Active Directory Troubleshooting
On this page
Use this page when a sign-in through Active Directory fails. Start with the tool that names the cause. Then look up what you see in the tables below.
Where to look first
| Tool | Where | What it tells you |
|---|
| The check page | Open /sso-check on the person's PC, or click Why? on the sign-in screen | Why Sign in with Windows does not work on that PC. See The check page /sso-check. |
| Test connection | Access Management › Active Directory | Whether Primentra reaches the domain controllers, trusts their certificate and can sign in with the AD account. It also checks the Base DN and the SPN. |
| The audit log | Log Viewer, filter on Login failed | Each refused sign-in, with the name that was typed, a Code and a Reason. See the table Codes in the audit log below. |
| The card Check now | Access Management › Active Directory | The result of the last AD check, and when the next one runs. |
errorlog.txt | logs\ in the installation folder | The detail behind a Reference code on the sign-in screen. Search the file for the code. |
| The Event Viewer | Windows Logs › Application, source Primentra | Event 102 (Node.js), 103 (mds-config.json) and 411 (the AD check failed twice in a row). |
| What you see | Why | What to do |
|---|
| No Sign in with Windows button | Active Directory is off, or Windows button (no typing) is not ticked on the tab Sign-in. | Tick it and click Save settings. If the box is not there at all, the Kerberos part did not load on the server. The line Windows sign-in (Kerberos) is not available in errorlog.txt says why. |
| The form opens, with ← Sign in with Windows at the top | The screen remembers that this person used the form last time. | Click ← Sign in with Windows once. Next time the button shows first. |
| Windows sign-in did not work. in amber | The browser did not send a Kerberos ticket. | Click Why? The check page names the cause. |
| Edge or Chrome asks for a user name and password in its own box | The address is an IP address or localhost, the address is not in the Local intranet zone, or the browser runs on the Primentra server itself. | Open Primentra by its server name. Put that name in the Local intranet zone. On the server itself the button cannot work: test from another PC. |
| The check page says Windows sent NTLM, not Kerberos | On the Primentra server itself this is normal. From another PC, the server name has no SPN. | Run the check from another PC. Otherwise the check page gives a klist command to test the name. |
The sign-in screen
| The screen says | Why | What to do |
|---|
| Invalid user name or password. | The Windows password or the user name is wrong. | Type them again. The form takes anna, DOMAIN\anna and anna@company.com. |
| Too many attempts. Try again in 30 minutes. (Windows account tab) | Three wrong Windows passwords for this name in 30 minutes. Primentra stops asking AD for this name, so AD cannot lock the Windows account. | Wait. The Sign in with Windows button keeps working: it sends a ticket, not a password. This limit does not set Locked out in Users. |
| Too many login attempts. Please wait 15 minutes before trying again. | Ten failed sign-ins for this name from this PC in 15 minutes, on any form. | Wait 15 minutes. Another person on the same PC can still sign in. |
| Too many attempts. Try again in 30 minutes. (Primentra account tab) | Five wrong Primentra passwords. The account is locked, and Users shows Locked out. | The lock ends after 30 minutes. It also ends when the person sets a new password with Forgot password?, or when an administrator unticks Locked out. |
| DOMAIN\name has no access to Primentra yet. Ask your administrator to add you to a Primentra group. | The Windows account is right, but none of the person's AD groups grants a role. | Put the person in an AD group that is mapped to a role on the role page. |
| Your Windows password has expired. Change it on your Windows PC, then try again. | AD says the password expired or must be changed. | The person changes it in Windows, then signs in again. |
| Active Directory sign-in is not available right now. Try again in a few minutes. If it keeps happening, contact your administrator. with a Reference | Primentra could not reach AD, or the AD account that Primentra uses could not read the user. | Search errorlog.txt for the reference. Then click Test connection. |
| Your Windows account cannot sign in to Primentra. | The AD account has no email address and no UPN. | Give the account an email address in AD. |
Test connection
| The result says | What to do |
|---|
| The password of the Active Directory account is wrong. | Type the password of the AD account again, then Save. The raw text of AD is under Details. |
| The certificate of this controller is not for the name … | Use one of the names in the list under it in the address. The name in the address must match the certificate. |
| The Base DN … is outside the domain. or … does not exist in AD. | Click Use the domain. Primentra does not save a wrong Base DN. |
| Could not check the SPN: no address could be read. | Fix the address first. The SPN check needs one address that works. |
| The address did not answer. | Check the address, the port (636 for LDAPS) and the firewall between the Primentra server and the domain controller. |
Roles and users
| What you see | Why | What to do |
|---|
| A person in an AD group does not have the role yet | Primentra reads a person's groups at sign-in, at the AD check and when you link the person. | Click Run now and Apply in the card Check now, or ask the person to sign in again. |
| A person keeps a role after leaving the AD group | Someone gave the role by hand, not the group. A role from AD shows the AD badge in the user form. | Remove the hand-given role. After Unlink, the AD roles become hand-given too. |
| A person was switched off and is back in AD, but still cannot sign in | AD switches a user off, but never on again. | Open the user and tick Enabled. |
| An administrator was signed out while you changed a group mapping | That person lost the administrator role through the change. Primentra ends the session at once, so it cannot keep administrator rights. | Nothing. When the person signs in again, they get the roles they have now. |
The AD check
When the automatic AD check fails twice in a row, the administrators get a mail, the bell shows a message, and event 411 is in the Event Log. Each one starts with the plain reason. The raw text of AD comes after Details. Fix the cause, then click Run now. A check that passes removes the bell message.
A check that fails switches nobody off and changes nobody. The next try runs one hour later.
Codes in the audit log
A refused sign-in in the Log Viewer has a Code and a Reason.
| Reason | Meaning |
|---|
ad_52e | The Windows password is wrong. |
ad_532, ad_773 | The Windows password expired, or must be changed. |
ad_533, ad_701 | The AD account is disabled or expired. Primentra switches the user off. |
ad_775 | The AD account is locked in AD. |
limit | A limit from the section above stopped the sign-in. |
not_found | AD has no account with this name. |