AD failing after validating all permissions and communications

icar planells over 1 year ago

I have integrated an AD asset to manage accounts.

When I read users or groups it works perfectly

1. I can discover accounts in the AD

2. I can test the asset successfully

3. I can test connection sucessfully

4. I can check the functional account successfully

5. I can sync the AD with no errors

but when I try to change another password fail with the following message:
Debug ChangePassword failed. Access to the resource was denied. (PrincipalOperationException) HResult: 0x80131501

(the service-functional account is domain admin of the domain)

We have followed step by step that the follwoing article says:

https://support.oneidentity.com/es-es/one-identity-safeguard-for-privileged-passwords/kb/4263587/how-to-delegate-permissions-in-active-directory-for-a-safeguard-service-account-4263587?kblang=en-US

Some help please?

0 Tawfiq.Ahmad over 1 year ago

Hi,

You can try to troubleshoot this by specifying a single Domain controller under the (AD Asset > Connection tab > Domain Controllers field) so that SPP will only talk to one DC for troubleshooting this issue.

Save the change and reproduce the issue \ perform the change password on the other AD account

If it fails again, check the AD event logs on that specific DC to see why it refused to allow SPP to change that other AD account password.

Thanks!
Cancel
Up 0 Down

Reply

Verify Answer

Cancel
0 nathan pierce over 1 year ago

having this exact same issue - was there ever a resolution to this?
Cancel
Up 0 Down

Reply

Verify Answer

Cancel
0 Tawfiq.Ahmad over 1 year ago in reply to nathan pierce

Please check if any firewalls between SPP and the Active Directory is blocking the connectivity from Safeguard to AD

Please check the ports required to be open for Safeguard in the Admin guide below:

https://support.oneidentity.com/technical-documents/one-identity-safeguard-for-privileged-passwords/7.0.3.1%20lts/administration-guide/139#TOPIC-2048630

Thanks!
Cancel
Up 0 Down

Reply

Verify Answer

Cancel