Intel® vPro™ Platform
Intel Manageability Forum (Intel® EMA, AMT, SCS & Manageability Commander)
Announcements
Intel® Endpoint Management Assistant (Intel® EMA) Cloud Start Tool for Azure* 2.0 is now available for download here.

The Intel® Manageability Commander 2.2 has been released! Learn more here.

The Intel® Endpoint Management Assistant, version 1.6.0 is now available for download here.

The Intel® Setup and Configuration Software tool will End of Life (EOL) on 12/31/2022. The Intel® Setup and Configuration Software Download will be available until March 31, 2021. For details, Please click here.
2570 Discussions

Intel EMA Windows Login issue

k_thnx
Beginner
2,464 Views

I have Intel EMA setup to use windows login. We have multiple domains, so say I sign on as contoso\user. It pulls in an email from an account on another domain lets call that contoso2\user  While both of these accounts are related to the same user. The emails associated with them are different. When you get logged on, the email being used to delegate permissions will be incorrect. So a user may not be able to login or have the right permissions. The current fix is to add both emails.

But it shouldn't be getting that email, its associated with a different domain. Its almost like its searching all domains for a username, but ignoring the domain it comes from. 

0 Kudos
12 Replies
JoseH_Intel
Moderator
2,406 Views

Hello k_thnx,


Thank you for joining the Intel community


The issue you describe is been reported and it is under investigation. Please allow us some time in order to get our engineering team involved. We will get back to you as soon as we have updates.


Regards


Jose A.

Intel Customer Support Technician


JoseH_Intel
Moderator
2,191 Views

Hello k_thnx,


Just wanted to let you know that we have escalated the issue and an engineer is investigating it. We have seen this issue before but is not common. We may need some time. We appreciate your patience while we look into this. Seems like somehow this may turn out to be a complex issue. We will keep you posted. You can also ask for updates in the meanwhile.


Regards


Jose A.

Intel Customer Support Technician


k_thnx
Beginner
2,153 Views

Thank you, let me know if I can be of any assistance.

JoseH_Intel
Moderator
1,774 Views

Hello k_thnx,


AD is actually using a UPN (User Principal Name), not the email address. However, often UPNs will look like email address. You can have two UPNs be the same email address. This often gets confusing in a multi-domain environment.

So you need to verify in your AD it is in fact the UPN is what you believe you are trying to login with.

Also could you tell if this is an on-prem installation or in the cloud?


Regards


Jose A.

Intel Customer Support Technician


k_thnx
Beginner
1,466 Views

Yeah the UPN is being selected. But is for the wrong account. So say I am logged on as Domain1\User55. I may also have an account in another forest lets call it Domain2\User55. Both these account have different UPNs.

User55@Domain1.com

User55@Domain2.com

 

When I login using my windows credential it is getting User55@Domain2.com even though I am logged in as User55@Domain1.com

It seems like EMA is pulling the entire global catalog and finding the first match..

 

This is an On-Prem Installation.

 

 

JoseH_Intel
Moderator
1,431 Views

Hello k_thnx,


It looks like AD is actually using a UPN (User Principal Name), not the email address. However, often UPNs will look like email address.

You can have two UPNs be the same email address. This often gets confusing in a multi-domain environment.

You need to verify in your AD it is in fact the UPN is what you believe you are trying to login with.


Regards


Jose A.

Intel Customer Support Technician


JoseH_Intel
Moderator
1,363 Views

Hello k_thnx,


I am just following up to double-check if you found the provided information useful. If you have further questions please don't hesitate to ask. If you consider the issue to be completed please let us know so we can proceed to mark this thread as closed. I will try to reach you back on next Tuesday 16th. After that the ticket will be automatically archived. 


Regards


Jose A.

Intel Customer Support Technician


k_thnx
Beginner
1,314 Views

Hey Jose,

 

While information is useful it doesn't solve the problem. The UPN ema finds does not directly match the account the user has logged into windows with.

 

So say I am logged on as Domain1\User55. I may also have an account in another forest lets call it Domain2\User55. Both these account have different UPNs.

User55@Domain1.com

User55@Domain2.com

 

When I login using my windows credential it is getting User55@Domain2.com even though I am logged in as User55@Domain1.com

It seems like EMA is pulling the entire global catalog and finding the first match..

 

JoseH_Intel
Moderator
1,238 Views

Hello k_thnx,


Thank you for your feedback. Let me try to do a further research to try to find the root cause for this behavior.


Regards


Jose A.

Intel Customer Support Technician


JoseH_Intel
Moderator
1,131 Views

Hello k_thnx,


Please bring up Powershell as the User55@Domain1.com and run the following command...

([ADSI]"LDAP://<SID=$([System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value)>").UserPrincipalName


Then bring up Powershell has the User55@Domain2.com

([ADSI]"LDAP://<SID=$([System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value)>").UserPrincipalName


Please go ahead and report back the results for each user. Our suspicion is that you have the UPN mixed up and they aren't associated to the right accounts.


Regards


Jose A.

Intel Customer Support Technician


JoseH_Intel
Moderator
1,042 Views

Hello k_thnx,


I am just following up to double-check if you found the provided information useful. If you have further questions please don't hesitate to ask. If you consider the issue to be completed please let us know so we can proceed to mark this thread as closed. I will try to reach you back on next Thursday 25th. After that the ticket will be automatically archived. 


Regards


Jose A.

Intel Customer Support Technician


JoseH_Intel
Moderator
985 Views

Hello k_thnx,


We will proceed to mark this thread as closed. If you have further issues or questions just go ahead and submit a new topic.


Regards


Jose A.

Intel Customer Support Technician


Reply