Unable to integrate two RSA Authentication Agents for Windows on the same server (Node Verification Mismatch)
Originally Published: 2015-08-12
Article Number
Applies To
RSA Product/Service Type: Authentication Agent for Windows
RSA Version/Condition: 7.2.1
Platform: Microsoft Windows
Issue
Cause
Resolution
- Clear all known node secrets for the RSA Authentication Agent for Windows, from the third-party product and from the authentication agent record found in the Security Console of Authentication Manager.
- Navigate to Access > Authentication Agents > Manage Existing.
- Select the Restricted or Unrestricted tab. depending on the agent type.
- Use the search fields to find the agent with the node secret that you want to manage.
- Click on the context arrow next to the agent name and choose Manage Node Secret.
- Select the Clear Node Secret check box.
- Click Save.
- To clear the node secret from the RSA Authentication Agent for Windows use the RSA Control Center and click Clear Node Secret then follow the prompts.
If the deployment is using third party authentication devices such as Check Point, Cisco, SonicWALL, etc., please refer to the third-party documentation on how to clear the node secret from the third-party product.
- From the Security Console, navigate to Reporting > Real-Time Activity Monitors > Authentication Activity Monitor.
- In the popup window, click Start Monitor.
- Following steps provided by Microsoft, deactivate User Access Control (UAC) on the Microsoft Windows 2012 server.
Performing this step will require a system restart.
- Perform a test authentication from the third-party product.
- The node secret (securid) file maybe stored in the C:\Windows\System32 or C:\Windows\SysWOW64 folder. If this is not where the node secret is being stored, refer to the third-party product documentation for information on where the node secret is stored.
- Monitor the real-time authentication activity monitor should a failed authentication occur.
- Copy the node secret to C:\Program Files\Common Files\RSA Shared\Auth Data folder, which is where the RSA Authentication Agent for Windows is expecting to see the node secret.
a. Use the Node Secret Upload utility (agent_nsload.exe) to move the node secret via command prompt. The syntax would be:
b. It is common that applications running on Windows 2012 to be 64-bit so copy the node secret from \SysWOW64 to \Auth Data directory where applicable with the command:
agent_nsload -c "C:\Windows\system32\securid" "C:\Program Files\Common Files\RSA Shared\Auth Data"
Chapter 3: Installing RSA Authentication Agent (page 47) covers the usage of the Node Secret Load utility in the RSA Authentication Agent 7.2 Installation and Administration Guide.
b. It is common that applications running on Windows 2012 to be 64-bit so copy the node secret from \SysWOW64 to \Auth Data directory where applicable with the command:
agent_nsload -c "C:\Windows\SysWOW64\securid" "C:\Program Files\Common Files\RSA Shared\Auth Data"
- Use the RSA Control Center of the RSA Authentication Agent for Windows to perform a test authentication and monitor the real-time authentication activity monitor should a failed authentication occur.
- Should there be a requirement to have UAC enabled on the Microsoft Windows 2012 server, then reverse the changes made in Step 5.
Notes
Also, the RSA Authentication Agent 7.2.1 for Windows software provides the Node Secret Upload utility (agent_nsload.exe) file.
