NPM 10.7 - Error while trying to retrieve the authorization groups

Changed title and group based on new information.

When we upgraded from NPM 10.6 to NPM 10.7 and SAM v6.0 to SAM v6.1 we are still seeing the following error in OrionWeb.log:

The following error message is appearing every 5 minutes in OrionWeb.log:

2014-03-26 11:13:02,819 [1] ERROR SolarWinds.Orion.Web.AuthorizationManager - Get Auth Groups of admin.solarwinds in XXXXX-PROD. System.DirectoryServices.AccountManagement.PrincipalOperationException: While trying to retrieve the authorization groups, an error (5) occurred.

at System.DirectoryServices.AccountManagement.AuthZSet..ctor(Byte[] userSid, NetCred credentials, ContextOptions contextOptions, String flatUserAuthority, StoreCtx userStoreCtx, Object userCtxBase)

at System.DirectoryServices.AccountManagement.ADStoreCtx.GetGroupsMemberOfAZ(Principal p)

at System.DirectoryServices.AccountManagement.UserPrincipal.GetAuthorizationGroupsHelper()

at SolarWinds.Orion.Web.AuthorizationManager.WindowsAuthorizationManager.GetPrincipalGroups(WindowsIdentity identity, String identName, PrincipalContext context, String domainName, Boolean& faulted)

Find more posts tagged with

sam

network_monitoring

solarwinds

network_management

npm

Accepted answers

FormerMember

Our tier 3 AD team corrected some AD issues last week and I do not see error in event log now so whatever they fixed appears to have resolved issue.

All comments

aLTeReGo

On the surface it appears there is a problem obtaining group membership. I would recommend looking at the Windows users and groups defined in Orion and determine if any of these no longer exist in Active Directory. I would also look at the groups in Active Directory and see if any group members appear only a a SID (broken/disassociated objects) that should be removed. If everything appears to be in order I suggest opening a case with support so we can troubleshoot this issue further.

FormerMember

Based on more tests and analysis of other systems:

(1)It appears this error is related to NPM 10.7 web portal, and only indirectly related to SAM 6.1 HTTP Form Login monitors not WMI monitors.

(2)It appears NPM 10.7 changed the web portal and how it interacts with AD.

(3)Only NPM 10.7 systems are generating this error.

(4)I have not found any NPM 10.3 systems that are recording this error.

(5)The last time we opened a case for this error when we were testing NPM 10.6, we were told SolarWinds development advised that Error 5 means access denied. And that this means that user (IIS) does not have the required permission to query groups. Check what user is running the query (it's probably NT AUTHORITY\NETWORK SERVICE) and if it has access to all AD objects it wants.

(6)If this is true then someone in authority needs to document why AD administrators should allow NT AUTHORITY\NETWORK SERVICE needs access AD objects and which AD objects NT AUTHORITY\NETWORK SERVICE needs access to.

FormerMember

Our tier 3 AD team corrected some AD issues last week and I do not see error in event log now so whatever they fixed appears to have resolved issue.