Use Windows session credentials failing

Usage and Config Platform
1

(imported topic written by jpeppers91)

Receive an error when trying to connect using this option. Here is the error message…

Failed to connect to
https://server:24439
: Windows Error 80090303: The specified target is unknown or unreachable. Any ideas?

jp

2

(imported comment written by NoahSalzman)

What OS and service pack is the Console running on (Win7, 2003, 2008, etc.)? Does it fail on all machines? What version of IEM server and console

And, from the manual, is all of this correct in your environment:

The server must be joined to a domain (Active Directory only) and have validated write to service principal name (SPN) for SELF set to Allow. If other users will be running the service, the server must also have write permissions for them. The service must be run as the Local System or domain user that has Administrative rights on the computer.

3

(imported comment written by jpeppers91)

Console is Win7 Sp1 and running 9.0.787 IEM on server and console. Can you provide a link to the manual where this is located?

4

(imported comment written by NoahSalzman)

http://pic.dhe.ibm.com/infocenter/tivihelp/v26r1/index.jsp?topic=%2Fcom.ibm.tem.doc_9.0%2FPlatform%2FConsole%2FConsoleAuthenticationUsingWindowsSessionCredentials.html

5

(imported comment written by jpeppers91)

I’m not understanding this fully. Where do I check the service principal name for SELF? Do I check the computer account for the server or the user accounts that are trying to login? What is the service that should be run as Local System or domain user with admin rights.

6

(imported comment written by Niraj Kumar Mishra)

Hi,

Can you please share the screenshot of services.msc from your IEM server ? Seems either your besroot service is running under some domain id or some other id? If it is domain id then it should must be the member of local administrator group else services should run under the
Local System
.

Thanks

Niraj

7

(imported comment written by jpeppers91)

The account that is running the BESROOT service and is a domain account and the account is in the administrators group of the box.

8

(imported comment written by jpeppers91)

Does it matter if I’m running DSA?

9

(imported comment written by Niraj Kumar Mishra)

Yes… Only FillDB should run under account that has SA privilege. Rest all other service needs to be run under local system account specially besroot service.

Thanks

Niraj

10

(imported comment written by Niraj Kumar Mishra)

Note: You have done similar setting on all DSA servers.