It seems there is an account name / password problem.

[RenegadeUK]

OK, so I was bored...You need to add the account to 2 local system policies..."Log on as a service" and "Allow log on locally". I can't see any reason why you couldn't do this on a SBS server either just create a domain account and alter the Domain Controler policy instead of the local system policy...

[Vali_3CX]

Only for my information: if you have a domain controller, I suppose you have also some "normal" computers in that network - which is the main problem against installing gateway on one or more of these computers?

[microtronx]

OK, so I was bored...You need to add the account to 2 local system policies..."Log on as a service" and "Allow log on locally". I can't see any reason why you couldn't do this on a SBS server either just create a domain account and alter the Domain Controler policy instead of the local system policy...

I've added the user and the 3cx... group to that two policies on my DC but it is not working.
....

btw. we do have only this domaincontroller which is online all the time 7/24. all others (2 pc) clients are notebooks .

[edmills]

Regarding the security issues of letting a program create domain accounts.

If you're logged in as a domain administrator, that should be possible. A domain admin is responsible for determining if what they're doing is a good idea or not. Without domain admin credentials, you clearly won't be allowed to create a domain account.

As a work-around, how about letting the domain admin manually create the accounts either before, or during channel creation? If you list out what group memberships and priviledges are needed, the admin can decide if they want to grant them.

I'm trying to install this on a WIN 2003 server DC.

Thanks,
Ed

[edmills]

On further reading I realize that my previous post is true, but not as relevant as it might be, Sorry about that.

After more reading I tried something similar to what RenegadeUK suggested Sat Dec 12, 2009 6:55 pm. I added 3cxskypeacc01 to both "Log on as a service" and "Allow log on locally" in the default domain controllers policy under Computer Configuration/Windows Settings/Security Settings/Local Policies/User Rights Assignment. Did I get the location right?

I then tried going back through the cycle in the Gateway for Skype monitor. It didn't help.

I have 3CX running on a WIN 2003 DC since that's the only always on machine. I also have a client with a SBS 2003 system with the same problem.

Any ideas would be much appreciated.

Thanks,
Ed

[edmills]

As an interesting note:

The DLink DPH-50U USB Phone Adapter works properly on a WIN 2003 DC server.

[igor.snezhko]

After adding any new rights to user account, you have to re-logon under that account.

[edmills]

I rebooted, but still no luck.

[sdp]

The trick with 'Allow log on locally' workes for me.
I'm also using WHS and had the same problem.
After setting the policy for the 3CXSkypeGatewayAccounts it did not work yet.
After removing the created account first and recreation I managed to complete the dialog.

I only wonder why some users in this forum suggest to add the account to an Administrators or Backup Users group.
That 3CX fails to set the rights in a correct way is clear but adding these accounts to an Administrator group does not show any sense for security.
If you don't want to add the 3CXSkypeGatewayAccounts group to the 'Allow...' policy, you should try adding the 'Power Users' group to the account but remeber that you have to assign this group manually to every new account.

[Vali_3CX]

Manually changing user rights for 3CXSkypeGateway accounts is on your own, and, subsequently, on your own risk, we don't take any responsability for such changes.

I repeat what I already said several times: these accounts are required only to allow multiple Skype client instances to run at the same time. Nothing more. Due to security reasons, these accounts are highly recommended to have MINIMUM privileges, exactly as much as is needed for the Skype client to run.

Then - if you have a physical, hardware gateway, it does run in its own box, being connected by network to the PBX, it doesn't require user accounts privileges handling. Therefore, since 3CXSkypeGateway has been designed in the same way ("set it and forget it"), there is no practical reason to force its installation on a machine not suitable, particulary a DC. If there is a DC machine, then there are also client machines, so 3CXSkypeGateway can, and is recommended, to be installed on such one and connected, as in the case of a hardware gateway, by network to the PBX.

If you look carefully on questions related to 3CXSkypeGateway, you will be surprised to see that more than half are related to user accounts handling. If 3CXSkypeGateway would allow domain accouunts, then perhaps 90% of our technical support will be focused on debugging an maintaining computer policies instead of gateway specific issues.

[MrKoen]

I too encountered this problem. Too bad the error message doesn't provide insight in what really is going on. This causes people like me to start experimenting up to the boiling point before starting to Google and find the, unlogical, answer right in this topic

I'm running 3CX on a virtualized instance of Windows 2003 in a domain running under Microsoft Hyper-V. Even though virtualized environments are note supported, it seems to work great. Only thing was that my Windows 2003 instance running 3CX is bound to a domain and the domain policy does not allow the log on locally policy to be overridden. I used the technique of manually adding the 3cxskypeacc01 account created by the 3CX Gateway for Skype to the backup operators group. Once done, registration went fine, Skype popped up and I could log on to Skype using my Skype username and password. The 3CX Skype Gateway manual to me makes it sound you should enter the 3cxskypeacc01 account again in Skype. This is not true, this should be your Skype credentials. Logical if you think about it, but the manual is pretty vague if you follow it by the letter without thinking (like I did).

Thanks for providing the solution in this topic guys!

[Yurivel]

since 3CXSkypeGateway has been designed in the same way ("set it and forget it"), there is no practical reason to force its installation on a machine not suitable, particulary a DC. If there is a DC machine, then there are also client machines, so 3CXSkypeGateway can, and is recommended, to be installed on such one and connected, as in the case of a hardware gateway, by network to the PBX.

It looks, this recommendation (to run 3CXSkypeGateway at the separate machine) goes in contradiction with pre-requisites at http://www.3cx.com/voip-gateways/skype.html, in particular:
...
3. 3CX Gateway for Skype must be installed on the same machine as 3CX Phone System. ...

If, nevertheless, 3CXSkypeGateway may run on the separate host, it's not convenient for many small companies, where the only stable and reliable enough machine (with UPS)is a SBS Server, with Windows Server 2003 and DC running on it. All client machines in such environment are not suitable for a critical company-wide application, as they are either mobile (notebooks) or can be switched off, reloaded etc., occasionally, by ordinary users.

So, running both, 3CX Phone System+3CXSkypeGateway on a single machine with DC is very actual and solution for that is highly demanded.

Best Regards
Yuri

[igor.snezhko]

+1

[gabrielme]

Thank you so much for this post solution. Now my WHS with 3CX and Skype gateway works perfect!
This is a very important information, was very hard to find.

[kleon]

im facing the same problem, ive installed the 3cx and 3cx gateway for skype on windows 2003 with AD , read all previous posts but no luck..

After i press the create button and set the ports and id , i get this error " System error:A member could not be added to or removed from the local group beacause the member does not exist.(0x0000056b).
But it creates 3cxskypeacc01 & 3CXSkypeGatewayAccounts in the AD.


So to all of you that made it happen , which are the working steps to make it pass the message "It seems there is an account name / password problem."?