D.1 Troubleshooting the Installation Issues

The following table lists the issues you might encounter and the suggested actions for working on these issues. If the problem persists, contact your NetIQ representative.

Issues

Suggested Actions

Installation Takes a Long Time.

When you are installing eDirectory into an existing tree and the installation takes a long time to complete, look at the DSTrace screen on the server. If the -625 Transport failure message appears, you need to reset the address cache

To reset the address cache, enter the following command at the system console:

set dstrace = *A

eDirectory Install Fails for Container Administrators

The eDirectory 9.0 installation program supports installations by administrators who have supervisor rights to the container that the server resides in. In order to handle this, the first server that eDirectory 9.0 is installed into must have supervisor rights to [Root] to extend the schema. From that point on, subsequent servers do not have to have rights to [Root]. However, with eDirectory 9.0, depending on the platform that eDirectory 9.0 is installed in to first, all schema might not be extended, requiring supervisor rights to [Root] for subsequent server installations on different platforms.

If eDirectory 9.0 will be installed on multiple platforms, make sure that you have supervisor rights to [Root] for the first server eDirectory will be installed on for EACH platform. For example, if the first server that eDirectory 9.0 is going to be installed on is running Linux, and eDirectory 9.0 will also be installed on Solaris, the first server for each platform must have supervisor rights to [Root]. Subsequent servers on each platform will only have to have container administrator rights to the container where the server is being installed.

For additional information, see solution NOVL83874 in the eDirectory 8.7.x Readme Addendum

Default Listeners for New Network Interface

On Windows, eDirectory listens on all interfaces configured on the computer for NCP, HTTP, HTTPS, LDAP and LDAPS by default. Adding a new network interface address to the computer, and restarting eDirectory will make it start listening on that address automatically, and have referrals also added correspondingly.

NOTE:On Linux, we need to manually add interfaces to n4u.server.interfaces parameter.

Replication Issues After an Upgrade

When you upgrade to eDirectory 9.0 and enable encrypted replication, replication fails in rare scenarios.

To workaround this issue:

  1. In NetIQ Identity Console, select Object Management.

  2. On the Objects window > click the Types drop-down tab > select NCP Server > click Search.

  3. Under Search Results > select the NCP Server

  4. Under the General tab, select Other.

  5. On the Modify Objects tab > click Valued Attributes .

  6. On the SELECT ATTRIBUTES screen, select NCPKeyMaterialName > click OK.

    For example, SSLCertificateDNS.

  7. Run Limber on the server where the attribute is changed (Step 6). For information about using Limber, see the NetIQ eDirectory Administration Guide.

Error 1603 encountered during eDirectory patching

Following sysprep.exe execution in Windows, installing or updating eDirectory to a directory requiring authenticated user group privileges may result in a 1603 error.

The Administrator user was found to be part of both the Authenticated Users Group (all logged-in users) and the Administrators Group. According to Microsoft troubleshooting guidelines, this dual group membership can cause conflicts with the User Account Control (UAC) system, potentially blocking installation privileges for the administrator. Adjusting the privileges for the Authenticated Users group resolved the issue, allowing the upgrade to complete successfully.

To resolve installation/update failures of eDirectory on Windows systems after sysprep.exe execution, the administrator should modify the eDirectory installed directory permissions. Specifically, remove the Authenticated Users group from the directory's permissions. This can be achieved by navigating to the directory's Properties and accessing the Security tab, where the Authenticated Users group can be removed from the list of granted privileges.