Technical Library | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
DC Agent Troubleshooting : DC Agent initial diagnostic steps
DC Agent initial diagnostic steps
Topic 50322 | DC Agent Troubleshooting | Web Security Solutions | v7.7.x, 7.8.x | 27-Mar-2013
Locate error messages
To start troubleshooting DC Agent user identification problems, start by assessing the status of the Websense DC Agent service:
1.
On the DC Agent machine, open the Windows Services dialog box (Start > Administrative Tools > Services) and make sure that the Websense DC Agent service has started. If the service has stopped, right-click the service name and attempt to start it.
Regardless of whether the service starts, was already started, or refuses to start, continue with the next step.
2.
Open the Windows Event Viewer (Start > Administrative Tools > Event Viewer) to look for error messages and warnings from the Websense DC Agent service.
The most common DC Agent errors are:
*
ERROR_ACCESS_DENIED, which indicates a permissions issue. Although they do not make any changes to the domain, both Websense DC Agent and Websense User Service must run with domain administrator privileges. If you suspect a permissions issue, you can enable directory service auditing to find out what user and group information Websense software is trying to access. See DC Agent: ERROR_ACCESS_DENIED - 5.
*
ERROR_BAD_NETPATH, which indicates a network communication issue. See DC Agent: ERROR_BAD_NETPATH - 53.
Make sure that users are being identified correctly
To ensure that users are being identified correctly, start with the following procedure:
1.
Log on to a machine whose users do not appear to be getting identified properly.
2.
Open a browser and navigate to 4 or 5 distinctive Web sites.
3.
Go to the DC Agent machine and check the Windows Event Viewer for error messages. If error messages appear, see:
*
DC Agent: System error while enumerating domain controllers
*
DC Agent: Error Code 1058 (seen on startup)
*
DC Agent: ERROR_ACCESS_DENIED - 5
*
DC Agent: ERROR_BAD_NETPATH - 53
4.
If there are no errors, open the Web Security manager and use Real-Time Monitor or investigative reports to see if your Internet activity (in step 2) was logged as the correct user.
*
If the correct user name appears associated with the requests, there may be a policy configuration issue, rather than a user identification issue. Use the Check Policy tool in the Web Security manager to troubleshoot the issue.
*
If the user name is incorrect, see DC Agent doesn't see some or all users.
*
If no user name information appears, verify that the Websense DC Agent and Websense User Service components are able to communicate with your directory service, and that the Windows Computer Browser service is enabled on the DC Agent machine.
To enable the Computer Browser service, open the Windows Services dialog box (Start > Administrative Tools > Services), right-click Computer Browser, and select Properties. Change the Startup type selection to Automatic, then click Start.
You can also use Real-Time Monitor, accessed via the Web Security manager, or the command-line TestLogServer utility, located on the Log Server machine, to verify that user names are being associated with Internet requests.
*
See the Web Security Help for more information about Real-Time Monitor.
*
For more information about TestLogServer see Using TestLogServer for Web Security Troubleshooting.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
DC Agent Troubleshooting : DC Agent initial diagnostic steps
Copyright 2016 Forcepoint LLC. All rights reserved.