FortiClient EMS 6.4.1 does not sync to AD

[blair_nowakowsky]

I have been testing the FortiClient EMS server and got it working in a test system for now using 6.2.7.   I have tried upgrading to 6.4.0 and 6.4.1 and it breaks my AD sync.   It fails to complete any sync.   When I try to re-create the Domain sync it is successful when I do a test but when I then go to sync it stays at 0% and never completes.    I was hoping that the 6.4.1 version had fixed this as there is a Resolved Bug in the release notes for Domain sync failing to complete.   

I had a Fortigate support ticket open before and they were very unhelpful.   They basically told me no one else has experienced this and it should work.  They did mention that since I could get it working with an earlier issue that there was not problems.  Oh boy! how helpful. 

Has anyone else experienced this issue?

This product is basically useless if I cannot get this working.  

Blair Nowakowsky

Coanda Research

[Seppel]

Hello

We also had some problems with the previous versions. But with 6.4.1 everything works fine. Here are our settings.

[FortinKnight]

Are you seeing the following warning in the logs under the administration menu, 

Cannot enumerate DC=*********,DC=**** (LDAP ID 5) due to previous error: Failed to roll back transaction while handling exception.

This is what we have been getting recently, also since the upgrade to v6.4.1, we do have 2 domains attached and it only seems to effect this particular one domain. 

the only way i fix it is to remove the domain from the console and re create it, it than syncs fine than. 

unfortunately it does than remove all those endpoints, and over a few hours re registers them back. 

[blair_nowakowsky]

Hi FortinKnight.

I am (kind of) glad that someone else has this problem.   It is good you were able to fix it.   My errors are slightly different.   I have tried deleting the domain and recreating it but it will not sync and because of that the clients loose all of their configuration.   It is a test system so not a big deal with that but I cannot use the software like this.   I have a ticket in with Fortinet support and if they ever come back with a solution I will post it.  There seem to be a few AD sync issues related to the 6.4.x versions.  6.2.7 works fine for me.

This is a VM with a snapshot so I can always roll back the upgrade.   I really want to be at 6.4.1+ but.....

I am getting the error:

[ ERROR ] Failed to enumerate ou=xxxxxxx,DC=xxxxxx,DC=xxxxxx: Object reference not set to an instance of an object.

and

[ WARNING ] Cannot enumerate ou=xxxxxxx,DC=xxxxxx,DC=xxxxxx (LDAP ID 1) due to previous error: Object reference not set to an instance of an object.

TNX

Blair.

FortinKnight wrote:

Are you seeing the following warning in the logs under the administration menu, 

Cannot enumerate DC=*********,DC=**** (LDAP ID 5) due to previous error: Failed to roll back transaction while handling exception.

This is what we have been getting recently, also since the upgrade to v6.4.1, we do have 2 domains attached and it only seems to effect this particular one domain. 

the only way i fix it is to remove the domain from the console and re create it, it than syncs fine than. 

unfortunately it does than remove all those endpoints, and over a few hours re registers them back.