Jump to content


Photo

Account Lockout Examiner installation error


  • Please log in to reply
9 replies to this topic

#1 Pocket73

Pocket73

    Newbie

  • Members
  • Pip
  • 5 posts

Posted 27 January 2014 - 11:21 AM

Trying to install Account Lockout Examiner on Server 2008 R2 and am close to giving up. I've read the article on the KB and tried all of the suggestions:

1. Verified that .NET 3.5 SP1 is installed
2. Run with both local administrative account and Domain Admin account with local administrative permissions
3. Removed all Group Policies (I've actually gone as far as moving the server to a test OU with all GPO inheritance blocked)
4. Attempted with another Domain Admin account

Despite all of these, every time I try to install I get the error "Service 'NetWrix Account Lockout Examiner (ALSService) failed to start'" and corresponding errors (7000 and 7009) in the System log.

I cannot see anything that says it does not run on Server 2008 R2. I have successfully installed it on a Windows 8.1 machine but, for reasons which are too complicated to explain here, I need to run it on 2008 R2.

Is there anything else I can try?

Thanks in advance.

Andy

#2 jeffb

jeffb

    Advanced Member

  • Administrators
  • PipPipPip
  • 384 posts
  • Gender:Male

Posted 27 January 2014 - 12:58 PM

Andy,

Are you referring to the even that occurs because of a logon failure?

The service did not start due to a logon failure. Domain admin or otherwise the account is failing to authenticate on the machine you installed Account Lockout Examiner on. This message is coming from Windows. To isolate the issue try using a local machine account. The product won't be able to work with this account but at least you can start the service and see that indeed this is what is causing the issue. What I suspect is that there is a security policy in place on that server (or perhaps all servers) that doesn't allow storage of network credentials (possible this would even keep a local account from working but not sure). It is almost like the account that runs the service attempts to run the service but passes empty credentials locally to authenticate.

-Jeff

#3 Pocket73

Pocket73

    Newbie

  • Members
  • Pip
  • 5 posts

Posted 27 January 2014 - 03:35 PM

Jeff,

Thanks for the quick and detailed response. The errors I'm seeing in the Windows system log are as follows:

7000: The service did not respond to the start or control request in a timely fashion
7009: A timeout was reached (30000 milliseconds) while waiting for the NetWrix Account Lockout Examiner service to connect

The error that the installer generates is:

"Service 'NetWrix Account Lockout Examiner' (ALService) failed to start. Verify that you have sufficient privileges to start system services."

Following your suggestion I reran the installation and used a local administrator account instead of a Domain Admin when prompted to do so. It complained but the installation carried on, until it hung on starting service as before.

I should also note that I was using the same account for the 2008 R2 installation that I have used successfully on my Windows 8.1 machine.

Andy

#4 jeffb

jeffb

    Advanced Member

  • Administrators
  • PipPipPip
  • 384 posts
  • Gender:Male

Posted 28 January 2014 - 12:16 PM

Andy,

Have you tried another server to isolate the issue to a specific server or to just servers in general? That may help understand the issue.

-Jeff

#5 Pocket73

Pocket73

    Newbie

  • Members
  • Pip
  • 5 posts

Posted 28 January 2014 - 04:13 PM

Yes, I'm afraid I have. The server I mentioned above in the dedicated OU with GPO inheritance blocked was the second one I've tried to install it on. I'm having the same issue on both systems.

#6 jeffb

jeffb

    Advanced Member

  • Administrators
  • PipPipPip
  • 384 posts
  • Gender:Male

Posted 29 January 2014 - 05:16 PM

The only other thing I can think of is making sure the account has logon as a service rights on the server (even explicitly added and not as part of a group). Disabling UAC and anti-virus to isolate. Possibly even making sure the .NET framework version 4.0 is installed (but that is a stretch).

-Jeff

#7 Pocket73

Pocket73

    Newbie

  • Members
  • Pip
  • 5 posts

Posted 29 January 2014 - 05:30 PM

Jeff,

Thanks for the suggestions: I'll give those a try.

From what you're saying I am right in assuming that it should definitely work on Server 2008 R2?

Andy

#8 jeffb

jeffb

    Advanced Member

  • Administrators
  • PipPipPip
  • 384 posts
  • Gender:Male

Posted 30 January 2014 - 05:45 AM

Andy,

Yes, almost all of our users run it in Windows Server 2008 R2. Not too many have adopted 2012 yet and not too many are still on 2003. :)

-Jeff

#9 Pocket73

Pocket73

    Newbie

  • Members
  • Pip
  • 5 posts

Posted 30 January 2014 - 03:20 PM

Jeff,

Got it working. I had to increase the timeout that Windows waits for a service to start using the ServicesPipeTimeout:

http://support.microsoft.com/kb/922918

Andy

#10 jeffb

jeffb

    Advanced Member

  • Administrators
  • PipPipPip
  • 384 posts
  • Gender:Male

Posted 31 January 2014 - 01:14 PM

Andy,

Very nice! Thanks for coming back and letting us know.

-Jeff




0 user(s) are reading this topic

0 members, guests, anonymous users