Troubleshooting Server Authentication

SYMPTOMS

Cannot authenticate Zoolz/BigMIND desktop software on a Windows Server platform. Because of this, Zoolz/BigMIND software is not opening or running.

 

CAUSE

This issue arises when the Windows user profile or the group it belongs to is not included in the “Log on as a batch job” local security policy for a workspace server configuration, or if it is part of the “Deny logon as a batch job“. policy.

  • Logon as a batch job Policy

Check if the user account or the group to which it belongs to is added to the Logon as a batch job policy in the Windows Domain Controller Security Policy. If the user account or the group to which it belongs to does not have rights for this policy, please add the user account or the group to the Logon as a batch job Policy in Windows Domain Controller Security Policy. By default, this policy is applied to Administrators and the Backup Operators group. But there are scenarios where we see that no accounts or groups were added to this user policy. This user right is defined in the default Domain Controller’s Group Policy object (GPO) and in the Local Security Policy of workstations & servers and it allows a user to be logged on by means of a batch-queue facility.

 

  • Deny logon as a batch job Policy

Also, make sure that the account is not part of the Deny logon as a batch job policy in the Windows Domain Controller Security Policy. ‘Deny logon as a batch job’ determines which accounts are prevented from being able to log on as a batch job. This policy setting super cedes the Log on as a batch job policy setting if a user account is subject to both policies. This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers. By default, there are no users denied logon as a batch job.

 

RESOLUTION

Steps to add the account to the Default Domain Controller Security Policy:

  1. Login to the server as an Administrator or Domain Admin.
  2. Go to Control Panel → Administrative Tools → Group Policy Management. This would open the Group Policy Management Console.
  3. In the Group Policy Management Console, expand Domain and then Domain Controllers; then select the Default Domain Controllers Policy.
  4. Right-click on the Default Domain Controllers Policy and click on Edit. This would open the Group Policy Management Editor.
  5. In the ‘Default Domain Controllers Policy‘, go to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Select User Rights Assignment.
  6. On the right pane, under Policy select Log on as a batch job.
  7. Right-click on this Log on as a batch job and select Properties. This would show the Log on as a batch job Properties dialog. Click on Add User or Group button and add the user account which is used in Zoolz/BigMIND or add the group to which the user account belongs to. Click on Ok and Apply the changes as well.
  8. Make sure that the account is not part of the Deny logon as a batch job policy in the Windows Domain Controller Security Policy. If it is part of it, then Remove it.
  9. After making the above changes, close the Group Policy Management Editor and then close the Group Policy Management Console.
  10. To update the changes to the policy, the following command needs to be run from the command prompt: 
    gpupdate /force
Tagged: