Why doesn't my User Tracking show anything

This may have been asked at some point, but I cannot find anything related. I have added my Domain Controllers and the credentials used have Domain Admin access. But when I go to Device Tracker>User Tracking, there's no one there. Am I missing a step?

Find more posts tagged with

Accepted answers

All comments

donrobert5

First, you should have send this to the UDT forum.

[mention:485a7fb12896487fbbd0497381735151:23b05a61c3e5445190d9bfa00453bce4]

Try the steps below.

On the Orion server:
1st Connection Error Test...........

1. Start > run > type MMC where allowed.

2. Click on File and then choose Add Remove Snap in and choose Event Viewer

3. When the popup appears click the radial button next to "Another computer:". Here you can Browse your network or just type the AD server name in the place provided.

4. click the check mark next to "Connect as another user" then click the "Set User" button.

5. Fill in the credentials used by UDT to access AD.

NOTE: This test proves we can validate the event viewer and get the login events IDs 4768 and 4769. Without it being successful then UDT does not record this.

- If not, please refer to this article: https://support.solarwinds.com/SuccessCenter/s/article/Not-receiving-user-data-from-domain-controllers-and-validating-active-directory-in-UDT

If they do show up, then we may be able to successfully connect using Eventing6, but not receive data from it. If that's the case, then you can attempt to use Eventing5 or WMI.
Please try the following:

RDP into your Orion server, and open the following:
C:\Program Files (x86)\SolarWinds\Orion\UDT\
Run the UDTCompatiibilityChecker.exe

Click New, and enter in a name for the Test session. Choose Orion Node.
Enter in your Orion web console credentials (for example, Admin / password)
Select SERVERNAME from the list, and choose WMI.
Select Users from the test options list.
Click Finish to begin testing the device - this may take some time to complete.

Does any data show up under these?
- Eventing5
- Eventing6
- WMI

You can also save and send on the results of the test to UDT Support from the checker tool.

bennett.suzanne

Thank you for correcting my placement I thought it would be on the software I was using, not the module. I'll try and do better next time.

I was able to remotely connect to AD, so I moved on to your 2nd suggestion.

In my instance of Observability the Compatibility Checker is actually C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.UDT.Checker.UI.exe

When I ran it with the settings you mention, the only message it came back with was REL job for node 'N:504|Eventing6' didn't find any matching log entries. WMI says the same and Eventing5 says "returned an error: Error while reading log"

I ran that on both my AD servers and received the same message from both.

donrobert5

I would suggest for you to try the first instruction as that will verify if the service account you are using has access to to the said servers and can connect via RCP.

If it can, then proceed finding those Login Event IDs I mentioned. Because I'm almost certain that you are not getting the needed event IDs and the link I provided has the resolution how to correct that