000

Issue: After some strange problems with the PBXnSIP service installed on our client’s Windows Small Business Service server, I decided to take action. On a couple occasions we’ve had to restart the service during the day because the phone system froze or the phones went down for some as-yet unexplained reason. Solution: As a result, I decided to set up a couple scheduled tasks to perform a restart of the service at an early morning hour. So far the daily restart seems to be effective. Since it was implemented I’ve not heard any complaints about strange phone outages. Ongoing issue: (18 Oct) The scheduled service restart happened successfully on time in the early hours, but I got word in the middle of the workday that the phones had gone down again. A quick service restart got the phones back up in short order, but it doesn’t appear the daily restart is having the desired effect. This issue is ongoing. One possible solution has to do with setting the keepalive time (found in Trunks > Broadvox > Keepalive Time). The official wiki suggests a time of 20 seconds. I have set this to 20 in the off chance that it has some effect; I’m not confident that it will since it seems to be recommended when dealing with a shaky ISP, and ours isn’t. But perhaps it will work.

HP LaserJet 1020 in Windows 7

rmoeller — Fri, 24 Sep 2010 21:31:42 +0000

Issue: Windows 7 and the driver for the HP LaserJet 1020 don’t seem to want to play nicely together.

Solution: If the printer no longer wants to work, here are the steps involved in getting it running again.

Open the Registry Editor (regedit from the run prompt) and delete the entry for the printer (located at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Drivers\Version-3\HP LaserJet 1020)
Restart the computer and sign in as Administrator
Open Devices and Printers from the Start menu
Add a new printer and follow the prompts to install the HP LaserJet 1020 from scratch

Don’t try to use the driver installer that came with the files downloaded from the site. Windows does a fine job of installing it. Set up the printer as necessary (default?) and sign out the Admin.

At this point, have the user sign back in and make sure the printer works correctly.

TimeTrak Permissions Problem

rmoeller — Thu, 23 Sep 2010 04:30:56 +0000

Issue: We recently installed a time-logging application called TimeTrak at one of our client locations. For the most part installations went smoothly and users were able to get right in and use both TimeTrak and the sister application, ClocTrak. On one or two machines, however, users were not able to run the applications without administrator privileges. Since we can’t hand out the administrator password to everyone in the company, we needed to figure out what the problem was.

Solution: In the past I’ve set up RunAs script files written in VBScript, and did so this time, thinking that might solve the problem, but even these weren’t working. I had also assigned Full Control privileges on the application directory to the computer’s user, but still nothing wanted to run.

The problem was that I assigned these privileges to the subdirectory of the application in which the executable was installed, not the parent folder. So instead of assigning the right privileges to C:\TimeTrak 10, I had assigned them to C:\TimeTrak 10\Client. Once I made the change, both TimeTrak and ClocTrak started right up without difficulty.

PBXnSIP Configuration Login Page Can’t Be Reached

rmoeller — Wed, 22 Sep 2010 01:45:57 +0000

Issue: We had some strange behavior in our PBXnSIP system at FirstCare recently. Although phone calls were still coming in, which indicated the PBX was still partially working, users couldn’t access the configuration page for the system.

Solution: After ensuring everyone was off the office phones, I restarted the service. Once complete, the web page was accessible once again.

PBXnSIP Configuration Error – Direct dialing not working

rmoeller — Sat, 18 Sep 2010 04:35:11 +0000

Issue: We recently installed and configured a VoIP PBXnSIP system for a local client. Once complete, the system allowed:

outside callers to reach a main number; once connected, a hunt group was activated which rang four phones at once
internal callers to contact extensions directly

However, outside callers were not able to dial directly to desk numbers. If a caller dialed a specific representative’s desk number instead of the main line number, the same hunt group mentioned above was activated, causing all four phones to ring at the same time. We had to figure out how to allow direct dials to go to the correct representative.

Solution: The answer was contained in the configuration settings of the trunk. In the Send calls to extension field towards the bottom of the page, we had no value listed. Our research indicates that different carriers handle calls differently, so this answer may vary from provider to provider. Below are what we know different carriers require for direct dialing to work:

CallCentric: No value needed
Broadvox: A regular expression is required. Enter the following: !(.*)!\1!t!

Once entered and saved, direct dial calls should operate as expected.

MSCRM Install Error – Domain User account SPN for the Microsoft Dynamics CRM ASP.NET Application Pool account.

rmoeller — Fri, 04 Jun 2010 02:38:52 +0000

Issue: During a recent install of Dynamics CRM 4.0 on a Win2k8 64-bit server, I ran across the following error from the CRM Environment Diagnostics Wizard: Domain User account SPN for the Microsoft Dynamics CRM ASP.NET Application Pool account. Our trusty friend Google revealed this is a very common problem when running MSCRM as a service account instead of a built-in service using NETWORK SERVICE. While this error is really just a warning and you can continue the install, I advise applying the fix to remove the warning. I found the following article to be most useful when solving this particular problem: http://billoncrmtech.blogspot.com/2008/08/now-i-am-master-tips-for-running-\crm-40.html I have posted the procedure below in case the link breaks: Solution: Using Windows Support Tools, setup the SPNs for the machine and service account (Important: needs to be done first)�Note: Don’t forget the PORT Note: Don’t forget to do both the FQDN and the NetBios namesetspn –A HTTP/servername:5555 domain/serviceusername setspn –A HTTP/servername.company.com:5555 domain/serviceusername Trust for Delegation enabled in AD for the Service Account AND CRM Machine Note: This option is only available after you add the SPN for the both the NetBios name and FQDN) in step #1 Verify / add the service account to the CRM installation’s PrivUserGroup Note: This step must be done after installation. There is a known issue where setup will remove the user used for installation (the “setup user”) and if this user is the same as the service account user, it will be missing. The service account needs to be added to the local machines IIS_WPG group Restart the CRM server. Also depending on your domain’s replication settings, some of these changes may take a few minutes to propagate. Happy installing!

CRM Install on Win2k8 – You must have Administrator privileges on this system to run this Setup Error

rmoeller — Wed, 02 Jun 2010 21:53:01 +0000