The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
You may encounter an error message or other issue in Directory Connector. Also, after Directory Connector synchronizes user information, the connector may send you an email report that lists any problems with the synchronization. See the sections that follow for problems that may arise, possible causes, and proposed solutions you can try before contacting support.
Problem You received alert emails notifying you that your Directory Connector is not working.
The Directory Connector may not be installed correctly.
The Directory Connector may not be running.
The network may not be available.
Solution Try the following:
Open the Control Panel, then Programs and Features. Locate Directory Connector. If it’s not there, download the latest version from Control Hub and install it.
Open Service and locate Cisco DirSync Service. Make sure that it displays the status as Started. If the service is stopped, right-click and select Start to restart the service.
Make sure the server on which you installed the Directory Connector has the access to Internet.
Problem If you immediately install a new connector after uninstalling an old one, you may see an error message.
Possible Cause In Windows Server 2012, the uninstall client needs time to delete the service account from service list.
Solution After some time passes, try the installation again.
Problem Directory Connector may crash after you enter an email address from an SSO sign in page.
Solution Try the following:
Do these steps to configure a new group policy:
Go to the domain controller and open Group Policy Management (gpedit.msc).
Right click a specific OU or domain, and select Create a GPO in this domain, and Link it here…
Give the policy a name, then right click and choose Edit.
Do these steps to change the policy at the machine level:
Go to Computer Configuration > Preferences > Windows Settings, right click Registry, choose New, and then Registry Item.
For Key Path, enter or navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main.
Enter Disable Script Debugger for Value, and enter no for Value data.
The settings should match this screenshot:
Do these steps to change the policy at the user level:
Go to User Configuration > Preferences > Windows Settings, right click Registry, choose New, and then Registry Item.
For Key Path, enter or navigate to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main.
Enter Disable Script Debugger for Value, and enter no for Value data.
The settings should match this screenshot:
 Note |
The changes take effect after you run gpupdate /force, the machine restarted (for machine changes), or the user signs in again (for user changes). |
Problem Sign in fails and this message appears: "The Cisco DirSync Service Connector could not be registered."
Solution The Windows system on which Directory Connector is installed must be a member of Active Directory.
Problem You opened Directory Connector and the sign in page didn't appear.
Solution Try the following steps:
Solution In Internet Explorer, go to https://cloudconnector.webex.com/SynchronizationService-v1_0/?orgId=GLOBAL. Try the link in other browsers like Chrome and Firefox.
Solution If Internet Explorer can’t visit the link but other browsers can, check Internet Explorer settings and check the TLS 1.1 and 1.2 check boxes. (Use the Enable TLS in Internet Explorer procedure.)
Problem A prompt appears that requests you to enter the username and password to pass the authentication.
Possible Cause The Directory Connector completes NTLM security authentication silently with the sign-in account. If authentication fails, a dialog pops up to ask for the authentication username and password.
Solution When you see the sign in pop-up window, you need provide a valid account with correct authentication for passing security.
Problem During normal operation, the error message appears: "Unable to connect to the remote server."
Possible Cause You may have proxy issues that need to be resolved.
Solution See Troubleshoot Service Account Sign In Issues for more troubleshooting information.
Problem You see the error message "Unable to register the connector. A general exception occurred."
Possible Cause In most cases, the problem is because the Directory Connector has no privilege to connect to LDAP root context.
Solution Try the following:
Run a command prompt (cmd) and then enter ldp.exe.
Click , choose Bind as currently logged on user, and then click OK.
Click , enter DC=arbonneintl,DC=ad as BaseDN, and then click OK.
If the issue continues, open a case with support.
Problem Cisco directory connector synchronized user AD data to the Webex cloud. But no avatar data was synced successfully.
Possible Cause If you reused an existing avatar server and the user avatars were already synchronized, then the local cache captures them and avoids resending again to save bandwidth.
Solution Deleted the local cache by following these steps:
Go to C:\Program Files (x86)\Cisco Systems\Cisco Directory Connector\Plugins\
Delete DirSyncPluginAvatar.dll-cache.bin.
Rerun the avatar synchronization from the Cisco directory connector.
Problem Synchronization results may show conflicting user email accounts.
If users tried the free version of Webex App, their email addresses reside in the free consumer organization.
If user emails were ever synchronized in another organization.
If user emails exist in multiple domains that belong to the organization.
Solution Try the following:
Follow these steps if you're trying to claim users:
Make sure you've verified the domain in Control Hub.
Temporaily disable Cisco Directory Connector.
Use the Claim User option in Control Hub to claim any accounts that may exist in the free consumer organization. See Claim Users to Your Organization (Convert Users) for more information.
Do a dry run in Cisco Directory Connector, and then reenable directory synchronization
For the last case, double-check the user data in your Active Directory sources.
Problem In your directory synchronized environment, you converted a free (consumer organization) user into your enterprise organization, but the converted user cannot sign into Webex App.
Possible Cause When the free user is converted into the enterprise organization, the user is marked as inactive status for 30 days as a security compliance measure. During this period, the user cannot sign into Webex App and is marked for deletion at the end of the 30-day period. This situation arises because the free user information does not reside in Active Directory.
Solution You must take action if you don't want the user account to be deleted. To resolve this issue, create a user account in your on-premises Active Directory that corresponds to the converted free user account. Then, perform a synchronization from the Cisco Directory Connector. Then, the user can sign into Webex App again and the account won't be deleted.
Problem An incremental sync fails.
This issue may occur on Windows Server 2008 R2 under the following conditions:
You support incremental value updates.
The filter that you use references a linked value attribute.
The result values of that attribute were updated since the last time a full sync was performed.
Solution Windows Server 2008 R2 has a bug that is related to this issue. The bug is fixed in 2012 R2 and later. We recommend that you upgrade your Windows Server to at least 2012 R2.
Problem For [user dn (distinguished name)], the attribute [attribute name] has the following invalid value [attribute value].
Possible Cause For CN=b,OU=Employees,OU=C Users,DC=c,DC=com, the attribute [telephone number] has the following invalid value: +. This attribute must contain at least one number.
Solution An attribute for this user does not have a valid value. Fix its value according to the description in the warning message. Then do another synchronization.
Problem The matched users are marked to be deleted.
When performing a dry run synchronization to check the data between Active Directory and the cloud, you may see the same email address in both. However, the user is marked as an object to be deleted.
Solution Choose an appropriate fix:
If it's okay to delete the user and redo the licenses after, you can use Directory Connector for the fix. Perform a synchronization to delete the user and then perform another synchronization to sync the user from on-premises AD to the cloud.
If you can't delete and recreate the user account, open a case with support.
Problem The required attribute [attribute_name] when adding on-premises entry [user dn (distinguished name)]. The entry is not created in Control Hub until all required attributes have a value.
Possible Cause The required attribute email address is missing. When adding on-premises entry [CN=Sales User,OU=Engineers,OU=K,DC=k,DC=local], the entry is not created in Control Hub until all required attributes have a value.
Solution One of the required attributes is missing for the user [user_email_address]. Provide the required values for that user.
Problem Users in a nested Active Directory group are not synchronized properly to the cloud.
Possible Cause A filter is used that includes both the child group and parent group, which is not supported. For example: (memberof=CN=testgroup1,CN=Users,DC=rktest2008,DC=org)
Solution You must reconfigure the filter that synchronizes groups. For example: |(memberof=CN=testgroup1,CN=Users,DC=rktest2008,DC=org)(memberof=CN=testSubGroup,CN=Users,DC=rktest2008,DC=org)
Problem There is a naming conflict for [user dn] for an existing cloud entry object with the name: [user email address], and of user type [user_type].
Possible Cause A user with that email address already exists in Control Hub.
Solution Create a user in your Active Directory with the same email address as the account that you registered through Control Hub.
Solution You can use the search functionality to find a user account. In Control Hub, go to Users, click search 
, and then enter search criteria to locate a specific user.
You can enable troubleshooting to help diagnose any errors you encounter in Directory Connector. Troubleshooting lets you capture the network traffic information and save it to a file.
The log files that are : <Installation Location>\Cisco Systems\Cisco Systems\Cisco Directory Connector\Logs
| Step 1 |
Run the |
||
| Step 2 |
Restart the service. See How to Start Services for guidance. |
||
| Step 3 |
In Directory Connector, click Dashboard. |
||
| Step 4 |
Go to Actions, and then click . |
||
| Step 5 |
With troubleshooting enabled, repeat the actions that were causing an error; this captures the traffic data so that it can be examined. |
||
| Step 6 |
Examine the log files: if the file is blank, make sure that the account has privileges to access your AD DS or AD LDS.
|
||
| Step 7 |
If necessary, send the log file to support for assistance. |
||
| Step 8 |
Disable the troubleshooting feature when you are done. |
To see the events that occurred during a full or incremental synchronization, launch the Event Viewer. It displays a summary of the administrative events and error logs.
| Step 1 |
From Directory Connector, go to Dashboard, and then click . The Event Properties dialog shows the synchronization event details and error details. |
| Step 2 |
From Event Viewer, go to .
|
| Step 3 |
Under Actions, click Save All Events As to export all the logs as a single Events file (*.evtx) or another format such as xml or csv. |
If you need to open a case, contact support, describe the problem with the connector, and then attach the Events file to your case.
Note |
Event logs capture user actions. For help with managing network traffic, enable troubleshooting on the connector. |
If you switched Single Sign-On (SSO) providers, you may see the following error messages from Cisco directory connector:
Error occurred logging on to service
An error has occurred in the script on this page
If you see these errors, you must enable a TLS setting in your browser.
| Step 1 |
Open Internet Explorer, and then choose Tools. Now check the boxes for the TLS/SSL version you want to enable Click OK Close the browser and open it again |
| Step 2 |
Click Internet Options , go to Advanced , scroll to the Security. |
| Step 3 |
Check the Use TLS 1.1 and Use TLS 1.2 check boxes, and then click OK.
|
| Step 4 |
Restart your system for the changes to take effect. |
If you can't sign in to Cisco directory connector or can't run a synchronization, use these steps to try to resolve the issue before contacting support.
| Step 1 |
Try to visit https://cloudconnector.webex.com/SynchronizationService-v1_0/?orgId=GLOBAL in your web browser. |
||
| Step 2 |
Choose one, depending on the results:
|
||
| Step 3 |
At a minimum, make sure the configured account for the Cisco DirSync Service (which can be found in Windows services) has a privilege level that lets it access avatar data and AD data. By default, the service leverages the Windows login account credentials and authentication. |
Safe dynamic link library (DLL) search mode is set by default in the Windows registry and places the user's current directory later in the DLL search order. If this mode was somehow disabled, an attacker could place a malicious DLL (named the same as a referenced DLL file that is located in the system folder) into the current working directory of the application.
Usually, SafeDllSearchMode is enabled, but use this procedure to double-check the registry settings.
 Caution |
Changes to the Windows registry should be done with extreme caution. We recommend that you make a backup of your registry before using these steps. |
| Step 1 |
In Windows search or the Run window, type regedit and then press Enter. |
| Step 2 |
Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager. |
| Step 3 |
Choose one:
|
For more information, see Dynamic Link Library Search Order.
Feedback