The order of "account user connection"?

clerevan · Post by **clerevan** » Wed May 14, 2014 8:38 am

Hi KS-soft,

I want to ask you about the order of how hostmonitor connect as an account when they try to do some tests like check service test, or Drive Free Space, or SQL test (using system DSN logged with windows NT authentication)

Let's say I Have started my service as an account A and one of my test connect as account B, which account will be used by hostmonitor to connect to use particular server?

The one we configure from option>startup>service>log on as?
or
The one we configure from each test>connect as?

thank you

KS-Soft · Post by **KS-Soft** » Wed May 14, 2014 8:48 am

The one we configure from option>startup>service>log on as?
or
The one we configure from each test>connect as?

2nd one - "each test>connect as".
But in some cases this does not work, Windows API ignores specified account and uses current logged in user account (or account used for service startup). Microsoft does not explain why this happens...

Regards
Alex

clerevan · Post by **clerevan** » Wed May 14, 2014 9:06 am

also i have an issue with login, I tried to move my hostmonitor from one server to other server, before i disabled the first server i check at my new server, one test for service is failed (wind32 error 5 or access denied)even though i already copied everything including the user account and password. Also old server and new server and in the same subnet (no ACL problem) and i already give administrator access to the new server. Is there any chance it happen because of the hostmonitor?

Is there any major issue regarding movement from hostmonitor v7.10 to v9.82?

KS-Soft · Post by **KS-Soft** » Wed May 14, 2014 10:07 am

Is there any chance it happen because of the hostmonitor?
Is there any major issue regarding movement from hostmonitor v7.10 to v9.82?

Do you mean you had version 7.10 on old system and you installed version 9.82 on new system?
- Windows on target system?
- Windows on old system?
- Windows on new system? Service Pack? UAC enabled?
- HostMonitor 9.82 started as service? Under local admin account?
If UAC is enabled, you should start service using BUILT-IN administrator account.

>one test for service is failed (wind32 error 5 or access denied)

Have you checked security event log?
Test performed directly by HostMonitor, not RMA?

Is there any major issue regarding movement from hostmonitor v7.10 to v9.82?

Well, there are 1000 different functions in new version however we tried to keep backward compatibility as much as possible so all your tests and actions should work in new version as well.
Just make sure your license will work...

Regards
Alex

clerevan · Post by **clerevan** » Wed May 14, 2014 1:55 pm

- Windows on target system? windows server 2008 R2 data center service pack 1
- Windows on old system? windows XP
- Windows on new system? Service Pack? windows server 2008 R2 data center service pack 1
- HostMonitor 9.82 started as service? Under local admin account?
no, hostmonitor is started application under the same account i give in test properties "connect as" and i have already given that account as administrator in target machine.

Have you checked security event log?
Test performed directly by HostMonitor, not RMA? test performed directly by Hostmonitor

I managed to connect them just now, the setting in test properties "connect as" is not working, It seems the test using my windows account to that target machine instead of using connect as. But If I log off from my computer it will start to fail right? how to ensure it won't use the windows authentication and will use the connection manager or "connect as" in test properties? I have tried to disable the UAC but no effect.

clerevan · Post by **clerevan** » Thu May 15, 2014 8:57 am

Hi KS-Soft,

So I tried to do test again yesterday and i want to ask you, i don't know this is bug or because of wrong configuration.

I made 2 test from host monitor who work in windows XP OS.
That test is to test the service from a computer in different computer.
This is the exact condition:
1. That computer not using any domain user account
2. There is no profile in connection manager
3. First test, say test A configure with connect as an user who have access to the target computer's service. And its working well.
4. After I done make test A.
5. I made the same target for test B but not specified the connect as.
6. And test B still working!!! what happen here? Why test B who doesn't have any connect as credential can still working?
7. I disable the test A and close the host monitor then tried again for test B, and it's still working.

Is it bug? so the host monitor somehow save some session or save cache of a process and will used it everytime the same target connected?

KS-Soft · Post by **KS-Soft** » Thu May 15, 2014 9:00 am

No, its not a bug, everything looks fine.
If authentication already passed, all other test probes may use it.

Regards
Alex

KS-Soft · Post by **KS-Soft** » Thu May 15, 2014 9:07 am

I managed to connect them just now, the setting in test properties "connect as" is not working, It seems the test using my windows account to that target machine instead of using connect as. But If I log off from my computer it will start to fail right? how to ensure it won't use the windows authentication and will use the connection manager or "connect as" in test properties? I have tried to disable the UAC but no effect.

If HostMonitor running in service mode, logon/logoff procedure should not change anything.

HostMonitor always pass to Windows API accounts specified for Connection Manager or "Connect As" property (Connect As option has priority over Connection Manager records). We checked this code and trace working software many times, it works fine.
However under some circumstances Windows API ignores these settings and uses account specified for the service itself. Unfortunately we don't know why exactly this happens, we did not find explanation in Microsoft manuals and did not get clear answer from them...

Regards
Alex

clerevan · Post by **clerevan** » Thu May 15, 2014 10:03 am

Well, other test may use it even though other test have wrong password? I mean, i want if it incorrect then the second test will failed to connect as because the second test give incorrect credential.

Another cases:

Because I said i want to move the hostmonitor into new server I tried to migrate both of them to Windows server 2008 R2 data center edition sp1.

https://imagizer.imageshack.us/v2/712x2 ... 5/zw4q.png

I want to both of them test their host monitor's services between them. But each side have their account to log in to their own computer. I do not want to add Alpha account to Beta Site and Beta Account to Alpha site, ofcourse the way to do it just by making host monitor using "connection manager" or "connect as".

I've done many tests, UNC test working perfectly, but, service's test to site Beta is not and it's keep failing and still use Windows authentication which is account Alpha. Meanwhile I don't want to give access to account Alpha as administrator in group B. Is there any way to solve this issue?

KS-Soft · Post by **KS-Soft** » Thu May 15, 2014 12:07 pm

Well, other test may use it even though other test have wrong password? I mean, i want if it incorrect then the second test will failed to connect as because the second test give incorrect credential.

Various (but not all) Windows functions do not work this way. They do not require special authentication procedure and may get information from target system even if connection was established by different application.
E.g. you do not provide any account information at all but when HostMonitor asks Windows to retrieve information about some service this information can be retrieved (in some cases).
Unless we add special test method just to check authentication (some "User login" test method). Do this for all tests? I don't think this is good idea from performance point of view.

I want to both of them test their host monitor's services between them. But each side have their account to log in to their own computer. I do not want to add Alpha account to Beta Site and Beta Account to Alpha site, ofcourse the way to do it just by making host monitor using "connection manager" or "connect as".

HostMonitor services can be started under different accounts (local admin accounts) but I don't see reason to use different set of accounts specified in Connection Manager.

I've done many tests, UNC test working perfectly, but, service's test to site Beta is not and it's keep failing and still use Windows authentication which is account Alpha. Meanwhile I don't want to give access to account Alpha as administrator in group B. Is there any way to solve this issue?

Both systems run the same OS and located in the same domain but works differently?

Regards
Alex

clerevan · Post by **clerevan** » Thu May 15, 2014 1:30 pm

As I stated in the previous attachment/pic, It's on different site and domain. The OS is the same. I want to connect to Beta site using Beta Account and Alpha Site using Alpha account. I managed to do it for UNC test, but in Service test, it is failed. My question is, you mention before that some test may failed to use the authentication from connection manager and "connect as" as result of Windows unknown problem, is this the service test?

KS-Soft · Post by **KS-Soft** » Thu May 15, 2014 4:20 pm

I saw image but I was not sure there are different domains.
If you need to monitor 2 domains using 2 HostMonitors, then I think its better to use each HostMonitor for its own domain.
If you want redundancy (use each HostMonitor to monitor both domains) or you need to monitor more than 2 domains, we recommend to use RMA. Remote Monitoring Agent can be installed on domain host and monitor entire domain.
http://ks-soft.net/hostmon.eng/rma-win/index.htm

I managed to do it for UNC test, but in Service test, it is failed. My question is, you mention before that some test may failed to use the authentication from connection manager and "connect as" as result of Windows unknown problem, is this the service test?

UNC test, Service, Process, CPU usage use the same authentication procedure, just different permissions and services. E.g. Process and CPU usage tests require admin rights and need Remote Registry Service to be running.
Windows security event log shows login with wrong account?

Regards
Alex

clerevan · Post by **clerevan** » Fri May 16, 2014 8:33 am

Yes, I want to use 2 hostmonitor in 2 domain. But also make a service test to monitor hostmonitor as a service works perfectly or not (because we don't have dedicated people to monitor the web service 24 hours).

As you can see, let just say i will use alpha\hma for site alpha and beta\hmb for site beta.

In Alpha site, I want to use monitor hostmonitor as service which exist in beta site. In Alpha site I use alpha\hma to login as a service but ofcourse i don't want to add that account in beta site as administrator. Because of that I want to use beta account or beta\hmb in the connection manager and "connect as".

Right now, it's working perfectly for UNC and Drive Free Space test, but for service test, it's failed. It's seems the hostmonitor use the alpha\hma(windows login) instead of connection manager or "connect as". You've said that the priority will be "connect as" first, connection manager as a second, and windows auth. as the third right? but it's a bug that's it still using windows auth. instead of "connect as" and connection manager?

thank you.

KS-Soft · Post by **KS-Soft** » Fri May 16, 2014 2:54 pm

But also make a service test to monitor hostmonitor as a service works perfectly or not (because we don't have dedicated people to monitor the web service 24 hours)

Monitor another copy of HostMonitor using Service test method?
There is much better option - HM Monitor test method
http://ks-soft.net/hostmon.eng/mframe.h ... #hmmonitor

You've said that the priority will be "connect as" first, connection manager as a second, and windows auth. as the third right? but it's a bug that's it still using windows auth. instead of "connect as" and connection manager?

HostMonitor does the following
- if "connect as" option specified, this account will be used for authentication (Windows API calls)
- else if connection manager contains appropriate account record, this account will be used for authentication (using Windows API)
- perform test

Windows should do the following
- receives account information from HostMonitor, use it for authentication
- if connection already established it will be used

Windows really does
- receives account information from HostMonitor, uses this account (normally) or uses different account (sometimes)
Bug? May be. May be not. May be there is some logic behind such Windows behavior but were unable to get explanation from Microsoft.

If you want to monitor different domain, you may use RMA. It can be installed as service and run under different account.
And if you want to check services in DomainB, it would be logical to install RMA on host within domainB as well.

BTW: other Windows functions (e.g. WMI API) always work correctly and use account specified by HostMonitor

Regards
Alex

clerevan · Post by **clerevan** » Tue May 20, 2014 12:03 pm

Well, we already have RMA in one site but because we have 2 datacenters in 2 different sites, we want to monitor it from that 2 places using 2 hostmonitors, the problem right now is the old hostmonitor v7.10 which run in windows xp under local account can use the connection "connect as" to test service in other site (site Beta), and after we move it to new hostmonitor v.98 which run in windows server r2 under domain account site Alpha, instead of using the connection "connect as" with beta account, they use the alpha account.

So Any idea how to solve this? I tried many things with connect as and the connection manager but windows keep doing the test using it's windows login session.