DC Agent initial diagnostic steps

DC Agent Troubleshooting | Web Protection Solutions | v8.5.x | 29-Apr-2022

To start troubleshooting DC Agent user identification problems, start by assessing the status of the DC Agent service:

On the DC Agent machine, open the Windows Services tool and make sure that the Websense DC Agent service has started. If the service has stopped, right-click the service name and attempt to start it.

Regardless of whether the service starts, was already started, or refuses to start, continue with the next step.

Open the Windows Event Viewer to look for error messages and warnings from the Websense DC Agent service.

The most common DC Agent errors are:

ERROR_ACCESS_DENIED, which indicates a permissions issue. Although they do not make any changes to the domain, both DC Agent and User Service must run with domain administrator privileges. If you suspect a permissions issue, you can enable directory service auditing to find out what user and group information your software is trying to access. See DC Agent: ERROR_ACCESS_DENIED - 5.

ERROR_BAD_NETPATH, which indicates a network communication issue. See DC Agent: ERROR_BAD_NETPATH - 53.

Make sure that users are being identified correctly

To ensure that users are being identified correctly, start with the following procedure:

Log on to a machine whose users do not appear to be getting identified properly.

Open a browser and navigate to 4 or 5 distinctive websites.

Go to the DC Agent machine and check the Windows Event Viewer for error messages. If error messages appear, see:

DC Agent: Error Code 1058 (seen on startup)

DC Agent: ERROR_ACCESS_DENIED - 5

DC Agent: ERROR_BAD_NETPATH - 53

If there are no errors, open the Forcepoint Security Manager and use Real-Time Monitor or investigative reports to see if your Internet activity (in step 2) was logged as the correct user.

If the correct user name appears associated with the requests, there may be a policy configuration issue, rather than a user identification issue. Use the Check Policy tool in the Security Manager to troubleshoot the issue.

If the user name is incorrect, see DC Agent doesn't see some or all users.

If no user name information appears, verify that DC Agent and User Service are able to communicate with your directory service, and that the Windows Computer Browser service is enabled on the DC Agent machine.

To enable the Computer Browser service, open the Windows Services tool, right-click Computer Browser, and select Properties. Change the Startup type selection to Automatic, then click Start.

You can also use either Real-Time Monitor, in the Security Manager, or the command-line TestLogServer utility, located on the Log Server machine, to verify that user names are being associated with Internet requests.

See Real-Time Monitor for more information.

For more information about TestLogServer see Using TestLogServer for Troubleshooting.