Trouble Shooting: TechIDAgent is not doing the “right” thing

Issue:

You’ve installed the TechIDAgent, but something isn’t working as expected. You might notice one of the following:

• The agent isn’t listed in the TechIDPortal
• It is listed in the TechIDPortal, but no users appear in the TechIDClient
• User accounts are created in the wrong OU or without the correct permissions
• Passwords aren’t rotating
• Or something else just doesn’t seem right

Let’s walk through some troubleshooting steps—starting with the most common issues and moving toward less frequent ones:

---

1

Check if the TechIDAgent is running

• For domain accounts:
  Ensure the TechIDAgent is running on the Domain Controller (DC). Look for a service named “TechIDAgent”. If it’s not running, start it using: TechIDAgent.exe start 
  Refer to the TechIDAgent setup documentation for guidance.
• For local admin accounts or LAPS:
  Ensure the TechIDAgent is running on the local machine.
  Again, look for the “TechIDAgent” service. If it’s not running, start it using: TechIDAgent.exe start
  Refer to the same documentation.

---

2

Check for user rights via Triplets

• Go to the TechIDPortal and navigate to:
  Reports -> Triple Access Report
• Select the relevant Agent from the dropdown.
• Make sure the expected users have at least one Right on that Agent.
• If not, create appropriate Groups and a Triplet to grant them rights.
  See the Triplets documentation.

---

3

Check the Agent log for errors

• Go to the directory where TechIDAgent is installed.
• Open the Logs folder and review
  TechIDAgent.log (not TechIDAgent.InstallLog).
• Look near the end of the file for errors.

---

4

Common errors in TechIDAgent.log and their solutions

• System.DirectoryServices.AccountManagement.PasswordException: The password does not meet the password policy requirements.
Likely due to a password over 16 characters on an SBS (or SBS-migrated) domain.
  Solution: Use a 16-character password. Set this using the passwordlength option.
  See the setup documentation.
• System.UnauthorizedAccessException: Access is denied.
  This typically indicates an Active Directory issue.
  • Can you manually perform what TechIDAgent is trying to do?
  • Is TechIDAgent running on the DC?
  • Is the service running as Local System?
  • Could antivirus or other protection software be interfering
• System.DirectoryServices.AccountManagement.PrincipalServerDownExceptionor System.DirectoryServices.AccountManagement.ActiveDirectoryServerDownException
These mean the agent is referencing a DC that is offline or decommissioned  (“tomb stoned”). This is an AD setup issue and the references to the old, off, or decommissioned, DC need to be removed from AD. 
  Solution: Remove all references to that DC from Active Directory.
• System.IO.FileNotFoundException: Could not load file or assembly 'Newtonsoft.Json, Version=12.0.0.0...
This means not all files from the distribution ZIP were copied to the same directory.
  Ensure everything is correctly placed.
• System.DirectoryServices.AccountManagement.MultipleMatchesException:Multiple principals contain a matching identity...
This usually happens when TechIDAgent is installed on two DCs and both created user accounts before syncing.
  Solution:
  • Uninstall TechIDAgent from one DC
  • Delete the duplicate user accounts
  • Let the remaining TechIDAgent recreate/manage them
• Error: MainThread : System.Exception: Error posting information about Domain with CentralHost... – This error indicated a breakdown in communication between the affected server and the TechIDManager server. Essentially, every time the client server attempted to initiate a connection, it is being silently ignored. 

  In our zero trust environment, all communication between a TechIDAgent and  theTechIDHost must be validated using public-private key pairs. This security measure was introduced as part of TechIDManager 5.0.  This issue can arises when one of these keys is changed, becomes invalid, or is corrupted. When the TechIDAgent presents a mismatched or invalid key, the TechIDHost cannot verify the identity and, as a result, ignores the communication attempt entirely. No verification means no trust—and no trust means no action.
  Solution: select “Clear Public Key” in the specific agent’s details screen in the TechIDPortal and allow the TechIDAgent to upload its key as the trusted key. 

---

Still having issues?

Contact Support@RuffianSoftware.com. We are here to help.