• State Verified Answer
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 68 subscribers
  • Views 223 views
  • Users 0 members are here
Options
Related

Is the username generation button broken in 8.5?

charleneforbes

Hi,

Since we updated to 8.5 the mmc console doesn't show the username generation button, has anyone else seen this?  The web console still has it, and it works, but the mmc console doesn't.  I've recreated the rule and that hasn't helped, and when I create it there's a message in the General tab of the policy saying "Provisioning policy failure. The 'User Logon Name Generation' policy encountered an error."

Has anyone else found this?

Parents
  • 0

    Hi Charlene,

    That message on the policy's General tab — "Provisioning policy failure. The 'User Logon Name Generation' policy encountered an error." — is the key here. The Generate button next to the User logon name field only appears when the MMC Console can successfully load and evaluate that policy. Since the console can't evaluate it, it doesn't render the button. The Web Interface uses a different code path, which is why it still works there.

    A few things worth checking before assuming it's a product bug:

    1. Console vs. Service version. After an upgrade this is the most common cause — the MMC Console is often left on the older build while the Administration Service is on 8.5. Check the version in the Console's Help → About and compare it to the Administration Service version; they should match. If the console wasn't upgraded, reinstall/upgrade it to 8.5.
    2. The actual exception. The General-tab message is just the surface. Look in the Application event log on the Administration Service server (source: ARAdminService) at the moment you open the policy — that entry will contain the real error (e.g. a missing attribute, a script error, or a migration issue). That's what determines whether this is a config problem or a genuine defect.
    3. Rule/attribute migration. If the generation rule references a script or a virtual/custom attribute, it's worth confirming that attribute still exists and resolves after the upgrade. Recreating the rule (which you've already tried) won't help if the underlying dependency is missing.

    If you can share the exact error from the Application event log (or the full text from the policy's General tab), it'll be much easier to pin down whether this is environmental/migration-related or something that needs to be raised with Support.

    Thanks,

    Aron

Reply
  • 0

    Hi Charlene,

    That message on the policy's General tab — "Provisioning policy failure. The 'User Logon Name Generation' policy encountered an error." — is the key here. The Generate button next to the User logon name field only appears when the MMC Console can successfully load and evaluate that policy. Since the console can't evaluate it, it doesn't render the button. The Web Interface uses a different code path, which is why it still works there.

    A few things worth checking before assuming it's a product bug:

    1. Console vs. Service version. After an upgrade this is the most common cause — the MMC Console is often left on the older build while the Administration Service is on 8.5. Check the version in the Console's Help → About and compare it to the Administration Service version; they should match. If the console wasn't upgraded, reinstall/upgrade it to 8.5.
    2. The actual exception. The General-tab message is just the surface. Look in the Application event log on the Administration Service server (source: ARAdminService) at the moment you open the policy — that entry will contain the real error (e.g. a missing attribute, a script error, or a migration issue). That's what determines whether this is a config problem or a genuine defect.
    3. Rule/attribute migration. If the generation rule references a script or a virtual/custom attribute, it's worth confirming that attribute still exists and resolves after the upgrade. Recreating the rule (which you've already tried) won't help if the underlying dependency is missing.

    If you can share the exact error from the Application event log (or the full text from the policy's General tab), it'll be much easier to pin down whether this is environmental/migration-related or something that needs to be raised with Support.

    Thanks,

    Aron

Children
  • 0 in reply to aron cseuz

    Hi Aron,

    Thanks for the reply.

    1. version - I have updated my console version to 8.5 and I get the same result running the console directly on the Active Roles Server.

    2. The error in the general tab is: "Provisioning policy failure. The 'User Logon Name Generation' policy encountered an error."  I don't get an error in event viewer when I open the policy. 

    3. we don't use a script or custom attribute for the usernames, it's all based on the first name, middle initial, and last name, nothing fancy.

    I hope that helps

    Charlene

  • +1 in reply to charleneforbes

    Hi Charlene,

    Thanks for checking those — that rules out the things I suspected, and it turns out I pointed you in the wrong direction. Apologies. Two separate things are going on here:

    The error message is a red herring. "Provisioning policy failure. The 'User Logon Name Generation' policy encountered an error." on the General tab of the built-in Default Logon Name policy is a long-standing cosmetic message — it predates 8.5 and isn't what's suppressing the button. It can safely be ignored.

    The missing button is a genuine, known regression. In the MMC Console, the inline Generate button next to User logon name (pre-Windows 2000) is not rendered when a User Logon Name Generation policy is in scope. It affects 8.3, 8.4 and 8.5; 8.2.1 SP6 is unaffected. It's console-side only, which is exactly why the Web Interface still works for you. The same regression also removes the Generate button from the Email Alias field, so you may want to check that too.

    Importantly, the policy itself is not broken. It still evaluates and populates the logon name when you complete the wizard — you just lose the ability to generate it on demand and see it before finishing.

    Workaround: complete the New User wizard (or the property change) without clicking Generate. The policy will populate sAMAccountName automatically on Finish. For cases where you must see the value up front, the Web Interface remains a reliable path.

    This is fixed in 8.7 and is documented as a known issue in the release notes for the affected versions. I'd recommend opening a case with Support referencing this thread so your environment gets attached to the defect and you're notified when the fix is available to you.

    Thanks,

    Aron

  • 0 in reply to aron cseuz

    Hi Aron,

    Thanks for the speedy reply.  The policy does still work in the web interface, and the helpdesk staff are using that as an alternative already so yeah it does look like it's only affecting the mmc console.  Thanks for the confirmation of the regression and that 8.7 should fix it.  tbh updating to 8.5 seems to have caused more issues than it fixed!  We use the username as the email alias anyway, and the mailboxes are created by Azure on sync so not being able to generate that isn't a problem.

    Thanks again

    Charlene