Active Directory Monitoring Issue

I am using the AD template. All components in the template are being monitored except for one, where it lists the state as "unknown". The component is "LDAP Version Script". The error that I receive is "Unexpected error occurred. Unable to impersonate user "domain\user". This user must be a valid user on the Orion Server/Polling Engine.

What I find strange is that I use this account for all the components.

What I have done... I used this article and followed it to a "T", but it did not fix this issue. Any help would be appreciated!

Shaun

Find more posts tagged with

template

unexpected_error_occurred

active_directory

Accepted answers

All comments

breener96

I forgot to mention that I am using version APM 2.5.

FormerMember

I am having the same issue occur in my monitoring. Same set up as above. In my case the Orion server is on a different domain than then AD server being monitored. The service account I am using is a domain admin.

Will the orion server be able to successfully impersonate a user on a different domain?

josh.clark

That component monitor is a different type than the other ones in the template. It is a Windows Script Monitor. The others are WMI Service Monitors or WMI Performance Counters.

The Windows Script Monitor needs to execute the script locally on the Orion Server. This means the credential used needs to be for a valid user on the Orion Server. The error you are getting seems to imply that user ("domain\user") isn't a valid user on your Orion Server. What's a valid user? Try logging into that box using that user. If that works then the script should work. If it doesn't, the script won't be able to work either.

josh.clark

Will the orion server be able to successfully impersonate a user on a different domain?

Probably not. If you can't log in to that box as the domain admin from the other domain, then APM won't be able to impersonate the user. You could try creating a local user with the same name and password. So if your remote account is remotedomain\testuser and has a password of abc123, then create a local account on the Orion Server with the username testuser and a password of abc123. Specify this user for the script.

This might work since NTLM can work cross domains, but I haven't tried it. Give it a try and let us know how it works.

fletcorion

I'm going through the same issue with Orion. We also have multiple domains. Orion sits in a secure DMZ and monitors activities on two other separate domains.

We are going to try to setup a trust between the domains we are monitoring and the DMZ domain using AD Domains and Trusts. Will let you know if that works.