Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Deployment Guide for Cisco Directory Connector

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Deployment Guide for Cisco Directory Connector

Chapter Title

Manage and Troubleshoot Cisco Directory Connector

Results

Updated:
November 20, 2019

Chapter: Manage and Troubleshoot Cisco Directory Connector

Manage and Troubleshoot Cisco Directory Connector

Upgrade to the Latest Cisco Directory Connector

To keep your deployment in compliance and get the latest features, functionality, bug fixes, and security enhancements, you must always upgrade to the latest version of Cisco Directory Connector. If you do not upgrade to the latest version that's available, you may experience issues, such as Cisco Directory Connector no longer synchronizing properly or being on a version that doesn't support the mandatory TLS 1.2 requirement.

Cisco Directory Connector automatically notifies you when a new version is available. Always upgrade to the latest version to avoid problems. You also see a notification in the Windows task bar.


Tip

Although you can manually install Cisco Directory Connector updates, we recommend that you follow the steps in Set Automatic Upgrades for Cisco Directory Connector to let the app manage your upgrades automatically.

Before you begin

  • We recommend performing an upgrade at your earliest convenience during a maintenance window.

  • Prepare one hour for the upgrade and note that provisioning and deprovisioning will not work during this time.

Procedure

Step 1

Either click on the notification in the Windows taskbar, or right-click on the Cisco Directory Connector icon in the Windows taskbar to start the upgrade process.

Step 2

Follow the instructions to complete the upgrade.

Step 3

Relaunch Cisco Directory Connector and sign in with your admin credentials.

Step 4

Verify the version number of the software under Help > About.

What to do next

For a fresh installation of Cisco Directory Connector, you can download the zip file from this link and then follow the installation steps in this guide.

Configure General Settings for Directory Connector

Use this procedure to configure general settings as needed, such as the name of the server running Cisco Directory Connector, the log levels, automatic upgrades, and the preferred settings for the domain controllers. The name of the connector appears on the dashboard in the connectors section, along with any other connectors that are running.

Procedure

Step 1

From Directory Connector, go to Configuration, and then click General.

Step 2

In the Connector Name field, enter the connector name. This field shows only the computer name that is currently running the connector.

Step 3

Choose the log level from the drop-down. By default, the log level is set to info. The available log levels are:

  • Info (Default)—Shows informational messages that highlight the progress of the application at a high level.

  • Warn—Shows potentially harmful situations.

  • Debug—Shows detailed informational events that are most useful to debug an application. When you see any issue, set this log level and send the event log to support when you open a case.

  • Error—Shows error events that might still allow the application to continue running.

Step 4

Choose the Preferred Domain Controllers to set the order of domain controllers for synchronizing identities.

The domain controllers are accessed from top to bottom. If the top controller is unavailable, choose the second controller on the list. If no controller is listed, you can access the primary controller.

Step 5

Check Automatically upgrade to the new Cisco Directory Connector version if you want automatic upgrades to occur.

It's always important to keep your Cisco Directory Connector software up to date to the latest version. We recommend that you check this setting to allow automatic upgrades to the software to be installed silently when they're available.

Step 6

Check LDAP over SSL to use the secure LDAP (LDAPS) as the connection protocol.

Note 

If you don't check LDAP over SSL, DirSync will continue to use the LDAP connection protocol.

LDAP (Lightweight Directory Application Protocol) and Secure LDAP (LDAPS) are the connection protocols used between an application and the Domain Controller within the infrastructure. LDAPS communication is encrypted and secure.

Configure the Connector Policy

You can set the maximum number of deletes that can occur during synchronization. Running synchronization does not delete objects from your on-premises Active Directory. All objects are deleted only from the cloud.

For example, you set 1 as the delete threshold trigger value. When you do full or incremental sync, if the number of users you want to delete is more than the setting, the directory connector shows a warning. If you click Override Threshold, you can start full or incremental sync successfully, but you will see this override notice the next time you run the policy.

Procedure

Step 1

From Directory Connector, click Configuration, and then choose Policy.

Step 2

Check the Enable delete threshold trigger box if you want to add a threshold trigger.

Choosing this option triggers an alert if the number of deletes exceeds the threshold. When the deletion account exceeds the one that you define, the synchronization fails.
Step 3

Enter the maximum number of deletes that you want. The default is 20.

Note 
We recommend that you do not increase the default value.
Step 4

Click Apply.

Set the Connector Schedule

You can set the times that you want to synchronize your Active Directory. Failover is used for high availability (HA). If one connector is down, we switch to another standby connector after the predefined interval.

Procedure

Step 1

From Cisco Directory Connector, click Configuration, and then choose Schedule.

Step 2

Specify the Incremental Synchronization Interval in minutes.

By default, an incremental synchronization is set to occur every 30 minutes. The full incremental synchronization does not occur until you initially perform a full synchronization.

Step 3

Change the Send Reports per… time value if you want the change how often reports are sent.

Step 4

Check Enable Full Sync Schedule to specify the days and times on which you want a full synchronization to occur.

Step 5

Specify the Failover Interval in minutes.

Step 6

Click Apply.

Multiple Domain Scenarios

The way multiple domain works is based on domain priority. For objects that have the same key value in different domains, after synchronization, the data from the higher priority domain rewrites the data from lower priority domain.

Objects that have same key value are linked into one record in the database.

The key value for "User" is Email address; the key value for "Group" is Group name.

Example Use Case for Multiple Domains

This example assumes an organization with two domains—example1.com and example2.com, in order of priority.

  • Add user1(email: user@example1.com) to the Active Directory of example1.com.

  • Add group1(Group name: Test) to the Active Directory of example1.com.

  • Add user2(email: user@example2.com) to the Active Directory of example2.com.

  • Add group2(Group name: Test) to the Active Directory of example2.com.

Synchronization on example1.com

As a use case, user2 and group2 are synchronized to the cloud and appear in https://admin.webex.com, whereas user1 and group1 are not.

If you do a full or incremental synchronization for example1.com, user1 and group1 are synchronized. Also, user2 and group2 are overwritten by user1 and group1's information.

User1 links to user2 as the same record in the database; group1 links group2 as the same record in the database.

Synchronization on example1.com and example2.com

As a use case, user2 and group2 are synchronized to the cloud and appear in https://admin.webex.com, whereas user1 and group1 are not.

Consider these steps:

  1. Delete user1 and group1 on the Active Directory for example1.com.
  2. Do a full or incremental synchronization for example1.com.

    Result: the user's information is not changed in https://admin.webex.com. User2 isn't linked to user1, and group2 isn't linked to group1.

  3. Do an incremental synchronization for example2.com.

    Result: the user's information is not changed in https://admin.webex.com.

  4. Do a full synchronization for example2.com.

    Result: user2 and group2’s information is listed in https://admin.webex.com.

Synchronize a New Domain And Preserve an Existing Domain

If you want to synchronize a new domain (B) while maintaining the synchronized user data on another existing domain (A), ensure that you install Cisco Directory Connector for domain (B) synchronization on a supported Windows server. The connector binds to the new domain after the initial setup, and the user information under domain (A) remains unaffected.

Every domain must have its own active connector. Consider two domains with the following setup: domain A with connectors (ca1) and (ca2) for local high availability (HA); domain B with connector (cb1). (ca1)and (ca2) serve domain A. In this scenario, one connector is active and the other is standby (HA). This design keeps the domain synchronized, because one connector is always active. So, cb1 is the active connector for domain B, because domain A already has an active connector (ca1 or ca2).

Set the Domain Priority

Use this procedure to change the priority of your Active Directory domains. Domain priority lets you determine the primary domain, secondary domain, and so on. This helps when two users from two different domains have the same email value synchronized to one organization.

Do not use this procedure if you have a single domain listed in the Directory Connector. If you try, the connector shows you a message, stating that domain priority is not required.

Before you begin

To avoid errors, install or upgrade to the latest version of Cisco Directory Connector. You must download it from https://admin.webex.com.

Procedure

Step 1

From Cisco Directory Connector, click Dashboard.

Step 2

Go to Actions, and then click Set Domain Priority.

Step 3

Highlight one domain in the list, click Up or Down to change this domain's priority, and then click Save to save this change.

Note 

The domains are sorted by priority from top to bottom.

Switch Domains

Use this procedure to rebind the Cisco Directory Connector to a different domain.

Before you begin

  • Make sure no synchronization tasks are running before you switch domains.

  • To avoid errors, install or upgrade to the latest version of Cisco Directory Connector. You must download it from https://admin.webex.com.

Procedure

Step 1

From Cisco Directory Connector, click Dashboard.

Step 2

Go to Actions, and then click Switch Domain.

Step 3

After reading the caution, if you understand the affect this change has on your deployment and you're still sure, click Yes.

If you switch a domain, then you are signed out of the current Cisco Directory Connector, other domains in the connector are unregistered, and the connector information on that computer is deleted.

Step 4

Sign back in to the Cisco Directory Connector and rebind the domain.

Turn Off Directory Synchronization

If you need to stop synchronization from Cisco Directory Connector, you can temporarily turn it off from Cisco Webex Control Hub.

Procedure

Step 1

From the customer view in https://admin.webex.com, go to Settings, scroll to Directory Synchronization, and then choose one:

  • Click and then click Turn Off next to the connector instance that you want to turn off.
  • Click Turn Off All Directory Synchronizations to stop synchronization from all connector instances.
Step 2

After you read the prompt, click Turn Off.

Synchronization stops until you reenable it from Cisco Directory Connector.

Uninstall and Deactivate Cisco Directory Connectors

After you uninstall an instance of Cisco Directory Connector, you must deregister it. Completely remove a Cisco Directory Connector for any of these scenarios:

  • You don't want to use directory synchronization any more.

  • You don't want to use one of multiple directory connectors (high availability).

  • You want to change the domain and install another connector.

Before you begin

  • You may have multiple instances of Cisco Directory Connectors set up for high availability (HA) or multiple domain synchronization. Disable the synchronization if you are uninstalling the only or last remaining instance of Cisco Directory Connector.

  • Save and close any important work before you uninstall Cisco Directory Connector.

Procedure

Step 1

From your Windows machine, go to Control Panel, and then click Programs and Features.

Step 2

From the program list, click Cisco Directory Connector, choose Uninstall, and then follow the prompts.

You might have to reboot your system to complete the uninstallation.
Step 3

From the customer view in https://admin.webex.com, go to Settings, scroll to Directory Synchronization, click and then click Deactivate next to the directory connector instance that you want to uninstall.

Step 4

After you read the prompt, click Deactivate.

Unless there's another Cisco Directory Connector in a high availability (HA) deployment, user accounts are not synchronized any more.

Run the Diagnostic Tool

You can use the built in diagnostic tool to troubleshoot your Cisco Directory Connector deployment. This tool is installed as part of Cisco Directory Connector 3.4 onwards.

If synchronization didn't work properly, you may have a configuration or network error. This tool tests your connection to LDAP so that you can diagnose errors yourself before contacting support. If the tool returns any error, you can send the detailed log results to support.

Procedure

  • To run tests for Active Directory Domain services:

    1. Go to the start menu, locate Cisco Directory Connector, click Cisco Directory - Diagnostic. Click the AD-DS tab, enter your Domain then click Load Domain Controllers.

    2. Choose one Domain Controller from the list.

      Don't change the entry later, because incremental search must always run on the same Domain Controller.

    3. By default, all paths are searched, but you can choose one Attribute and then click Test to check that value.

    4. Configure more filters in the Active Directory Queries section, such as either or both Users and Group objects and search filters.

    5. Check Auto Fill Cookie to automatically generate a cookie for a search.

    6. Click Query to start a new incremental or complete search. This search may take a few seconds.

    7. When the test is complete, click Save to save a log entry, which you can send to the support team for analysis when you open a ticket.

  • To run tests for Active Directory Lightweight Directory services:

    1. Go to the start menu, locate Cisco Directory Connector, click Cisco Directory - Diagnostic. Click the AD-LDS tab, enter your Host and Port, and then click Load Partitions.

    2. Choose a Partition from the list and then click Connect.

    3. By default, all paths are searched, but you can choose one Attribute and then click Test to check that value.

    4. Configure more filters in the Active Directory Queries section, such User, UserProxy, and UserProxyFull and search filters.

    5. Check Auto Fill Cookie to automatically generate a cookie for a search.

    6. Click Query to start a new incremental or complete search. This search may take a few seconds.

    7. When the test is complete, click Save to save a log entry, which you can send to the support team for analysis when you open a ticket.

  • To run tests for the Lightweight Directory Access Protocol (LDAP):

    1. Go to the start menu, locate Cisco Directory Connector, click Cisco Directory - Diagnostic. Click the LDAP RAW tab, enter your Root Path, Filter, and choose an entry from Attributes then click Load Partitions.

    2. Check the following options as needed:

      • ObjectSecurity—If this option is present, the caller requires no rights and can see only objects and attributes that are accessible to the caller. If this option is not present, the caller has the right to replicate changes.

      • ParentsFirst—Ensures that all parents of the children come before their children.

    3. Choose a value for ExtendedDN.

      This value is used with an extended LDAP search to request an extended form of object Distinguished Name.

    4. Choose a value for ReferralChasing.

      A referral chase is initiated when a domain controller returns a referral from a query—for example, for details of a query result that may be outside the namespace (such as group members in another domain or forest).

    5. Click Query to start a new incremental or complete search. This search may take a few seconds.

    6. When the test is complete, click Save to save a log entry, which you can send to the support team for analysis when you open a ticket.

Troubleshooting and Fixes for Cisco Directory Connector

You may encounter an error message or other issue in Cisco Directory Connector. Also, after Cisco Directory Connector synchronizes user information, the connector may send you an email report that lists any problems with the synchronization. See the sections that follow for problems that may arise, possible causes, and proposed solutions you can try before contacting support.

Install

Cisco Directory Connector Stopped Working

Problem You received alert emails notifying you that your Cisco Directory Connector is not working.

  • The Cisco Directory Connector may not be installed correctly.

  • The Cisco Directory Connector may not be running.

  • The network may not be available.

Solution Try the following:

  • Open the Control Panel, then Programs and Features. Locate Cisco Directory Connector. If it’s not there, download the latest version from Cisco Webex Control Hub and install it.

  • Open Service and locate Cisco DirSync Service. Make sure that it displays the status as Started. If the service is stopped, right-click and select Start to restart the service.

  • Make sure the server on which you installed the Cisco Directory Connector has the access to Internet.

Reinstallation Error

Problem If you immediately install a new connector after uninstalling an old one, you may see an error message.

Possible Cause In Windows Server 2012, the uninstall client needs time to delete the service account from service list.

Solution After some time passes, try the installation again.

Sign In

Cisco Directory Connector Crashes During SSO Sign In

Problem Cisco Directory Connector may crash after you enter an email address from an SSO sign in page.

Solution Try the following:

Do these steps to configure a new group policy:

  1. Go to the domain controller and open Group Policy Management (gpedit.msc).

  2. Right click a specific OU or domain, and select Create a GPO in this domain, and Link it here…

  3. Give the policy a name, then right click and choose Edit.

Do these steps to change the policy at the machine level:

  1. Go to Computer Configuration > Preferences > Windows Settings, right click Registry, choose New, and then Registry Item.

  2. For Key Path, enter or navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main.

  3. Enter Disable Script Debugger for Value, and enter no for Value data.

    The settings should match this screenshot:

Do these steps to change the policy at the user level:

  1. Go to User Configuration > Preferences > Windows Settings, right click Registry, choose New, and then Registry Item.

  2. For Key Path, enter or navigate to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main.

  3. Enter Disable Script Debugger for Value, and enter no for Value data.

    The settings should match this screenshot:


Note

The changes take effect after you run gpupdate /force, the machine restarted (for machine changes), or the user signs in again (for user changes).

Cisco DirSync Service Connector Could Not Be Registered

Problem Sign in fails and this message appears: "The Cisco DirSync Service Connector could not be registered."

Solution The Windows system on which Cisco Directory Connector is installed must be a member of Active Directory.

No Sign In Page Appears

Problem You opened Cisco Directory Connector and the sign in page didn't appear.

Solution Try the following steps:

  1. Solution  In Internet Explorer, go to https://cloudconnector.cisco.com/SynchronizationService-v1_0/?orgId=GLOBAL. Try the link in other browsers like Chrome and Firefox, too.

  2. Solution If Internet Explorer can’t visit the link but other browsers can, check Internet Explorer settings and check the TLS 1.1 and 1.2 check boxes. (Use the Enable TLS in Internet Explorer procedure.)

Sign in Prompt Appears

Problem A prompt appears that requests you to enter the username and password to pass the authentication.

Possible Cause The Cisco Directory Connector completes NTLM security authentication silently with the sign-in account. If authentication fails, a dialog pops up to ask for the authentication username and password.

Solution When you see the sign in pop-up window, you need provide a valid account with correct authentication for passing security.

Unable to Connect to the Remote Server

Problem During normal operation, the error message appears: "Unable to connect to the remote server."

Possible Cause You may have proxy issues that need to be resolved.

Solution See Troubleshoot Service Account Sign In Issues for more troubleshooting information.

Unable to Register the Connector

Problem You see the error message "Unable to register the connector. A general exception occurred."

Possible Cause In most cases, the problem is because the Cisco Directory Connector has no privilege to connect to LDAP root context.

Solution Try the following:

  1. Run a command prompt (cmd) and then enter ldp.exe.

  2. Click Connection > Bind, choose Bind as currently logged on user, and then click OK.

  3. Click View > Tree, enter DC=arbonneintl,DC=ad as BaseDN, and then click OK.

  4. If the issue continues, open a case with support.

Synchronization

Avatars not Synchronized

Problem Cisco Directory Connector synchronized user AD data to the Cisco Webex cloud. But no avatar data was synced successfully.

Possible Cause If you reused an existing avatar server and the user avatars were already synchronized, then the local cache captures them and avoids resending again to save bandwidth.

Solution Deleted the local cache by following these steps:

  1. Go to C:\Program Files (x86)\Cisco Systems\Cisco Directory Connector\Plugins\

  2. Delete DirSyncPluginAvatar.dll-cache.bin.

  3. Rerun the avatar synchronization from the Cisco Directory Connector.

Conflicting User Email Accounts

Problem Synchronization results may show conflicting user email accounts.

  • If users tried the free version of Cisco Webex Teams, their email addresses reside in the free consumer organization.

  • If user emails were ever synchronized in another organization.

  • If user emails exist in multiple domains that belong to the organization.

Solution Try the following:

  • Use the Convert User option in Control Hub to convert any accounts that may exist in the free consumer organization. See Convert Unlicensed Users in Cisco Webex Control Hub for more information.

  • For the last case, double-check the user data in your Active Directory sources.

Converted User Marked as Inactive

Problem In your directory synchronized environment, you converted a free (consumer organization) user into your enterprise organization, but the converted user cannot sign into Webex Teams.

Possible Cause When the free user is converted into the enterprise organization, the user is marked as inactive status for 30 days as a security compliance measure. During this period, the user cannot sign into Webex Teams and is marked for deletion at the end of the 30-day period. This situation arises because the free user information does not reside in Active Directory.

Solution You must take action if you don't want the user account to be deleted. To resolve this issue, create a user account in your on-premises Active Directory that corresponds to the converted free user account. Then, perform a synchronization from the Cisco Directory Connector. Then, the user can sign into Webex Teams again and the account won't be deleted.

Incremental Sync Fails

Problem An incremental sync fails.

This issue may occur on Windows Server 2008 R2 under the following conditions:

  • You support incremental value updates.

  • The filter that you use references a linked value attribute.

  • The result values of that attribute were updated since the last time a full sync was performed.

Solution Windows Server 2008 R2 has a bug that is related to this issue. The bug is fixed in 2012 R2 and later. We recommend that you upgrade your Windows Server to at least 2012 R2.

Invalid Value for Attribute

Problem For [user dn (distinguished name)], the attribute [attribute name] has the following invalid value [attribute value].

Possible Cause For CN=b,OU=Employees,OU=C Users,DC=c,DC=com, the attribute [telephone number] has the following invalid value: +. This attribute must contain at least one number.

Solution An attribute for this user does not have a valid value. Fix its value according to the description in the warning message. Then do another synchronization.

Matched Users to be Deleted

Problem The matched users are marked to be deleted.

When performing a dry run synchronization to check the data between Active Directory and the cloud, you may see the same email address in both. However, the user is marked as an object to be deleted.

Solution Choose an appropriate fix:

  • If it's okay to delete the user and redo the licenses after, you can use Directory Connector for the fix. Perform a synchronization to delete the user and then perform another synchronization to sync the user from on-premises AD to the cloud.

  • If you can't delete and recreate the user account, open a case with support.

Missing Attribute

Problem The required attribute [attribute_name] when adding on-premises entry [user dn (distinguished name)]. The entry is not created in Cisco Webex Control Hub until all required attributes have a value.

Possible Cause The required attribute email address is missing. When adding on-premises entry [CN=Sales User,OU=Engineers,OU=K,DC=k,DC=local], the entry is not created in Cisco Webex Control Hub until all required attributes have a value.

Solution One of the required attributes is missing for the user [user_email_address]. Provide the required values for that user.

Nested Group Won't Synchronize

Problem Users in a nested Active Directory group are not synchronized properly to the cloud.

Possible Cause A filter is used that includes both the child group and parent group, which is not supported. For example: (memberof=CN=testgroup1,CN=Users,DC=rktest2008,DC=org)

Solution You must reconfigure the filter that synchronizes groups. For example: |(memberof=CN=testgroup1,CN=Users,DC=rktest2008,DC=org)(memberof=CN=testSubGroup,CN=Users,DC=rktest2008,DC=org)

User Naming Conflict

Problem There is a naming conflict for [user dn] for an existing cloud entry object with the name: [user email address], and of user type [user_type].

Possible Cause A user with that email address already exists in Cisco Webex Control Hub.

Solution Create a user in your Active Directory with the same email address as the account that you registered through Cisco Webex Control Hub.

Control Hub

User List Missing in Control Hub

If you have a Cisco Webex organization with more than 1000 synchronized users, you may not see the user list in Cisco Webex Control Hub.

Solution You can use the search functionality to find a user account. In Control Hub, go to Users, click search , and then enter search criteria to locate a specific user.

Enable Troubleshooting for Cisco Directory Connector

You can enable troubleshooting to help diagnose any errors you encounter in Cisco Directory Connector. Troubleshooting lets you capture the network traffic information and save it to a file.

The log files that are : <Installation Location>\Cisco Systems\Cisco Systems\Cisco Directory Connector\Logs

Procedure

Step 1

Run the services.msc file to change the running account for the Cisco Directory Connector service from the Local System to a domain account that has privileges to access your AD DS or AD LDS.

Step 2

Restart the service.

See How to Start Services for guidance.

Step 3

In Cisco Directory Connector, click Dashboard.

Step 4

Go to Actions, and then click Troubleshooting.

Step 5

With troubleshooting enabled, repeat the actions that were causing an error; this captures the traffic data so that it can be examined.

Step 6

Examine the log files: if the file is blank, make sure that the account has privileges to access your AD DS or AD LDS.

Note 

The log folder only saves files for the last 3 days. The content in the log files is consistent with the event log output to the system.

Step 7

If necessary, send the log file to support for assistance.

Step 8

Disable the troubleshooting feature when you are done.

Launch the Event Viewer

To see the events that occurred during a full or incremental synchronization, launch the Event Viewer. It displays a summary of the administrative events and error logs.

Procedure

Step 1

From Cisco Directory Connector, go to Dashboard, and then click Action > Launch Event Viewer.

The Event Properties dialog shows the synchronization event details and error details.
Step 2

From Event Viewer, go to Applications and Services Logs > Cisco Directory Connector.

Step 3

Click Save All Events As to export the logs as an Events file (*.evtx).

What to do next

If you need to open a case, contact support, describe the problem with Cisco Directory Connector, and then attach the Events file to your case.


Note

Event logs capture user actions. For help with managing network traffic, enable troubleshooting on Cisco Directory Connector.

Enable TLS in Internet Explorer

If you switched Single Sign-On (SSO) providers, you may see the following error messages from Cisco Directory Connector:

  • Error occurred logging on to service

  • An error has occurred in the script on this page

If you see these errors, you must enable a TLS setting in your browser.

Procedure

Step 1

Open Internet Explorer, and then choose Tools. Now check the boxes for the TLS/SSL version you want to enable Click OK Close the browser and open it again

Step 2

Click Internet Options , go to Advanced , scroll to the Security.

Step 3

Check the Use TLS 1.1 and Use TLS 1.2 check boxes, and then click OK.

Step 4

Restart your system for the changes to take effect.

Troubleshoot Service Account Sign In Issues

If you can't sign in to Cisco Directory Connector or can't run a synchronization, use these steps to try to resolve the issue before contacting support.

Procedure

Step 1

Try to visit https://cloudconnector.cisco.com/SynchronizationService-v1_0/?orgId=GLOBAL in your web browser.

Step 2

Choose one, depending on the results:

  • If you can't visit the link from your browser, check your network settings. if your environment uses proxy, check the proxy settings.
  • If you can visit the link from your browser but can't open Cisco Directory Connector (Can't open connector and pop up error message with 407), click here to get the latest version of Cisco Directory Connector.
  • If you can visit the link from your browser but can't run a synchronization from the Cisco Directory Connector, change the service login account to domain admin.
    Note 

    Check whether the account you used to sign in to the Windows system is the same account that you set in 'Cisco DirSync Service'. If they are 2 different accounts, make sure both accounts can visit https://cloudconnector.cisco.com/SynchronizationService-v1_0/?orgId=GLOBAL. If your environment uses proxy, make sure both accounts are configure for proxy in Internet Explorer and can visit https://cloudconnector.cisco.com/SynchronizationService-v1_0/?orgId=GLOBAL successfully.

Step 3

At a minimum, make sure the configured account for the Cisco DirSync Service (which can be found in Windows services) has a privilege level that lets it access avatar data and AD data. By default, the service leverages the Windows login account credentials and authentication.

Check SafeDllSearchMode in Windows Registry

Safe dynamic link library (DLL) search mode is set by default in the Windows registry and places the user's current directory later in the DLL search order. If this mode was somehow disabled, an attacker could place a malicious DLL (named the same as a referenced DLL located in the system folder) into the current working directory of the application.

Usually, SafeDllSearchMode is enabled, but use this procedure to double-check the registry settings.

Before you begin


Caution

Changes to the Windows registry should be done with extreme caution.

Procedure

Step 1

In Windows search or the Run window, type regedit and then press Enter.

Step 2

Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager.

Step 3

Choose one:

  • SafeDllSearchMode isn't listed—No further action is needed.
  • SafeDllSearchMode is listed—Ensure that the value is set to 1.

For more information, see Dynamic Link Library Search Order.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Cisco Community Discussions

About Us
Contact Us
Work with Us