Login Failure

[wwdabbs]

One of my users is having intermittent log-in failures. Her account is setup to use domain authentication. Every week or so she will be unable to log on to Vault. The only solution we've found is to restart the server hosting Vault. Check the Vault log I see this error entry:

Active Directory authorization for user xxxxxxxx@electrotek failed: Illegal operation attempted on a registry key that has been marked for deletion.
----6/9/2016 2:58:27 PM xxxxxxxx--xxxxxxxx.electrotek.com(192.168.1.26)--SSL Disabled Login failed: FailInvalidPassword

We've started seeing this issue with Vault 7.2.1. We recently upgraded to Vault 9.1.0 and are having the same problem. Suggestions as to what to check would be appreciated.

[Beth]

Do you have any errors in your Event Viewer logs around the same time?

[wwdabbs]

Thanks for responding.

I checked the Server's Event logs (I can't check the user's computer's logs). I do not see any Events in the System or Application Event logs matching the time of the log-in failure. The security log has already "rolled out" so I can't look at the time when the log-in failure occurred.

Was there a specific Event log that I should look at?

[jclausius]

We were looking for some kind of DCOM or Microsoft-Windows-User Profiles Service event viewer error.

According to this link - https://social.technet.microsoft.com/Fo ... dminlegacy , an 'iisreset' from an administrative command prompt may make the problem go away.


There is also a comment in this thread that references a related error - https://social.technet.microsoft.com/Fo ... dminlegacy . This is where the event viewer errors came into question. The post here suggests diabling the 'Do not forcefully unload the user registry at user logoff' property.

Can you pick a time and try running "iisreset.exe" from admin command prompt to reset the ASP.NET / Vault Server? That might be the easiest thing to try.

[wwdabbs]

Thanks for the information.

I'll try just restarting IIS if we get another failure instead of restarting the entire server. Also, I'll try disabling the "force registry unload" feature -- that looks pretty suspicious.