[HELP] Group membership lookup error

[severinscheidegger-fl]

Group membership lookup error

Good Day

I have installed the AMS on my server but having a problem with the Active Directory Domain Permissions. Under the three groups (Windows Authorization Access Group, etc) it sais Group membership lookup error. I double checked, that the gMSA is in each required group. The necessary ports are open on the AMS server as well as on the DC. Restarting the AMS Service also didn't help. I've set up the Service Account with the provided Script from the Installation Instructions and i've waited 10 Hours. What could be the Problem.

2025-02-06 11:02:32.3188|ERROR|Lithnet.AccessManager.Server.UI.ActiveDirectoryDomainPermissionViewModel|Group membership lookup error
System.Runtime.InteropServices.COMException (0x8007200A): Das angegebene Verzeichnisdienstattribut bzw. der angegebene Verzeichnisdienstwert ist nicht vorhanden. Translation: The specified directory service attribute or value does not exist
at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
at System.DirectoryServices.DirectoryEntry.get_SchemaEntry()
at System.DirectoryServices.AccountManagement.ADStoreCtx.IsContainer(DirectoryEntry de)
at System.DirectoryServices.AccountManagement.ADStoreCtx..ctor(DirectoryEntry ctxBase, Boolean ownCtxBase, String username, String password, ContextOptions options)
at System.DirectoryServices.AccountManagement.PrincipalContext.CreateContextFromDirectoryEntry(DirectoryEntry entry)
at System.DirectoryServices.AccountManagement.PrincipalContext.DoLDAPDirectoryInitNoContainer()
at System.DirectoryServices.AccountManagement.PrincipalContext.DoDomainInit()
at System.DirectoryServices.AccountManagement.PrincipalContext.Initialize()
at System.DirectoryServices.AccountManagement.PrincipalContext.get_QueryCtx()
at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithTypeHelper(PrincipalContext context, Type principalType, Nullable`1 identityType, String identityValue, DateTime refDate)
at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithType(PrincipalContext context, Type principalType, IdentityType identityType, String identityValue)
at System.DirectoryServices.AccountManagement.GroupPrincipal.FindByIdentity(PrincipalContext context, IdentityType identityType, String identityValue)
at Lithnet.AccessManager.Server.UI.ActiveDirectoryDomainPermissionViewModel.GroupExists(SecurityIdentifier groupSid) in D:\a\1\s\src\Lithnet.AccessManager\Lithnet.AccessManager.Server.UI\ViewModels\ObjectWrapperViewModels\ActiveDirectoryDomainPermissionViewModel.cs:line 213
at Lithnet.AccessManager.Server.UI.ActiveDirectoryDomainPermissionViewModel.CheckP2kCaStatus() in D:\a\1\s\src\Lithnet.AccessManager\Lithnet.AccessManager.Server.UI\ViewModels\ObjectWrapperViewModels\ActiveDirectoryDomainPermissionViewModel.cs:line 181

[ryannewington]

@severinscheidegger-fl it sounds like there are some changes made in the AD to the default permissions. Have you done any domain hardening activities?

It's trying to bind to the directory to read the membership of the pre-windows 2000 compatible access group, (perhaps even the schema), and being told it that something about that doesnt exist.

Note this check is running as the account you are running the UI as, so if you don't have permission to read these objects and attributes, then this could be causing the issue

[severinscheidegger-fl]

Hi @ryannewington

Thanks a lot for your reply. You were right, I was logging in as a non-DomainAdmin to the UI and as soon as i logged in as a Domain Admin, the checks were Green. Is it standard practice to log in as a domain admin, or should other users/admins normally be able to have permission to read these objects too? And is that affecting only the ability to see the checkmarks green, since the rest is being run as the Service account, or could it cause deeper functionality issues?

Thanks and Regards, Severin

[ryannewington]

Hi Severin

If you add yourself to the pre windows 2000 compatible access group, it should work. You don't need to be domain admin.

However it is just a helper screen. As long as the service account is in those groups, that is all that is needed for proper operation.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs.

[Sev-dev-1990]

Hi Ryan,

I see. Thanks a lot.

Regards, Severin