BlackBerry Forums Support Community
              

Closed Thread
 
LinkBack Thread Tools
Old 03-16-2010, 05:13 AM   #21 (permalink)
Knows Where the Search Button Is
 
Join Date: Nov 2008
Location: Isle of Man
Model: 9800
PIN: N/A
Carrier: Manx Telecom
Posts: 23
Post Thanks: 0
Thanked 1 Time in 1 Post
Default

Please Login to Remove!

Quote:
Originally Posted by sleeper55 View Post
open for any suggestions at this point!
Sleeper it strikes me that you are coming in on a domain that somebody else already laid out the Active Directory structures to and made it a little difficult to find simple things like Users due to them being assigned to all sorts of Organisational Units. The one sure fire way to find the BESAdmin account in the Domain is use the Find feature in the MMC for Active Directory Users and Computers.

In AD Users and Computers first select the root of the domain in the tree on the lefft of the screen. Then choose Action on the bar menu, then select Find. Type in the name of the account (In this case I assume it is BESAdmin that you created?) and click the find button. If the account exists then it will appear in the list and you can then right click it and select properties. You can then proceed as per my suggested fix of a few days ago quoted above.

Hope that solves the problem though it also sounds like somebody needs to document the OU structure of the Active Directory so that people like yourself have some way of referencing where users and computers are situated. Best of luck!
Offline  
Old 03-19-2010, 12:57 AM   #22 (permalink)
New Member
 
Join Date: Mar 2010
Model: 9530
PIN: N/A
Carrier: Verizon
Posts: 1
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default Problem Resolved

Quote:
Originally Posted by A_Zimbo View Post
Using Active Directory Users and Computers I went to the users container and right clicked on the user BESADMIN and selected properties. Under the Account Tab I set the following items in the "Account Options" list at the bottom of that tab.

Use Kerberos DES etc - Checked.
This account Supports Kerberos AES 128bit encryption - checked.
This account supports Kerberos AES 256bit encryption - checked.
Do not require Kerberos preauthentication - UNCHECKED.
I reset my system time which was about 7 minutes off. Then I followed the advice of A_Zimbo in configuring account properties for besadmin. I did not have to reboot. I tried logging in after setting change and it worked like a charm. Thanks!!
Offline  
Old 03-19-2010, 01:00 AM   #23 (permalink)
Knows Where the Search Button Is
 
Join Date: Nov 2008
Location: Isle of Man
Model: 9800
PIN: N/A
Carrier: Manx Telecom
Posts: 23
Post Thanks: 0
Thanked 1 Time in 1 Post
Default

Quote:
Originally Posted by Portland_Girl View Post
I reset my system time which was about 7 minutes off. Then I followed the advice of A_Zimbo in configuring account properties for besadmin. I did not have to reboot. I tried logging in after setting change and it worked like a charm. Thanks!!
That's true about the system time Portalnd girl. I read about that in the knowledge base somewhere. Silly me forgot to put that in my original post.
Offline  
Old 03-26-2010, 05:35 PM   #24 (permalink)
Knows Where the Search Button Is
 
Join Date: Jan 2007
Model: none
Carrier: ATT
Posts: 17
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Quote:
Originally Posted by A_Zimbo View Post
I had about eight or nine hours trying to resolve this yesterday and this is what I finally did to get this working. I am posting this here for others who may have the same issue and hopefully it may help the OP of this thread.

I made a discovery in the Security log of the Event viewer on my Server that was hosting both BES Express 5.0.1 as well as Exchange 2007. They are both on the same box. The Security log entry made reference to a Kerberos right being denied to the BESADMIN active directory account around the time I tried to login to the BES Admin service website. This was irrespective of whether I wanted to login to the BES Express Admin website as BESADMIN or as another login (Say my domain admin account).

I deduced from this that when the BES Express Admin Web service needs to verify your login it is being denied some sort of Kereberos Ticket and or elevated privilege. Since the Message indicated the problem to be with the BESADMIN Active Directory user that I created for installing BESX and of course used by the BESX background services to execute under, I checked out the properties of this account I had created and made the following changes / settings.

Using Active Directory Users and Computers I went to the users container and right clicked on the user BESADMIN and selected properties. Under the Account Tab I set the following items in the "Account Options" list at the bottom of that tab.

Use Kerberos DES etc - Checked.
This account Supports Kerberos AES 128bit encryption - checked.
This account supports Kerberos AES 256bit encryption - checked.
Do not require Kerberos preauthentication - UNCHECKED.

I rebooted the server (Not just restarting the background services!) and finally I was able to login to the BESX Administration Service web site under BESADMIN or under my Domain Admin login ID.

Hope that helps anyone else in this predicament. It was an unnecessarily long day yesterday getting this going thanks to that one stupid little problem.

Best Wishes all
These changes helped me get logged in. Thank YOU.
Offline  
Old 03-26-2010, 07:34 PM   #25 (permalink)
Knows Where the Search Button Is
 
Join Date: Nov 2008
Location: Isle of Man
Model: 9800
PIN: N/A
Carrier: Manx Telecom
Posts: 23
Post Thanks: 0
Thanked 1 Time in 1 Post
Default

Quote:
Originally Posted by chrislehr View Post
These changes helped me get logged in. Thank YOU.
That's great to hear Chris.

I wish though that a more Kerberus type person would tell us why we have to do this to a "Standard user" to get it to work. I can't think of any other product I have ever installed that required this sort of amendment to "out of the box" user settings. Very strange.

Glad the fix worked for you though.
Offline  
Old 03-26-2010, 08:34 PM   #26 (permalink)
BlackBerry Elite
 
knottyrope's Avatar
 
Join Date: Jan 2008
Location: Massachusetts
Model: DT60
OS: 123456789
PIN: t of blood has been taken
Carrier: AT&T-US with I dee ten tee errors
Posts: 7,324
Post Thanks: 399
Thanked 406 Times in 372 Posts
Default

M$ does not want it to be easy for BES installs, so they can sell active sync compatable devices.
__________________
I had to fall
To lose it all
But in the end
It doesn't even matter

Rocking the Motion with out lotion.
Offline  
Old 03-30-2010, 06:44 PM   #27 (permalink)
Knows Where the Search Button Is
 
Join Date: Mar 2010
Model: 8330
PIN: N/A
Carrier: VERIZON
Posts: 34
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

"The username, password, or domain is not correct. Please correct the entry." error appears when trying to log in to BlackBerry Administration Service using Windows Authentication
Document ID: KB20406 - Blackberry website-support and services- type in KB article kb20406

This is a known issue.
Offline  
Old 05-06-2010, 04:48 AM   #28 (permalink)
Knows Where the Search Button Is
 
Join Date: Apr 2010
Model: 8900
PIN: N/A
Carrier: BT
Posts: 18
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Quote:
Originally Posted by knottyrope View Post
M$ does not want it to be easy for BES installs, so they can sell active sync compatable devices.
to be fair to M$ - this install is littered with problems and poor documentation and bugs, its not all M$' fault (wow, never had to say that before lol)
Offline  
Old 06-04-2010, 06:21 PM   #29 (permalink)
New Member
 
Join Date: Jan 2010
Model: 9000
PIN: N/A
Carrier: VIVO
Posts: 3
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Kerberos, ohhhh kerberos and time issues...
My BESx box was 6 minutes off.
Just sync'd it and it worked! No reboots needed!

Thanks!
Offline  
Old 10-26-2010, 03:19 PM   #30 (permalink)
New Member
 
Join Date: Oct 2010
Model: na
PIN: N/A
Carrier: att
Posts: 1
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Quote:
Originally Posted by A_Zimbo View Post
I had about eight or nine hours trying to resolve this yesterday and this is what I finally did to get this working. I am posting this here for others who may have the same issue and hopefully it may help the OP of this thread.

I made a discovery in the Security log of the Event viewer on my Server that was hosting both BES Express 5.0.1 as well as Exchange 2007. They are both on the same box. The Security log entry made reference to a Kerberos right being denied to the BESADMIN active directory account around the time I tried to login to the BES Admin service website. This was irrespective of whether I wanted to login to the BES Express Admin website as BESADMIN or as another login (Say my domain admin account).

I deduced from this that when the BES Express Admin Web service needs to verify your login it is being denied some sort of Kereberos Ticket and or elevated privilege. Since the Message indicated the problem to be with the BESADMIN Active Directory user that I created for installing BESX and of course used by the BESX background services to execute under, I checked out the properties of this account I had created and made the following changes / settings.

Using Active Directory Users and Computers I went to the users container and right clicked on the user BESADMIN and selected properties. Under the Account Tab I set the following items in the "Account Options" list at the bottom of that tab.

Use Kerberos DES etc - Checked.
This account Supports Kerberos AES 128bit encryption - checked.
This account supports Kerberos AES 256bit encryption - checked.
Do not require Kerberos preauthentication - UNCHECKED.

I rebooted the server (Not just restarting the background services!) and finally I was able to login to the BESX Administration Service web site under BESADMIN or under my Domain Admin login ID.

Hope that helps anyone else in this predicament. It was an unnecessarily long day yesterday getting this going thanks to that one stupid little problem.

Best Wishes all
Just FYI doing this change also BREAKS the ability for the BES installer to communicate with a remote sql server. I found this out because the sysadmin prior to me applied this fix- I had to reinstall BES because of a data failure and it wouldn't work. Make sure you revert the changes if you have to reinstall BES!!

You'll get an error in your logs like this:

ConnectionItem::ConnectToDB: COM Error 0x80004005 - Unspecified error - Source: "Microsoft OLE DB Provider for SQL Server" - Description "Cannot generate SSPI context" - Command "ConnectionItem::ConnectToDB"

Last edited by kevincap : 10-26-2010 at 03:31 PM.
Offline  
Old 02-10-2011, 11:27 AM   #31 (permalink)
Thumbs Must Hurt
 
dlautman's Avatar
 
Join Date: Sep 2005
Location: USA
Model: 9000
OS: 5.0.0.509
Carrier: AT&T
Posts: 93
Post Thanks: 2
Thanked 0 Times in 0 Posts
Default Re: Login problem Blackberry Administration Service

FYI. I had this problem and just solved. The problem was I changed the admin password that was used to authenticate in blackberry server configuration - > administration service -> ad settings.

Re the Kerberos thing: if you're not using Kerberos and you have this checked, it will make you unable to log in.
Offline  
Closed Thread


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

Mitubishi Electric RM150DZ-2H / C77C203E Semiconductor High Power Insulated NEW
$49.95
Mitubishi Electric RM150DZ-2H / C77C203E Semiconductor High Power Insulated NEW pictureThree (3) Ferraz Shawmut A70QS50-4 AmpTrap Fuse 50 Amp SemiConductor 700VAC USED
$69.95
Three (3) Ferraz Shawmut A70QS50-4 AmpTrap Fuse 50 Amp SemiConductor 700VAC USED pictureFerraz Shawmut A50P600-4 Semiconductor Fuse 600AMP - New No Box
$27.95
Ferraz Shawmut A50P600-4 Semiconductor Fuse 600AMP - New No Box pictureASM Advanced Semiconductor Materials 73055-72046 Positioning Pin A Lot of 18 New
$353.19
ASM Advanced Semiconductor Materials 73055-72046 Positioning Pin A Lot of 18 New pictureASM Advanced Semiconductor Materials 16E00390B01 Pin Set PLB Slot 1 Lot of 2 New
$353.19
ASM Advanced Semiconductor Materials 16E00390B01 Pin Set PLB Slot 1 Lot of 2 New picture






Copyright 2004-2016 BlackBerryForums.com.
The names RIM and BlackBerry are registered Trademarks of BlackBerry Inc.