CF2018 Server after Auto-Lockdown CF Services issues

[SSemrauSr]

We are installing on an offline 2012r2 'standard' installation.

Installation of CF2018 went just fine - sites are reachable.

After running the Lockdown application none of the ColdFusion services will start.  I did select an AD account to use, validated the password was updated first, but after completing the Lockdown and restarting the server the services fail with 'Access Denied'.

I have restored the ColdFusion service to use the Local System account and that now fails as well.

Any insight would be greatly appreciated.

[Dave Watts]

I would recommend you try running the CF services with the account you were previously trying to use, but run them as an application using cfstart.bat and use tools like Filemon etc to see what that user can't reach.

Dave Watts, Fig Leaf Software

[SSemrauSr]

Thanks for replying Dave.  After installing I left it with the default Local System account so that should work - but using that account even gets the 'Access Denied' now.

I'm going to run the un-installer for the Lock Down and see how things are - hopefully restored and I can try once again with the Lock Down.

[pete_freitag]

Make sure you take a look at the Lockdown tool logs, often has the reason in there.

[SSemrauSr]

Thanks for the reply Pete;

Here are the items that stand out in both of the logs ...

Summary

-------

Installation: Successful with errors.

70 Successes

0 Warnings

2 NonFatalErrors

0 FatalErrors

Action Notes:

None

Adobe_ColdFusion_2018_Server_Auto-Lockdown_Install_xxxxx.log

Install Log Detail:

Custom Action:  com.adobe.ia.action.iis.WebserverValidator

                          Status: ERROR

                          Additional Notes: ERROR -     class com.adobe.ia.action.iis.WebserverValidator.install() runtime exception:

Custom Action:  com.adobe.ia.action.coldfusion.LockdownColdFusion

                          Status: ERROR

                          Additional Notes: ERROR -     class com.adobe.ia.action.coldfusion.LockdownColdFusion NonfatalInstallException null

ServerLockdown_cfusion_xxxxx.log

2018-10-22 09:25:05 INFO  - Change Permissions of ColdFusion file system: Error Logs

2018-10-22 09:25:05 INFO  -

2018-10-22 09:25:05 INFO  - Permissions changed for the user: IIS AppPool\CS for the path: C:\ColdFusion2018\cfusion\..\config\wsconfig\1\isapi_redirect.dll

2018-10-22 09:25:05 INFO  - Change Permissions of ColdFusion file system: Input Logs

2018-10-22 09:25:05 INFO  - Successfully processed 0 files; Failed processing 1 files

2018-10-22 09:26:41 INFO  - All permissions changed!

2018-10-22 09:26:41 INFO  - Restarting ColdFusion using ColdFusion services!

2018-10-22 09:26:43 INFO  - The ColdFusion 2018 Add-on Services service is stopping.

The ColdFusion 2018 Add-on Services service was stopped successfully.

2018-10-22 09:26:46 INFO  - The ColdFusion 2018 Application Server service is stopping.

The ColdFusion 2018 Application Server service was stopped successfully.

2018-10-22 09:26:46 INFO  - The service name is invalid.

More help is available by typing NET HELPMSG 2185.

2018-10-22 09:26:46 INFO  - The service name is invalid.

More help is available by typing NET HELPMSG 2185.

2018-10-22 09:26:46 INFO  - Not all services could be stopped!

2018-10-22 09:26:47 INFO  - System error 5 has occurred.

Access is denied.

2018-10-22 09:26:47 INFO  - System error 5 has occurred.

Access is denied.

2018-10-22 09:26:47 INFO  - The service name is invalid.

More help is available by typing NET HELPMSG 2185.

2018-10-22 09:26:47 INFO  - The service name is invalid.

More help is available by typing NET HELPMSG 2185.

2018-10-22 09:26:47 INFO  - Not all services could be restarted!

2018-10-22 09:26:47 INFO  - All ColdFusion services restarted successfully!

2018-10-22 09:26:47 INFO  - Successfully changed the logon users for ColdFusion services!

2018-10-22 09:26:48 INFO  - Trying to restart ColdFusion

2018-10-22 09:26:48 INFO  - ColdFusion restarted successfully!

2018-10-22 09:26:48 INFO  - Setting up virtual directory for cf_scripts!

2018-10-22 09:26:48 INFO  - Trying to add virtual directory for cf_scripts

2018-10-22 09:26:48 INFO  - Adding virtual directory for cf_scripts!

2018-10-22 09:26:49 INFO  - Successfully added virtual directory for cf_scripts!

2018-10-22 09:26:49 INFO  - Changing scripts source in ColdFusion Administrator

2018-10-22 09:26:50 INFO  - Old Value for scripts source: none

2018-10-22 09:26:50 INFO  - java.lang.StringIndexOutOfBoundsException: begin 48, end -1, length 4

at java.base/java.lang.String.checkBoundsBeginEnd(String.java:3107)

at java.base/java.lang.String.substring(String.java:1873)

at com.adobe.coldfusion.lockdown.core.win.CFScriptsVdir.changeScriptSourceInAdmin(CFScriptsVdir.java:214)

at com.adobe.coldfusion.lockdown.core.win.CFScriptsVdir.addVirtualDirectoryForCfscripts(CFScriptsVdir.java:139)

at com.adobe.coldfusion.lockdown.core.win.LockDownColdFusion.addVDIRForCfScripts(LockDownColdFusion.java:313)

at com.adobe.coldfusion.lockdown.core.win.LockDownColdFusion.startColdFusionLockDown(LockDownColdFusion.java:177)

at com.adobe.ia.action.coldfusion.LockdownColdFusion.install(LockdownColdFusion.java:54)

at com.zerog.ia.installer.actions.CustomAction.installSelf(Unknown Source)

at com.zerog.ia.installer.InstallablePiece.install(Unknown Source)

at com.zerog.ia.installer.InstallablePiece.install(Unknown Source)

at com.zerog.ia.installer.InstallablePiece.install(Unknown Source)

at com.zerog.ia.installer.InstallablePiece.install(Unknown Source)

at com.zerog.ia.installer.GhostDirectory.install(Unknown Source)

at com.zerog.ia.installer.InstallablePiece.install(Unknown Source)

at com.zerog.ia.installer.Installer.install(Unknown Source)

at com.zerog.ia.installer.actions.InstallProgressAction.ae(Unknown Source)

at com.zerog.ia.installer.actions.ProgressPanelAction$1.run(Unknown Source)

2018-10-22 09:27:02 INFO  - Creating xml mapper for the lockdown website.

[pete_freitag]

I don't think the java.lang.StringIndexOutOfBoundsException is to be expected, maybe someone from Adobe can chime in here.

I have seen that WebserverValidator error a bunch, even filed a bug for it during public beta: Bug CF-4202956

[bihani]

Hi,

Can you mail me the details bihani@adobe.com?

Also, is it possible to go on a call to look at the issue first hand?

Thanks,

Kailash

[bihani]

SSemrauSr Looking at the logs, it seems when the installer tried to restart the ColdFusion Application Server, it was giving an error: Access Denied

This happens only if password provided is incorrect, or installer is not able to connect to the AD domain (since you mentioned AD)

It will be better if you can mail me the complete logs at bihani@adobe.com

[SSemrauSr]

Thank you (everyone) for your replies.

I have emailed the logs to you Kailash as well as indicated the time frame I'm available to talk on the phone.