How to troubleshoot SSO agent reported: OS error -2147024891

03/26/2020 100 11409

DESCRIPTION:

This article explains how to troubleshoot SSO errors on the firewall where the Agent reports an OS error with a negative value of 10 digits. These numbers change from time to time, however the underlying cause remains the same. 

The SSO agent reports an OS error of -2147024891 in this scenario. 

CAUSE:

This error is the cause of a WMI failure to a machine where there is no user logged in. This is received from the SSO agent as "getFields failed" in the RPC log which can be found in the SSO agent. WMI, when polling for a user name is unable to retrieve some fields, which is represented by SonicOS as this negative number.

This can also be verified by looking up the same user on the Sonicwall using the Test feature in the SSO configuration: 

This error can be translated to a "No User Found" error. In most cases, if WMI fails, NetAPI will try to poll the IP again to get user information. The IP addresses which result in these negative number errors, usually get a "No user found" from NetAPI, which means no user is logged in to the machine. The same can be observed in the log messages from the RPC log on the SSO agent, as shown below: 

Line 36: 04/23/2018 13:15:07.313 TAG_DEBUG RPC request: {"MethodInput":{"StartIp":"10.4.10.99","Range":1},"MethodName":"QueryUserByWMI","Stub":47099}

Line 37: 04/23/2018 13:15:07.391 TAG_DEBUG RPC response: {"Message":"success","MethodName":"QueryUserByWMI","MethodOutput":[{"Ip":"10.4.10.99","Result":"getFields failed","TimeSpent":"0.06"}],"Result":true,"Stub":47099}

Line 42: 04/23/2018 13:15:27.500 TAG_DEBUG RPC request: {"MethodInput":{"StartIp":"10.4.10.99","Range":1},"MethodName":"QueryUserByNetAPI","Stub":47102}

Line 43: 04/23/2018 13:15:27.625 TAG_DEBUG RPC response: {"Message":"success","MethodName":"QueryUserByNetAPI","MethodOutput":[{"Ip":"10.4.10.99","Result":"No user found","TimeSpent":"0.13"}],"Result":true,"Stub":47102}

RESOLUTION:

This issue can be resolved by not using WMI. This particular error message is not indicative of an SSO error as it detects no user logged in; so you can continue to use WMI for user identification. NetAPI on the other hand will show the message as " No user Found"