Crystal Reports Server- not accepting new NT groups

[Former Member]

Crystal Report Server (aka InfoView)- I'm logged into the CMC as admin, I go to Authentication, then "WindowsNT". Under Mapped NT Member Groups, I work at adding an NT Group. NT Authentication is enabled. Single Sing On is enabled. Default NT Domain is our company's domain. When I enter the new NT group in the proper syntax and click on "Add" and then "Update", I get this error message:

Error updating Windows NT authentication properties: Failed to commit objects to server : Duplicate object name in the same folder.

I cannot find this same object name in this location.

When I move away from the page and then return, I see the group listed. However, when I go to groups in order to set permissions and to view the users in the group, I get this error:

RETRIEVE ERROR: There was an error while retrieving data from the server: NT Authentication failed to get the members of the group with ID "S-1-5-21-664290670-206467230-137390319-52916". If the problem persists, please delete this group and re-map it into BusinessObjects Enterprise, then try again.

Deleting this group and re-mapped produces the same results.

The users do not appear under the USERS page either.

Although it appears that I can use that User Group for applying permissions to a access a category, tests from end users prove otherwise.

Does anyone know how to resolve this issue?

[BasicTek]

Hi Tony,

there could be any number of issues when by default something like adding an NT groups causes this issue. It's usually best to open a message with support as these issues can take multiple resolutions. But you can start here.

1) Why are you using NT instead of AD. the NT plugin no longer works in XI 3.0 and if you are just setting up for the first time I'd strongly recommend using AD and getting a service account(this is an AD user with a non-changing password used for quering AD).

2) If you really need to use NT then you will likely need to trace the CMS while mapping the group to see where things are going wrong.

3) try running the CMS under an AD account with local admin privilages, and the local policy setting "act as part of the operating system".

Let us know.

Regards,

Tim

[Former Member]

Thank you for a prompt reply.

I initially had started working with this problem through calling Business Objects technical support prior to the expiration of our last support agreement with them. They were unable to help.

In response to the questions here...

1) I never heard that there was a problem with NT. When attempting to set this up as AD, I get the following error: Error updating Windows AD authentication properties:

The secWinAD security plugin is not available. Please contact your system administrator for details

We have been up and running with this for over a year and I don't recall anything corporately about changing to AD from NT. I believe that corporately we are still on NT.

2) I'll work at setting the trace for this one and see how I fare.

[BasicTek]

Well AD supports 2000/2003 and works in XI 3.0 so just trying to save you some trouble possibly later. I haven't see a customer running NT as in NT 4.0 in quite some time. If you are on NT then this will be your only option. Are you mapping groups as domain\group or computer\group? Also are the groups on a DC or the local server?

RE: The error in AD... Are you saying you can't even get into the plugin? If so then that's an installation issue, should be worked with our deployment team. Could also be related to the issue with NT if something is missing in your install it could cause different problems in the different plugins. Can you get into the LDAP plugin? That too can be set to AD but isn't preferred unless your CMS is on unix.

Edited by: Tim Ziemba on Jul 15, 2008 6:33 PM

[Former Member]

Honest truth is that when we first configured this back in the fall of 2006 we just followed the lead of the BO tech that was assigned at that time and did what he told us to do.

We are running on Windows Server 2003, Standard Edition, Service Pack 1.

If we have been configured to this point using the Windows NT configuration, will it cause problems for us to pull up and move to Windows AD?

To this point, the groups that are up and running along with the group that failed to map were set up as domain\group.

The error in AD occurs after I entered information in and then clicked on "UPDATE". I'm not certain by that if I got into the plugin or not. With the LDAP I am able to see the screen to enter values, but not certain what values to attempt to enter at this point.

Just wondering what other trouble could possibly come later by using NT? Trouble like what we are seeing now?

Thanks!

[BasicTek]

ok so both plugins are pretty reliable but they work in different ways. The NT plugin offers a hostname type mapping for legacy NT
servername\groupname.

The ADplugin was designed for 2000/2003 and is the only one that works in XI 3.0 if you were planning on upgrading.

So did it just start working without changing anything? or I may have missed something. Was this working and then failed? It seemed you were setting it up initially?

[Former Member]

At this point, there hasn't been any discussion here about upgrading. Not out of the question, just had not heard that there were any major updates out there.

This has been up and working in production for a year and a half now using the NT setup. Although we have a change management system in place here, there have often been changes done by other groups that don't get communicated properly and we've had to dig around to figure out what changed in order to fix things again. At this point, I don't know of anything that changed that would have impacted us, but I can't be certain.

I first attempted to set this up late in the fall, if memory serves me correctly. With the recent change to SAP, I thought I might try reviewing this one again. We have been extremely outraged with the support we had received from BO and reached a point where I would only contact them if I had exhausted all other avenues to resolve an issue.

[BasicTek]

Wow, sorry about your experience with support... It's constantly improving if that's any help and the new SAP software should make things even better.

Anyway this SID seems to be a possible problem S-1-5-21-664290670-206467230-137390319-52916 you can use a tool such as sysinternals psgetsid to verify which group in AD this is. If the SID exists then we may be having resolution issues if bad then the problem was caused because someone deleted a mapped group.

You should be able to run both plugins fine at the same time if you wish to migrate at any time.

In the future try to get CMS logs when this is happening either AD or NT.

Regards,

Tim

[former_member203619]

Post has been moved to the BusinessObjects Enterprise Administration group.

Shawn

[former_member183750]

Tony, you've posted to the .NET support team. You'll be better served posting to the BO support forum:

https://www.sdn.sap.com/irj/sdn/businessobjects-forums

Select "Business Objects Enterprise Administration"