This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DGE add DFS

I use DGE 7.1.1, last fix (to 7.1.1.18).

I installed agents to Windows file servers. Then I tried to add DFS to publish shared folders with friendly DFS names (with share name, no server name). After adding DFS root using Manager I opened list of folders (double click to share name in Maanged hosts). I receive errors:

Issue Text
An error occurred while attempting to retrieve information for the share '\\DCMAIN\DH'. System.ComponentModel.Win32Exception: Access is denied
An error occurred while attempting to retrieve information for the share '\\DCMAIN\DH'. Access was denied while attempting to perform the requested operation.

And when I try to access shares I receive errors:

Issue Text
System.ComponentModel.Win32Exception: Access is denied

In documentation there is information that I don't need to install agents on DFS root hosts.

When I access to shares using service account (whish run DGE service, Manager) I can list foldeers.

What can be the problem?

There is logs:

<event logger="Quest.Titan.Server.Util.Authorization.ServerCallManager" timestamp="1490967064831" level="ERROR" thread="28">
<message><![CDATA[Access to perform the operation 'Get Resource Security' on resource '\\DCMAIN\DH' was denied to the service account. ]]></message>
<exception><![CDATA[Quest.Titan.Common.Exceptions.SystemPlatform.ServiceAccountAccessDeniedException: Access to perform the operation 'Get Resource Security' on resource '\\DCMAIN\DH' was denied to the service account.
at Quest.Titan.Server.ServiceHosts.EnterpriseBrowsingHost.<>c__DisplayClass8.<GetResourceSecurity>b__6()
at Quest.Titan.Server.Util.Authorization.ServerCallManager.WebServiceCallAsUser[T](String dialogFeatureRequired, Func`1 function)]]></exception>
<locationInfo file="Unknown" line="0" function="WebServiceCallAsUser" />
</event>
<event logger="Quest.Titan.Server.Contracts.Faults.ExceptionFaultTranslator" timestamp="1490967064831" level="ERROR" thread="28">
<message><![CDATA[Access to perform the operation 'Get Resource Security' on resource '\\DCMAIN\DH' was denied to the service account. ]]></message>
<exception><![CDATA[Quest.Titan.Common.Exceptions.SystemPlatform.ServiceAccountAccessDeniedException: Access to perform the operation 'Get Resource Security' on resource '\\DCMAIN\DH' was denied to the service account.
at Quest.Titan.Server.ServiceHosts.EnterpriseBrowsingHost.<>c__DisplayClass8.<GetResourceSecurity>b__6()
at Quest.Titan.Server.Util.Authorization.ServerCallManager.WebServiceCallAsUser[T](String dialogFeatureRequired, Func`1 function)]]></exception>
<locationInfo file="Unknown" line="0" function="MapFaultFromException" />
</event>
<event logger="Quest.Titan.Server.ServiceHosts.ManagedHostsHost" timestamp="1490967075691" level="INFO" thread="106">
<message><![CDATA[IManagedHosts.GetDfsTargets: \\domain.name\dh\IT-Home True False]]></message>
</event>
<event logger="Quest.Titan.Server.Util.Authorization.ServerCallManager" timestamp="1490967075691" level="ERROR" thread="106">
<message><![CDATA[Access is denied]]></message>
<exception><![CDATA[System.ComponentModel.Win32Exception (0x80004005): Access is denied
at Quest.Titan.Common.Shared.SimpleCache`2.GetValue(TKey key)
at Quest.Titan.Server.Util.ResourceUsage.DfsPathInformation..ctor(String path)
at Quest.Titan.Server.Data.ManagementData.GetDfsTargets(String dfsPath, Boolean managed, Boolean valid)
at Quest.Titan.Server.ServiceHosts.ManagedHostsHost.<>c__DisplayClass9.<GetDfsTargets>b__8()
at Quest.Titan.Server.Util.Authorization.ServerCallManager.WebServiceCallAsUser[T](String dialogFeatureRequired, Func`1 function)]]></exception>
<locationInfo file="Unknown" line="0" function="WebServiceCallAsUser" />
</event>
<event logger="Quest.Titan.Server.Contracts.Faults.ExceptionFaultTranslator" timestamp="1490967075691" level="ERROR" thread="106">
<message><![CDATA[System.ComponentModel.Win32Exception (0x80004005): Access is denied
at Quest.Titan.Common.Shared.SimpleCache`2.GetValue(TKey key)
at Quest.Titan.Server.Util.ResourceUsage.DfsPathInformation..ctor(String path)
at Quest.Titan.Server.Data.ManagementData.GetDfsTargets(String dfsPath, Boolean managed, Boolean valid)
at Quest.Titan.Server.ServiceHosts.ManagedHostsHost.<>c__DisplayClass9.<GetDfsTargets>b__8()
at Quest.Titan.Server.Util.Authorization.ServerCallManager.WebServiceCallAsUser[T](String dialogFeatureRequired, Func`1 function)]]></message>
<locationInfo file="Unknown" line="0" function="MapFaultFromException" />
</event>

0 Matthew.Muise over 7 years ago

Best bet for something like this would be to create a support case. Please include DEBUG server logs in the case. Information on how to set DEBUG logs is here: support.quest.com/.../22
Cancel
Up 0 Down

Cancel
0 bpakhomov over 7 years ago

Thank you! I created a request. But always belive that community is a bit faster. Maybe someone solved same problem
Cancel
Up 0 Down

Cancel
0 VilounV over 7 years ago

Are you accessing the DFS via domain name, and not domain controller? We support only support domain based DFS, and not standalone. I saw that you wrote "dcmain". It should be your "domain".
Cancel
Up 0 Down

Cancel
0 bpakhomov over 7 years ago

DFS root is on domain controller. Share whish i tryed to access: \\domain.name\dh (\\domain.name\dh\IT-Home in logs)
dcmain - that is the name of domain controller. This server host DFS
So I think we can name this as domain based DFS.

Using explorer I can hage access to \\domain.name\dh\IT-Home and to \\DCMAIN\DH\IT-Home

One more thing. I open Manager using service account, DGE service also run using this account.
Cancel
Up 0 Down

Cancel
0 VilounV over 7 years ago
Make sure the Employee object for the service account you are using has the correct Data governance One Identity Manager Application roles.

Data Governance/Administrators

Data Governance/Access Managers

https://support.oneidentity.com/technical-documents/identity-manager-data-governance-edition/7.1.1/deployment-guide/5#TOPIC-677018

Also, you should always use \\domain.name\dh\IT-Home when using the Manager UI. Don't use the other way.

You can double check with your networking/admin team to see if it really is using domain-based namespace, and not a virtual IP Address (VIP).
Cancel
Up 0 Down

Cancel
0 bpakhomov over 7 years ago

I assigned service account Employee to all DGE roles (except Managed Resources and Operators).

We use Domain-based DFS. We have 2 namespaces. In Manager it looks like DOMAIN\DH. When I open a Folder browser I see shares and 3 folders with type "Target Share Path". When I try to open "Target Share Path" I receive error "The namespace server host for the Target Share Path must be managed before resource browsing."

Have anyone got nay other ideas?
Cancel
Up 0 Down

Cancel
0 Matthew.Muise over 7 years ago

You mentioned that you opened a support ticket for this. Has the issue been resolved? If not, could you message me the support case #? Thanks.
Cancel
Up 0 Down

Cancel
0 Matthew.Muise over 7 years ago

Never mind, I found the case#
Cancel
Up 0 Down

Cancel
0 bpakhomov over 7 years ago

We found that the issue happened because we forgot to add DFS namespace server as managed hosts.
Later we fount error thet we can't manager server remotely
After installing agents on DFS namespace servers and granting service account local administrator rights we solved this issue
Thank you!
Cancel
Up 0 Down

Cancel