Problem Statement

A X 503 Service Unavailable error message displays when attempting to access the WhatsUp Gold Web interface.

Symptoms

You will observe the following error in browser when accessing the whatsupGold web interface

Service Unavailable HTTP Error 503. The service is unavailable.

Cause

This error occurs due to a group policy object (GPO) conflict in which the GPO is pushed to the WhatsUp Gold server and the WhatsUpGold User account has been removed or does not have the required rights associated with it.

The WhatsUpGold_User account is created during the installation process. This account is used for the identity of the WhatsUp Gold application pool in IIS as well as the account with rights to the WhatsUp virtual directory. This user should be added to the Local Administrators group and should not be removed. This issue is usually caused by a Group Policy Object (also known as a “GPO”) applied on your domain which has removed or altered the WhatsUpGold_User account on the WhatsUP Gold server.  

Steps to Reproduce

Open IIS Console

Select Application Pools. Select NmConsole and check if the application is in “Stopped“ state as the user privilege issue will fundamentally cause the stoppage of the application pool.

Resolution

Verify/restore the following settings:

The WhatsUpGold_User user must exist on the WhatsUp Gold Server

1. Click Start > Control Panel > Administrative Tools > Computer Management.
   
2. Expand the Local Users and Groups section in the left-hand pane of the window.
   
3. Click the Users folder.
   
4. If the WhatUpGold_User account does not exist, a GPO conflict exists and needs to be resolved at the Domain Controller.
   

The WhatsUpGold_User must be a member of the Local Administrators group on the WhatsUp Gold server

1. Repeat steps 1 and 2 above.
   
2. Select the Groups folder.
   
3. Double-click the Administrators group within the list.
   
4. Make sure the WhatsUpGold_User account appears in this list; if it does not, a GPO conflict exists and needs to be resolved at the Domain Controller
   

The Local Administrators group must have the Local Security option enabled as Logon as a batch job.

1. Click Start > Control Panel > Administrative Tools > Local Security Policy.
   
2. Expand Local Policies.
   
3. Click User Rights Assignment.
   
4. Locate and double-click Log on as batch job.
   
5. If the Administrators group does not appear in this list, a GPO conflict exists and needs to be resolved at the Domain Controller.
   

After verifying and/or restoring all these settings, this issue should be resolved.

IMPORTANT:  If the GPO is systematically applied to servers on a regular basis, this issue will reappear. You need to work with your Network Administrator to reassess the GPOs that are applied to this server. 

Additional Information

                                                                                                                                                                                     Author:  Junaid Vengadan

Reviewed & approved: Fawad Laiq