Using the Windows Messenger 5.0 debug log to troubleshoot sign-in failures in Live Communications Server 2003 (871023)

MORE INFORMATION

If you cannot use Windows Messenger 5.0 or Microsoft Office Communicator 2005 to sign in to Office Live Communications Server 2003, use the Windows Messenger or Communicator 2005 debug log file to help you determine the cause of the sign-in failure. The Windows Messenger 5.0 debug log file contains the Session Initiation Protocol (SIP) communications that occur between the SIP client program and the server. One of the advantages of using this debug log file to troubleshoot your SIP connection is that the debug log file includes unencrypted Transport Layer Security (TLS) communications. A Network Monitor trace cannot unencrypt this information. The log file will be deleted, and a new log file will be added when the Windows Messenger client is restarted.

To enable debug logging

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To enable debug logging on a computer that is running Windows Messenger 5.0, follow these steps:

End the Windows Messenger Msmsgs.exe process. To do this, follow these steps:
1. Right-click the task bar, and then click Task Manager.
2. Click the Processes tab, click msmsgs.exe, and then click End Process.
3. When you receive the following message, click Yes.
  WARNING: Terminating a process can cause undesired results including loss of data and system instability. The process will not be given the chance to save its state or data before it is terminated. Are you sure you want to terminate the process?
4. Quit Task Manager.
Click Start, click Run, type regedit, and then click OK.
Locate and then click the following registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Tracing\RTCDLL
If the EnableFileTracing registry value does not exist, create it. To do this, follow these steps:
1. On the Edit menu, point to New, and then click DWORD Value.
2. In the New Value #1 box, type EnableFileTracing, and then press ENTER.
Right-click EnableFileTracing, and then click Modify.
In the Value data box, type 1, and then click OK.
Quit Registry Editor, and then start Windows Messenger.

The debug tracing file is created in the %USERPROFILE%\Tracing folder. To view the contents of this folder, click Start, click Run, type %userprofile%\tracing, and then click OK.

Note After you finish troubleshooting your SIP connection problem, disable debug logging. To do this, set the EnableFileTracing registry value to 0 (zero).

To enable logging on a computer that is runningCommunicator 2005, set the following values:

HKCU\Software\Microsoft\Tracing\Communicator EnableFileTracing=1
HKCU\Software\Microsoft\Tracing\LCAPI EnableFileTracing=1
HKCU\Software\Microsoft\Tracing\LCIMSP EnableFileTracing=1
HKCU\Software\Microsoft\Tracing\LCMSGSC EnableFileTracing=1
HKCU\Software\Microsoft\Tracing\lcmedia_rtp EnableFileTracing=1

Note By default the FileDirectory value should be:

%USERPROFILE%\Tracing

After you set these values, stop the Communicator process in Task Manager and then restart it.At this point, the client picks up the new registry values.Logging should now be enabled. For more information and session-specific tracing settings, see the Planning & Deployment Guide .

The SIP protocol is a request and response protocol. The client program sends a request in the form of a method to indicate the action that the client wants to perform. The server then returns a response that includes a three-digit code and a description of that code. Response codes that are in the 4xx class or the 5xx class typically indicate a connection problem. SIP requests and SIP responses appear on the first line of each SIP packet. Typically, you do not have to understand the whole SIP packet to troubleshoot Windows Messenger sign-in problems. The following is an example of a SIP request:

REGISTER sip:example.com SIP/2.0

The following is an example of a SIP response:

SIP/2.0 504 Cannot locate the next server

This article does not describe every SIP method or every server response class. However, if you recognize only the 4xx class and the 5xx class SIP responses, you can successfully troubleshoot Windows Messenger sign-in problems. To obtain a complete listing of the SIP methods and response codes, see the SIP RFC. To see this document, visit the following Web site:

http://www.ietf.org/rfc/rfc3261.txt

To troubleshoot Windows Messenger sign-in failures

After you enable debug logging in Windows Messenger, view the Rtcdllx.log file that is created in the %USERPROFILE%\Tracing folder to help troubleshoot Windows Messenger sign-in failures. Typically, you can use the end of the log file to determine the reason that the Windows Messenger client did not sign in successfully. Use the following list of error codes to help identify the reason that the Windows Messenger client did not connect to Live Communications Server 2003 successfully:

400 - Invalid contact information

This error code indicates that the client computer is on a network that the Live Communications Server computer cannot contact. This issue may occur if a Network Address Translation (NAT) device, a proxy server, or a firewall prevents communications.

When you connect to Live Communications Server from behind a proxy server, from behind a firewall, or in some cases, from behind a NAT device, you must use a TLS connection. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

834469 Cannot connect to Live Communications Server 2003 through a network address translation (NAT) device

For additional information about how to configure TLS connections in Live Communications Server, see the "Configuring a Home Server and Windows Messenger for TLS" section of the Microsoft Office Live Communications Server 2003 Deployment Guide. This guide is located in the Documentation folder of the Microsoft Office Live Communications Server 2003 CD.

400 - Missing correct VIA header

This error code indicates that Mutual Transport Layer Security (MTLS) authentication is not configured correctly on the Live Communications Server computer. You may receive this error code when Live Communications Server is configured in one of the following topologies:

A Home server to front-end server to public switched telephone network (PSTN) configuration.
A Home server to front-end server to proxy server configuration.

Note In a Home server to Home server configuration, you receive a 504 error code instead of a 400 error code.

To resolve this issue, make sure that the Live Communications Server computers have the correct certificates installed. Additionally, make sure that the Trusted Root certification authority (CA) certificate is located in the local computer Trusted Root CA certificate store and not in the current user's certificate store. For additional information about how to configure MTLS, see the "Module 4: Implementing Live Communications Server 2003 Environment" document. To download this document, visit the following Microsoft Web site:

http://download.microsoft.com/download/c/d/f/cdf3c55a-fc5b-46ae-9030-44e44935f003/Course_2081a_Live_Communication_Server.exe

401 - Unauthorized

This error code indicates one of the following problems:

Kerberos authentication may be failing because the client workstation computer is not part of a domain or because the client workstation computer cannot contact the Active Directory directory service Key Distribution Center (KDC).

To resolve this issue, configure Live Communications Server to use NTLM authentication. Do not configure Live Communications Server to use both NTLM authentication and Kerberos authentication. To view the authentication method that Live Communications Server uses, follow these steps:
1. Click Start, point to Administrative Tools, and then click Live Communications Server.
2. Expand Servers, right-click your Live Communications Server computer, and then click Properties.
3. Click the Authentication tab, and then view the option that appears in the Authentication scheme in use list.
An incorrect realm may be specified on a Live Communications Server computer.

If you use a custom realm, you must configure the same realm on every Live Communications Server computer in the Active Directory forest. To view the realm that is specified, follow these steps:
1. Click Start, point to Administrative Tools, and then click Live Communications Server.
2. Expand Servers, right-click your Live Communications Server computer, and then click Properties.
3. Click the Authentication tab, and then view the option that appears in the Realm box.
The Windows Messenger user has specified a correct user name and sign-in name but has specified an incorrect password.

To resolve this issue, verify the password that the Windows Messenger user enters to connect to Live Communications Server.
The Live Communications Server Service Principal Name (SPN) registration in Active Directory may be incorrect.

To resolve this issue, use the Checkspn.vbs tool from the Microsoft Office Live Communications Server 2003 Resource Kit to verify and to correct the SPN. To obtain the Office Live Communications Server 2003 Resource Kit, visit the following Microsoft Web site:
http://www.microsoft.com/downloads/details.aspx?FamilyId=0397ECFF-3535-4A39-9851-F4B22D1DE9BA&displaylang=en
For additional information about how to use the Checkspn.vbs tool, see the Checkspnreadme.htm file that is extracted to the installation folder when you install the Office Live Communications Server 2003 Resource Kit. By default, this file is located in the following folder:
C:\Program Files\Microsoft LC\ResKit

403 - Forbidden

This error code indicates one of the following problems:

The user was successfully authenticated, but the security identifier (SID) information that is contained in the Microsoft SQL 2000 Desktop Engine (MSDE) database is not valid or is missing.

To resolve this issue, use one or both of the following methods:
- Restart the Live Communications Server service (Rtcsrv), and then give Live Communications Server time to populate the database with the user account information. To restart the Live Communications Server service, follow these steps:
  1. Click Start, click Run, type cmd, and then click OK.
  2. Type the following commands. Press ENTER after each command.
    
    net stop rtcsrv
    net start rtcsrv
- Remove the affected user from the MSDE database. To do this, follow these steps:
  1. Click Start, click Run, type cmd, and then click OK.
  2. Type the following command, and then press ENTER, where user@domain is the sign-in name of the affected user:
    OSQL -S (local)\rtc -d rtc -E -Q "exec RtcDeleteResource N'user@domain'"
    
    Note The OSQL command must be run on every Live Communications Server computer in the forest.
The user already exists in the MSDE database from a previous Live Communications Server installation. To resolve this issue, remove the user from the MSDE database by using the OSQL command.

Note Before you use the OSQL command to remove a user from the MSDE database, disable SIP communications for the user. Re-enable SIP communications for that user after the user has been removed from all Live Communication Server computers in the forest. To do this, follow these steps:

Click Start, point to Administrative Tools, and then click Live Communications Server.
Expand Servers, expand your Live Communications Server computer, and then click Users.
In the right pane, right-click the user who you removed from the MSDE database, and then click Properties.
Click to clear the Enable Live Communications for this user check box and then click Apply.
Click to select the Enable Live Communications for this user check box, and then click OK.

404 - Not Found

This error indicates one of the following problems:

An incorrect SIP domain is listed on the Domains tab in the User Services Global Settings Properties dialog box on the Live Communications Server computer. To view this setting:
1. Click Start, point to Administrative Tools, and then click Live Communications Server.
2. Right-click User Services Global Settings, and then click Properties.
3. Click the Domains tab.
The domain that appears must match the domain part of the sign-in name (SIP URI) that is assigned to the user. By default, Live Communications Server will use the Active Directory domain name. Typically, you must change this name to match the Simple Mail Transfer Protocol (SMTP) domain name.
The user is not enabled for Live Communications Server. To verify that the user is enabled for Live Communications Server:
1. Click Start, point to Administrative Tools, and then click Live Communications Server.
2. Expand Servers, expand your Live Communications Server computer, and then click Users.
3. In the right pane, right-click the user who you want to verify, and then click Properties.
4. Click to select the Enable Live Communications for this user check box if this check box is not already selected. Click a server in the Home server list, and then click OK.
The user's sign-in name is misspelled in Windows Messenger or in Live Communications Server. To resolve this issue, verify the spelling of the user account name when you use Windows Messenger to try to sign in. If the user name is spelled correctly in Windows Messenger, verify the user account in Live Communications Server. To do this, follow these steps:
1. Click Start, point to Administrative Tools, and then click Live Communications Server.
2. Expand Servers, expand your Live Communications Server computer, and then click Users.
3. In the right pane, right-click the user who you want to verify, and then click Properties.
4. In the SIP:URI box, verify that the user name is correct.
The user does not exist in the MSDE database on the Live Communications Server computer. To resolve this issue, follow these steps:
1. View the application log in Event Viewer to determine if Live Communications Server Active Directory Connector error messages are logged. Resolve these errors by using the information that appears in the application log.
2. Use the Dbanalyze.exe tool to determine if the user exists in the MSDE database. (This tool is in the Office Live Communications Server 2003 Resource Kit.) To do this, run the following command, where user@domain is the user who you want to verify:
  dbanalyze.exe /report:user /user:user@domain
  For information about how to obtain the Office Live Communications Server 2003 Resource Kit, see the "401 - Unauthorized" section.
3. If the user entry appears to be damaged in the MSDE database, remove that user. For information about how to do this, see the "403 - Forbidden" section.

405 - Method not supported

This error indicates that Windows Messenger is running on the Live Communications Server computer and that Windows Messenger has taken the communications port from the server. To resolve this issue, follow these steps:

Quit Windows Messenger.
Restart the Live Communications Server service (Rtcsrv). To do this, follow these steps:
1. Click Start, click Run, type cmd, and then click OK.
2. Type the following commands. Press ENTER after each command.
  
  net stop rtcsrv
  net start rtcsrv

480 - Temporarily Unavailable

This error indicates that a user is trying to sign in to Live Communications Server while that user is in the process of being moved from one Live Communications Server Home server to another Home server.

503 - Service Unavailable

This error indicates that the MSSQL$RTC service is stopped while the Live Communications Server service is running. To resolve this issue, start the MSSQL$RTC service, and then restart the Live Communications Server service. To do this, follow these steps:

Click Start, click Run, type cmd, and then click OK.
Type the following commands. Press ENTER after each command.

net start mssql$rtc
net stop rtcsrv
net start rtcsrv

Note The MSSQL$TRC service is the instance of MSDE that is used for Live Communications Server.

504 - Gateway Timeout

This error indicates that one or more of the following problems exist:

MTLS is not configured correctly in Live Communications Server. To resolve this issue, verify the MTLS configuration on the Live Communications Server computer. You must configure MTLS on every Live Communications Server Home server.
The outbound MTLS certificate has been removed from the Routing tab in the ServerName Properties dialog box on the Live Communications Server computer. To view this information, follow these steps:
1. Click Start, point to Administrative Tools, and then click Live Communications Server.
2. Expand Servers, right-click your Live Communications Server computer, and then click Properties.
3. Click the Routing tab, and then view the information that appears under Default certificate to be used for TLS Mutual encryption when none is specified in the routing table.
An invalid static route is listed on the Routing tab in the ServerName Properties dialog box of the Live Communications Server computer.
An incorrect SIP domain is listed on the Domains tab in the User Services Global Settings Properties dialog box. For additional information about how to verify these settings, see the "404 - Not Found" section.
The user's sign-in name is incorrect in Windows Messenger. To resolve this, verify the spelling of the name of the user who is trying to sign in to Live Communications Server.

For additional information about how to configure MTLS, see the "Module 4: Implementing Live Communications Server 2003 Environment" document. To download this document, visit the following Microsoft Web site: