返回
-
标题
Watcher service does not detect changes, manual compliance check does find changes -
说明
The watcher service can not find any modifications from the live environment on workflow enabled objects.
There are errors in the event log as follows:Access is denied.Error,System.Runtime.InteropServices.COMException (0x80070005): Access is denied.at System.DirectoryServices.SearchResultCollection.ResultsEnumerator.MoveNext()at Quest.Avalanche.Watcher.WatcherManager.LiveEnvironmentGPOWorker_DoWork(Object sender, DoWorkEventArgs e)Access is denied.Error,System.Runtime.InteropServices.COMException (0x80070005): Access is denied.at System.DirectoryServices.SearchResultCollection.ResultsEnumerator.MoveNext()at Quest.Avalanche.Watcher.WatcherManager.LiveEnvironmentDomainWorker_DoWork(Object sender, DoWorkEventArgs e)Access is denied.Error,System.Runtime.InteropServices.COMException (0x80070005): Access is denied.at System.DirectoryServices.SearchResultCollection.ResultsEnumerator.MoveNext()at Quest.Avalanche.Watcher.WatcherManager.LiveEnvironmentOUWorker_DoWork(Object sender, DoWorkEventArgs e)Access is denied.Error,System.Runtime.InteropServices.COMException (0x80070005): Access is denied.at System.DirectoryServices.SearchResultCollection.ResultsEnumerator.MoveNext()at Quest.Avalanche.Watcher.WatcherManager.LiveEnvironmentSiteWorker_DoWork(Object sender, DoWorkEventArgs e) -
原因
The watcher service is missing the permission for replicating directory changes. -
解决办法
The Watcher Service requires that the service account has the “Replicating directory changes” permission on the Default Naming Context (DC=domain, DC=com) and the Configuration Context (CN=Configuration, DC=domain, DC=com) for this object and all descendants.
If setting permissions with a group, this group must be viable across all domains, i.e. a Global or Universal group.
Otherwise, if the group is a Domain Local, it can only monitor the changes in the domain that it exists in.