Related Products
ADAudit Plus

Real-time Active Directory Auditing and UBA
Download | Demo
ADSelfService Plus

Self-Service Password Management
Download | Demo
EventLog Analyzer

Real-time Log Analysis & Reporting
Download | Demo
Exchange Reporter Plus

Exchange Server Auditing & Reporting
Download | Demo
AD360

Integrated Identity & Access Management
Download | Demo
Log360

Comprehensive SIEM and UEBA
Download | Demo

Troubleshooting Tips

Domain Settings

When I start ADManager Plus, none of my domains are discovered. It says "No Domain Configuration available". Why?
When I add my domains manually, the Domain Controllers are not resolved. Why?
When I add the Domain Controller, I get an error as "The Servers are not operational". What does it mean?
When I add the Domain Controller, I get an error as "Unable to get domain DNS / FLAT name". What does it mean?
The status column in the domain settings says that the user do not have Admin Privilege?
When I add an additional Domain, I get the error message"License is applied only to "n" Domains. What should I do now?
When I try to install ADManager Plus, I get the error & quot; The InstallShield Engine (iKernel.exe) could not be installed. What should I do?

1. When I start ADManager Plus, none of my domains are discovered. It says "No Domain Configuration available". Why?

ADManager Plus, upon starting, discovers the domains from the DNS server associated with the machine running the product. If no domain details are available in the DNS Server, it shows this message.

Questions

2. When I add my domains manually, the Domain Controllers are not resolved. Why?

This problem occurs when the DNS associated with the machine running ADManager Plus do not contain the necessary information. You need to add the Domain Controllers manually.

Questions

3. When I add the Domain Controller, I get an error as "The Servers are not operational". What does it mean?

This error could be due to any of the following reasons:

Domain Controllers (DCs) are down.
Servers is not available.
Firewall has been enabled, and port 389 is closed.
Network is busy. Try after some time.

Questions

4. When I add the Domain Controller, I get an error as "Unable to get domain DNS / FLAT name". What does it mean?

This error could be due to any of the following reasons:

When the specified user name or the password is invalid.
Anonymous login (when no user name and password is provided).
When IP Address of the Domain Controller is specified instead of its name.

Questions

5.The status column in the domain settings says that the user do not have Admin Privilege?

This is a warning message to indicate that the specified user do not have administrator privileges i.e., the user is not a member of Domain Admins Group. Hence permissions applicable to Administrator may not be available to this user.

Questions

6.When I add an additional Domain, I get the error message "License is applied only to "n" Domains". What should I do now?

This is a warning message to indicate that you are trying to exceed the maximum number of domains that can be added in the purchased license. To add another domain , you must either delete an existing domain or purchase a license for additional domains based on your requirement.

Questions

7.When I try to install ADManager Plus, I get the error " The InstallShield Engine (iKernel.exe) could not be installed. What should do?

This is a warning message to indicate that you do not have appropriate rights/privileges to copy iKernel.exe to the desired folder where you want to install ADManager Plus.

Questions

Back to Modules

Admin Settings

1. SMS server settings and SSLHandshakeException errors

Why does this error occur?

This occurs when the configured SMTP mail server or the web server configured with SSL in ADManager Plus uses a self-signed certificate. As self-signed certificates will not be trusted by the Java Runtime Environment used in ADManager Plus, unless they are explicitly imported, it is recommended that the following troubleshooting steps are followed.

Step 1: Download the required certificates

For SMTP servers:
Note: Ensure you have OpenSSL pre-installed and download the certificate for SMTP server from here.
- From the Command Prompt, navigate to the bin folder in the location where OpenSSL has been installed.
- Run the following command,
  openssl.exe s_client -connect SMTPServer:Portno -starttls smtp → certificatename.cer
- For example, openssl.exe s_client -connect smtp.gmail.com:587 -starttls smtp → gmailcert.cer
For web servers:
- Open the web URL in the browser.
- In the address bar, click on the padlock icon, then click Certificate.
- In the Certificate window that opens, click on the Details tab.
- Then click on the Copy to File button.
- Choose the 'DRE encoded binary X.509 (.CER)' format and click Next.
- Enter the file path of the location where the file is to be saved and click Finish.
Import the certificates to the JRE package of ADManager Plus
- Open the Command Prompt and navigate to \jre\bin folder. For example, 'C:\ManageEngine\ADManager Plus\jre\bin'.
- Run the following command,
  Keytool -importcert -alias myprivateroot -keystore ..\lib\security\cacerts -file
  For example, Keytool -importcert -alias myprivateroot -keystore ..\lib\security\cacerts -file C:\smtpcert.cer
- When prompted for a password, enter "changeit" and enter "y" when prompted for a yes or no.
- Now close the Command Prompt window and restart ADManager Plus.

Back to Modules

Active Directory User Management

1. While creating a user, I get the following error "Error in setting the Password. The network path not found - Error Code: 80070035"

While setting the password for the user, if the target machine could not be contacted, this error is shown. The possible reasons could be:

The DNS associated with the machine running ADManager Plus does not point to the Domain Controller where the user account has been created (possibly both are in different domains).
Port 445 in the Firewall might be blocked. Try setting the password after opening port 445.

Questions

2. While creating a user, I get the following error "Error in setting the Password. There is a naming violation - Error Code : 80072037"

One possible reason for this error could be creation of a user in an invalid container.

Questions

3. While creating/modifying a user, I get the following error "The server is unwilling to process the request - Error Code : 80072035"

Possible reasons for this error could be:

While setting the password, if the password complexity requirement as defined in the password policy is not met. For example, the password policy might state that the password should be alphanumeric and if the password specified do not comply this, you might get this error.
When you try to remove a non-existing user object from a group.
When you try to remove a user from his/her primary group.
When modifying the sAMAccountName format for multiple users and when more than one user happens to have the same sAMAccountName.

Questions

4. While creating a user, I get the following error " Error In Setting Terminal service Properties. The specified user does not exist - Error Code : 525"

One possible reason could be that the user or the system account as which the product is run do not have an account in the target domain. Terminal Service properties can only be set if the user account or the system account (applies when ADManager Plus is run as a service) that runs ADManager Plus has an account on the target domain.

Questions

5. I have updated the Exchange attributes using ADManager Plus, but the properties are not updated in the Exchange Server yet.

ADManager Plus modifies the Exchange properties in the Active Directory. The changes may not be immediately reflected in the Exchange Server. It will get updated after some time.

Questions

6. Legacy Mailboxes

Prerequistes for Exchange 2007

1. 64 bit Edition of ADManager Plus should be installed on a compatible machine. (You can find the architecture of the existing installation from the "Product.conf" file located at \ManageEngine\ADManager Plus\conf). Download the 64 bit Edition of ADManager Plus from: https://www.manageengine.com/products/ad-manager/download.html

2. To create Mailbox Enabled Users in Exchange 2007, you would require the corresponding version of Exchange Management Console (EMC) in the same machine where ADManager Plus is installed, failing which the legacy Mailbox will be created.

3. If ADManager Plus is running in console mode, then you must log on to the machine as an administrator (Exchange administrator).

4. If ADManager Plus is installed as a service, kindly configure the service account with administrator (exchange administrator) privileges by following the below procedure,

Step 1: Click Start->run->services.msc
Step 2: Locate the service name "Manageengine ADManager Plus"
Step 3: Right click the service and select Properties->Log On
Step 4: Select "This account" and provide the credentials.

Prerequisites for Mailbox Creation in Exchange 2010

1.Windows PowerShell 2.0 or above should be installed on this machine.
2.TCP port 80 must be open between this machine and the remote Exchange 2010 Server.
3.Remote PowerShell must be enabled for the user account specified in ‘Domain Settings’.

Questions

7. I am not able to set the Terminal Services properties for the user?

One possible reason could be that the user or the system as which the product is run do not have an account in that domain.

Refer to here for starting ADManager Plus in User or System account.

Questions

8. I am getting an error as "The attribute syntax specified to the directory service is invalid - Error Code : 8007200b"?

This error could popup in the following scenarios:

When you try to remove (or make the value as blank) a non-existing attribute, during bulk user modification.
When you specify a blank value for an attribute during user creation.
When the specified LDAP attribute does not follow the syntax.

Questions

9. When I create/modify a user, I get the following error " A device attached to the system is not functioning - Error Code : 8007001f "

The possible reasons for this error could be:

When creating a user, if the naming attributes, such as Name, Logon Name, SAM Account Name, etc., has some special characters in it.
When modifying a user, if an unacceptable format is chosen for the naming attributes. For example, if the format chosen for the Logon Name is LastName.FirstName.Initials and if the user does not have any one of these attributes specified, this error will occur.

Questions

10. Email address for user not showing up or not set properly?

The possible reason could be:

Email may not be set as per Recipient Policy. Check whether all LDAP attributes in recipient policy query are set to specific value.
Check in the user account properties whether you have entered the attribute for email. Ex: xyz@company.com. The company should be entered to the users.

Questions

11.Error-The server is unwilling to process the request while setting Password which not matches to password complexity

The possible reason could be:

You may not have specified or opted for any options in 'Password Complexity' while creating user account.

Ex: There will be options for password complexity like length of password, characters that can be used or number of bad login attempts etc. You need to select any degree of complexity. Ignoring so will throw above error.

Questions

12. Error code: 8007052e

This error is caused when the supplied credentials are invalid.

13. Error code: 80070775

Reason: The referenced account is currently locked out and may not be logged on.

14. Error code: 800708c5

Reason: The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements.

Questions

14. 5 -Access is denied (Terminal Service / Folder Creation)

Reasons:

User does not have rights to create a home folder.
Users do not have access over terminal services.

Questions

16. No such user found. Verify the LDAP attribute in search query

Reason: No Users in AD matches with the criteria provided by you. Try choosing the correct matching attributes by checking with the query provided in the "Match criteria for Users in AD", this is obtained by clicking on "Update in AD" button and expanding "Select Attributes" box. Also, ensure that the help desk technician has rights/privileges in that particular OU.

Questions

17. Error Code 80072035 : Error In Setting Attributes. The server is unwilling to process the request.

Reason: The primary group specified in User Creation has been moved or deleted.

Questions

18 Error Code : 80072030 : Error In Setting Attributes. The server is unwilling to process the request.

Reason: The primary group/container specified in User Template that was selected during User Creation has been moved or deleted. (You are trying to create a child object inside an OU, but that parent OU does not exist)

Questions

19. Error Code : 80070005 - Access Denied

Reason: The User may be trying to access an object to which he has no permissions granted.

Questions

20. Error Code : 80072014 Error In Setting Attributes. The requested operation did not satisfy one or more constraints associated with the class of the object

Reason: You may encounter this type of error when the CSV file you are using to import values, does not satisfy the conditions associated with the attribute.

Questions

21. Error Code : 80072016 Error In Setting Attributes. The directory service cannot perform the requested operation on the RDN attribute of an object

Reason: You may encounter this type of error if any of the LDAP headers in the CSV file are mentioned inappropriately.

Questions

22. Error Code 35 : Error in Creating Terminal Services Home Directory/ Error in Creating Home Directory. The network path was not found.

Reason: The remote server path might not be accessible.

Questions

23. Error Code: 800704c3 - Error While accessing User in Setting Account Properties

Reason:Multiple connections to a server or shared resource by the same user, using more than one username, is not allowed. Disconnect
all previous connections to the server or shared resource and try again.

Questions

24. Error Code b7 : Error in Creating Profile Path

Reason: There may be a File/Folder that already exists with the same name.

Questions

25. When I delete the Remote Profile folder, it throws "Unable to Delete the profile. The handle is invalid - Error code:6."

Reason : There might not be any inherited permission on the folder. Check whether the particular user has delete permissions on that folder. This can happen even in a condition when the folder is currently in use.

Questions

26. When I try to modify users, I get an error message saying, "Unable to modify the user. Error: The specified directory service attribute value does not exist. Error code : 8007200a" What should I do now?

Reason: The following are the possible reasons why this error could occur:

The specified LDAP attributes are incorrect.
There are misplaced commas in the imported CSV file.
The specified custom LDAP attributes do not exist in the selected domain.

Please check the syntax of the specified attributes and the CSV file for misplaced commas. Also, ensure that the specified attributes are a part of the domain where you would like to use the attribute.

Questions

27. While adding user(s), I get the error message: 'License Level Exceeded'. What should I do now?

This message indicates that you have reached the limit for the maximum number of users permitted as per your license. To add more user(s), you should upgrade your license.

Questions

28. While creating new user(s) along with Lync Telephony options, either of these error messages is displayed: "Error while enabling Lync services for the user" or "Error occurred while enabling Lync Telephony options". What could be the possible reasons?

Mentioned below are the possible reasons for the above errors. Rectifying them would help you in avoiding these errors:

Missing values required for the settings of the required Telephony type. The values could be missing because of:
- Providing an empty value for the settings / the settings being left empty.
- You might have used a naming format but the attributes specified in the naming format might not have any values. For example, for 'Line URI' you might have specified the value as 'tel:%telephoneNumber%' but the attribute telephone number might have been empty.
Duplicate values for the settings that must have unique values. For example, in 'Line URI' you might have provided a value that another user already has and this might have caused the error.
The LDAP attributes provided in the settings might have some special characters. For example, you might have user '%mail%' to provide values to a Lync Telephony setting and the email address could have special characters like: %, $, #, etc. Though the mail attribute supports special characters, the Lync settings do not support these special characters.

Questions

29. Error Code 78: This function is not supported on this system.

Reason: The remote server path might not be accessible due to insufficient rights.

Questions

30. Error Code 80004005: Unspecified Error.

Reason: An object with same name already exists in the restore path.

Questions

31.Technician does not have permissions to perform the required operation on this object.

Reason: You may not be authorized to perform the required operation in this OU. Please contact your administrator to get the rights for this OU too.

Questions

32. While creating or modifying Room mailboxes with Resource In Policy Request/Resource Out Policy Request, you get these errors: 'The values is already present in the collection' or ' The parameter 'legacyExchangeDN must be a non-empty string'. What could be the possible reasons?

Reason: These errors would occur if the mailboxes selected for the Resource In Policy Request/Reqource Out Policy Request policies are legacy mailboxes. Just remove legacy mailboxes from the selected list, and perform the operation again.

Questions

Active Directory Reports

When I specify the details and generate the report, it says "No Reports available" or incomplete data
AD Reports shows an object that does not exist in the Active Directory?
Error Code : 80070035- Error in getting Shares. The network path was not found
Cannot process the argument transformation on the parameter 'Credential'.

1. When I specify the details and generate the report, it says "No Reports available" or incomplete data

It could be because of any of the following reasons:

When ADManager Plus could not contact the Domain Controller as it is not operational or due to network unavailability.
In case of multiple Domain Controllers, when the data is not replicated in all the Domain Controllers.
The LastLogonTime that is used to determine the inactive users and computers is not replicated in all the Domain Controllers. Hence, you need to specify all the Domain Controllers in the Domain Settings to enable ADManager Plus to retrieve the data from all the Domain Controllers.
When the password policy is not set (i.e., Max Password Age is set to zero), the Password Expired Users report and Soon to Password Expiry users report will not show any data.
For time-based reports like inactive users, inactive computers, recently logged on users, etc., the date and time of the machine running ADManager Plus should be in sync with the domain controllers.
Originally there would have been no data available in the corresponding Report.

Questions

2. AD Reports shows an object that does not exist in the Active Directory?

This mismatch could occur when the data is not synchronized with the Active Directory. The data synchronization with the Active Directory happens every day at 1.00 hrs. If ADManager Plus is not running at that time, you can initiate the data synchronization manually by clicking the icon of that domain from the Domain Settings.

3.Error Code : 80070035- Error in getting Shares. The network path was not found

Reason - The remote server path might not be accessible.

4. Cannot process the argument transformation on the parameter 'Credential'.

Reason: This error occurs when authentication credentials are not specified in the Domain Settings. To resolve this error,

Go to Domain Settings.
Click the Edit icon next to the domain for which you get the above error.
Enable Authentication and enter credentials of a valid domain account.
Once done, click Update.

Questions

Back to Modules

Active Directory Delegation

1. When a role is delegated, I get the error as "Permission Denied"/p>

One possible reason could be, the user or system as which the product is started do not have necessary privileges to perform this operation.

Refer to here for starting ADManager Plus in User or System account.

2. I am not able to login through my account!

The following are the possible reasons for that:

Invalid user name/ password.
Log on to restriction.
Account Disabled / Locked out / Expired
User must change password on next logon checked.

3. Reset second factor of authentication for the default admin account

If you have lost your authentication device, or cannot retrieve the verification code required to complete the authentication, you can reset the secondary authentication factor using the following steps.

Navigate to <Installation_Dir>\bin folder. By default, the path is C:\ManageEngine\ADManager Plus\bin.
Find and run the resetAdminTFAEnrollment.bat file.
You can now reenroll for the secondary authentication factor again by logging in to ADManager Plus.

Note: Authentication factor reset can be done only for the built-in admin account

Back to Modules

File Server Management

I tried to access a folder but the folder is empty.

The reasons could be the folder does not contain any data or you do not have permission to list the contents of this folder.
In case of a Cluster Shared Volume,

If the failover cluster and ADManager Plus are in different domains, then ensure that the DNS conditional forwarding in DNS server is configured in the domain where ADManager Plus is installed. This can be done by updating the following fields in the DNS conditional forwarding record,

The DNS Domain field should be mapped to the domain in which desired failover cluster is configured.
The IP address of master servers field should be mapped to the IP address of the DNS server of the same failover cluster domain mentioned in the DNS domain field.

When I try to set permissions on a folder, I get the following error message "Access denied; cannot set permissions for the folder";

The reason could be you do not have permissions to alter permissions on that particular folder.

I encountered the following error message while trying to modify permissions on a folder "Error occurred while modifying permissions for one or more folders"

The reason could be you do not have permissions to alter permissions on one of the folders or subfolders.

I encountered the following error message while trying to modify permissions on a folder "One or more of the permissions to be applied already exists"

The reason could be one of the permissions you are trying to apply has already been applied and is currently effective.

I encountered the following error message while trying to remove permissions from a folder "One or more of the permissions to be applied already exists";

The reason could be one of the permissions you are trying to remove has already been denied and is currently effective.

Why do deleted namespaces show up in DFS file servers?

When you delete a namespace using the DFS Management snap-in, sometimes it may not be reflected in the DFS Metadata. To resolve this issue, manually delete the namespaces in DFS metadata too.

To delete a namespace from DFS metadata:

Launch ADSIedit.msc.
Connect and expand Default naming context (the domain partition).
Expand and locate the following node:
CN=Dfs-Configuration, CN=System, DC=<domain_Name>, DC=<extension>
Delete the namespace that you've already deleted using the DFS management snap-in.

Back to Modules

Office 365 Management

While managing Office 365 licenses or creating Office 365 users, I get the following error "Unable to update license for this user. The set of licenses includes two or more service plans which cannot be assigned at the same time."

This error occurs due to invalid combination of licenses assigned to an Office 365 user. That is, if you try to assign same license in two or more service plans, you will get this error.

While selecting OUs, I get the following message "No data available for the specified criteria."

This error could occur if the selected OUs do not contain any users. Click 'refresh', select the desired OUs and try again.

Some users who are not present in AD are displayed, or some users who are present in AD are not displayed.

This mismatch could occur when the data is not synchronized with Active Directory. Click the refresh icon to synchronize ADManager Plus database with your AD.

While creating an Office 365 user, I get the following error "Invalid syntax Parameter Name."

This message is displayed when there is an error in the value being assigned to the parameter. There might be spaces or special characters in the values. Ensure that the parameter is not empty and does not contain any spaces or special characters.

While creating an Office 365 user, I get the following error "You must provide a required property: Parameter Name: FederatedUser.SourceAnchor."

This error occurs when you try to create an Office 365 user directly in a federated domain. To create an Office 365 user in a federated domain, the user must be created in Active Directory first, and then synchronized with Office 365 using DirSync.

While creating an Office 365 user, I get the following error "Must provide required parameter DisplayName/ UserPrincipalName."

Both of the above attributes are mandatory. Ensure that you provide valid values to both the attributes.

While creating an Office 365 user, I get the following error "Unable to add this user because a user with this user principal name already exists."

This error occurs when a user account with the same user principal name already exists in Office 365. Enter a different user principal name and try again.

While creating an Office 365 user, I get the following error "You must choose a strong password."

This error could occur if the specified password does not meet the password policy requirements. Ensure that the password you provide meets the required password policy settings such as minimum password length, password complexity, and password history requirements.

Back to Modules

Active Directory Migration

The following error was displayed while migrating AD objects using ADMT in ADManager Plus: "The following configuration required for SID history has not been performed. Auditing has not been enabled in the target domain. Unspecified error (0x80004005)."
Solution: Create an empty group called <DomainDNS>$$$ in both the source and target domains, respectively.

Back to Modules

Help Document

Troubleshooting Tips

Domain Settings

Admin Settings

Active Directory User Management

Active Directory Reports

Active Directory Delegation

File Server Management

Office 365 Management

Active Directory Migration