Connection and credential failures

#General credential checks

• Re-enter the secret. Trailing spaces from copy/paste are the most common culprit.
• Confirm host/port and that the FileAgent host can reach them (firewall, VPN, DNS).
• Check the account isn't locked or expired on the target system.
• Use Test connection to isolate a credential problem from a job/path problem.

#SMB: access denied

• Both share permissions and NTFS permissions must allow the account — check both layers.
• Prove access from the FileAgent host as the service account; another machine's access doesn't prove the host has it.
• Move, Sync/Mirror, and Purge need delete rights on the relevant side.
• Use the username format your environment expects (DOMAIN\user or UPN).

#FTP: listings or transfers hang

Login succeeds but directory listing or transfers hang — almost always passive/active mode vs. firewall:

• Prefer passive (PASV) — it works through most firewalls and NAT.
• Active mode needs the server to connect back to the client and usually fails through NAT.
• If passive also fails, the server's passive port range may be blocked — ask the server owner for the range and allow it outbound.

#SFTP: timeouts and key errors

• Confirm the port (22 or the partner's custom port) is reachable from the FileAgent host.
• Partner IP allowlists are common — ask whether your host's public IP needs registering.
• For key auth, confirm the private key and passphrase are correct and the key is authorized on the server.
• If connection succeeds but large transfers stall, raise the job timeout and enable retries.

#Amazon S3: AccessDenied and region errors

AccessDenied means the policy doesn't cover the action or resource. Scoped to the bucket/prefix, a job needs s3:ListBucket, s3:GetObject, s3:PutObject, and s3:DeleteObject (only for Move/Sync-Mirror/Purge).

• Check the policy's prefix paths — a policy for reports/* won't allow exports/*.
• Bucket policies and organization SCPs can deny even when the user allows.
• A wrong region can surface as a connection error.

#Azure Blob: keys, SAS, and firewalls

• Verify the storage account and container names, and that the account key or SAS token is current — rotated keys/expired tokens are a frequent cause.
• The storage account's network rules/firewall must allow the FileAgent host's IP.
• Confirm outbound HTTPS (443) to the Azure Storage endpoints.