About Beetlejuice_

Beetlejuice_ · ‎01-07-2014

I'm getting the same result as you are. Looking into it more I found the following Juniper KB article (KB16934) which point to a Microsoft Technet article. I stopped at that point...

Beetlejuice_ · ‎11-04-2013

Yes - you can create a new role mapping to a role that does nothing - i.e. We have some that displays a webpage (delivered from an internal webserver) that basically explains why that particular user is not permitted to sign in but you need not go that far I guess. The new role mapping can be the DA username(s) or if there are loads (and I hope for your sake there are not ) you can point it to the DA Group in AD. Using the DA group is the safest because if a new user is added to DA's group then they will also receive the fake role whereas if you specify the username then the new user will be missed. That new mapping needs to be above the "*" role mapping for all other users and you then need to tick the ' Stop processing rules when this rule matches' box for the new role mapping. It works from top downwards. If a user is not in the DA Group it moves onto the next mapping. If the user is in the DA Group it stops and assigns the fake role. Job done...

Beetlejuice_ · ‎05-28-2009

Thanks for your response, contents of the config.ini are; (I have just *** out the sensitive stuff ) [DOUBLELOGON] PROGRESS=0 [vpn.********.com] enable_logupload=1 CertMd5=***************************** fips_mode=0 [Network Connect 6.5.0] locale=en ProxyServers=****.************.***:80;****.******* *****.***:80 GINAIVE=35=https://vpn.********.com [default] current_user=******** current_domain=******** [GINA] user_enable_gina_option=0 NCGinaRegistered=1 DisableGina=0

Beetlejuice_ · ‎05-28-2009

In the role mapping you can specify the users that can connect to the role - just don't include the Domain Admins? You could point the role mapping to a security group in AD that has all users other than the DA's. Hope that helps...

Beetlejuice_ · ‎05-28-2009

We use Network Connect with GINA enabled. There is a Host Checker policy (looks for a file hidden on C:\) that is assigned to the NC realm. This has worked fine for a number of years but all of a sudden we started receiving calls with the error message stating, "HostChecker Launching failed. Please login without using Juniper GINA (nc.windows.gina.24215)". We use software version 6.5R2 in production but we have also tried it on version 7.3R8 which we will be migrating to shortly. This error is affecting more than 60 XP machines (all started within 1 day of each other) but not all of the XP machines. We have so far not received any reports of it affecting Win 7 PC's. Looking at the debug log it looks like the HostChecker process that should be running to evaluate the HC Policy id failing. The error in the log file is, "create process failed with err = 193". We have checked to make sure no recent updates have been deployed etc. Has anyone come across this error before? Any pointers would be greatly received.

Beetlejuice_ · ‎05-28-2009

Under Authentication - Endpoint Security - Host Checker check to see what your "Perform Check Every" and "Client-side Process, Login inactivity timeout" settings are set to. I bet it's 40 minutes. I have experienced this problem with some of the IVE versions (not all of them!!) and the work around it to up these settings to a value higher than your Session Timeout in the user role.

Beetlejuice_ · ‎05-28-2009

No, at startup we get the create process failed error. If you then login, without NC, and go through IE using the URL it works. Just can't get it to work at login stage.

Re: Secure Mail

Re: First post & already asking for help.

Re: HostChecker Launching Failed

Re: First post & already asking for help.

HostChecker Launching Failed

Re: NC disconnects every 40 minutes

Re: HostChecker Launching Failed