You may have specified an invalid PDC / BDC / Active Directory or there is a typo in the PDCname parameter!
Make sure the value for the string-value pair PDCname under registry key HKLM\SOFTWARE\System Integrators\License Server\version is
correct.
License Broker™ runs under the anonymous Internet Guest (IUSR_machinename) account.
While this account had enough rights under old NT domain to validate group membership of the user across IIS and PDC, under the new
Active Directory in Windows 2000, this account does not have the rights to successfully query group membership!
You must explicitly add the IUSR_machinename (or any substitute account like DOM/lbuser you may be using in
place of default anonymous account) to the "Pre-Windows 2000 compatible access" group.
Additionally if you are using a substitute account like DOM/lbuser in place of IUSR_machinename (for
example, you would do this when your IIS and Active Directory Domain Controller are on two different machines), then you must
also ensure that Log on locally right is assigned to both the DOM/lbuser and the administrator that is administering the
License Broker™ Server. Administrator should have this same privilege to ensure Group policy administration will work.
Remember that Log on locally must be an effective policy setting, not just local security policy.
The same goes for the LBAdminGrp as well. If you are restricting access to the License Broker™
Administration tool to members of LBAdminGrp instead of Administrators, then that group must also be given Log on locally
right as above. Otherwise drill-down from Software Discovery Report to Group policy definition screen will not auto-populate the
group names of users that ran the application.
Additionally, the IUSR_machinename or the substitute domain account DOM/lbuser and the administrator account or
LBAdminGrp must also have full-control access privilege to the folder where License Broker Server is installed (usually
\Program Files\System Integrators\License Server).
Finally, Ensure the
following is selected in Internet Service Manager: go to the SIScripts
Properties page, Directory Security settings, and ensure 'Allow Anonymous
Access' and 'BASIC' are selected in the Authentication
Methods panel. Ensure 'Integrated Windows' is not selected!. Otherwise drill-down from Software Discovery Report to Group policy definition screen will not auto-populate the
group names of users that ran the application. |
