Common UI errors

This page explains errors that the web UI and the Access History show during scans and access requests, and how to resolve them. Many of the errors result from incorrect or outdated DNS entries, especially slow updates to dynamic DNS records, or from incorrect credentials. For errors that have their own article, see Errors and messages.

rpc_s_access_denied

The scan account can't read the local Administrators group of the system.

Cause 1: The scan account doesn't have permission to enumerate the local Administrators group. The Group Policy Object (GPO) that allows the scan account to make remote calls to the Security Account Manager (SAM) is missing.

Resolution 1: Apply the scan GPO. See Scan GPO for domain controllers.

Cause 2: The system can't reach a domain controller (DC) to authenticate an Active Directory (AD) account. To verify, try to sign in to the system with an AD account by using Remote Desktop Protocol (RDP). If you have a terminal through a remote management tool, run gpupdate /force and check for a DC connection error.

Resolution 2: Restore the connection between the system and a DC, and verify it with gpupdate /force. Until then, sign in with a local account, such as the built-in Administrator (RID 500) account or, if Offline Access Management (OAM) is enabled, the alternate administrator account.

403 Error: Forbidden from viewing this resource

Cause: The signed-in user tried to view a system on the Grant Access page without permission. A user has permission when the user, or a group that the user belongs to, is in the account inventory of the system.

Resolution: Add the user or a group of the user to the account inventory. See Add a user or group to an account inventory.

STATUS_NONE_MAPPED

Cause 1: The local Administrators group contains a duplicate or redundant built-in administrator account, which causes an error when OAM scans the system.

Resolution 1: Identify the built-in administrator account on the system, disable OAM, and rescan the system. If the incorrect built-in administrator remains in the account inventory, remove it. If you can't remove it, contact Netwrix Support.

Cause 2: The OAM policy uses the same name for the alternate administrator account as the built-in administrator account.

Resolution 2: Disable OAM and rescan the system. Change the OAM policy to use a name that differs from the built-in local Administrator account. Enable OAM and rescan.

STATUS_SPECIAL_ACCOUNT

This status indicates that an operation isn't allowed on a built-in (special) SAM account, for example deleting it.

Cause: The OAM alternate administrator account has the same name as the RID 500 account, for example Administrator, while OAM is enabled. When you set OAM to Unmanaged, the next scan tries to remove the alternate administrator account, but that account is the RID 500 account.

Resolution: Contact Netwrix Support. While OAM is set to Unmanaged, Support removes the stale account entries that end in -500 for the system. Afterward, leave OAM unmanaged, or enable it with an alternate administrator name that differs from the name of the RID 500 account.

Your request is taking longer than usual to process

The full message is "Your request is taking longer than usual to process. Check back in a few minutes." The web UI shows it as a warning.

Cause 1: The product exceeded the time limit to communicate with the system. The process keeps trying to complete the action, such as a rescan, a just-in-time access (JITA) request, an extension, or an expiration.

If the signed-in user has a JITA session that doesn't expire, because it is overdue or a manual expiration failed, Access > Overview > Overdue Users with Admin Access shows the message "Pending expiration run" and offers no button to dismiss it.

Resolution 1: Wait a few minutes, refresh the Grant Access page for the system, and repeat the action.

Cause 2: The worker service stopped responding or restarted, and the queue record for the JITA request on the system stayed in progress.

Resolution 2: Contact Netwrix Support to reset the queue record.

Unable to connect to system: Host is offline

The full message is "Unable to connect to system: Host is offline". When DNS returns no address for the system, the message ends with "DNS not resolving an IP" instead.

Cause: The product found no IP address for the system that answers a ping.

Resolution: Verify that the system is running and reachable from the node. Verify that DNS returns the current address of the system, because stale or slow-updating DNS records often cause this message. For how the product determines that a host is offline, see the knowledge base article.

Windows authentication and connection errors

When the product can't authenticate to a Windows system, it shows the SMB error that the system returns. The following table lists errors that the product reports when it connects to a Windows system.

Error	Cause	Resolution
STATUS_LOGON_FAILURE: The attempted logon is invalid. This is either due to a bad username or authentication information.	DNS isn't up to date, so the product connects to the wrong IP address and uses the wrong credentials. Alternatively, another administrator changed the credentials on the system.	Correct the DNS entry. Verify the credentials of the service account on the system.
STATUS_ACCOUNT_LOCKED_OUT: The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested.	The service account is locked out for the same reasons as STATUS_LOGON_FAILURE.	Unlock the account and resolve the cause of the failed logons.
STATUS_LOGON_TYPE_NOT_GRANTED: A user has requested a type of logon that has not been granted.	The product most likely connects to the wrong system, for the same reasons as STATUS_LOGON_FAILURE.	Correct the DNS entry for the system.
STATUS_MEMBER_IN_ALIAS: The specified account name is already a member of the group.	The product tried to add a user to the local administrators group, and the account was already a member.	None required.
STATUS_MEMBER_NOT_IN_ALIAS: The specified account name isn't a member of the group.	The product tried to remove a user from the local administrators group, and the user wasn't a member.	None required.
System hostname does not match	DNS isn't up to date, so the product connects to the wrong IP address. Alternatively, the AD attributes Computer Name (CN) and Computer (NetBIOS) Name of the computer don't match, which happens when the NetBIOS name is longer than 15 characters.	Run ipconfig /all on the system and compare the returned host name with the system name in the product. If they differ, correct the DNS entry. Otherwise, shorten the NetBIOS name to 15 characters. See Microsoft's naming conventions in Active Directory.
Kerberos authentication failed, could not issue ticket, check user/pass.	The domain controller rejected the user name or password of the account that the product uses.	Verify the credentials of the scan or Protect service account, and unlock the account if it's locked out.
Kerberos encryption type negotiation failed (RC4/AES mismatch)	The account has only RC4 keys but the domain controller requires AES, or the domain controller disabled RC4.	Check msDS-SupportedEncryptionTypes on the account and SupportedEncryptionTypes on the domain controller, and align them.
STATUS_ACCESS_DENIED: A process has requested access to an object and has not been granted those access rights.	The service account authenticated, but doesn't have the required access.	Verify that the service account is in the local administrators group. See the following note.
STATUS_PASSWORD_RESTRICTION (0xc000006c): Some password update rule has been violated, for example the password doesn't meet length criteria.	The OAM password complexity setting conflicts with the domain password policy.	Align the OAM password settings with the domain password policy.
STATUS_TRUSTED_RELATIONSHIP_FAILURE: The logon request failed because the trust relationship between this workstation and the primary domain failed.	AD has no trust relationship with the system. This happens when someone deletes a computer from AD and adds it again.	On the system, leave the domain, restart, and join the domain again.
STATUS_NO_LOGON_SERVERS: No logon servers are available to service the logon request.	The system can't reach a DC.	Fix network path problems such as the firewall, routing, or VPN. Restart the system.
STATUS_NOT_SUPPORTED during a scan	A Microsoft update that mitigates an NTLM relay vulnerability blocks incoming NTLM traffic. See Microsoft's KB5005413. The product shows the error as the system returns it.	Set the policy Network security: Restrict NTLM: Incoming NTLM traffic to Allow all. Microsoft recommends auditing incoming NTLM traffic first. See Network security: Restrict NTLM: Incoming NTLM traffic. Alternatively, switch the domain to Kerberos authentication, which requires TCP port 88. See Choose the Windows authentication method.
SAMR SessionError: unknown error code: 0xc000a08b	Microsoft Local Administrator Password Solution (LAPS) prevents password changes to the local Administrator (RID 500) account. Windows generates this error on the endpoint. To verify, check the LAPS operational log in Event Viewer under Applications and Services Logs > Microsoft > Windows > LAPS > Operational.	Prevent the LAPS GPO from applying to the system. As a workaround, disable OAM rotation of the local Administrator password. The product keeps the account disabled and manages an alternate administrator account.
SAMR SessionError: unknown error code: 0xc000030c	Nobody set a password for the local Administrator (RID 500) account, so the password is blank. Windows generates this error on the endpoint.	Set a password for the local Administrator (RID 500) account.
Error 9999: Connection reset by peer	File and Printer Sharing for Microsoft Networks is disabled, which blocks connections on port 445.	Enable File and Printer Sharing for Microsoft Networks on the system.
Your configuration is not valid. (ECONNRESET) when you select Test Connection while you add a domain	The DC doesn't use Secure Sockets Layer (SSL) for Lightweight Directory Access Protocol (LDAP) and closed the connection.	Clear the SSL option and change the port to 389.
Rescan doesn't work	The AD entry represents a cluster, such as a Microsoft SQL Server cluster, instead of an individual computer. A rescan expects an individual server.	Scan the individual nodes of the cluster.

For STATUS_ACCESS_DENIED, verify the following:

• The service account (Protect or Scan) is in the local administrators group of every system that you scan. The service account must show On System: Yes and Persistent: Yes. A team, a process, or a GPO usually manages this membership. To fix the problem immediately, sign in to the affected system and add the service account to the local administrators group.
• If OAM is enabled, disable OAM and contact Netwrix Support to remove stale administrator entries from the account inventory data.

Connection timed out, refused, or no route to host

The product can't connect to port 445 of the system. The error appears in one of the following forms:

• Unable to connect to system: ... Connection timed out
• Unable to connect to system: ... Connection refused
• Unable to connect to system: ... No route to host
• STATUS_PIPE_NOT_AVAILABLE
• The NETBIOS connection with the remote host timeout

Cause: File and Printer Sharing is disabled, or the Server service (LanmanServer) isn't running, so SMB doesn't listen for connections.

Resolution: On the system, run the following commands from a command prompt:

1. Check that port 445 reports LISTENING:

   netstat -n -a | findstr "LISTEN" | findstr "445"

2. Check the status of the Server service:

   sc query lanmanserver

3. If the service is stopped, start it:

   sc start lanmanserver

If the problem persists, apply the following steps in order. After each step, check again that port 445 reports LISTENING.

1. Enable File and Printer Sharing for Microsoft Networks on the network adapter that the system uses.
2. In Windows Services, set the Server service to Automatic and start it.
3. Stop and start the Server service.
4. Restart the system. The Server service sometimes doesn't start or stay running until the system restarts.

Linux system errors

Error	Cause	Resolution
Remote script exited with error: see details in log during a scan	The Linux system is out of disk space, or the disk or the /tmp directory is read-only.	Free disk space, or fix the read-only state or the permissions of /tmp.
Remote script exited with error: see details in log and the password of the service account has expired	The password of the service account on the Linux system has expired.	Set the password to never expire: sudo chage -M 99999 <account>. Replace <account> with the name of the service account.
Unhandled error: Host is Unreachable: Failed to connect to the host via ssh: WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! during registration	The SSH host key of the Linux system changed, and it no longer matches the key that the worker service stored.	Restart the worker service from Configure > Services > Worker > Restart, or run s1 restart worker on any node.
No sudoers file or no users or groups in the UI permissions	The internal_api service, which stores the sudoers data, isn't deployed, isn't running, or can't reach the database.	Check the internal_api service as Inspect and troubleshoot the deployment describes. If it runs, contact Netwrix Support.

For the SSH key error SSH connection error: encountered RSA key, expected OPENSSH key, see Errors and messages.

Import errors

The file does not have a header with value "Name"

Cause: You selected Select By File on the Management > Systems page and uploaded a CSV file that you edited and saved in Excel. Excel removes the quotation marks that the upload requires.

Resolution: Save the file in Excel as an .xlsx file, or edit and save the CSV file in a text editor.