Return
-
Title
"Unable to authenticate to host host.domain.com with credential" and "credentials rejected " error when WindowsAgent can't connect to the monitored host using WinRM. -
Description
A WindowsAgent using the WinRM connection method could not connect to the monitored host. The following message was reported in the non-debug log:ECHO <HostAgents/5.7.2/WindowsAgent/Monitor@host.domain.com-agent> ERROR [Quartz[0]-711] com.quest.remoteos.SystemMonitorImpl - The agent failed to collect data for host.domain.com.com.quest.glue.api.services.RemoteConnectionException: a connection could not be establishedThe following messages were reported in the debug WindowsAgent log:ECHO <HostAgents/5.7.2/WindowsAgent/Monitor@host.domain.com> DEBUG [Quartz[0]-0] com.quest.glue.core.remoteconnection.ConnectionPool - Unable to authenticate to host host.domain.com with credential 04d18da6-f705-4722-86ea-d94fe8de2722com.quest.glue.api.services.CredentialRejectedException: received HTTP/401 - credentials rejected...ECHO <HostAgents/5.7.2/WindowsAgent/Monitor@host.domain.com> DEBUG2 [Quartz[0]-0] com.quest.glue.core.services.windowsinfo.WindowsInfoServiceImpl - Caught unimportant exception; safe to ignore: connection attempted failed, moving on to next connectioncom.quest.glue.api.services.InvalidCredentialsException: A connection with host.domain.com-agent could not be established using any of the 1 credentials assigned to this host -
Cause
The FglAM identified the monitored host as being in a different domain (domain.com) than the FglAM was in (child.domain.com), and the krb5.conf file was not configured in a way that would allow the FglAM to contact the KDC (Key Distribution Center) in the parent domain (domain.com) to authenticate the user. Both hosts were actually members of the same domain (child.domain.com). -
Resolution
The domain of the credential user was changed from domain.com (domain.com/user) to child.domain.com (child.domain.com/user).