Grant Unity Access Problem

[lnthompson]

We were having problems with accessing the Unity Administration web site (both remotely and local on the server). The error message was something to the effect of "User is no longer associated to the Unity Administration account." TAC Advised to run the Grant Unity Access utility and remap the AD Admin/Installer account to EAdministrator. <br><br>This worked and allowed me to get into the Administration site. However every time we access the SA web site it prompts us to choose which account we want to login as: 1. EAdministrator or 2. Unity Install Account. I choose the Unity Installer account and everything works. But I don't understand why it keeps prompting me to choose. If I remove the access, I worry that I won't be able to access the SA site again.<br><br>There is also another small issue with it reprompting me for the Administrator/Password/Domain login when I try access a Subscriber for the first time. So it is like logging in twice for each session.<br><br>

[#2]

sounds like you might have added two SID mappings for that account (one to the Installer and one to the EAdmin account). If you run the GrantUnityAccess with the -L option it'll list all the mappings. You can remove just one of them.

If you're having to log in twice it's probably a case where Unity is installed into another domain than the one you're authenticating in. This has to do with the media master control (for recording voice names and greetings via the SA). It uses DCOM and wont accept the authentication you provided via IIS to access the SA initially and requires it's own. As soon has you hit the first page with that control (i.e. the profile page of a subscriber) it'll request authentication.

If you domains trust each other or you're in the same domain (which is always what I recommend) then this wont happen.


Jeff Lindborg
Unity Technical Lead/Answer Monkey
Cisco Systems
lindborg@cisco.com
http://www.AnswerMonkey.net (new page for Unity support tools and scripts)

[lnthompson]

The problem is, before I ran the grantunity access for EAdministrator the UnityInstaller account wasn't working. I was getting the message that it wasn't assocciated. I will try and remove one and see if it goes back to having a problem.

On the second issue. The Unity was installed into the domain using the Domain Administrator account. The same domain admin that all the users are a part of, and the same domain that Unity is a part of. So everything should be in the same domain. What is odd is that I just have to reenter the same account information over again.

[#4]

It's ok if your domain account is associated with more than one subscriber, you'll just have to choose which subscriber credentials to use when opening the Unity SA. If this extra mouse click isn't a big deal, it won't cause any harm... it's expected behavior when two email accounts are linked to the same domain account.

Scott Morgan
Cisco Systems TAC

[j.mont-louis]

One of my customers is having the same issue. In addition, when he clicks on the status monitor icon, the SA Web page opens instead.

Jackson

[lindborg]

not much in the way of details for me to go on here... Unity version? Which problem, exactly, are you having? This thread talks about a couple including possibile resoltuions...

[maslaga]

I also am having the same issue. Unity 3.1.2 & 3.1.3 (2 separate servers in same domain), Exchange 2000/AD. The extra click does appear to be an issue for the customer. Any way to remove one account or the other?

[lindborg]

The Grant Unity Access tool has a -L option to list all associations that were added and a -D option to remove an association. The most common issue I see is folks using GrantUnityAccess when they should not be. For instance they can't get into the SA for some reason and use GrantUnityAccess to create an unecessary association and then later when the problem clears both account tags are offered - you should ONLY have to use GrantUnityAccess if you need access to a system that you are not a subscriber on.

[bdeese]

What if they have not used the grant unity access tool and they have more than one option when they log into the SA web. The customer just wants the admin account to go righ into the SA web. How do I remove the other listings.

[lindborg]

The only way that could happen is if you were using Exchange 5.5 and you had multiple domain acounts associated with a single Exchange mailbox - if this is Ex2K/AD then there's no way we'd be getting a list of potential accounts back unless someone had used GrantUnityAccess to add an entry to the SIDHistory table.

did you run GrantUnityAccess with the "-L" option to list all extra assocations in the SIDHistory table just in case? Is this an Ex55 system or 2K?