- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
How to troubleshoot SSO agent reported: OS error -2147024891
03/26/2020 
110 People found this article helpful
97,596 Views
Description
This article explains how to troubleshoot SSO errors on the firewall where the Agent reports an OS error with a negative value of 10 digits. These numbers change from time to time, however the underlying cause remains the same.
The SSO agent reports an OS error of -2147024891 in this scenario.
Cause
This error is the cause of a WMI failure to a machine where there is no user logged in. This is received from the SSO agent as "getFields failed" in the RPC log which can be found in the SSO agent. WMI, when polling for a user name is unable to retrieve some fields, which is represented by SonicOS as this negative number.
This can also be verified by looking up the same user on the Sonicwall using the Test feature in the SSO configuration:
This error can be translated to a "No User Found" error. In most cases, if WMI fails, NetAPI will try to poll the IP again to get user information. The IP addresses which result in these negative number errors, usually get a "No user found" from NetAPI, which means no user is logged in to the machine. The same can be observed in the log messages from the RPC log on the SSO agent, as shown below:
Line 36: 04/23/2018 13:15:07.313 TAG_DEBUG RPC request: {"MethodInput":{"StartIp":"10.4.10.99","Range":1},"MethodName":"QueryUserByWMI","Stub":47099}
Line 37: 04/23/2018 13:15:07.391 TAG_DEBUG RPC response: {"Message":"success","MethodName":"QueryUserByWMI","MethodOutput":[{"Ip":"10.4.10.99","Result":"getFields failed","TimeSpent":"0.06"}],"Result":true,"Stub":47099}
Line 42: 04/23/2018 13:15:27.500 TAG_DEBUG RPC request: {"MethodInput":{"StartIp":"10.4.10.99","Range":1},"MethodName":"QueryUserByNetAPI","Stub":47102}
Line 43: 04/23/2018 13:15:27.625 TAG_DEBUG RPC response: {"Message":"success","MethodName":"QueryUserByNetAPI","MethodOutput":[{"Ip":"10.4.10.99","Result":"No user found","TimeSpent":"0.13"}],"Result":true,"Stub":47102}
Resolution
This issue can be resolved by not using WMI. This particular error message is not indicative of an SSO error as it detects no user logged in; so you can continue to use WMI for user identification. NetAPI on the other hand will show the message as " No user Found"
Related Articles
- Parserror on Event logs.
- Switch from the Policy mode to classic mode on Gen 7 appliances
- Analyzing TCP reset(RST)packets
Categories
- Firewalls > SonicWall NSA Series > User Login
- Firewalls > SonicWall SuperMassive 9000 Series > User Login
- Firewalls > TZ Series > User Login
YES
NO