75,730
I am stuck with a client where suddenly MR can no longer communicate with the server. It does not work on the server either. In the event viewer are messages about SOAP security negotiation. SSL is not installed on this server. What can I check to correct whatever has gone wrong?
Ok, yes, we've seen this as well with the Kerberos options enabled/disabled under the Local Policies.
We began seeing the issues with MR and the Windows updates a couple of weeks before the holidays....imagine we'll see some more come in now that we're through the holidays/people's time off.
Last I heard from around 12/22, that we were seeing issues with the Dec update also, KB5021235, but that may because it includes the KB4019964 from Nov and the OOB patch 5021654.
Thanks
Derek, first MR broke on the client's server and then on our copy of their server. Applying these Kerberos steps fixed it on both so whatever the update did to Kerberos was the problem.
Check the Kerberos settings by going to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Network security: Configure encryption types allowed for Kerberos.
If any of these options are turned on:
AES128_HMAC_SHA1
AES256_HMAC_SHA1
Future Encryption Types
Then this one, needs to be enabled as well:
RC4_HMAC_MD5
Derek, is there anyway I can copy their MR database to our copy of their server, install MR and get the MR client running so I can export the building blocks?
Then I will try a complete re-installation on their server.
Upgrading from 2.12.16007 to 2.12.16013 did not work. I am going to open a case with MS. The IT group wants nothing to do with this so I am on my own.
I hit this same issue for a customer a few weeks back. (SOAP connection errors)
MR server or client, repair or re-install did not work.
restarted MR services, restarted app server did not work.
created SPN's for the MR service accounts did not work.
in the end the customer was still running MR CU15, i updated them to the latest CU16 build and it all started working again.
The MR service accounts don't necessarily need to be domain accounts, though that is the most common.
They can also be the Network Service or Local Service account, but also need to be assigned to the sysadmin role in SQL, access to the network share or SharePoint location that reports will be generated to and should be dedicated account where password doesn't expire.
That being said, all MR users must have AD domain accounts for authentication.
Derek, I would definitely put us in the most work but some don't category. This is the first client we have had this issue. I could play around with different domain/local accounts but I really want to get into MR so I can export the building blocks. Why does MR require a domain? If the account is a local admin why can't it run the MR services?
I'm wondering if you might be running into a connection issue with MR we've started to see due to Windows updates, as mentioned in our blurb below:
If MR was working and then suddenly stopped, it is most likely related to the November Windows updates which have a known issue with Kerberos when installed on a domain controller server. The KB numbers vary based on the OS but these are the ones we have noted so far:
Server 2016:
Server 2019:
Server 2022:
From what we have seen, the issue can be intermittent. There were out of band (OOB) patches released to address this known issue. We are seeing it fix the issue for some but not all:
Server 2016:
OOB Fix 5021654: support.microsoft.com/.../5021654
Server 2019
OOB Fix 5021655: support.microsoft.com/.../5021655
Server 2022
OOB Fix 5021656: support.microsoft.com/.../5021656
The OOB patches, and their prerequisite KBs, need to be applied to all domain controller servers. You may need to reboot again after rebooting for the update for them to take effect.
Some users are able to work around the issue by creating SPN’s. Create two SPNs for the domain account running the MR services. You must log in as a full domain administrator to do this. To create an SPN for this domain account, run the Setspn tool at an elevated command prompt (Run as Administrator) with the following commands:
setspn -S HTTP/Mrservername domain\customAccountName
setspn -S HTTP/MRservername.fullyqualifieddomainname domain\customAccountName
"MRservername" should be replaced with the MR server name where the MR Application Service is installed.
"domain\customAccountName" should be replaced with the domain account running the MR Services (check the MR Configuration Console for this account)
"MRservername.FullyQualifiedDomainName" should be replaced with the fully qualified domain name of the MR server where the MR Application Service is installed.
Another potential work-around is to reinstall the MR services using one of the built-in Local Service or Network Service accounts. This is only an option if the MR services are installed directly on the SQL server. Here are the steps:
1. Get all users out of MR and make a backup of the ManagementReporter SQL database.
2. Log into the MR server as a user who is an Administrator in MR, an Administrator on the server, and a sysadmin in SQL.
3. Start the MR Configuration Console.
4. Select the integration and use the Remove link at the top-right to remove it.
5. Under Services, use the Remove links at the top right to remove the process service and then the application service.
6. Close the Configuration Console.
7. Delete the ManagementReporterDM database from SQL if it exists.
8. In SQL under Security -> Logins, right-click -> Properties -> User Mapping on the account that you want to run the MR services. Add the account if it isn’t there yet (right-click on Logins).
9. Mark the ManagementReporter database and ensure the GeneralUser and public roles are selected.
10. Start the MR Configuration Console. It may pop up asking what to deploy. If not, click File -> Configure.
11. Choose to deploy just the two MR services (application and process). Wait to deploy the integration until later.
12. Select the Local Service or Network Service account (whichever was added to SQL), mark the “Connect to an existing database checkbox”, and select the ManagementReporter database from the dropdown.
13. Click File -> Configure and deploy the integration. Use the ‘sa’ credentials to select the DYNAMICS database. If using the data mart, enable it and wait for it to fully load.
If none of the above works, the recommended action at this point is to roll back the November updates from the domain controllers.
Derek, the event log has the usual SOAP error and refers to SSL. They do not have SSL installed.
Message: System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at servername:4712/InformationService.svc that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
The following is the main blog we have regarding MR connection errors and the potential causes/resolutions for each one:
learn.microsoft.com/.../cannot-connect-to-server-error-message-when-starting-management-reporter
Most of these are geared more towards a client machine/Report Designer not being able to connect to the main MR Server, but some will still be applicable.
If you cannot connect the MR Client to the MR Server even on the server itself, try restarting the two MR services and then look in the Event Viewer logs on the server for more information as well as the service logs in the Configuration Console.
Thanks
#1
André Arnaud de Cal...
291,735
Super User 2024 Season 2
#2
Martin Dráb
230,466
Most Valuable Professional
#3
nmaenpaa
101,156
Share
Report
All responses (
Answers (
