Chapter 19. Troubleshooting ZENworks

ZENworks for Desktops is an extremely powerful tool. It saves network administrators much needed time. However, because of the complexity of network environments, problems can occur that prevent ZENworks for Desktops from doing its job. This chapter covers how to troubleshoot and diagnose those problems in the following areas:

• Troubleshooting desktop management

• Troubleshooting distributed applications

• Troubleshooting policies packages

• Troubleshooting NetWare errors

Troubleshooting Desktop Management

Desktop management is difficult to troubleshoot because several network components are involved; this includes the server, clients, eDirectory, and the LAN.

The following sections discuss the most common areas to review when you are troubleshooting desktop management issues.

Reduce LAN Traffic

If you find that LAN traffic is unacceptable after you create and associate policy packages with objects, you might need to reduce the LAN traffic. One effective way you can reduce LAN traffic is by limiting how the system searches the tree for associations between policy packages and objects discussed in earlier chapters. Limiting the searches should reduce LAN traffic.

To reduce LAN traffic in this way, use the following steps in ConsoleOne:

  1. Create a Container Policy Package. Right-click it and select Properties from the drop-down menu.

  2. Enable the Search Policy on the Policies tab.

  3. Highlight the Search Policy and click the Properties button.

  4. On the Search Level tab, set the Search For Policies Up To field to Partition, and then choose OK to close the Search Policy properties window. This limits how many directory levels are searched for associations between policy packages and objects.

  5. Select the Associations tab, and associate this Container Policy Package to the container where you want to make the Search Policy effective. Remember that the Search Policy affects all containers below the associated container, because the workstation manager looks for the container package.

Troubleshooting Workstation Import Issues

If an attempt to import a workstation was unsuccessful, you might need to troubleshoot import by using the suggestions covered in the following sections.

Note

A workstation does not synchronize with eDirectory until after it has been imported and the Workstation Registration program runs again.

Verify Workstation Setup

The first step in troubleshooting workstation import issues is to verify that the correct client is installed on the workstation. This client can be installed from the ZENworks for Desktops CD, or can be downloaded from Novell's Web site.

Validate the Workstation Import Policy

The next step in troubleshooting workstation import issues is to validate the Workstation Import Policy. First verify that the Workstation Import Policy is enabled for the server in to which the user is logging. Do so following these steps:

  1. From ConsoleOne, right-click the server that the user, not registering their workstation, is logging into and select Properties.

  2. Click the ZENworks, Effective Policies tab.

  3. Select the correct platform for the server that the user is logging into and then click Effective Policies.

  4. There should be a policy package listed for the Workstation Import Policy. If not, you need to create-enable the Workstation Import Policy in a Server Policy Package and associate it to the server.

Check Registry Keys for Workstation Manager

Next check the Registry keys for Workstation Manager to ensure that the workstation is not already imported. Follow these steps:

  1. Launch REGEDIT.EXE (or REGEDT32.EXE for NT/2000/XP).

  2. Browse to the following Registry key:


    HKEY_LOCAL_MACHINESOFTWARENovellWorkstation ManagerIdentification


  3. Workstation registration might be in three states (No WS Import Policy, Registration, or Imported).

    If the workstation is in the No WS Import Policy state, the Registered In, Registration Object, and Workstation Object values will be either NULL or will not exist.

    If the workstation is in the Registration state, the Registered In and Registration Object values will be populated, but the Workstation Object value will not exist.

    If the workstation is in the Imported state, the Registered In, Registration Object, and Workstation Object values will be populated.

Note

A good general troubleshooting step for registration is to delete the Registered In, Registration Object, and Workstation Object values. They will be recreated at the next boot up login attempt.

Verify the Trusted Tree for Workstation Manager

Once you have verified the Registry keys, ensure that the Workstation Manager Trusted Tree is set to the correct tree name by using the following steps:

  1. Launch REGEDIT.EXE (or REGEDT32.EXE for NT).

  2. Browse to the following Registry key:


    HKEY_LOCAL_MACHINESOFTWARENovellWorkstation ManagerIdentification


  3. The tree value must exactly match the tree name the user is logging into. ZENworks is enabled for one tree at a time, and this tree name is listed here. If the tree you are logging into does not match this Registry value, all of ZENworks is disabled (including the Workstation Import Policy).

Ensure That the Automatic Workstation Import Is Running

Verify that the Automatic Workstation Import service is running on your server and that an import policy is associated with that server.

Also check to make sure that the workstation is pointing to the import service by having the string "ImportServer=<DNS of the import service server>" or "ImportServer=<IP address of the import service server >" in the following Registry key :


HKEY_LOCAL_MACHINESoftwareNovellENworkszenwsreg


View the Error Log

When troubleshooting workstation import issues, you can also view the WSREG32.LOG log file at the root of the C: drive. Look for errors and then continue troubleshooting from there.

Re-Register the Workstation

As a final option, you can re-register the workstation by running the register utility from the following location:


C:Program FilesNovellENworkszwsreg.exe


Use the –unreg option to unregister and no parameters to register. Use /? or -? for additional options.

Troubleshooting Distributed Applications

The next area of troubleshooting ZENworks for Desktops is distributed applications. If users encounter problems using distributed applications, you can use the following procedures to help diagnose and debug the issues.

Troubleshoot Application Launcher and Explorer

The first place to start when troubleshooting distributed applications is Application Explorer. You can obtain information about Application Explorer to help you troubleshoot problems that your users encounter.

Open the Application Launcher Debug Window

You can see the applications and their states within a debug window to allow you to see, from the workstation's perspective, what applications are available and why or why not. This can be opened by launching the Application Windows or Explorer. Choose the About box from the menu. Then press and hold the F2 key and click on the More button. This will bring up the debug window and provide all the information about the application.

Review Information About the State of Currently Running Applications

The first issue to consider when troubleshooting the Application Launcher is getting information about the state of currently running applications. This helps you determine whether any resource conflicts or incompatibilities exist between different applications.

To get information about the state of applications currently running on a workstation, select Start, ZENworks for Desktops 4, Application Window and check the status of any running applications.

Re-create the Workstation Cache

You can remove the c: alcache directory from the workstation. This will remove all distributed information about the applications from the workstation. The cache will be re-created and repopulated the next time that you boot or run the Application Launcher.

Review eDirectory Tree Specific Information

Once you have information about files and running applications, you should look at Directory tree specific information about the tree the workstation is logged into. Select Help@, About Application Explorer and click the More button to view the login information and verify that the workstation is logged into the appropriate location to receive the application.

View and Edit User or Container's Application Launcher Configurations

Once you have looked at Application Explorer, you should view and edit user or container Application Launcher configurations. This helps you troubleshoot issues that are caused by problems with the setup of distributed applications in the user and/or container objects. To review the Application Launcher configuration for user or container objects, use the following procedures.

Use the Launcher Configuration Property Page

Verify the Application Launcher configuration tab on the properties page for user or container objects in ConsoleOne. You should review the following information:

• The effective Application Launcher configurations for a User, Organizational Unit, Organization, or Country object

• The Application Launcher configuration inheritance tree (where the current object gets configurations from objects higher in the tree)

• Set up custom Application Launcher configurations for the currently selected container object

Review User or Container's Effective Application Launcher Configurations

Once you have reviewed the previous information from the main Application Launcher page in ConsoleOne, you should check the effective Application Launcher configurations. Effective settings include custom configurations applied to the current object as well as configurations inherited from parent container(s). You can control how a Container object inherits Application Launcher configurations by using the Use as Top of Inheritance Tree option.

To view the custom Application Launcher configurations from within ConsoleOne, follow these steps:

  1. Right-click a User, Organizational Unit, Organization, or Country object and click Properties.

  2. Click the Application Launcher tab.

  3. Choose View Object's Effective Settings from the Mode drop-down list.

Review Application Launcher Configuration Inheritance Tree

Once you have reviewed the custom Application Launcher configurations, you should review the Application Launcher configuration inheritance tree for the user or container object by following these steps:

  1. Right-click a User, Organizational Unit, Organization, or Country object and click Properties.

  2. Click the Application Launcher tab.

  3. Choose View Configuration Inheritance Tree from the Mode drop-down list.

Review and Edit User or Container's Custom Application Launcher Configurations

Once you have reviewed the Application Launcher configuration inheritance tree, you should review the container's custom Application Launcher configurations for the Container object by following these steps:

  1. Right-click a User, Organizational Unit, Organization, or Country object and click Properties.

  2. Click the Application Launcher tab.

  3. Choose View/Edit Object's Custom Configuration from the Mode drop-down list. If no settings appear in the list, no custom settings have been defined for this User or Container object.

  4. Click the Edit button to customize the settings for this object.

Review User Object's Inheritance Applications

The next step in troubleshooting distributed application launcher problems is to look at the applications inherited by User objects. You might find that the user inherits two applications that are incompatible or that take up too much of the client's resources, and so on.

Use the Show Inherited Applications option on the Tools, Application Launcher Tools menu to see the Application objects that have been associated with the User object, including all applications either associated with or inherited by the User object. The applications are listed by mode of delivery, such as force run, App Launcher, Desktop, Start menu, and system tray. These categories come from the Applications property panel, which is available for User, Group, Organization, and Organizational Unit objects.

Use the following steps to list the applications that the user has rights to use:

  1. Highlight a User object.

  2. Choose Tools, Application Launcher Tools, Show Inherited Applications.

  3. Expand the User object to view all associated applications.

Set Timed Refresh Frequency

A useful setting when troubleshooting distributed applications is the Set Refresh Frequency option, which lets you specify the refresh frequency in seconds. For example, if you set the refresh to 300 seconds, Application Launcher or Application Explorer updates applications from the network automatically every five minutes and might even run some applications depending on how you have set them up.

Although a short timed refresh interval is very useful in situations where you want changes to refresh quickly, it usually causes higher network traffic.

Tip

If you are having problems with network traffic when distributing applications you should always increase the timed refresh frequency for Application Launcher and Explorer. You might need to play with the frequency value to match your specific environment.

Change Workstation Files in Use

Another useful step in troubleshooting distributed applications is to make certain that the workstation was properly rebooted with the appropriate files. Occasionally the workstation will not reboot or a file will be in use when the application was distributed, preventing it from being distributed properly.

When Application Launcher distributes applications, it might change workstation configuration files (for example, CONFIG.SYS, AUTOEXEC.BAT, or WIN.INI) depending on the settings in the Application object. The changes to these files do not take effect until after the workstation is rebooted. Application Launcher detects whether such changes are made, and prompts the user with a message stating that the workstation must be rebooted before the changes can take place.

Similarly, when application files are copied, the files they are replacing might be in use, and cannot be deleted or replaced. Application Launcher usually handles this situation. Generally, the new files are copied to a temporary area and then copied to their correct locations when Windows is restarted. However, if a problem exists with the temporary area or the workstation was not rebooted then the correct files will not be properly installed.

Clean Up Network Resources

The next step in troubleshooting distributed applications in ZENworks for Desktops is to make certain that network resources are being properly cleaned up.

The process of “cleaning up” means that the license for a particular network connection is removed. This prevents users from using a network connection when they don't need it. When the clean up Network Resources option is selected, drive mappings and printer ports associated with Application Launcher-delivered applications are removed.

Note

If the resource (a connection, map, or capture) is already in use when Application Launcher or Application Explorer is started, Application Launcher or Application Explorer uses it and does not clean it up. Otherwise, the resource is created and cleaned up when all other Application Launcher or Application Explorer applications are finished using it. The connection to the server containing the resource is removed as well. If the applications that Application Launcher or Application Explorer launched are still running when Application Launcher or Application Explorer is terminated, the allocated resources remain intact.

When an application is launched, Application Launcher or Application Explorer monitors the executable of the application. When the executable terminates, the process of cleaning up network resources begins. However, it's possible that the executable filename is actually a wrapper that sets up environments, runs other executables, and then terminates. If Application Launcher or Application Explorer monitors the wrapper executable, it might prematurely start cleaning up network resources before the application has terminated.

To prevent Application Launcher and Explorer from prematurely cleaning up an application's resources, consult your application documentation about whether the application uses a wrapper executable. If it does use a wrapper executable, find out the name of the module that remains running, and then type this name, excluding the extension, in the text box provided.

Write Application Administrator Notes

As a network administrator, you should keep records for later use. When troubleshooting issues with distributed applications you should use the Administrator Notes property page to create a section of notes that only you, as the administrator, can view and edit.

For example, you might want to remind yourself about some special settings for a particular application. This is true especially when several administrators manage your system. You could use the Administrator Notes property page to provide a history of application upgrades and file changes so that work is not duplicated.

To write administrator notes for an Application Object, follow these steps:

  1. Right-click the Application object and click Properties.

  2. Click the Administrator Notes option from the Identification tab.

  3. In the space provided, type the note, and then click OK.

Review Roll-Back Application Distribution

When troubleshooting application distribution you should be aware that if ZENworks for Desktops encounters an error during distribution, it rolls back or reverses all the changes made before the error and resets the workstation to the state it was in before the distribution began.

When you roll out or distribute a complex application using Application Launcher, changes are made to the targeted workstation. These changes might include text files (such as CONFIG.SYS and AUTOEXEC.BAT), Windows Registry entries, and .INI files. In addition, application files can be copied or deleted at the target workstation.

The method Application Launcher uses to roll back changes is simple. First, it creates temporary files and directories to store files and other rollback information on the workstation. If the distribution is successful, those files and directories are deleted. If the distribution encounters an error, Application Launcher uses the rollback information to restore the workstation to its original state. Once that is completed, the rollback information is deleted.

Problems rolling back can occur if a file is in use, the application is set to overwrite an existing application, and so on when the roll back occurs. Application Launcher is unable to roll back a file that is in use or does not exist.

Use Search and Replace Entire Application Object

A very useful tool in troubleshooting application objects is the Search and Replace Entire Application Objects option in ConsoleOne. You can use the Search and Replace dialog box to search the entire Application object for text strings.

For example, if a directory name is changed and the application object no longer functions, you could use this feature to correct the directory name every place it occurs in the application object.

To search and replace text strings in all property pages of application object, follow these steps:

  1. Highlight the Application object that you want to search.

  2. Choose Tools, Application Launcher Tools, Search and Replace.

  3. Choose Options, and then choose the type of Application object settings you want to search.

  4. Choose Match Case to make the search case sensitive.

  5. Type the text you want to search for in the Search For text box, and then click Find Next.

  6. If you want to replace that text with other text, type it in the Replace With text box and then click Find Next. Click Replace or Replace All.

Use Search Specific Application Object Property Page

A very useful tool in troubleshooting application objects is the Search Specific Application Object property page in ConsoleOne. You can use the Find dialog box to search the current Registry settings, .INI settings, or Application files property page.

For example, if a specific Registry setting was causing the application distribution to experience problems, you could use this feature to find the Registry setting in the application object.

To find specific application object settings, use the following steps:

  1. Right-click the Application object and click Properties.

  2. Click the Registry Settings, INI Settings, or Application Files option panels from the distribution tab.

  3. Choose the Find option (in most cases this might appear on the File button).

  4. Type the text that you want to find, and then choose Find.

Review Application Termination

When troubleshooting application distribution, make certain that the application was terminated properly. You can use the Termination property panel in ConsoleOne to view and modify how Application Launcher handles the termination of an application. If termination is improperly set up, users can experience problems when the application runs.

Use the following steps to view and modify termination of the application:

  1. Right-click the Application object and click Properties.

  2. Click the Termination option panel from the Availability tab.

  3. Select and modify the appropriate termination behaviors from the drop-down list.

Send Message to Close Application

If users should close the application, use the Send Message to Close Application option. For example, if you set an interval of 20 minutes, Application Launcher sends a message (if one is active) to the user every 20 minutes until the application is closed.

Send Message to Close Then Prompt to Save Data

You can use this option when the application must be terminated; however, user data loss might occur. This option prompts users, for a specified period of time, to close the application on their own (this action is optional). When that period of time expires, the Application Launcher attempts to close the application. If users have not saved data, they are prompted to save it.

Send Message to Close, Prompt to Save, Then Force Close

Use this option when the application must be terminated, regardless of user data loss. This option prompts users, for a specified period of time, to close the application on their own. When that period of time expires, you can close the application prompting users, at specified intervals, to save their work. If users have still not closed within a specified period of time, the application is forced to close.

Send Message to Close Then Force Close with Explanation

Use this option when the application must absolutely be terminated and user data loss is not a concern. This option prompts users, for a specified period of time, to close the application on their own. When that period of time expires, the application is forced to close.

Troubleshooting Policy Packages

Another troubleshooting area that you should be familiar with is the policy packages. No formal method exists for troubleshooting the Workstation Policy Package; however, the following are some steps you can take to identify problems and find resolutions.

Review eDirectory Workstation Object

In the case of a Workstation Policy Package, make certain a valid eDirectory Workstation object has been created and is linked to workstations that use the policy package. This can be checked by viewing the values listed in Table 19.1 in the workstation's Registry.

Table 19.1. Identification Key in Workstation's Registry

image

You are specifically looking for the Workstation object value. It identifies which eDirectory Workstation object the workstation is using when it is logged in. All Workstation Policy Packages need to be associated with this eDirectory Workstation object or to a Workstation Group that has this eDirectory Workstation object as one of its members.

If a Workstation Policy Package is not associated to the eDirectory Workstation object listed in the Workstation object Registry value or a group it belongs to, no Workstation Policy Packages are downloaded and applied. You can also check for effective policies on the effective policies panel of a container object's properties page.

Review Policy Package Type

Make certain that the appropriate type of policy package has been created. For example, if the workstation is running Windows NT/2000, make sure you have created a WINNT Workstation Policy Package.

Review Workstation Object Associations

In the case of a Workstation Policy Package, make certain that eDirectory Workstation objects have an association to the policy package. This can be verified by looking at the details of the policy package within ConsoleOne by clicking on the Associations tab.

Make certain that all the workstations that use the eDirectory Workstation object are listed there, are members of a Workstation group listed, or exist in a container listed.

Tip

Make certain to look for potential problems with a Container Policy Package if you are only using the container to associate the eDirectory Workstation Object. If you are not sure, it is a good idea to associate the eDirectory Workstation object directly (as a troubleshooting step, not as an implementation design).

Enable Policies

Make certain that at least one policy is enabled to download. If no policies are enabled, the user cannot detect any change to the user/workstation environment and might question if it is working properly.

Review Trusted Trees

Make certain that workstations have the active tree listed as a trusted tree. The Workstation Manager component of ZENworks uses the concept of trusted trees, and Windows 95/98 or NT/2000 Workstations attempt to search for a ZENworks policy package only if the tree is listed as a trusted tree. This feature gives greater administrative flexibility as to which workstations are controlled by ZENworks.

You can set the trusted tree by selecting the custom installation of the Novell client for NT/2000 or 95/98. If Typical Installation is selected, it automatically sets the tree that you first log in to as the trusted tree.

To view the trusted tree property on a Windows workstation, view the Registry key directly at the following location:


HKEY_LOCAL_MACHINESOFTWARENOVELLWorkstation MangerIdentification


Troubleshooting NetWare Errors

When troubleshooting ZENworks for Desktops you should always be aware of any NetWare error messages that are occurring. ZENworks for Desktops is heavily tied into the NetWare operating system, eDirectory, and file system. Therefore, any error occurring in NetWare could possibly affect ZENworks for Desktops as well.

NetWare Server File System Errors

When ZENworks for Desktops is having problems distributing applications, you should always look for errors in the NetWare file system. These errors often help you narrow down the problem to a specific cause and resolution.

For example, if the ZENworks for Desktops client gives the user the following error, you might suspect a connection problem with the server and could focus troubleshooting on finding the cause and fixing that problem.


918: This utility was unable to get connection information. Error code: 89FF.


Table 19.2 contains common file system errors.

Table 19.2. Common File System Errors

image

eDirectory Errors

Another area you should always review when troubleshooting ZENworks for Desktops is the eDirectory error messages. ZENworks for Desktops uses eDirectory heavily, not only for normal authentication and access, but also as a service for controlling ZENworks for Desktops objects.

eDirectory errors can be categorized as follows.

eDirectory Operating System Error Codes

Some eDirectory background processes require the functionality provided by the NetWare operating system. These processes, such as communication and transaction servers, can return operating system specific error codes to eDirectory. These error codes are then passed to the eDirectory background process that initiated a request. In NetWare 4.x, versions of eDirectory (NDS) can also generate operating system error codes.

Usually operating system error codes that are generated by eDirectory have a negative numerical representation, whereas normal operating system error codes have a positive numerical representation. The numerical range for operating system error codes generated by eDirectory is -1 through -256; inversely the numerical range for operating system error codes is 1 through 255.

Note

eDirectory returns the positive numerical error code rather than the negative error code normally used by eDirectory to the application to prevent any incompatibility. Therefore, any occurrence of an error code within the range of 1 to 255 or -1 to -255 should be treated as the same error.

eDirectory Client Error Codes

The next class of eDirectory error codes is the client error codes. Some eDirectory background processes require the functionality provided by other eDirectory servers. Use of these functions, such as bindery services, requires that an eDirectory server act as an eDirectory client to the server providing the functionality. Therefore, these functions often result in client-specific error codes being returned to the eDirectory background processes and operations.

eDirectory client error codes are generated by the eDirectory client that is built into eDirectory. The eDirectory client error codes fall in the range of codes numbered -301 through -399.

eDirectory Agent Error Codes

Another class of eDirectory error codes is the eDirectory agent error codes. eDirectory agent error codes represent errors that originated in the eDirectory Agent software in the server that are returned through eDirectory. These codes are numbered -601 through -799 (or FDA7 through F9FE).

Note

Temporary errors are normal, because the eDirectory database is designed as a loosely consistent database. You should not be alarmed if eDirectory error conditions exist temporarily. However, some errors might persist until the error condition is resolved.

Other eDirectory Error Codes

Some eDirectory background processes require the functionality provided by other NLM programs, such as timesync.nlm or unicode.nlm. If any of these modules encounter an error, it can be passed on to the ds.nlm. Unicode.nlm and other errors in this category range from -400 to -599.

Tools for Troubleshooting eDirectory Errors

To effectively troubleshoot eDirectory errors that affect ZENworks for Desktops, you should be familiar with the tools available to troubleshoot eDirectory problems. The following tools are provided to monitor and repair error conditions with eDirectory.

The eDirectory Manager Utility

The eDirectory manager utility provides partitioning and replication services for the eDirectory database on a NetWare server. It also provides repair capabilities for repairing the database from a client workstation, which alleviates the network administrator's total dependence on working from the server console.

The DSREPAIR Utility

The DSREPAIR utility enables you to work from the server console to monitor and repair problems with the eDirectory database on a single-server basis. It does not correct problems on other servers from a single, centralized location. It must be run on each server on which you want to correct eDirectory database errors.

The DSTRACE Utility

The DSTRACE utility enables you to work from the server console to diagnose eDirectory errors. These errors might appear when you are manipulating eDirectory objects with the administration utilities. eDirectory errors also show up on the DSTRACE screen.

Table 19.3 contains common eDirectory errors.

Table 19.3. Common eDirectory Errors

CODE

TEXT

DESCRIPTION

-601 FDA7

NO SUCH ENTRY

The specified eDirectory object cannot be found on the eDirectory server that is responding to a request.

-603 FDA5

NO SUCH ATTRIBUTE

The requested attribute cannot be found. In eDirectory, if an attribute does not contain a value, the attribute does not exist for the specific object.

-625 FD8F

TRANSPORT FAILURE

The source server is unable to communicate with the target server. This error is almost always LAN-related.

-626 FD8E

ALL REFERRALS FAILED

The object could not be found; however, it is still possible that the object does exist. It is likely that the server cannot communicate with another server that is holding a copy of the object.

-634 FD86

NO REFERRALS

The source server has no objects that match the request and has no referrals on which to search for the object. This is not a serious error, just a response. This error usually resolves itself.

 

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.143.218.160