The following errors are found in the IWSVA logs:
2009/01/01 15:01:42 GMT+08:00 <12574:12574> LDAP server returned result code 85 (Timed out), This server is down or timeout, or operation interrupted by signal
2009/01/01 15:01:42 GMT+08:00 <12574:12574> Error: LDAP module failed to get Root DSE, please check whether ldap hostname is valid
2009/01/01 15:01:42 GMT+08:00 <12574:12574> Error: Netscape LDAP CSDK: Failed to get Root DSE
2009/01/01 15:01:42 GMT+08:00 <12574:12574> No Of Connections Requested 5, No Of Connections Created:1
2009/01/01 15:01:42 GMT+08:00 <12574:12574> Warning: Could not allocated the requested LDAP connection
2009/01/01 15:43:09 GMT+08:00 <4090:4095> Direct to Advanced Authentication mode
2009/01/01 15:43:09 GMT+08:00 <4092:4113> LDAP Connection Pool, Get 0x109075D0
2009/01/01 15:43:09 GMT+08:00 <4092:4113> LDAP server returned result code 81 (Can't contact LDAP server), This server is down or timeout, or operation interrupted by signal
2009/01/01 15:43:09 GMT+08:00 <4092:4113> IWSSLDAPMonitorThread: LDAP connection is unavailable for some reason, maybe slow network and overtaxed LDAP server
2009/01/01 15:43:09 GMT+08:00 <4092:4113> Refreshing LDAP Connections
The packet captures show that the Active Directory is expecting something from IWSVA because it returns KRB error, "KRB5KDC _ERR_PREAUTH_REQUIRED". These Event IDs are normal and the issue is related to pre-authentication. The AD server will always record and event for "pre-authentication required" so these events can be safely ignored.
For additional information on this normal Kerberos authentication process, refer to the following article: KRB5KDC_ERR_PREAUTH_REQUIRED.
If you prefer that these events are not logged, you can disable pre-authentication for the administrator account used by IWSVA as a workaround. To disable pre-authentication on the Active Directory:
- Go to the property of the admin account.
- Click the Account tab.
- Under the Account options section, select the Do not require Kerberos preauthentication option.
If you are using IWSVA 5.0, you can install Patch 1. This patch will have IWSVA perform pre-authentication directly without having to negotiate with the LDAP server to the encryption method. The "Failure Audit" Security Event Log will no longer occur in the Active Directory. After applying Patch 1, enable Pre-Authentication:
- Look for and open the intscan.ini file.
- Add the following key under the [LDAP-Setting] section:
[LDAP-Setting]
direct_preauth=yes - Save and close the file.