topic AD Groups Authentication not working in Intel vPro® Platform

AD Groups Authentication not working

wosat666 — Thu, 12 Dec 2024 16:21:32 GMT

Hello

i setup a Intel EMA server on prem on a Windows Server 2025

if i create a local user with web console i can log on

but if i create a AD group with distinguished name, and add a user to the group the logon is not possible

in the log file i found the information "C:\Program Files (x86)\Intel\Platform Manager\EMALogs\EmaWebApiLogs\Ema-Global\2024-12-12.log"

2024-12-12 17:11:05.3586 [ERROR], Message: Can not find a match between AD Groups in EMA database & Active Directory

how can i fix this?

Re:AD Groups Authentication not working

Suneesh — Fri, 13 Dec 2024 00:16:08 GMT

Hello wosat666,

Good day,

Please share us the below given details:

SQL version

Location of SQL and EMA server; (physical, virtual)

Will they be on the same server machine?

Authentication mode: Local, Azure AD, or Windows AD

Intel® EMA software version:

Regards,

Suneesh_intel

Re: Re:AD Groups Authentication not working

wosat666 — Fri, 13 Dec 2024 08:32:28 GMT

SQL version

15.0.2000.5

Location of SQL and EMA server; (physical, virtual)

all on the same server, virtual server

Will they be on the same server machine?

yes

Authentication mode: Local, Azure AD, or Windows AD

Windows AD

Intel® EMA software version:

ema1.14.1.0

Re: Re:AD Groups Authentication not working

wosat666 — Fri, 13 Dec 2024 08:53:16 GMT

hello

now i try the role "endpoint group creator" and it works

i do not understand the for what is "endpoint group user"

thanks

Re:AD Groups Authentication not working

Suneesh — Sat, 14 Dec 2024 00:27:23 GMT

Hello wosat666,

Good day,

Glad to hear the issue is resolved.

For further details on End point group user and creator.

Endpoint Group Creator: This role is specific to a particular tenant. It can perform endpoint management, as well as create new endpoint groups and manage Intel AMT Profiles. An Endpoint Group Creator can be a member of multiple user groups and can manage all groups to which they belong. Endpoint Group Creators cannot perform user management. However, they can see the list of all user groups and the list of all Endpoint Group Creators and Endpoint Group Users in that tenant (i.e., user roles in that tenant that are equal or lower in the user role hierarchy; they cannot see Account Managers, Tenant Administrators, or Global Administrators).

Endpoint Group User: This role is specific to a particular tenant, and can perform endpoint management only. Endpoint Group Users can be members of multiple user groups, but they cannot perform user management, and can only view their own user information.

Please refer the link for more details on User Roles under section 1.2.2. https://www.intel.com/content/dam/support/us/en/documents/software/intel_ema_admin_and_usage_guide.pdf

Regards,

Suneesh_intel

Re:AD Groups Authentication not working

Suneesh — Tue, 17 Dec 2024 18:22:35 GMT

Hello wosat666,

Good day.

We are following up on this case. If further assistance is necessary, please do not hesitate to reply.

Regards,

Suneesh_intel

Re:AD Groups Authentication not working

Suneesh — Fri, 20 Dec 2024 00:19:46 GMT

Hello wosat666,

Good day.

We are following up on this case. If further assistance is necessary, please do not hesitate to reply.

Regards,

Suneesh_intel

Re: Re:AD Groups Authentication not working

wosat666 — Tue, 07 Jan 2025 14:30:32 GMT

sorry but today i have still the problem, that i can not login, if i use an account from the domain which is in a AD GROUP.

i have not changed anything in the IIS config

if i add user in the EMA web server under Users i can login

how can i troubleshoot this?

Re: Re:AD Groups Authentication not working

wosat666 — Wed, 08 Jan 2025 10:47:56 GMT

Hello Suneesh

after silvester

i try to login with an account in an AD group

but i have still no luck

i add some pics to show my config

can you please help me?