Error: “Client Side Kerberos Authentication Failed”
Cause: The setspn command was not run on all Active Directory Servers, or there is a duplicate SPN.
Solution: On the DC, run the setspn command as directed in the appropriate ExacqVision Active Directory setup guide, or run setspn -X to check for duplicates. If a duplicate is found, remove the SPN attribute from all but one of the accounts.
Error: “User not authenticated in LDAP”
Cause: Windows 2000 or earlier Active Directory Domain Functional Level.
Solution: Upgrade the Functional Level of your Domain to Windows 2003 or higher.
See How to raise Active Directory domain and forest functional levels for details.
Alternate Solution:
- If you are using ExacqVision 4.8 or newer, you can edit the StreamPI.xml file. Change the value of EnableActiveDirectoryUserDisabling from 1 to 0.
- If you are using an ExacqVision version earlier than 4.8, contact support@exacq.com to obtain an updated DLL.
Error: The connection to the server always shows “Disconnected” in the ExacqVision Client.
Cause: The Binding DN is incorrect.
Solution: Complete the following procedure:
- Download Softerra LDAP Browser. (Be sure to click the tab for Browser, NOT Administrator.)
- Install and Run LDAP Browser.
- Click File and then New Profile.
- Enter a name for your new profile and click Next.
- Enter the hostname of your AD server in the Host field (or click the Lookup Servers button if you don’t know the host).
- Click Next.
- Select Currently Logged On User.
- Click Finish.
- Highlight the new profile you just created in the left panel.
- In the Find What box at the top of the right panel, enter the username used to connect to Active Directory in the ExacqVision software.
- Press Enter.
- After the search completes, find the correct user account.
- Right-click the user account and select Properties.
- Copy the string in the top portion of the Properties Panel (it should start with CN=).
- Paste this string into the Binding DN section of your ExacqVision Client and click Apply.
Error: “Connected, SPN not found”
While there are other possible causes, it’s common for a ‘Binding DN’ to be an extended string that is easy to mistype. For instance the following Distinguished Name will work, but must be typed exactly:
CN=exacqSVC,OU=ServiceAccounts,OU=SecurityGroups,OU=Indiana,OU=US,DC=exacqts,DC=local
Any incorrect spacing or punctuation will not allow proper setting of the SPN and you will see the following Server log:
StreamPI Warning LDAP: Bind DN was not found. Unable to create SPN.
You can also try the Username instead. In this instance, the username (UPN) for that account is:
exacqSVC@exacqts.local
<br>
