Troubleshooting the AD Services Workload

This feature is currently available only to customers participating in a Private Preview. If you'd like to participate and be among the first to try this feature, ask our support or account team for details.

This page provides help for issues and questions you might encounter related to the AD Services Workload.

Engine Installed but AD Services Not Available

Symptom:

The engine is online but Active Directory Services does not appear as an available capability.

Solution:

  1. Confirm your tenant is provisioned for Active Directory Services. Currently, this capability is only available to net new platform customers and SSC customers upgrading to the platform.

  2. If you are an existing platform customer, this capability is not yet available to your tenant.

  3. Contact IBM SecuritySupport if you believe your tenant should have access.

Installation Script Fails

Symptom:

Running the installation script produces an error or the script exits without completing.

Solution:

  1. Confirm the script is being run in PowerShell with administrator privileges.

  2. Confirm the server meets the system requirements.

  3. Confirm the server has outbound access to the IBM Security engine download URLs.

  4. The device code expires after 24 hours and an expired code will cause the script to fail. Regenerate the script from the Engines page.

Domain Validation Fails on Registered App

Symptom:

After completing the domain configuration and triggering validation, received an Error status.

Solution:

  1. Open the Engines page and confirm the engine selected for the site is online.

  2. Confirm the domain FQDN is correct and resolvable from the engine server.

  3. Confirm the vaulted secret contains valid, unexpired service account credentials.

  4. Confirm the service account has the required permissions in Active Directory for the failing capability.

  5. Check the engine logs in Engine Management for connectivity or authentication errors.

  6. Re-trigger validation after making corrections.

Validation Fails for Some Capabilities

Symptom:

Read operations validate successfully, but password reset or unlock capabilities show a Failed status.

Solution:

  1. Confirm the service account has the Reset Password permission in Active Directory. This permission is required for both password reset and account unlock operations and is separate from the read permissions required for user and group lookups.

  2. If the Reset Password permission has recently been granted, allow a few minutes for the change to propagate across domain controllers.

  3. Re-trigger validation after updating permissions.