Pointsec-Protector-Troubleshooting.doc

Device Protector Troubleshooting Guide

Pointsec Protector Troubleshooting Guide

Table of Contents
Pointsec Protector – General Troubleshooting 3
General Server Troubleshooting Issues 3
1. User cannot run setup.exe from CD-ROM 3
2. Invalid License Code 3
3. Error 1069 – The service did not start due to logon failure 3
4. Disknet Pro Server Service on local computer started and then stopped 3
5. USB Printers/Scanners are not working 3
6. No Logs Appear 3
7. Unable to Add a Device to Device Manager 3
General Client Troubleshooting Issues 3
1. User cannot run setup.exe from CD-ROM 3
2. The server is unavailable 3
3. Error 1069 Service did not start due to logon failure 3
4. No authentication between the client and the server 3
5. Client is not receiving their correct profile 3
6. Cannot access previously allowed devices 3
7. You do not have permission to add/remove features or uninstall 3
Device Protector Troubleshooting by Subject 3
Server Installation Issues 3
1. Error 1603 – Fatal Error during installation 3
2. Cmd Prompt appears – Error creating tables 3
3. MMC does not connect to the Device Protector Server after Installation 3
Client Installation Issues 3
1. Error 1603 – Fatal Error during installation 3
Service Issues 3
1. Error 1053: Service did not respond to start or control request in timely fashion 3
2. MS SQL Server Service (Dependency Service) has not started 3
3. Service has no logon rights to DBMS 3
4. Error 7031 - Client Service unexpectedly terminated 3
Server Configuration Issues 3
1. Cannot add a device to Device Manager 3
2. DP Icon does not appear in the system tray 3
3. SMTP alerts not sent to Exchange 3
4. Cannot Access/Burn CD/DVDs 3
5. Logged on machines do not appear in the MMC 3
6. Users do not appear in the MMC 3
Client Configuration Issues 3
1. Cannot modify the registry/stop the service 3
2. Cannot enable local admin 3
3. User is picking up the default profile 3
4. Error when trying to connect to a machine via C$ 3
5. Redirecting Clients to a new Device Protector Server 3
6. PSG blocked the process “No Process” from performing an Unauthorised Operation 3
Server Upgrade Issues 3
1. Failure to re-register on upgrade 3
2. Database Migration: Error while upgrading database 3
Client Upgrade Issues 3
1. Failure to Upgrade 3
Server Uninstall Issues 3
1. Some files that need to be updated are currently in use. 3
Client Uninstall Issues 3
1. Internal Failure Error No 0x80040707 3
2. You do not have permission to add/remove features or uninstall 3
3. Please use Add/Remove Programs to de-install Device Protector 3

Pointsec Protector – General Troubleshooting
This section describes some of the possible causes of problems related to the Device Protector, and the recommended actions.
General Server Troubleshooting Issues
This section describes some of the possible causes of server-related problems, and the recommended actions.
The following problems are described in this section:
· User cannot run setup.exe from CD-ROM
· Invalid License Code
· Error 1069 – The service did not start due to logon failure
· Disknet Pro Server Service on local computer started and then stopped
· USB Printers/Scanners are not working
· No Logs Appear
· Unable to Add a Device to Device Manager
1. User cannot run setup.exe from CD-ROM
Copy the Server installation folder to the Desktop and run the setup again.
2. Invalid License Code
Incorrect Company Name/Code.
Check the customer’s details, support contract, and current license code.
3. Error 1069 – The service did not start due to logon failure
The logon account used by the service is incorrect. Check the account details and attempt to restart the service.
Note: The service account needs to be a domain account that has local administrator rights on the local machine, and the account must have 'logon as service' rights.
4. Disknet Pro Server Service on local computer started and then stopped
Some services stop automatically if they have no work to do, for example, the Performance Logs and Alerts Service.
A common issue here is that the user installed the server when prompted (Any User, Only Me) as Only Me when logged in with another username. When Only Me is selected, the username during installation is automatically inserted into this field. As a result, the service may not start.
5. USB Printers/Scanners are not working
The generic USB Printer/Scanner needs to be granted access along with USB Controllers.
6. No Logs Appear
Check that the filter is not enabled in the console.
7. Unable to Add a Device to Device Manager
In the Profile under Device Manager, the audit column must be selected to receive a device arrival event. Once this appears in the logs, it can be added to the Device Manager.
General Client Troubleshooting Issues
This section describes some of the possible causes of client-related problems, and the recommended actions.
The following problems are described in this section:
· User cannot run setup.exe from CD-ROM
· The server is unavailable
· Error 1069 Service did not start due to logon failure
· No authentication between the client and the server
· Client is not receiving their correct profile
· Cannot access previously allowed devices
· You do not have permission to add/remove features or uninstall
1. User cannot run setup.exe from CD-ROM
Copy the Client installation folder to the Desktop and run the setup again.
2. The server is unavailable
Check that the server is alive and can be pinged.
If Windows XP SP2 is installed, the firewall is most likely turned on and an exemption needs to be added.
3. Error 1069 Service did not start due to logon failure
The service should be running as local system on the client.
4. No authentication between the client and the server
Check that the client can ping the server.
If Windows XP SP2 is installed, then check that the firewall exemption has been applied.
5. Client is not receiving their correct profile
On the server, verify that the correct profile has been assigned to the group to which the user belongs.
6. Cannot access previously allowed devices
Check that the server can be pinged.
This is a common issue especially if the Group is synced with AD. The user may have been removed from a group.
7. You do not have permission to add/remove features or uninstall
The user does not have privileges to upgrade.

Pointsec Protector Troubleshooting by Subject
Specific troubleshooting subjects are addressed in the following sections:
· Server Installation Issues
· Client Installation Issues
· Service Issues
· Server Configuration Issues
· Client Configuration Issues
· Server Upgrade Issues
· Client Upgrade Issues
· Server Uninstall Issues
· Client Uninstall Issues
Server Installation Issues
This section describes some of the possible causes of server installation problems, and the recommended actions.
The following problems are described in this section:
· Error 1603 – Fatal Error during installation
· Cmd Prompt appears – Error creating tables
· MMC does not connect to the Device Protector Server after Installation
1. Error 1603 – Fatal Error during installation
Error 1603 is a generic machine-specific issue. One or more of the following fixes may resolve the error.
1. This error is known to occur on computers that do not have enough disk space for the installation. To increase your hard disk space, follow the instructions in “How Do I Increase Hard Disk Space on My Computer? “
2. The Temp directory is not clean. To clean the Temp directory, follow the instructions in Clean the Temp Directory.
3. A certain file on the machine is locked. To fix this:
· Close all applications running in the background.
· Reboot your computer.
· Run the installation again.
4. If you are using Windows 95, 98, ME, 2000, or NT, the Windows Installer Service may not be properly installed on the machine. Update the system with the latest Windows Installer Service by following the instructions in “How Do I Install the Windows Installer Engine on My Computer?”
5. If you are using Windows NT, 2000, or XP, make sure you have administrative privileges. To confirm you have administrative privileges, follow the instructions in” Acquire Administrative Privileges on Your Computer.”
6. Use Microsoft’s Windows Installer Cleanup utility to remove traces of previous installations. This utility does not remove files installed by the installation, which may need to be removed manually. For more information, refer to Microsoft’s Knowledge Base article “Description of the Windows Installer CleanUp Utility.”
2. Cmd Prompt appears – Error creating tables
Software needs to be removed and installed again because the default MSDE Instance already in operation.
If this is the case, an MSDE Instance must be manually installed.
MSI Logging should be enabled by creating the following keys in the registry and running uninstall again:
[HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer]
"Logging"="voicewarmup"
"Debug"=dword:00000007
The logs should appear as MSIXXXX.LOG files in the user's TEMP folder for normal installations:
c:\documents and settings\<username>\local settings\temp
or system TEMP folder for GPO based installs
c:\windows\temp
Note: This regkey is available upon request.
3. MMC does not connect to the Device Protector Server after Installation
Causes
If a custom installation was selected i.e. the database to be created on another machine using another MSDE\DBMS it is most likely that:
Keep existing database was selected.
The wrong machine name was entered.
Solution
1. Enable Server Debugging Logs and run setup.exe again:
HKLM\Software\Reflex\DisknetServer
2. Create a new dword called Debug and set this to 1. This can be found in SystemDrive\DNSRV.log.
HKLM\Software\Reflex\DisknetServer
3. Create a new dword called DebugXML and set this to 1. This can be found in SystemDrive\DNSRVxml.log.
Client Installation Issues
This section describes some of the possible causes of server installation problems, and the recommended actions.
The following problem is described in this section:
· Error 1603 – Fatal Error during installation
1. Error 1603 – Fatal Error during installation
Error 1603 is a generic machine-specific issue. One or more of the following fixes may resolve the error:
1. This error is known to occur on computers that do not have enough disk space for the installation. To increase your hard disk space, follow the instructions in “How Do I Increase Hard Disk Space on My Computer?”
2. The Temp directory is not clean. To clean the Temp directory, follow the instructions in “Clean the Temp Directory”.
3. A certain file on the machine is locked. To fix this:
· Close all applications running in the background.
· Reboot your computer.
· Run the installation again.
4. If you are using Windows 95, 98, ME, 2000, or NT, the Windows Installer Service may not be properly installed on the machine. Update the system with the latest Windows Installer Service by following the instructions in “How Do I Install the Windows Installer Engine on My Computer?”
5. On Windows NT, 2000, or XP, make sure you have administrative privileges. To confirm you have administrative privileges, follow the instructions in “Acquire Administrative Privileges on Your Computer.”
6. Use Microsoft’s Windows Installer Cleanup utility to remove traces of previous installations. This utility does not remove files installed by the installation, which may need to be removed manually. For more information, refer to Microsoft’s Knowledge Base article Description of the Windows Installer CleanUp Utility.
7. MSI Logging should be enabled by creating the following keys in the registry and running uninstall again:
[HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer]
"Logging"="voicewarmup"
"Debug"=dword:00000007
The logs should appear as MSIXXXX.LOG files in the user's TEMP folder for normal installations:
c:\documents and settings\<username>\local settings\temp
or system TEMP folder for GPO based installs
c:\windows\temp
Note: This regkey is available upon request.
Service Issues
This section describes some of the possible causes of service-related problems, and the recommended actions.
The following problems are described in this section:
· Error 1053: Service did not respond to start or control request in timely fashion
· MS SQL Server Service (Dependency Service) has not started
· Service has no logon rights to DBMS
· Error 7031 - Client Service unexpectedly terminated
1. Error 1053: Service did not respond to start or control request in timely fashion
This is a generic error message to indicate that the service has failed to start. To get more information, you need to enable debug logging on the server and then use the DNSrv.log file to check why the service failed to start.
1. Enable server debugging logs:
HKLM\Software\Reflex\DisknetServer
2. Create a new dword called Debug and set this to 1. This can be found in SystemDrive\DNSRV.log.
HKLM\Software\Reflex\DisknetServer
3. Create a new dword called DebugXML and set this to 1. This can be found in SystemDrive\DNSRVxml.log.
2. MS SQL Server Service (Dependency Service) has not started
Start the MS SQL Server Service.
3. Service has no logon rights to DBMS
Check the account permissions and roles in the DBMS.
4. Error 7031 - Client Service unexpectedly terminated
1. Enable Client Debug Logs:
HKLM\Software\Reflex\Disknet
2. Create a new dword called EnableDebugLogs and set this to 1.
This can be found in SystemDrive\DNCli.log.
Server Configuration Issues
This section describes some of the possible causes of server configuration problems, and the recommended actions.
The following problems are described in this section:
· Cannot add a device to Device Manager
· DP Icon does not appear in the system tray
· SMTP alerts not sent to Exchange
· Cannot Access/Burn CD/DVDs
· Logged on machines do not appear in the MMC
· Users do not appear in the MMC
1. Cannot add a device to Device Manager
In the Profile under Device Manager, the audit column must be selected (checked) to receive a device arrival event. Once this has appears in the logs, it can be added in Device Manager.
2. DP Icon does not appear in the system tray
In the Profile under User Interface, verify that the icon is actually configured to appear in the system tray.
Solution
1. Verify that the Device Protector icon is installed on the Client workstation. Select Start > My Computer. Click on C: Program Files>Reflex>Tray and then click on DNTray.exe and the Disknet system tray icon starts up.
2. Verify that the Reflex Disknet icon is installed within the “Run” key within the Windows Registry.
3. Select Start à Run à Regedit or Start à Run à Regedit32
4. Navigate to “HKEY_LOCAL_MACHINE\SOFTWARE