Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-3351: ZPA fails to provision with the following error: Access to the registry key is denied

Centrify DirectControl ,  

12 April,16 at 11:08 AM

Applies to: Centrify Zone Provisioning Agent 5.1.1 on all platforms

Problem:

ZPA fails to provision.

When running ZPA on a domain controller as a Service Account, the following errors are generated in the ZPA debug log:

[2013-08-05 11:34:16.900 -0500] Centrify.Provisioning.Agent.exe[5220,6] Error: ProvisioningWorker.LogEvent: Details: Access to the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Centrify\CIMS' is denied.

 

[2013-08-05 11:34:16.916 -0500] Centrify.Provisioning.Agent.exe[5220,6] Verbose: DomainPoller.Poll: Exception: System.UnauthorizedAccessException: Access to the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Centrify\CIMS' is denied.

 

Cause:

During the install of ZPA, the CIMS key was not generated on the following registry key path:

"HKEY_LOCAL_MACHINE\SOFTWARE\Centrify\CIMS"

 This happens if DirectManage Access Manager is not installed on the system and only ZPA is installed, regardless if only ZPA was installed as a Domain Admin.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Workaround:

The following workaround can be performed:

  1. Add the registry manually and see whether it solves the problem.
    (Attached is an exported registry from another environment, which could be imported into the registry as an alternative to the manual registry edit.)

     
  2. Run the service as an Domain Admin account once to let the application create the CIMS key, then change the service back to the service account.
     
  3. After this, the service should start provisioning users.

 

 

Attachments:

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.