none
You do not have permissions to open the dashboard RRS feed

  • Question

  • On a clean install of 2012 R2, I joined an existing domain and added the Essentials role.  After that, I configured it which took about 5 minutes.  At the end, it placed an icon on the desktop called "Dashboard".  It will not allow me to open this no matter what I try.  I get this error:

    Cannot open the Dashboard
    You do not have permissions to open the dashboard.  Please log on as a network administrator and try to open the dashboard again.

    I am using a domain admin account.  For laughs, I tried a couple accounts, but had no luck.

    The log at "C:\ProgramData\Microsoft\Windows Server\Logs\dashboard.log" shows "Dashboard.Forms: Dashboard: Non domain admin cannot access dashboard."

    Server Manager shows a green up arrow by Manageability for WSEE.

    BPA shows only one error about Windows Server Backup and unsupported partition, which from what I gather is to be ignored as a false alarm.

    Not sure what to do here.  Nothing seems to work.  Ideas?  Suggestions?

    Tuesday, November 5, 2013 7:21 PM

Answers

  • Hi everyone!

    I went in and tried all of your solutions, but none worked.

    I have found the REAL solution to why this isn't working, and it should be corrected by Microsoft. 

    In the users profile, you can see the member of and primary group. 

    With my admin account, on Primary Group, I had "Domain Admins" as the group. It didn't work. I tried setting that to Enterprise Admins, and it worked and was able to get into dashboard. I set it back to Domain Admins, and it didn't work.

    I set it as Domain Users, and it worked. 

    As long as you have the user in Domain Admins group, and primary group set to either "Domain Users" or "Enterprise Admins" -- it will always work. The account does NOT need to be in the Enterprise Admins group, just be sure to keep the primary group on "Domain Users", and make sure it is in the "Domain Admins" group. 

    When the member above Lynn said they created a new account, it worked because ALL new user accounts are set to primary group of "Domain Users".

    When the other user Brian Hoyt had to remove ALL administrator groups, it removed the primary role from "Domain Admins" to "Domain Users" which then worked. Then he added ALL admin groups (you do NOT need Enterprise Admins group) but probably forgot to set the primary group, which is good and that is why it worked. When he copied the Admin account, the primary group always rolls over to the new account and is copied with it. When he removed all groups, he forgot to set back the primary group. 

    When Robert Pearman tried, he probably had the primary group set to something other than "Domain Admins" as well. 

    You don't want a Domain Admin (primary group) configuring your server. You want a domain user in Admin group (such as an employee to reset passwords), OR the Enterprise Admin (primary group)  to configure server applications, NOT a domain admin. So I do see why Microsoft had this set the way it is. 

    So basically, you can NOT have the primary group to "Domain Admins". It needs to be either "Domain Users" OR "Enterprise Admins". The account MUST be in the "Domain Admins" group. 

    I do believe Microsoft should fix this issue, because it could be a bug, but also could be so that Domain Admins (primary group) can't screw applications that should be maintained and configured by Enterprise Admins (primary group). 

    I have made a video showing the problem was fixed, and this is the solution!

    youtube.com\watch?v=bZoNc3RkBSw

    Thanks guys!


    • Proposed as answer by rowebil Monday, November 11, 2013 3:22 AM
    • Edited by rowebil Monday, November 11, 2013 5:03 AM
    • Marked as answer by cculver78 Monday, November 11, 2013 6:14 PM
    Monday, November 11, 2013 3:15 AM

All replies

  • Hi,

    Based on my research, only users with administrative permissions can access the Windows Server 2012 Essentials Dashboard.

    Firstly, I recommend you use the Launchpad to access the Dashboard. Additionally, you cannot use the built-in Administrator account to sign in to the Windows Server 2012 Essentials Dashboard from the Launchpad.

    More information:

    Overview of the Dashboard in Windows Server Essentials

    http://technet.microsoft.com/en-us/library/jj593264.aspx

    If the issue persists, you can try to remove the client from the domain and then joined the domain again to see whether it can access the Dashboard if it won’t make too much trouble to you.

    Best regards,

    Susie

    Wednesday, November 6, 2013 7:37 AM
    Moderator
  • Hi.  As I stated, I am using a domain admin user and I have already tried a couple other domain admin accounts.  I'm not using the built-in admin account.

    I have also already tried your last suggestion.  The computer I was installing it on originally had this issue.  I messed with it for a while and decided to just reinstall the whole OS since it wasn't a critical machine.  I wiped the drive and installed the OS from scratch, clean, joined the domain and reinstalled Essentials.  Same problem, can't open dashboard.

    The log file says the user I am trying is not a domain admin, but it most certainly is.  It just seems like a bug to me at this point.

    Wednesday, November 6, 2013 12:35 PM
  • No, the local admin account didn't work either.  I'm just going to abandon the whole thing.  I wanted to experiment with it but it seems like there are a bit of issues I just don't have the time to fiddle with right now.  Thanks anyway for the responses.
    Wednesday, November 6, 2013 2:00 PM
  • I had the same problem, I have been fighting it for three days...both good and bad, at times, that I am so damned stubborn.  Anyway, I figured out the issue, it must be a bug in connecting to the domain for Essentials.

    My setup is a pre-existing 2012R2 (upgraded from 2003 -> 2008R2 -> 2012R2) domain that I added a second 2012R2 standard machine in order to run Essentials (to replace Home Server 2011.)  The Essentials is merely a member server and is NOT a domain controller.  No DNS/DHCP or AD installed on the Essentials server.  I was experiencing the same issues with my previously created domain admin account that I was using to configure Essentials.

    For troubleshooting what I did was create a NEW domain admin account and it worked!!

    I wasn't happy with that as the final answer so what I did was remove my primary domain account from ALL admin groups and left it as a Domain User, then closed the user properties to save it.  I then verified that I was no longer an admin on the Essentials server.  Then re-added my account to all the proper domain admin groups (Enterprise Admins, Domain Admins, Schema Admins, Group Policy Creators (or something like that), and Administrators.  Logged off Essentials and logged back in and VIOLA!!  This, for some reason, reset the account information on the Essentials server and I was able to log into Dashboard.

    Hope this helps.

    -Lynn

    • Proposed as answer by Visionamics Tuesday, April 14, 2015 8:56 PM
    Thursday, November 7, 2013 3:58 AM
  • I am going to try this in my lab to see if i can repro it.

    Robert Pearman SBS MVP
    itauthority.co.uk | Title(Required)
    Facebook | Twitter | Linked in | Google+

    Thursday, November 7, 2013 9:56 AM
    Moderator
  • I could not reproduce this.

    My steps.

    Install 2012 R2 DC

    Install 2012 R2 Member Server

    - Add Essentials Role to Member Server

    Able to open dashboard as any administrator.


    Robert Pearman SBS MVP
    itauthority.co.uk | Title(Required)
    Facebook | Twitter | Linked in | Google+

    Thursday, November 7, 2013 2:12 PM
    Moderator
  • Robert,

    The issue may be a matter of an existing domain that was updated from a prior version of AD and not built as a 2012(R2) domain.  I had built and rebuilt my Essentials server at least half a dozen times, trying to change the installation slightly each time to figure out what I was doing wrong.  The "fix" I posted above was only after giving up on the idea that reinstalling would have any effect.

    The issue may not pop up on a domain that was built initially on 2012(r2).  I hadn't the luxury of performing a clean AD installation and the thought of doing so was making me ill, which is why I stuck with figuring out a fix.  However, I may perform a test as well, when I get home on exactly that setting up a brand new 2012R2 domain then a 2012r2 member server with Essentials and see if I get the same results you did.

    Thanks.

    -Lynn

    Thursday, November 7, 2013 4:21 PM
  • Ill give that a whirl then.

    Robert Pearman SBS MVP
    itauthority.co.uk | Title(Required)
    Facebook | Twitter | Linked in | Google+

    Friday, November 8, 2013 10:53 AM
    Moderator
  • ok so i went from:

    2003 r2

    to

    2008 r2

    then installed an essentials member server -

    i was able to open the dashboard as any admin.


    Robert Pearman SBS MVP
    itauthority.co.uk | Title(Required)
    Facebook | Twitter | Linked in | Google+

    Friday, November 8, 2013 5:52 PM
    Moderator
  • I am having same problem.  Have existing domain with both DC running 2012 R2.  Added new 2012R2 Standard Server and joined domain then installed Essentials Role.  Now I am getting the permissions error.  I tried solution of creating brand new account by copying admin account.  Still no go?

    Update - I just rebuilt the server from scratch.  Here is my exact process:

    1. Install Server 2012 R2 from VL media.
    2. Add Essentials Role.
    3. Name and join server to domain.
    4. Login as domain admin.
    5. Run Essentials Post Configuration - completed without issue.
    6. Attempt to run dashboard and get permission error.

    Not sure what I am doing wrong?

    Update 2 - I tried the one solution above and took an existing admin account and removed from all groups.  Then logged in to server.  Logged out of server.  Joined account to Domain Admins group and waited for replication.  Then logged into server once again and was able to open dashboard.

    This is just odd?

    • Edited by Brian Hoyt Friday, November 8, 2013 7:26 PM
    Friday, November 8, 2013 6:22 PM
  • Hi everyone!

    I went in and tried all of your solutions, but none worked.

    I have found the REAL solution to why this isn't working, and it should be corrected by Microsoft. 

    In the users profile, you can see the member of and primary group. 

    With my admin account, on Primary Group, I had "Domain Admins" as the group. It didn't work. I tried setting that to Enterprise Admins, and it worked and was able to get into dashboard. I set it back to Domain Admins, and it didn't work.

    I set it as Domain Users, and it worked. 

    As long as you have the user in Domain Admins group, and primary group set to either "Domain Users" or "Enterprise Admins" -- it will always work. The account does NOT need to be in the Enterprise Admins group, just be sure to keep the primary group on "Domain Users", and make sure it is in the "Domain Admins" group. 

    When the member above Lynn said they created a new account, it worked because ALL new user accounts are set to primary group of "Domain Users".

    When the other user Brian Hoyt had to remove ALL administrator groups, it removed the primary role from "Domain Admins" to "Domain Users" which then worked. Then he added ALL admin groups (you do NOT need Enterprise Admins group) but probably forgot to set the primary group, which is good and that is why it worked. When he copied the Admin account, the primary group always rolls over to the new account and is copied with it. When he removed all groups, he forgot to set back the primary group. 

    When Robert Pearman tried, he probably had the primary group set to something other than "Domain Admins" as well. 

    You don't want a Domain Admin (primary group) configuring your server. You want a domain user in Admin group (such as an employee to reset passwords), OR the Enterprise Admin (primary group)  to configure server applications, NOT a domain admin. So I do see why Microsoft had this set the way it is. 

    So basically, you can NOT have the primary group to "Domain Admins". It needs to be either "Domain Users" OR "Enterprise Admins". The account MUST be in the "Domain Admins" group. 

    I do believe Microsoft should fix this issue, because it could be a bug, but also could be so that Domain Admins (primary group) can't screw applications that should be maintained and configured by Enterprise Admins (primary group). 

    I have made a video showing the problem was fixed, and this is the solution!

    youtube.com\watch?v=bZoNc3RkBSw

    Thanks guys!


    • Proposed as answer by rowebil Monday, November 11, 2013 3:22 AM
    • Edited by rowebil Monday, November 11, 2013 5:03 AM
    • Marked as answer by cculver78 Monday, November 11, 2013 6:14 PM
    Monday, November 11, 2013 3:15 AM
  • Confirmed here - Setting 'Domain Admins' as primary group does indeed prevent me from opening the Dashboard.

    My user was not in the enterprise admins group - so i would suggest that any group set to primary - would be fine excluding Domain Admins.


    Robert Pearman SBS MVP
    itauthority.co.uk | Title(Required)
    Facebook | Twitter | Linked in | Google+

    Monday, November 11, 2013 9:08 AM
    Moderator
  • Confirmed.  Changing primary group from Domain Admins to something else fixed it.  Thanks, rowebil
    Monday, November 11, 2013 6:15 PM
  • Hi all,

    I saw this on Rob P's blog and thought I'd weigh-in with my findings.

    Based on this article:
    http://msdn.microsoft.com/en-us/library/windows/desktop/ms677943(v=vs.85).aspx

    ...and reading through some of your tests, it seems possible that this might be the cause:

    When opening the Essentials Dashboard, a check is done for the user's membership of the Domain Admins security group.

    However, if the test is done using just the 'memberOf' attribute, then that check doesn't return the membership of the Primary Group. If it was going to check the primary group status also, then there'd need to be an additional test on the primaryGroupId attribute.

    If it's expecting to see a Domain Admin user and doesn't see that membership during the check, then it follows that it would generate the error and the respective log entry.

    Not sure if there's a way to test that theory, but if it can be confirmed, then I'd suggest it should be reported as a bug.

    Guy

    • Proposed as answer by Guy Gregory Monday, November 11, 2013 10:44 PM
    Monday, November 11, 2013 10:37 PM
  • This issue still exists. I have a W2K8 R2 DC. I am moving the client into W2012 R2 Essentials. I successful add the Essentials as a DC, however upon opening the dashboard I experienced the same issue. I went through the same steps cculver78 describe. I finally found this article and changed my primary group to enterprise admin and the dashboard would finally launch. This is a bug!
    Sunday, January 18, 2015 3:01 AM
  • Great, fixed it for me!
    Friday, November 13, 2015 3:17 PM
  • Just wanted to say thanks.  I struggled getting exchange 2013 installed on a 2008 R2 server with the domain being a new Essentials 2012 server.  When I checked for the "default" group assignment I found that it was blank.  Once I changed that to Enterprise Admins the installation finally moved forward.  I can't properly express my frustration over this item with MS.   I can understand if migrating from a former domain but this was a fresh install.  If only I could bill my time to MS.....

    Dennis

    Monday, March 14, 2016 11:59 AM
  • Fantastic, i had the same issue and reset the account into the domain users group, but didn't set it as primary!

    This seems like a big bug from Microsoft!

    Tuesday, October 24, 2017 11:44 AM