Lieberman Software Support Forums - Server-to-Server Password Synchronizer Knowledgebase http://forum.liebsoft.com/ en Thu, 09 Sep 2010 07:28:21 GMT vBulletin 60 http://forum.liebsoft.com/images/misc/rss.png Lieberman Software Support Forums - Server-to-Server Password Synchronizer Knowledgebase http://forum.liebsoft.com/ No Synchronization is Occuring http://forum.liebsoft.com/server-server-password-synchronizer-knowledgebase/53-no-synchronization-occuring.html Wed, 23 Jan 2008 16:12:27 GMT *Synchronization Does not Occur and No Activity is Displayed* *Rev:* 2.0 *Date:* 03/04/2009 *Problem* When you start synchronization in... Synchronization Does not Occur and No Activity is Displayed

Rev: 2.0
Date: 03/04/2009

Problem

When you start synchronization in Server to Server Password Synchronizer version 4.x, it does not appear to do anything. You see no logging information, no service activity, nothing.

Cause

You are terminal serviced into your system running the Server to Server Password Synchronizer version 4.x console.

This is a limit of Server to Server Password Synchronizer version 4.x and its agents. When a terminal services session is activated, the scheduling service and/or agent will "pause". As soon as the terminal services session is closed, the scheduling service and/or agent will resume synchronization.

Resolution

This was first resolved in Server to Server Password Synchronizer version 5.01. To solve this issue permanently, please upgrade to the latest version.

If you are unable to upgrade at this time, use an alternative method to remotely access your system such as your favorite version of VNC, net meeting, or similar technology. You may also interactively logon to the system without worry.

Ultimately be aware, if there is an active terminal services session on the system then synchronization will pause on that system when using Server to Server Password Synchronizer version 4.x but will resume when all terminal service sessions to the system are closed.

Applies To:

Server to Server Password Synchronizer (SSPS,S2S) ]]> Server-to-Server Password Synchronizer Knowledgebase Chris http://forum.liebsoft.com/server-server-password-synchronizer-knowledgebase/53-no-synchronization-occuring.html Syskey Found on Server http://forum.liebsoft.com/server-server-password-synchronizer-knowledgebase/52-syskey-found-server.html Wed, 23 Jan 2008 16:03:06 GMT *Syskey Error When Attempting to Synchronize* *Rev:* 1.2 *Date: *01/23/2008 *Problem* When you attempt to synchronize passwords, you note... Syskey Error When Attempting to Synchronize

Rev: 1.2
Date: 01/23/2008

Problem

When you attempt to synchronize passwords, you note errors similar to the following:

Quote:
Syskey Found on Server:\\SERVERX - Sync Inhibited
Error: Syskey found on \\SERVERX server in SERVERX target - Must install Agent on this system
Cause

There are two possible causes:
  • Syskey encryption is enabled on the target server and the Server to Server Password Synchronizer agent is not installed on the target server.
  • Syskey encryption is enabled on the target system, the agent is installed, but the incorrect target type is chosen in the Server to Server Password Synchronizer console.

Syskey encryption was first introduced in Windows NT4 Service pack 3 and among other things, provides encryption to the hashes stored in the system's local SAM. In NT4, when SP3 or later was installed, you could choose to turn on Syskey encryption or not. From Windows 2000 and later, Syskey is turned on and cannot be turned off though you can set various Syskey options by typing "Syskey" at your system's run menu. The SSPS agent is required locally on systems where Syskey is enabled in order to safely obtain the password information required for synchronization.

Resolution

In the case where you receive the above error and you have a system where Syskey encryption is enabled, simply install the SSPS agent. It can be downloaded from here: http://www.liebsoft.com/index.cfm/products?id=294. The account specified to run this agent should be the same account as the one that is running the scheduling service for SSPS.

In the case where the agent is installed and you receive the above error, validate that the correct target type is configured for your target server. To set the correct target type:
  1. Stop synchronization by clicking the STOP button at the center of the SSPS console.
  2. Select your target system and click the EDIT button in the targets area at the right center area of the SSPS console.
  3. In the target's properties dialog in the top left corner you will find a PLATFORM area. Here, from the drop down list, set the platform type to "Agent: NT Syskey/W2K".

    You will need to do this for all versions of Windows from NT4 with Syskey enabled to Windows 2000 and later.

Applies To:
Server to Server Password Synchronizer (SSPS,S2S) ]]> Server-to-Server Password Synchronizer Knowledgebase Chris http://forum.liebsoft.com/server-server-password-synchronizer-knowledgebase/52-syskey-found-server.html My Domain Controllers are Rebooting! http://forum.liebsoft.com/server-server-password-synchronizer-knowledgebase/34-my-domain-controllers-rebooting.html Wed, 28 Nov 2007 19:20:29 GMT *My Domain Controllers are Rebooting!* *Rev:* 2.0 *Date:* 03/04/2009 *Problem* You have installed the Server-to-Server Password... My Domain Controllers are Rebooting!

Rev: 2.0
Date: 03/04/2009

Problem

You have installed the Server-to-Server Password Synchronizer version 4.x and it's associated agent on a synchronization target and the machine reboots when the agent is running.

You may see Microsoft errors similar to: 1073741819 C:\windows\system32\lsass.exe has halted and a shutdown command has been issued by the NT AUTHORITY SYSTEM. This may be followed by a 60 second countdown clock before your machine reboots.

Cause

This is a known issue with Server-to-Server Password Synchronizer version 4.x and is caused by the DEP (Data Execution Protection) function being enabled on your system. If you turn this feature off, the problem will be corrected. This issue was first fixed in Server-to-Server Password Synchronizer version 5.01.

The reason for the error is that Server-to-Server Password Synchronizer version 4.x agent connects to the LSASS subsystem of your target machines to extract password hashes. In Windows XP SP2 and Server 2003 SP1 and later, the attachment methodology looks like a DEP attack and the operating system service shuts down when DEP is enabled to protect itself from a security violation.

Resolution

To resolve the issue permanently and without modifying your DEP settings, upgrade immediately to version 5.x or later of Server to Server Password Synchronizer. The original agents deployed for version 4.x can be removed with the version 5.x console and new agents deployed directly from the console.

If you are unable to update to version 5.x of Server to Server Password Synchronzier, turn off Data Execution Protection (DEP) on the affected target servers upon which you have installed the synchronization agents. Although DEP settings can be adjusted by selecting Control Panel | System | Advanced | Settings | Data Execution Prevention | “turn on DEP for essential Windows programs and services only”, to ensure resolution to the issue, the following procedures are recommended.

For Windows XP and Server 2003, change the DEP settings in the boot.ini file
  1. Click Start, right-click My Computer, and then click Properties
  2. Click the Advanced tab, and then click Settings under the Startup and Recovery field
  3. In the System startup field, click Edit. The Boot.ini file opens in Notepad.
  4. Edit the /noexecute value so that its value is AlwaysOff (e.g. /noexecute=AlwaysOff).
  5. Reboot your system

For Windows Vista and Server 2008 do the following:
  1. Open a command prompt by right-clicking on it and choose to “Run As Administrator”
  2. In the command prompt, type: bcdedit.exe /set nx AlwaysOff

    Note: If you wish to turn DEP back on, you may later run the same command with one modification: bcdedit.exe /set nx AlwaysOn

More Information

This article may be of service to you in your management of DEP: http://support.microsoft.com/kb/875352

Applies To:

Server to Server Password Synchronizer (SSPS) ]]> Server-to-Server Password Synchronizer Knowledgebase Chris http://forum.liebsoft.com/server-server-password-synchronizer-knowledgebase/34-my-domain-controllers-rebooting.html