AnsweredAssumed Answered

cannot login after installing and testing windows agent on PC

Question asked by Tunde Sholanke on Dec 4, 2019
Latest reply on Dec 4, 2019 by Jay Guillette

Like • Show 0 Likes0
Comment • 9

I have installed th authentication manager and also added an agent on the server from a PC. After installing the Windows agent and configuring it, i tested the connectivity to the AM and it was successful. however, when i try to login with the passcode and token, it gives me no particular error but just returns to the login page. I also noticed another thing that is it duplicates the name account login (one will have normal windows sign on logo and the other will have RSA logo). something like this.

No one else has this question

Outcomes

9 Replies

Erica Chalfin Dec 4, 2019 7:54 AM
Mark Correct
Correct Answer
Tunde Sholanke,

When you try to authenticate with the new agent, are you seeing any failed authentication messages on the RSA Authentication Manager server? To do so, please read View Messages in the Activity Monitor. Messages here can help identify why authentication is failing.

When you set up the agent, do you recall setting up a challenge group for users? If so, what users are being challenged? See page 28 of the RSA Authentication Agent 7.4 for Microsoft Windows Group Policy Object Template Guide (English) for more information.

Regards,
Erica
Like • Show 0 Likes0
Actions
- Tunde Sholanke @ Erica Chalfin on Dec 4, 2019 8:02 AM
  Mark Correct
  Correct Answer
  Thanks. the thing is no message shows up. it just goes back to the normal screen for logon. on the AM activity monitor, it shows successfully authenticated.
  Like • Show 0 Likes0
  Actions
  - Jay Guillette @ Tunde Sholanke on Dec 4, 2019 8:36 AM
    Mark Correct
    Correct Answer
    If you see successful Passcode authentication in the RSA Security Console Real Time Authentication Monitor, RTM then the passcode and userID were sent from the agent to Authentication Manager, AM. This means there's probably another Credential Provider, CP that gets displayed or invoked - normal agent installation should make it that the RSA SecurID CP is the only one invoked. You'll probably need verbose logs from the RSA Windows agent,
    have a look at the CredentialProviderFilter(LogonUI).log or other CredentialProviderFilter(*).logs to see which Credential Providers are getting displayed. You may need to check the App, Security and System Windows Event logs too. It sounds like a second CP is not being successfully navigated, so should not be displayed here. The Windows agent might actually indicate which second CP is involved here, it's name might be in the (parentheses) after the CredentialProviderFilter part of the log name, e.g. CredentialProviderFilter(consent).log can be related to the consent application part of RDP.
    Like • Show 1 Like1
    Actions
    - Jay Guillette @ Jay Guillette on Dec 4, 2019 8:50 AM
      Mark Correct
      Correct Answer
      000012084 - RSA SecurID prompt does not appear when connecting with Remote Desktop Protocol RDP on Windows Server 2012 with RSA Authentication Agent 7.2.1 or 7.3.1 for Windows
      has an example of using gpedit to filter or display various Credential Providers
      Like • Show 0 Likes0
      Actions
      - Tunde Sholanke @ Jay Guillette on Dec 4, 2019 9:05 AM
        Mark Correct
        Correct Answer
        Thanks for this. The thing is i have done this installation on another system on the same network and it works well. I challenged all users.
        I was wondering if there is a setting i must have gone wrong. is there any documentation that shows how to install the agent and the configuration that needs to be done on the AM. just in case i am forgetting something. cos the other system works perfectly well.
        Like • Show 0 Likes0
        Actions
        Jay Guillette @ Tunde Sholanke on Dec 4, 2019 9:18 AM
        Mark Correct
        Correct Answer
        You might run gpedit on each Windows machine to compare the Credential Provider filters of the one that works fine with challenge all and the one that challenges with the RSA Credential Provider, but then another CP tags along - that is the CP that probably needs to be filtered.
        Like • Show 0 Likes0
        Actions
        Tunde Sholanke @ Jay Guillette on Dec 4, 2019 10:35 AM
        Mark Correct
        Correct Answer
        how do i filter? so i found that the credential filters on both systems contain 2 credientials. RSA and A generic one.
        however, the last logon credential on the working system, is termed SIDcredentialprovider in Windows while the one for the system that is not working is showing a generic credential.
        DO i have to force the system to use RSA and how do i do that. although there must be a one time way to do this, rather than forcing the change from the registry.
        Like • Show 0 Likes0
        Actions
        Jay Guillette @ Tunde Sholanke on Dec 4, 2019 11:44 AM
        Mark Correct
        Correct Answer
        You might need to disable the generic CP on the non-working system, or exclude.
        See what the Working system has SIDcredentialprovider set to; disabled or NOT filtered/excluded, and try the same on non-working system.
        Like • Show 0 Likes0
        Actions
  - Erica Chalfin @ Tunde Sholanke on Dec 4, 2019 8:45 AM
    Mark Correct
    Correct Answer
    Tunde Sholanke,
    
    For security purposes we never provide a message on the agent itself as to why authentication failed. All messages about the success or failure of an authentication attempt are shown only in the authentication activity reports on the server.
    
    Like Jay Guillette suggested, review the logs to see which other credential providers are displayed.
    
    Regards,
    Erica
    Like • Show 0 Likes0
    Actions

cannot login after installing and testing windows agent on PC

Outcomes

Related Content

Recommended Content