Troubleshooting

The Manage Agent page allows you to monitor and manage the installed agent.

Please check the following while troubleshooting the agent service.

1. Check if the agent service is installed and running on the desired computer.

   1. Under Configured Servers, click on Manage to bring up the Manage Agent page.

   

   2. Refresh the Agent Service table.
   3. Check the Agent Service table.
   4. If the service has stopped, start the service.

   (Note: The ADAudit Plus service account should be a member of the Domain Admins group in order to get the service status.)

2. Check if the agent is able to communicate with the ADAudit Plus server.

   1. Go to the Agent Communication table.
   2. Refresh the Agent Communication table.
   3. Check if communication is established.

   Note:

   1. An RPC connection is required to sync configuration settings on the agent with the ADAudit Plus server.
   2. An HTTP connection needs to be established in order for the agent to forward event data to the ADAudit Plus server.
   4. If an error persists, test RPC and HTTP communication by clicking on the corresponding icons under Actions.
   5. If HTTP communication fails, open the machine on which the ADAudit Plus agent is installed, and connect to the ADAudit Plus server via a web browser. Enter ADAuditPlus_Protocol://ADAuditPlus_server_name:ADAuditPlus_running_port_number (eg. HTTPS://server_name:8081) in a web browser to connect to the ADAudit Plus server.
      1. If you are unable to connect to the ADAudit Plus server, check the firewall settings (outbound) on the machine where the agent is installed.
   6. If communication is established, refresh the Agent Property table to check if the agent properties match the properties on the server.
      1. If you are unable to refresh the Agent Property table check the Remote Registry Service status on the machine where the agent is installed, and if it has been stopped, start the service.
      2. Also, refresh and check the Configuration Sync Details table to ensure that the most recent changes have been synced.

If the error persists, please contact support, and one of our technicians will help you resolve the issue.

List of errors that may arise while installing the agent and the solutions to resolve them:

1. The network path was not found
2. Couldn't copy ADAuditPlusAgent.msi / Access Denied: failed to connect to ADMIN$ share
3. Another installation is already in progress (0x652)
4. The system cannot find the file specified (0x2)
5. Fatal error occurred (0x643)
6. "RemCom.exe' is not recognized as an internal or external command, operable program or batch file
7. Could not install client software
8. Could not connect to the machine
9. Initiating connection to remote service failed
10. Logon failure: The target account name is incorrect
11. Logon failure: unknown user name or bad password
12. Could not start remote service
13. Another version of the product is already installed (0x666)
14. Product is uninstalled (0x64E)
15. No communication available from agent to server. Last event read time:{recent event time}
16. No communication available from agent to the server (initial profile fetch not happening)
17. Incorrect function
18. Hexadecimal value 0x05, is an invalid character

1. The network path was not found

Causes:

This error occurs when:

• The target computer cannot be contacted.
• The service account used to run ADAudit Plus does not have sufficient privileges to access the admin share (\\server_name\admin$) on the target computer.

Solution:

• Ensure that there are no connectivity issues between the server (where ADAudit Plus has been installed) and the target computer.
• Check if you are able to access the admin share on the target computer, using the service account used to run ADAudit Plus. If you are unable to, configure Domain Settings (in the ADAudit Plus console) and the Log on tab (of ADAudit Plus service) with a user account that has privilege to access the admin share (\\server_name\admin$) on the target computer.

Note:

• To configure user account in Domain Settings page, log in to the ADAudit Plus console > Domain Settings. Hover over the relevant domain, click Modify Credentials, and enter the credentials.



• To configure user account in Log on tab, click the Start icon, select Services, navigate to ManageEngine ADAudit Plus, right-click Properties > Log On > This account and enter the credentials.

2. Couldn't copy ADAuditPlusAgent.msi / Access Denied: failed to connect to ADMIN$ share

Causes:

This error occurs when:

• The service account used to run ADAudit Plus does not have sufficient privileges to access the admin share (\\server_name\admin$) on the target computer.
• The ADMIN$ share access limit has been exceeded.

Solution:

• Check if you are able to access the admin share on the target computer, using the service account used to run ADAudit Plus. If you are unable to, configure the Domain Settings (in the ADAudit Plus console) and the Log on tab (of ADAudit Plus service) with a user account that has privilege to access the admin share (\\server_name\admin$) on the target computer.
• Navigate to Shared Folders Microsoft Management Console (MMC) snap-in > Shares > ADMIN$ > Properties, and set an appropriate value for the User limit.

Note:

• To configure user account in Domain Settings page, log in to the ADAudit Plus console > Domain Settings, hover over the relevant domain, click Modify Credentials, and enter the credentials.
• To configure user account in Log on tab, click the Start icon, select Services, navigate to ManageEngine ADAudit Plus, right-click Properties > Log On > This account and enter the credentials.

3. Another installation is already in progress (0x652)

Cause:

• This error occurs when the installation of another MSI file is in progress on the target computer.

Solution:

• Wait for a few minutes and try to install the agent again.
• If you have not initiated the installation of any software, you can also run this command in the command prompt: taskkill /im /f msiexec.exe to kill any MSI installation running on the target computer

4. The system cannot find the file specified (0x2)

Cause:

• This error occurs when the service account is unable to locate the ADAuditPlusAgent-x86.msi or ADAuditPlusAgent-x64.msi files.

Solution:

• Check if you are able to access the admin share on the target computer, using the service account used to run ADAudit Plus. If you are unable to, configure Domain Settings (in the ADAudit Plus console) and the Log on tab (of ADAudit Plus service) with a user account that has privilege to write files to the SYSTEMDRIVE\Windows directory on the target computer.

Note:

• To configure user account in Domain Settings page, log in to the ADAudit Plus console > Domain Settings, hover over the relevant domain, click Modify Credentials, and enter the credentials.
• To configure user account in Log on tab, click on the Start icon > Services, navigate to ManageEngine ADAudit Plus, right-click Properties > Log On > This account, and enter the credentials.
• Also, ensure that ADAuditPlusAgent-x86.msi or ADAuditPlusAgent-x64.msi file is present in SYSTEMDRIVE\Windows directory on the target computer.

Note: For 32-bit versions, it is ADAuditPlusAgent-x86.msi and for 64-bit versions, it is ADAuditPlusAgent-x64.msi.

5. Fatal error occurred (0x643)

Causes:

This error could occur due to multiple reasons:

• The drive that contains the folder that you are trying to install the package to is accessed as a substitute drive.
• Windows Installer is attempting to install an app that is already installed on your PC.
• The SYSTEM account does not have Full Control permissions on the folder that you are trying to install the Windows Installer package to.

Solution:

• On the target computer, ensure the following:
• .Net 4.5 framework and above is installed.
• ADAudit Plus has already not been installed.
• Check if you are able to access the admin share on the target computer, using the service account used to run ADAudit Plus. If you are unable to, configure Domain Settings (in the ADAudit Plus console) and the Log on tab (of ADAudit Plus service) with a user account that has privilege to write files to the SYSTEMDRIVE\Windows directory.

Note:

• To configure user account in Domain Settings page, log in to the ADAudit Plus console > Domain Settings, hover over the relevant domain, click Modify Credentials, and enter the credentials.
• To configure user account in Log on tab, click on the Start icon, select Services, navigate to ManageEngine ADAudit Plus, right-click Properties > Log On > This account, and enter the credentials.

Next, start and re-register Microsoft Installer service on the target computer. To do this, press Windows + R, type msiexec /unregister and hit Enter. Again press Windows + R, type msiexec /register and hit Enter.

If the issue persists, try resolving it using the Program Install and Uninstall troubleshooter.

6. "RemCom.exe' is not recognized as an internal or external command, operable program or batch file

Cause:

• This error occurs when the Remcom.exe file, which is used to install the agent on target computer, has been flagged and deleted by an antivirus software.

Solution:

• Check if the Remcom.exe file exists in the bin folder of ADAudit Plus Installation directory (<Installation-directory>bin) on the target computer. If not, check if your antivirus software has removed the file. If yes, configure your antivirus software to trust the Remcom.exe file. Then, contact support to get the Remcom.exe file.

7. Could not install client software

Cause:

• This error occurs because of a network timeout while installing the agent.

Solution:

• Ensure that the network connection is re-established and try to install the software again.

8. Could not connect to the machine

Cause:

• This error occurs when the target computer cannot be contacted.

Solution:

• Check if you are able to ping the target computer from the server where ADAudit Plus has been installed. If you aren't able to, fix the underlying connectivity issue. If you are able to ping the target computer, contact support for further assistance.

9. Initiating connection to remote service failed

Cause:

• This error occurs when the service cannot be created on the target computer.

Solution:

• Check if you are able to ping the target computer from the server where ADAudit Plus has been installed. If you aren't able to, fix the underlying connectivity issue.
• If you are able to ping the target computer, ensure that Remote Registry service is running on the target computer.
• Next, check if you are able to access the admin share on the target computer, using the service account used to run ADAudit Plus. If you are unable to, configure Domain Settings (in the ADAudit Plus console) and the Log on tab (of ADAudit Plus service) with a user account that has privilege to create a service on the target computer.

Note:

• To configure user account in Domain Settings page, log in to the ADAudit Plus console > Domain Settings, hover over the relevant domain, click Modify Credentials, and enter the credentials.
• To configure the user account in the Log on tab, click the Start icon, select Services, navigate to ManageEngine ADAudit Plus, right-click Properties > Log On > This account, and enter the credentials.

If the issue still persists, contact support.

10. Logon failure: The target account name is incorrect

Cause:

• This error occurs when the service account used to run ADAudit Plus is locked or disabled or its password has been changed.

Solution:

• Check if you are able to access the admin share on the target computer, using the service account used to run ADAudit Plus. If you are unable to, configure Domain Settings (in the ADAudit Plus console) and the Log on tab (of ADAudit Plus service) with appropriate user account credentials.

Note:

• To configure user account in Domain Settings page, log in to the ADAudit Plus console > Domain Settings, hover over the relevant domain, click Modify Credentials, and enter the credentials.
• To configure the user account in the Log on tab, click the Start icon, select Services, navigate to ManageEngine ADAudit Plus, right-click Properties > Log On > This account, and enter the credentials.

11. Logon failure: unknown user name or bad password

Cause:

• This error occurs when the name or password of the service account used to run ADAudit Plus is incorrect.

Solution:

• Check if you are able to access the admin share on the target computer, using the service account used to run ADAudit Plus. If you are unable to, configure Domain Settings (in the ADAudit Plus console) and the Log on tab (of ADAudit Plus service) with appropriate user account credentials.

Note:

• To configure user account in Domain Settings page, log in to the ADAudit Plus console > Domain Settings, hover over the relevant domain, click Modify Credentials, and enter the credentials.
• To configure the user account in the Log on tab, click the Start icon, select Services, navigate to ManageEngine ADAudit Plus, right-click Properties > Log On > This account, and enter the credentials.

12. Could not start remote service

Cause:

• This error occurs when the service account used to run ADAudit Plus does not have the privileges to start the service in the target computer.

Solution:

• Check if you are able to access the admin share on the target computer, using the service account used to run ADAudit Plus. If you are unable to, configure Domain Settings (in the ADAudit Plus console) and the Log on tab (of ADAudit Plus service) with a user account that has Domain Admin privileges.

Note:

• To configure user account in Domain Settings page, login to the ADAudit Plus console > Domain Settings > Hover over the relevant domain, click on Modify Credentials > Enter credentials.
• To configure user account in Log on tab, click the Start icon, select Services, navigate to ManageEngine ADAudit Plus, right-click Properties > Log On > This account, and enter the credentials.

13. Another version of the product is already installed (0x666)

Cause:

• This error occurs when another version of the agent is already installed in the target computer.

Solution:

• Uninstall the existing agent from the target computer by clicking on the Uninstall icon under the relevant configuration page in the ADAudit Plus console. Then, retry the current installation.

14. Product is uninstalled (0x64E)

Cause:

• This error occurs when the agent has already been uninstalled by some other method, such as manual uninstallation.

Solution:

Install the agent via the ADAudit Plus UI. Then, try to uninstall the agent again.

15. No communication available from agent to server. Last event read time:{recent event time}

Cause:

• This error occurs when there is no communication from agent to server, for past 'N' hours.

Solution:

• On the target computer, check if you are able to access the ADAudit Plus web console via a browser. To do this, open any web browser and in the address bar, type: Protocol://ServerName:Port

Here, ServerName refers to the name of the server where ADAudit Plus/NAT device is hosted.

Protocol refers to the protocol used for agent to server communication (HTTPS by default).

Port refers to the port number used for agent to server communication (8555 by default).

16. No communication available from agent to the server (initial profile fetch not happening)

Cause:

• This error occurs when there is no communication from the agent to the server, immediately after installation.

Solution:

• On the target computer, check if you are able to access the ADAudit Plus web console via a browser. To do this, open any web browser and in the address bar, type: Protocol://ServerName:Port

Here, ServerName refers to the name of the server where ADAudit Plus/NAT device is hosted.

Protocol refers to the protocol used for agent to server communication (HTTPS by default).

Port refers to the port number used for agent to server communication (8555 by default).

17. Incorrect function

Cause:

If the installation process gets quit abruptly, it could be due to the following two reasons:

• Shutdown/log off of the target computer has been initiated even while the installation is in progress.
• There is not enough space in the target computer to install the software.

Solution:

• Ensure shutdown/log off is not initiated in the target computer, while the agent is getting installed.
• Ensure there is sufficient hard disk space available in the target computer before initiating agent installation.

18. Hexadecimal value 0x05, is an invalid character

Cause:

• This error occurs when the agent is unable to read events.

Solution:

• Upgrade to the any build on or above 6058, if the error persists, contact support.