Active Directory registration not working Windows 7 x64 client

[Berend de Boer]

This is what I get with the original HostnameChange.dll:

[CODE] 16/02/2015 2:49 p.m. FOG::HostnameChanger Attempting to connect to fog server…
16/02/2015 2:49 p.m. FOG::HostnameChanger Attempting to connect to fog server…
16/02/2015 2:49 p.m. FOG::HostnameChanger Module is active…
16/02/2015 2:49 p.m. FOG::HostnameChanger Module is active…
16/02/2015 2:49 p.m. FOG::HostnameChanger AD mode requested, confirming settings.
16/02/2015 2:49 p.m. FOG::HostnameChanger AD mode requested, confirming settings.
16/02/2015 2:49 p.m. FOG::HostnameChanger Hostname is up to date
16/02/2015 2:49 p.m. FOG::HostnameChanger Hostname is up to date
16/02/2015 2:49 p.m. FOG::HostnameChanger Attempting to join domain if not already a member…
16/02/2015 2:49 p.m. FOG::HostnameChanger Domain Error! (‘Unknown Error’ Code: 1791)
16/02/2015 2:49 p.m. FOG::HostnameChanger Domain Error! (‘Unknown Error’ Code: 1326)[/CODE]

PS: had to split posts, as get a message that this was marked as spam by Askimet or something like that.

[Wolfbane8653]

From your comments [URL=‘http://fogproject.org/forum/threads/requests-for-wiki-access-ask-here.3811/page-2#post-42253’]here[/URL]. I am assuming that you have partly figured this out?

This error usually occurs due to the password not being encrypted correctly.

Check here and double check your settings.
[url]http://www.fogproject.org/wiki/index.php/FOGCrypt[/url]

[B]EDIT[/B]
OR the user you are inputting does not have the proper rights in your AD to join computers to the domain.

[Junkhacker]

[quote=“Berend de Boer, post: 42246, member: 28367”]
Had an a.b.c style DOMAIN, Administrator user did not have domain name in front. Have triple checked I got the password correct. The user is “Administrator” i.e. with all permissions as of this moment, as I’m trying to debug one problem at a time.[/quote]
It is worth mentioning that this user needs to be a domain user with rights to add computers to the domain, not a user on the computer.

[Berend de Boer]

[quote=“Junkhacker, post: 42278, member: 21583”]It is worth mentioning that this user needs to be a domain user with rights to add computers to the domain, not a user on the computer.[/quote]

Yep, it’s the domain administrator. I just wanted to avoid having permission issues, so using max permissions for now.

[Berend de Boer]

[quote=“Wolfbane8653, post: 42276, member: 3362”]From your comments [URL=‘http://fogproject.org/forum/threads/requests-for-wiki-access-ask-here.3811/page-2#post-42253’]here[/URL]. I am assuming that you have partly figured this out?

This error usually occurs due to the password not being encrypted correctly.[/quote]

That’s what one would think, but have triple checked the password, and got another person to check the encrypted password too.

But note I was using the old HostnameChanger and the new one. What error does indicate password not being encrypted correctly? Because I got different errors in both cases.

[Tom Elliott]

16/02/2015 2:49 p.m. FOG::HostnameChanger Domain Error! (‘Unknown Error’ Code: 1791)
16/02/2015 2:49 p.m. FOG::HostnameChanger Domain Error! (‘Unknown Error’ Code: 1326)

Those errors are messages coming directly from microsoft during the domain join process.

Look them up and you may have a better/clearer answer. The error codes you see are not FOG generated

[Joseph Hales]

The error codes appear to be as per [url]http://www.hiteksoftware.com/knowledge/articles/049.htm[/url]
[SIZE=4][FONT=arial][COLOR=#000000]1326 Logon failure: unknown user name or bad password.[/COLOR][/FONT][/SIZE]
[SIZE=4][FONT=arial][COLOR=#000000]1791 A remote procedure call is already in progress for this thread.[/COLOR][/FONT][/SIZE]

[Berend de Boer]

[quote=“Tom Elliott, post: 42287, member: 7271”]Look them up and you may have a better/clearer answer. The error codes you see are not FOG generated[/quote]

Yep, they are generated by the old HostnameChanger. But the new one says this:

[CODE]16/02/2015 2:41 p.m. FOG::HostnameChanger Padding is invalid and cannot be removed.
16/02/2015 2:41 p.m. FOG::HostnameChanger at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte
[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode,
Boolean fLast)
at System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset,
Int32 inputCount)
[/CODE]

As this is a different error message, does that mean that perhaps the encryption key of the new HostnameChanger is not the default one?

The old dll error message may seem to indicate I really have a problem with username/password, and I’ll check that again.

[Tom Elliott]

Which new one are you referring to?

The one from the github fogproject repo? Or the one from the fogservice repo?

[Berend de Boer]

[quote=“Tom Elliott, post: 42293, member: 7271”]Which new one are you referring to?

The one from the github fogproject repo? Or the one from the fogservice repo?[/quote]

The one I downloaded [URL=‘http://www.fogproject.org/forum/threads/active-directory-registration-not-working-windows-7-x64-client.11514/#post-42039’]from here in this thread[/URL].

[Berend de Boer]

OK, I had both the old dll and new dll in the directory, and it seems the service picks up both. That’s confusing. When using the new dll, I get this output (as already posted):

[CODE] 16/03/2015 9:04 p.m. FOG Service Engine Version: 3
16/03/2015 9:04 p.m. Starting all sub processes
16/03/2015 9:04 p.m. 2 modules loaded
16/03/2015 9:04 p.m. * Starting FOG.HostNameChanger
16/03/2015 9:04 p.m. * Starting FOG.MODDebug
16/03/2015 9:04 p.m. FOG::MODDebug Start Called
16/03/2015 9:04 p.m. FOG::MODDebug Sleeping for 100 Seconds
16/03/2015 9:04 p.m. FOG::HostnameChanger Starting hostname change process…
16/03/2015 9:04 p.m. FOG::HostnameChanger Yielding to other subservices for 5 seconds.
16/03/2015 9:04 p.m. FOG::HostnameChanger Attempting to connect to fog server…
16/03/2015 9:04 p.m. FOG::HostnameChanger Module is active…
16/03/2015 9:04 p.m. FOG::HostnameChanger AD mode requested, confirming settings.
16/03/2015 9:04 p.m. FOG::HostnameChanger Padding is invalid and cannot be removed.
16/03/2015 9:04 p.m. FOG::HostnameChanger at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte
[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode,
Boolean fLast)
at System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset,
Int32 inputCount)
at System.Security.Cryptography.CryptoStream.FlushFinalBlock()
at System.Security.Cryptography.CryptoStream.Dispose(Boolean disposing)
at System.IO.Stream.Close()
at FOG.FOGCrypt.decrypt(Byte[] cipherData, Byte[] Key, Byte[] IV)
at FOG.FOGCrypt.decrypt(Byte[] cipherData, String Password)
at FOG.FOGCrypt.decryptHex(String hex)
at FOG.HostNameChanger.changeHostName()[/CODE]

I’ve tried to fire up MonoDevelop, an IDE on Linux and to recompile this, but it seems my dll is not recognised unfortunately.

[Berend de Boer]

PS: it would be great if someone had a tip on how to compile HostnameChange.dll on Linux and produce a .dll that’s recognised. Then I could do some actual debugging!

[Berend de Boer]

And to repeat, with the original HostnameChange.dll I get this:

[CODE] 16/03/2015 9:21 p.m. FOG Service Engine Version: 3
16/03/2015 9:21 p.m. Starting all sub processes
16/03/2015 9:21 p.m. 1 modules loaded
16/03/2015 9:21 p.m. * Starting FOG.HostNameChanger
16/03/2015 9:21 p.m. FOG::HostnameChanger Starting hostname change process…
16/03/2015 9:21 p.m. FOG::HostnameChanger Yielding to other subservices for 7 seconds.
16/03/2015 9:21 p.m. FOG::HostnameChanger Attempting to connect to fog server…
16/03/2015 9:21 p.m. FOG::HostnameChanger Module is active…
16/03/2015 9:21 p.m. FOG::HostnameChanger AD mode requested, confirming settings.
16/03/2015 9:21 p.m. FOG::HostnameChanger Hostname is up to date
16/03/2015 9:21 p.m. FOG::HostnameChanger Attempting to join domain if not already a member…
16/03/2015 9:21 p.m. FOG::HostnameChanger Domain Error! (‘Unknown Error’ Code: 1355)[/CODE]

That’s the same error [URL='http://www.fogproject.org/forum/threads/fog-service-register-no-longer-working.10703/#post-29215’]that’s mentioned here[/URL].

[Tom Elliott]

And your username field is not in the format domain/username?

[Berend de Boer]

Wow, compiliation actually works if I compile the FOGService.exe as well and copy that first. That’s great, can now do development on Linux.

[Berend de Boer]

[quote=“Tom Elliott, post: 43893, member: 7271”]And your username field is not in the format domain/username?[/quote]

No, it wasn’t. The domain name is automatically appended I saw already. The problem is that the password is garbled. When I hard-code it, everything works. Narrowing down to the culprit.

[Berend de Boer]

One thing I found out is that you cannot use the fully qualified name as domain in the active domain settings of a client. It must be in NetBios format. The reason is that the backend returns the user name as “<DOMAIN><username>” and if you have as domain “fog.example.org” you get a user name “fog.example.org\Administrator” for example, which won’t work.

[Berend de Boer]

The error, as everyone expected, was indeed in the encryption key. Somehow there is a difference between how HostnameChange encrypts/decrypts. I put in some debug code to encrypt my password and the encrypted hex is completely different. When I enter this encrypted hex in the active domain settings, everything works. Now tracking down why HostnameChange encrypts differently from the standard FOGCrypt (recompiled that from scratch as well, same output as standard binary).

[Tom Elliott]

This completely depends on your set ups environment yes there are times were having the fully qualified domain name works perfectly and there are times where it doesn’t I don’t know the specific settings that cause these issues or how to fix them but they are completely environmental

[Berend de Boer]

And here’s the very very nasty deal: you will have to run FOGCrypt.exe on the SAME computer as you want to decrypt on. I did run FOGCrypt.exe on different computers (Linux in this case), and it simply does not encrypt/decrypt the same. I don’t know why.

This may be an implementation issue in mono, maybe 32/64 bit??

But that’s all that there was to it. Bummer, this whole thing cost me a big amount of time of getting fog up and running. I would love to contribute back some patches and knowledge. But can’t get access to the Wiki to cleanup some obsolete comments.

And how do I propose patches? Is that against the git branch? For example the AbstractFOGService uses the wrong variable name, here’s patch:

[CODE]diff --git a/FOGService/src/AbstractFogService/AbstractFOGService.cs b/FOGService/src/AbstractFogService/AbstractFOGService.cs
index f7cbeae…332b029 100755
— a/FOGService/src/AbstractFogService/AbstractFOGService.cs
+++ b/FOGService/src/AbstractFogService/AbstractFOGService.cs
@@ -265,9 +265,10 @@ namespace FOG
f.Delete();
}

•                objReader = new StreamWriter(strLogPath, true);
  

•                objReader.WriteLine(" " + DateTime.Now.ToShortDateString() + " " + DateTime.Now.ToShortTimeString() + " " + moduleName + " " + strlog);
  

•                objReader.Close();
  

•      using (StreamWriter writer = new StreamWriter(strLogPath, true))
  

•      {
  

•        writer.WriteLine(" " + DateTime.Now.ToShortDateString() + " " + DateTime.Now.ToShortTimeString() + " " + moduleName + " " + strlog);
  

•      }
            }
        }
        catch
  

[/CODE]

And this one to give better logging on what is exactly wrong instead of an error code:

[CODE]diff --git a/FOGService/src/FOG_HostNameChanger/MOD_HostNameChanger.cs b/FOGService/src/FOG_HostNameChanger/MOD_HostNameChanger.cs
index ae3de28…c39c315 100755
— a/FOGService/src/FOG_HostNameChanger/MOD_HostNameChanger.cs
+++ b/FOGService/src/FOG_HostNameChanger/MOD_HostNameChanger.cs
@@ -47,6 +47,8 @@ namespace FOG
public const int AccessDenied = 5;
public const int BadNetPath = 53;
public const int WrongPassword = 1323;

•        public const int LogonFailure = 1326;
  

•        public const int BadDomain = 1355;
        public const int UnknownDevDir = 2116;
        public const int TooManyItems = 2121;
        public const int RemoteErr = 2127;
  

@@ -289,7 +291,7 @@ namespace FOG
{
try
{

•                            log(MOD_NAME, "Attempting to connect to fog server...");
  

•                            log(MOD_NAME, "Connecting to fog server...");
                            WebClient wc = new WebClient();
                            String strPath = strURLModuleStatus + "?mac=" + macList + "&moduleid=hostnamechanger";
                            strDta = wc.DownloadString(strPath);
  

@@ -437,7 +439,11 @@ namespace FOG

                                                strUser = strU;
                                                if (strP != null && strP != "")

•                                                {
  

•                                                    FOGCrypt c = new FOGCrypt(PASSKEY);
                                                    strPass = new FOGCrypt(PASSKEY).decryptHex(strP);
  

•                                                }
                                                else
                                                    strPass = "";
  

@@ -599,6 +605,10 @@ namespace FOG
return "Domain Error! (‘Bad Netpath’ Code: " + code + ") ";
case NERR.WrongPassword:
return "Domain Error! (‘Wrong Password’ Code: " + code + ") ";

•            case NERR.LogonFailure:
  

•                return "Domain Error! ('Logon failure, unknown user name or bad password' Code: " + code + ") ";
  

•            case NERR.BadDomain:
  

•                return "Domain Error! ('The specified domain either does not exist or could not be contacted' Code: " + code + ") ";
            case NERR.DCNotFound:
                return "Domain Error! ('DCNotFound' Code: " + code + ") ";
            case NERR.SetupAlreadyJoined:
  

[/CODE]

And I would love to be allowed to add a patch that forbids people to use a DNS domain name in the active directory settings, or forbids to use the ‘’ character in the user name, both won’t work.