Cure / Resolution (additional steps):  Users may also need to remove the vbscript registry key:

32 bit Windows users navigate to:  HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{ B54F3741-5B07-11CF-A4B0-00AA004A55E8}  and then re-register vbscript.dll.  

64 bit Windows users navigate to:  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ B54F3741-5B07-11CF-A4B0-00AA004A55E8}   

Visit this link for more info.  A user couldn't complete the installation without performing these additional steps.

Army Knowledge Online problems and cures have been moved to a separate page.

APPROVE IT 

back to top

The ideas on this website are from my personal experience.  My "official" response is to send all XP & Vista users to the Army Publishing Directorate so they know about all of the problems with this program.  You can call:  703-428-0545 or email: apdfcmp@conus.army.mil  (If you are using Windows 7, they will NOT help you), you will have to try my ideas.

1.  Problem:  Approve It 5.8.2 keeps reinstalling every time you log onto the computer.

Cure:  Remove the Approve It from the startup menu (This version puts itself in this folder for some unknown reason).

Cure2:  Uninstall ApproveIt 5.8.2, restart computer, Install ApproveIt 5.7.3.  Follow instructions below.  PLEASE NOTE:  ApproveIt 6.1 is the only version that will work with Lotus Forms.

2.  Problem:  "Component is missing or corrupt" message after installing ApproveIt and attempting to digitally sign a form

Cure:  Restart computer after installing Approve It (multiple restarts might be required).

3. Problem:  "No host program form" stalls Approve It installation

Cure:  You need to have Adobe Acrobat Reader or Microsoft Office installed on the computer prior to Approve It installation.

4. Problem:  "Unable to complete the signature; the private key cannot be found or is inaccessible on the system.  Make sure you are using a good signing key or the right smart card."

Cure:   Close Pure Edge, restart computer, try again

Cure2:  Double check that you did install all software correctly.  You can use the notes page to verify.  Particularly ActivClient

Cure3:  Visit:  MilitaryCAC forums for another possible solution.

5. Problem:  "Unable to complete operation; an ApproveIt component (ApproveIt FrameworkResource.dll) is missing or corrupt"

Cure:  Restart the computer.  Could take 3-4 times.

Cure2:  Verify installation of ApproveIt, you may need to uninstall, restart computer, then reinstall.

6. Problem:  Receive "ApproveIt - Error  [message not found]: [message not found] [message not found]," followed by "Unable to access Private Key", then "The signature could not be created because the private key of the certificate could not be accessed."

Cure:  Uninstall Approve It, restart computer, Install ApproveIt 5.7.3  Follow instructions below.  PLEASE NOTE:  ApproveIt 6.1 is the only version that will work with Lotus Forms.

Cure2:  Your current profile could be corrupt.  Here's how to build a new profile:  If on a Government Computer, look below Cure2 for XP

Cure2 for Vista & 7:  

1. Click Add or remove user accounts under User Accounts in Control Panel

2. Click on Manage another account

3. Click Create a new account under the big box

4. Type in the name of the new account name

5. Click Administrator, then Create Account

6. Logon with the new username and try again

Cure2 for XP: 

1. Double click User accounts in Control Panel

2. Select Create a new account

3. Type in the name of the new account, select next

4. Select Computer Administrator and Create Account

Since you made your new logon as an administrator, you should have no problem accessing your old files.

These are fixes for Government Computers.

1.  Newer instructions that can cure this problem

2.  Instructions that can cure this problem

3.  ****MUST DO THIS STEP**** after renaming the old profile.

Run regedit and go to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList and delete the SID key for the corrupt profile. Easiest way to find the correct SID is to search from the 'ProfileList' key for the directory mentioned in %USERPROFILE% in step #1.

 After you do this, make sure you rename the users' profile under C:\Users\<user name>\

Then have the user login to verify user can sign the document.

7.  Problem:  You get prompted to enter a serial number when installing ApproveIt 5.7.3

Cure:  This means you attempted to install using the setup file from within the zipped file.  You need to extract the zip file, then run the setup from inside the new folder it just created.   Read installation Instructions below.

8.  Problem:  You get prompted to enter a serial number when installing ApproveIt 5.9

Cure:  Use the file titled:  AGMInst.exe (It will be an icon that looks like a star) instead of the setup (bootstrap) file

 9. Problem:  While installing Approve It 5.9, receive Error 1303. The installer has insufficient privileges to access this directory: C:\Program File\ApproveIt\Support\Tools.  The installation cannot continue.  Log on as an administrator or contact your system administrator.

Cure:  Stop the installation. Restart computer, start installation again from an administrator account

10. Problem:  Approve It tab does not show up in Microsoft Word 2007. 

Cure:  Look at this portable document file (aka pdf).

11. Problem:  Receive ePersona message when trying to sign a form in Pure Edge with Approve It?

Cure:  Close PureEdge (if it is open).  Go to: C:\Program Files\ApproveIt\, double-click the icon that looks like a wrench titled: "AprvCfg.exe".  On the Signature Method tab, make sure the radio button is on the bottom choice - "Sign using a certificate or smart card."  Don't change anything else.  Click Apply, then OK

After you click "Sign" in PureEdge, it may take a few minutes for the list of certificates to pop up. Be patient. Choose the certificate that doesn't say Email, and put a check in the box that says "Use this certificate as default" (if this is your personal computer).

12. Problem:  Receive error message: "Error 1327 Invalid Drive X"  (X=any drive letter other than C)

Cure:  Go to Start, Run, type in REGEDIT <Hit Enter or OK>  Navigate to:  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ Explorer\User Shell Folders

In the right pane - look for any entries which have an X or any other letters not C (your OS folder) modify data to C:\

13. Problem:  Receive "The signature could not be created because the Private key of the certificate could not be accessed."

Cure:  Look here for the answer

14. Problem:  When attempting to install Approve It on a computer with Office 2007, receive error message "Microsoft Word has encountered a problem and needs to close.  We are sorry for the inconvenience."

Cure:  Look here for the answer

15. Problem:  Installation guidance for ApproveIt 6.1

16. Problem:  Receive: "chilkatlog:  unzippedfile: failed to read compressed data.  failed to find file marker" when attempting to install Approve It 6.1.

Cure:  Install Approve It 5.7.3.  Follow instructions below.  PLEASE NOTE:  ApproveIt 6.1 is the only version that will work with Lotus Forms.

17. Problem:  Receive "Error 1606:  Could not access network location %APPDATA%  when trying to install ApproveIt on Windows 7

Cure:  You are trying to install ApproveIt in a profile without Administrative rights, or your current profile is corrupt.  Create a new profile and install the programs from that profile.  Here's how to build a new profile.

18. Problem:  Approve It tab does not show up in Microsoft Word 2010. 

Cure:  The current versions of ApproveIt (including 6.1) are not compatible with Office 2010 (except for Outlook).

CAC / CAC READER

back to top

1.  Problem:  The CAC reader driver did not automatically install correctly

Cure:  Go to Device Manager (Instructions are on the CACDrivers page), scroll down to Smart Card readers, right click the CAC reader that shows up below Smart Card Readers.  It may also show up under unknown devices.  Select Uninstall.  It will give you a message.  Once it is uninstalled, unplug the reader from your computer.  Wait a few moments, then plug it back in.  It "should start to install itself.  If that doesn't work, keep reading for other ideas below.

Cure2:  Look at the CACDrivers page to see how to fix this problem.  Hopefully whichever CAC reader you purchased will work on your Vista or Windows 7 computer.

Cure3:  If you are using an SCR-331 CAC Reader on Vista or Windows 7 (32 or 64 bit), and are still having problems getting the reader to be recognized by ActivClient, or your CAC reader shows up as STCII Smart Card Reader follow these instructions for updating the firmware on the reader.   

2. Problem:  Receive quick beep whenever you boot up your computer with the CAC reader plugged in, or when plugging in your CAC reader.

Cure:  Change the following registry key to 0 from 1  by going to Start, Run, type in "Regedit" (without the quotes) and navigate to:  HKEY_LOCAL_MACHINE\Software\ActivCard\ActiveClient\Notification\NoReaderWarning\Enable

3.  Problem:  Card does not read consistently

Cure:  Try cleaning the gold portion of the CAC with a clean pencil eraser. 

Cure2:  Your card could be wearing out.  It may be time to get a new one.  Click here to find an ID card office.

4. Problem:  CAC reader is seen in Device Manager in Windows but not by ACTIVCLIENT software:

Information:  Windows runs the Smart Card service as a local service and without it, smart cards will not work. Another symptom of this is when the Card Icon does not show on the logon screen.

Cure:  Log on as the local administrator.  Go to Start, Run, type in: services.msc, Verify that both ActivClient middleware and SmartCard services are stopped.

From the Run line:  type: Regedit

Navigate to "HKLM\Software\Microsoft\Cryptography\Calais (select Calais with the mouse cursor) Right click on it choose "Permissions".

Verify if "LOCAL SERVICE" exists, if not click "ADD"

In the search box type in your computer name\local Service

Click Check Names, then OK.

Select Local Service -> Click Advanced -> in the Permissions tab select LOCAL SERVICE -> and click Edit.

Mark the following with Allow:

Query Value

Set Value

Create Subkey

Enumerate Subkeys

Notify

Delete

Read Control

Open Services.msc again, Start smart Card Service,  Start ActivClient middleware Service.

CAC Card should now be working.

Cure2:  Follow these instructions for modifying your registry to make the Smart Card service start.

5. Problem:  How can I use 2 CAC readers on my computer?

Cure:  Once the second CAC reader is physically functioning:  Double click the ActivClient icon (down by your clock), select File, Use Reader, Select the other reader.  Go to Tools, Advanced, Make Certificates Available to Windows.  You should be able utilize either CAC on your computer now.   I personally use this on my office computer to assist with DTS, digitally signing forms, and helping Soldiers with AKO password resets. 

**  Here are Pictures showing how to do this.

6. Problem:  How do I get the message to stop coming up that says my CAC reader isn't plugged in?  I get a notice every time I start my computer that my reader isn't installed. I own a laptop and don't plug in the reader unless I need it. 

Cure:  Go to Start, All Programs, ActivIdentity, and click on Advanced Configuration Manager.  Select Notifications Management.  Double click Display No Smart Card Reader Alert, it will automatically change from a YES to a NO.

DTS

back to top

1. Problem:  Can I use DTS with my MAC or on Linux?

Cure:  Yes you can, the new version of DBSign called DBSign Universal Web Signer is now available on DTS and will allow all computer platforms to use it.    NOTE:  Look at #2 below and here for troubleshooting tips.

2.  Problem:  When accessing DTS for the first time, you 'may' be told to install JRE 1.5.

Cure:  Windows users can download JRE from:  http://download.cnet.com/Java-Runtime-Environment-JRE/3000-2213_4-10009607.html  

NOTE for Windows users:   One person informed me that he was able to uninstall JRE after installing the DBSign on his Windows computer, and DTS still worked.  He was having problems where another window would pop up and state that it was Done, never actually letting him into DTS.

NOTE for MAC users:  When you first get to the page telling you that you need Java, don't be tempted to click the link.  Just let it sit there and it will install it automatically. 

NOTE2 for MAC users:  If you get a blank page after successfully logging into DTS trying to navigate to your authorizations or vouchers, Click the word Safari, Select Security, uncheck the box for Block pop-up windows, then try it again.

3.  Problem:  Unable to access DTS (Error message "There has been a problem with Login.  Problem getting security information from your computer.  Please contact your DTS site administrator for assistance."), or DTS stalls at DBsign: logging into cryptographic libraries....

Cure: Reset your Internet Explorer.   Go to: Tools, Internet Options, Advanced (tab), Click on the Reset... (button)

Cure2:  In Internet Explorer:  Go to Tools, Internet Options, Security (tab), Click on Trusted Sites (green checkmark), Click Sites (button), in the Add this website to the zone:   type in "*.osd.mil" after unchecking "Require Server Verification", click add (button), select close, then click OK

Cure3:  Go to:  Tools, Internet Options, Security (tab), click on the Internet Security option.  Uncheck the box for Enable Protected Mode. 

4.  Problem:  DTS screen flashes up, then disappears after you hit login.

Cure:  Check your pop-up blocker(s), they are more than likely "killing" the page that is attempting to pop up.  DTS loves pop ups. :)

5.  Problem: DTS error:  "Your certificate is invalid or expired.  Please contact your local Registration Authority (LRA) or Verifying Official (VO) to obtain a new certificate or CAC card."

Cure:  Uninstall DB Sign, Restart Computer, Reinstall it and go to the advanced installation.  Tell the system not to use MS Entrust.  Then tell it to use CryptoAPI.  After that, you should be able to log into DTS.

6. Problem:  DTS will not allow you to get past the logon screen in Vista or Windows 7 (64 bit).

Cure:  Make sure you are using the (32 bit) Internet Explorer.  If you don't see it in your list of programs, navigate to:  C:\Program Files (x86)\Internet Explorer\  double click on iexplore.exe (it will be approximately 622KB in size.  You can also copy / create a shortcut for this program to your desktop.

7.  Problem:  DTS error:  "Your user account cannot be found, is locked, or your certificate has been revoked."

Cure:  Your account may be "in between" your old unit and your new unit.  Contact your new DTS person to have them receive you.

INTERNET EXPLORER

back to top

1.  Problem:  "There is a problem with this website security certificate."  error.  Your options are listed as  "Click here to close this webpage" or "Continue to this website" where it states it is not recommended.

Cure:  Latest DoD Certificates are needed, I have instructions where you can download and install them here

2.  Problem:  Internet Explorer browser closes (crashes) when attempting to register your CAC on AKO -or- receive "The server akocac.us.army.mil at cac-reg requires a username and password."

Cure:  (Vista specific, may work with IE 6, (does work with IE 8))  Go to Tools, Internet Options, Content, Certificates, Personal, Advanced, check the box that says "Client Authentication." 

NOTE:  A restart of Internet Explorer is required to allow this change to take place.  You don't have to restart the computer, just Internet Explorer.

Cure2:  Go to:  Tools, Internet Options, Security tab, click on the Internet Security option.  Uncheck the box for Enable Protected Mode. 

Cure3:  Close browser, reopen it, clear your cache and temporary internet files.  Close browser, restart, try again.

3.  Problem:  Can not save file in Internet Explorer while using MyForms

Cure: Follow these instructions

4. Problem:  Receiving the message: "You do not have Permission to Access this resource."

Cure:  Verify that you do have all needed software installed, Visit the Notes page to double check what you installed already.

Cure2:  Verify that you are using Internet Explorer when attempting to register your CAC.  If you are using Firefox, please look at the Firefox page for the needed DoD configuration file.

Cure3:  If you receive this message when trying to download ActivClient, you need to know that the ActivClient download links on AKO are for Army personnel only.  If your account is listed as an Army volunteer, Guest, family member, retired, or other military branch, you  will not be able to download the file from AKO.  Other military branches look here to find where you can download ActivClient.

Cure4:  Go to: https://www.us.army.mil from this link.  There could be a problem with the shortcut in your favorites.  Simply re add AKO to your favorites replacing your existing one.

Cure5:  Look at # 4 on AKO support page for more ideas

5. Problem:  CAC seems to work on all applications with the exception of anything using your internet browser

Cure:   Try to use Internet Explorer for anything relating to CAC use on the internet

Cure2:  If you are still having problems (even using Internet Explorer)  Open Internet Explorer, Click tools, Internet options, content (tab), certificate (button) and delete all the certificates listed. Re-insert your CAC, your certificates should automatically reload.  If they don't, open up ActivClient, click Tools, Advanced, Make Certificates available to Windows.

Cure3:  Alternate ideas can be found on the AKO support page primarily #'s 2, 4, & 9

6. Problem:  If you can access some websites with the CAC, but some don't work (e.g. AKO, the USMC MCNOSC site or the OWA for NMCI site)

Cure:   Click Tools, Internet Options, Advanced (tab).  Scroll to the bottom.  Make sure TLS 1.0 & SSL 3.0 are both checked, and SSL 2.0 NOT checked.

LOTUS NOTES

back to top

The ideas on this website are from my personal experience.  My "official" response is to send all XP & Vista users to the Army Publishing Directorate so they know about all of the problems with this program.  You can call:  703-428-0545 or email: apdfcmp@conus.army.mil  (If you are using Windows 7, they will NOT help you), you will have to try my ideas.

Problem 1:  Receive "Error loading  C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll" when attempting to install Lotus Forms.

Cure:  Uninstall PureEdge Viewer, Restart computer, then attempt Lotus install again

Problem 2:  Word Sign is gray after installing Lotus Notes

Cure:  If you have upgraded from Pure Edge Viewer and did not uninstall ApproveIt, Uninstall ApproveIt, restart computer, then install ApproveIt again.  ApproveIt HAS to be installed AFTER all programs that you want to be able to digitally sign.  These programs include: Office products, PureEdge, Lotus Forms, & Adobe.

Problem 3:  "One or more signatures could not be verified" when opening up Lotus Forms

Cure:  Latest DoD Certificates are needed

Cure2:  Verify you have ApproveIt installed

Cure3:  Restart your computer (if you have just installed ApproveIt)

Cure4:  Copy and paste libeay32.dll from C:\Program Files\ApproveIt to the following folders: 

C:\Program Files\IBM\Lotus Forms\Viewer\3.5\extensions 

and to: 

C:\Program Files\Lotus Forms\IBM\Viewer\3.5\API\76\System  

Problem 4:  Unable to print forms using Lotus forms on HP printers when you have 64 bit version of Vista and / or Windows 7  (Receive an error similar to this:  Viewer : Printer Driver's EndPage() Failed at PRINT ERROR(.\src\FormViewer\PrintEngine\CPrintEngine.cpp:1960 Fri Jan 29 15:27:50 2010):2780:8) )

Cure:  An idea to try... download a program like DoPDF.  You can print your form to a PDF, then print the PDF to your HP printer.

The below error and cure was copied from the IBM Support Portal

Problem 5:  Why do the following errors occur when you open the Lotus® Forms Viewer?

20080109T154705.078-0600 3972 MEVRegisterErrorEx: \Anthill_Build\Branch-API-Cannae-20050228\Api\src\masqutil\masqutil.c 10427 2079 118 22

20080109T154705.078-0600 3972 Viewer ReportAppMsg Title:"(null)" Msg:" at MUCreateDir(\Anthill_Build\Branch-API-Cannae-20050228\Api\src\masqutil\masqutil.c:10427 Tue Apr 19 21:59:46 2005):3972:32 -> 22" TitleCode:7020 MsgCode:0

20080109T154706.515-0600 3972 MEVRegisterErrorEx: \Anthill_Build\Branch-API-Cannae-20050228\Api\src\masqutil\masqutil.c 10508 2080 118 4294967295

20080109T154706.515-0600 3972 Viewer ReportAppMsg Title:"(null)" Msg:" at MUCreateAllDirs(\Anthill_Build\Branch-API-Cannae-20050228\Api\src\masqutil\masqutil.c:10508 Tue Apr 19 21:59:46 2005):3972:32 -> -1" TitleCode:7020 MsgCode:0

MAC / APPLE SPECIFIC ISSUES

DTS:  Page goes white after selecting Voucher or Authorization in DTS.  Never changes.

DTS Answer:  In Safari, select Safari, Uncheck Block Pop-Up Windows.  You can also go to Safari, Preferences, Security, and uncheck Block pop-up windows under the Web content section.

OUTLOOK / MICROSOFT OFFICE / OWA

back to top

Problem 1:  After installing ActivClient and ApproveIt, Outlook users are unable to send email without selecting a certificate.

Cure 1:  Outlook 2003: Open Outlook, click on Tools, Options, Security tab, Uncheck the top 4 boxes

                Outlook 2007:  Open Outlook, Click on Tools, Trust Center, E-mail Security, Uncheck the top 4 boxes

                Outlook 2010:  Open Outlook, Click on File, Options, Trust Center, Trust Center settings, E-mail Security, Uncheck the top 4 boxes

Problem 2:  Receive ADTMSO.dll message after installing all needed software on Vista Premium.

Cure 2:  Purchase Vista Ultimate and upgrade your Premium (I know this seems like an expensive option, but it did work for a Soldier in New York).

Problem 3:  After installing ActivClient and opening Outlook, Receive error message:  " An extension file failed to initialize.  Can't open the file: extend.dat" 

You need to first be able to view hidden files (here's how): 

- XP:   Double click My Computer, once open, click on Tools (in the bar at the top), Folder Options, View tab, scroll down to Hidden files and folders, click the little circle next to Show hidden files and folders.

- Vista & 7:  Control Panel (classic view), select Folder Options, click the View tab, scroll down to Hidden files and folders, click the little circle next to Show hidden files and folders.

- Vista & 7: Control Panel (Control Panel Home), select Additional Options, Appearance and Personalization, Folder Options, click the View tab, scroll down to Hidden files and folders, click the little circle next to Show hidden files and folders.

Cure 3: Make sure Outlook is closed, rename extend.dat to extend.bak, restart Outlook

- XP users, go to:  C:\Documents and Settings\<userid>\Local Settings\Application Data\Microsoft\Outlook

- Vista & 7 users, go to: C:\users\<userid>\AppData\Local\Microsoft\Outlook

Problem 4: When using your Organization's OWA (Outlook Web Access) from home cannot see the email in your inbox.

Cure 4:  Go to Options, scroll down to Email Security, click on Download to download the S/MIME control

Cure 4a: Make sure you are not automatically downloading your email at your office to your local hard drive.

Problem 5:  Can't view Encrypted emails in OWA

Cure 5:  Go to Options, scroll down to Email Security, click on Download to download the S/MIME control.  You also need to have ActivClient installed on your computer.

Problem 6:  How do I access my encrypted email from my old CAC once I receive a new CAC?

Cure 6:  Visit:  https://ara-1.c3pki.chamb.disa.mil/ara/Key   You will need to logon to the server with your current CAC (this authenticates you as you).   PDF explaining how to complete this process.

Problem 7: ActivClient is prompting for a smart card (5 times) when opening Windows Mail

Cure 7:  Open ActivClient, go to Tools, Advanced, Configuration and change "Remove certificates from Windows on Smart Card removal" from "No" to "Yes."

Cure 7a: This can also happen when trying to use the Native Windows 7 smart card program.  Using ActivClient will not cause this problem (other than Cure 7 immediately above).

Problem 8:  Now that I have received a new CAC, how do I encrypt emails again in Outlook?

Cure 8:  You need to publish your new CAC certificates to the Global Address List (GAL), here's how:

                     Outlook 2007:  Tools, Trust Center..., E-mail Security, Click on Publish to GAL...(button)

                     Outlook 2003:  Tools, Options, Security (tab), Publish to GAL... (button)

                     Outlook 2010:  File (tab), Options, Trust Center, Trust Center Settings...(button), E-mail Security, Click on Publish to GAL...(button)

Problem 9:  Receive error message "You do not have a valid certificate to encrypt to the following recipients...."

Cause: It is necessary to have a copy of the recipient’s public key to encrypt email messages.

Cure / Solution: 1) Have recipient send you a digitally signed email. Right click on their name in the from line and add them to your contacts. Click Save - Close. To send an encrypted email click on New - Mail Message. Create your message. Click To, and in the Select Names window drop-down list, click Contacts. Select the recipient’s email address from Contacts. On the message toolbar, Click Options - Security Settings, and select Encrypt message contents and attachments check box. Click OK - Close. Click Send.

2) Look up the recipient at https://dod411.gds.disa.mil and download their public key to your computer. Create a contact in your contacts list for them and add the certificate to it. Follow the steps above to send encrypted email.

Problem 10:  Is there a way to adjust the size of the digital signature when signing in Word using your CAC?   We are able to digitally sign, but the signature is so large it won't fit within the borders of a standard size memo.

Cure:  Yes, look at this Word document

Problem 11:  Receiving the following error message when trying to use OWA on Windows 7:  A digital ID that allows you to sign this message is missing.

Cure:  Add your OWA URL to your Trusted Sites

Here's How:  Open Internet Explorer, Go to Tools, Internet Options, Security (tab), Trusted Sites, Sites (button), Type your entire OWA web address into the Add this website to the zone (box)  Example:  https://owa.usar.army.mil

Problem 12:  You want to be able to Digitally Sign or Encrypt emails from Outlook when using AKO, but you can't find where to add the buttons.

Cure:  When composing a new email, click on the Options tab and you will see Encrypt and Sign

PURE EDGE VIEWER

back to top

The ideas on this website are from my personal experience.  My "official" response is to send all XP & Vista users to the Army Publishing Directorate so they know about all of the problems with this program.  You can call:  703-428-0545 or email: apdfcmp@conus.army.mil  (If you are using Windows 7, they will NOT help you), you will have to try my ideas.

1.  Problem:  The word Sign is "GRAYED OUT" when attempting to digitally sign a Pure Edge form.

Cure:  See answers in THE WORD SIGN IS GRAY section below.

2.  Problem:  "One or more signatures could not be verified" when opening up Pure Edge

Cure:  Verify you have ApproveIt installed.

Cure1:  Restart your computer (if you have just installed ApproveIt)

Cure2:  Copy and paste libeay32.dll from C:\Program Files\ApproveIt to the following folders: 

C:\Program Files\PureEdge\Viewer6.5\extensions 

and to: 

C:\Program Files\PureEdge\Viewer6.5\API\65\System   PDF with complete instructions

Cure3:  Latest DoD Certificates are needed

Cure4:  Uninstall ApproveIt 5.8.2, 5.9, or 6.1,  restart computer, Install ApproveIt 5.7.3.  Follow instructions below. 

PLEASE NOTE:  ApproveIt 6.1 is the only one that will work with Lotus Forms.

3.  Problem:  Digital Signature not loading

Cure:  Visit here

Cure2:  Uninstall ApproveIt 5.8.2, 5.9, or 6.1,  restart computer, Install ApproveIt 5.7.3.  Follow instructions below. 

PLEASE NOTE:  ApproveIt 6.1 is the only one that will work with Lotus Forms.

4.  Problem:  Receiving internal error when opening Pure Edge.  Details show "Null pointer dereferenced (in function RegistryIterator::updateCurrent()@.\src\RegistryProfile.cpp:line531)  Stack trace (unavailable)

Cure:  Run this batch file to fix your computer.  If IE blocked the file, download this text file and remove the .txt at the end, then run.

Cure2:  The following steps need to be completed while the affected user is logged in.  Since they are merely modifying the keys corresponding with their user hive, elevated privileges are not necessary.

1. Go to Start, Run, type in:  Regedit

2. Find [HKEY_CURRENT_USER\Software\VB and VBA Program Settings] and delete the entire key.

3. Click Start - Programs - ApproveIT Desktop - ApproveIT Configuration.

4. On the default Signature Method tab ensure the option "Sign using a certificate or smart card" is checked.

5. Click OK and test.

Cure3:  Copy and paste libeay32.dll from C:\Program Files\ApproveIt to the following folders:  C:\Program Files\PureEdge\Viewer6.5\extensions  and to:  C:\Program Files\PureEdge\Viewer6.5\API\65\System   PDF with complete instructions

Cure4:  Go to Start, Run

Type "regedit" (without the quotations)

Navigate to "HKEY_CURRENT_USER\Software\Silanis and delete it

Navigate to "HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ApproveIt MS Office" and delete it

Go to Start, All Programs, Startup, ApproveIt StartUp and click the ApproveIt Start up entry to start ApproveIt

5. Problem:  "Pure Edge Viewer has encountered a problem and needs to close.  We are sorry for the inconvenience."

Cure:  Copy "libeay32.dll" from the following location:  "C:\Program Files\ApproveIt"

Paste the files into both of the following locations:  "C:\Program Files\PureEdge\Viewer 6.5\API\65\System" and "C:\Program Files\PureEdge\Viewer 6.5\extensions" 

Reason:  These files can get written over by some Microsoft Updates.  Pure Edge cannot use the newer files that were installed by Microsoft.

6. Problem: Receive the following error "Form API initialization Failed"

Cure:  Reinstall Pure Edge

7. Problem:  Receive ePersona message when trying to sign a form in Pure Edge with Approve It.

Cure:  Close PureEdge (if it is open).  Go to: C:\Program Files\ApproveIt\, double-click the icon that looks like a wrench titled: "AprvCfg.exe".  On the Signature Method tab, make sure the radio button is on the bottom choice - "Sign using a certificate or smart card."  Don't change anything else.  Click Apply, then OK

After you click "Sign" in PureEdge, it may take a few minutes for the list of certificates to pop up. Be patient. Choose the certificate that doesn't say Email, and put a check in the box that says "Use this certificate as default" (if this is your personal computer).

8.  Problem:  Receive " MUCreateDir(\Anthill_Build\Branch-API-Cannae-20050228\Api\src\masqutil\masqutil.c:10427 Tue Apr 19 21:59:46 2005):2696:32-> 22"

Cure: Try the same Cure as Problem #5 above

Cure2:  Read the Tech notes on IBM

Cure3:  If you are using Vista and the errors happened after macrovision, this is the fix.

Logon as an administrator (i.e. using your SA account) instead of right clicking and choosing "run as"(do not choose).

Open PureEdge to make sure it is running fine(if macrovision hasnt been installed already).

Install macrovision if not yet installed.

If you are unsure it has been installed, go ahead and run it and it will ask you to modify, repair, or uninstall. Uninstall it and reboot, then you can install it again.

Open PureEdge to see if it has the errors.

Go into regedit follow this path;

HKCU\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData

Before you install macrovision AppData key is:

C:\Users\**USER.NAME**\AppData\Roaming

After you install it, nothing will be in its place so you can copy the above key from another key ONLY  to roaming.

After, open PureEdge and and check to see if the errors were fixed.

Cure4:  Uninstall ApproveIt 5.8.2, 5.9, or 6.1,  restart computer, Install ApproveIt 5.7.3.  Follow instructions below.  

PLEASE NOTE:  ApproveIt 6.1 is the only version that will work with Lotus Forms.

9. Problem:  Pure Edge bar stalls half way across the screen when attempting to load a form

Cure:  Reinstall the DoD certificates & ApproveIt try to access your form again.

Cure2:  Create a new profile and install Lotus Forms and ApproveIt from this new profile. 

10. Problem:  "Unable to complete the signature; the private key cannot be found or is inaccessible on the system.  Make sure you are using a good signing key or the right smart card."

Cure:   Look at ApproveIt Problem 4 above.

11. Problem:  Receive "Internal function call failed. at IFSObject_RegisterClass(\Anthill_Build/Branch-API-Cannae-20050228\Api\src\ifx\IFSObject.c:1997 Tue Mar 15 12:04:02 2005):2788"

Cure:  Uninstall ApproveIt 5.8.2, 5.9, or 6.1,  restart computer, Install ApproveIt 5.7.3.  Follow instructions below. 

PLEASE NOTE:  ApproveIt 6.1 is the only version that will work with Lotus Forms.

Cure2:  You can also try items listed at #9 above  or #5 in the LOTUS section

12. Problem:  If you receive an ePersona message, or "Add digital ID" with the choice of, I want to sign this document using? 

Cure:  Visit the Notes page to find out how to correct this.

13. Problem:  Unable to print forms from Pure Edge Viewer in Vista & Windows 7 64 bit systems with HP printers.  (Receive an error similar to:  Viewer : Printer Driver's EndPage() Failed at PRINT ERROR(.\src\FormViewer\PrintEngine\CPrintEngine.cpp:1960 Fri Jan 29 15:27:50 2010):2780:8) )

Cure:  Download a program like DoPDF, print your form to a PDF, then print on your printer

Cure2:  Open Pure Edge, Select Preferences, Printing options, Uncheck "Print each page as a separate print job"

VISTA / Windows 7 UAC (USER ACCESS CONTROL)

back to top

1.  Problem: A fix to one of Windows Vista & 7's most annoying features (in my opinion)

Cure:  Visit How-To-Geek for easy screen shot views (I prefer this method)

Cure2:  Video on Chris.Pirillo.com

Cure3:  User Access Control message.  Here is a registry hack to turn User Access Control off (right click, save target as on DisableUACforAdmin.reg), then double click it.  You will not have to enter the registry with this small .reg file as it will automatically change the location in the registry for those of you who are uncomfortable working in the registry.  I use this registry hack on my Windows Vista computers and do not get the annoying message saying that I'm not safe.   If you feel you should have it after turning it off, here is another .reg file to re-enable the UAC (right click, save target as on Re-EnableUACforAdmin..), then double click it.

OTHER MISC ERROR MESSAGES

back to top

1.  Problem:  The system could not log you on.  "The requested key container does not exist on the smart card."

Cure:  Have someone else log onto the same computer, double click ActivClient, Click on Tools, Advanced, Forget State for all cards.  This "other" person does NOT have to be an administrator.

Cure2:  Visit Google Groups for another possible solution

2.  Problem:   "Unable to sign using a certificate; there are no valid signing certificates available on the system.  Please select a different signing method and try again.  The Signature could not be created because the private key of the certificate could not be accessed." error.

Cure:  Latest DoD Certificates are needed, I have instructions where you can download them here

Cure2:  Make sure you have restarted the computer after installing ApproveIt

Cure3:  Make sure ActivClient is installed

Cure4:  Verify your CAC is not expired.  If so, you will need to visit an ID card office to get a new CAC.

Cure5:  Follow this guide for modifying the ApproveIt install

Cure6:  Uninstall ApproveIt 5.8.2, 5.9, or 6.1,  restart computer, Install ApproveIt 5.7.3.  (Only on XP and Vista systems)  Follow instructions below.  PLEASE NOTE:  ApproveIt 6.1 is the only version that will work with Lotus Forms.

Cure7:  Create a new profile and install Lotus Forms and ApproveIt from this new profile. 

3.  Problem:  Unable to install the DoD Certificates, or you keep getting "Unable to sign using a certificate; there are no valid signing certificates available on the system."

Cure:  Create a second profile and install DoD Certificates from the new profile.

Cure2:  Follow this guide

4.  Problem:  "The signature could not be created because the private key of the certificate could not be accessed"

Cure:  Look at #2 above

5.  Problem:  "The specified CSP doesn't contain any unexpired digital signature certificates matching your certificate filter (see Advanced Preferences)."

Cure:  Restart Computer after installing Approve It (multiple restarts might be required).

Cure2:  For Pure Edge users:  Open Preferences, Advanced (tab), clear all contents out of the Digital Certificate Identity Filter box, Path to Netscape profile, and uncheck the Check CRL distribution points box.

Cure3: Uninstall ApproveIt 5.8.2, 5.9, or 6.1,  restart computer, Install ApproveIt 5.7.3.  Follow instructions below.  PLEASE NOTE:  ApproveIt 6.1 is the only one that will work with Lotus Forms.

Cure4:  Follow the instructions located here to clear old Certificates out of the browser.

Cure5: Create a new profile on your computer and install ApproveIT from the new profile.  Make sure you uninstall it first from your current profile, restart computer before reinstalling.

6.  Problem:  Receive a "MASQFORM.exe" error when using PureEdge

Cure:  Copy and paste libeay32.dll from C:\Program Files\ApproveIt to the following folders:  C:\Program Files\PureEdge\Viewer6.5\extensions  and to:  C:\Program Files\PureEdge\Viewer6.5\API\65\System   PDF with full instructions

7.  Problem:  Receive "Unable to install Microsoft visual C++ 2005 Redistributable Package.  Contact your IT support" error when installing ActivClient 6.1

Cure:  Re-Extract the files and run again. 

8. Problem:  Receive the following error "An installation support file could not be installed.  The system cannot find the file specified."

Cure:  After performing the uninstall / reinstall steps and you still get the error message.  Try the following:

Go to Start, Run and enter 'regedit' and delete the following key.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

{E00000650-0650-0650-0650-000000000650}

This will remove the entry for the 6.5 Viewer in the Add/Remove programs list.

Following this, they should run the installer with Administrative privileges. 

9. Problem:  Receive the following error "Please enter the master password for the ActivIdentity ActivClient 0."

Cure:  You are getting this error because you are trying to use Firefox and your CAC.

You have 2 options, first is to switch over to Internet Explorer for any websites you need to use your CAC.  Second option is to visit the Firefox support page and attempt to get your Firefox working using the instructions.
 
NOTE:  I personally have tried several times to get my Firefox to work on all of my computers.  I've not had the luck that other people have had. So, I stick with IE for anything CAC related.

10. Problem:  Receive "Error 1324.  The path <insert file name here>  contains an invalid character."

Cure:  This article should be able to assist you.  http://windowsxp.mvps.org/usershellfolders.htm

Cure2:  Consider building a new profile and do the install / uninstall from the new profile.

11.  Problem:  Receive "Internal Error 2753"

Information:  The Microsoft Windows error "Internal Error 2753" is related to a Windows Installer failure. If this error is popping up as a prompt on your Windows operating system, you will not be able to install applications on your system. Thankfully, there is an easy fix for this problem that you can perform using your computer's DOS prompt.

Cure: 1.  Click on the "Windows Start" button. Windows XP Users click on "Run," then type "CMD" in the run box and click the "Go" button. This will bring up the DOS command window. Vista & Windows 7 users type "CMD" in the Start Search box (it will pop up on the list, simply hit <enter>.  You can also navigate to it by clicking on the Start bubble, go to "All Programs," "Accessories" and choose "Command Prompt," and the DOS window will appear.

2.  Type "regsvr32 vbscript.dll" without the quotation marks and with a space in between 32 and vbscript, press <Enter>

3.  You should now see the message "DllRegisterServer in vbscript.dll succeeded," if this message appears, the required files for the installer have now been successfully registered, and you should be able to install your apps.

4.  Click on the installer file for your application and see if the error appears again. If the installation begins, the files are now properly registered. Repeat the process one more time if the installation still gives the Error 2753 message.

12.  Problem: Certificate box comes up empty when trying to access a secure webpage.

Cure: Latest DoD Certificates are needed, instructions are here

13. Problem:  Receive error message:  "Local policy does not allow you to log on interactively." 

Cure:  Latest DoD Certificates are needed, instructions are here   

CURRENT PROBLEMS WITH NO KNOWN RESOLUTION

Please continue to check back later to see if a cure has been found

If you've found a cure for this, please contact me

Problem:  Unable to complete operation; an ApproveIt component (ApproveItFrameworkResource.dll) is missing or corrupt.  Please repair your ApproveIt Installation and try again.

Problem:  A digital ID that allows you to sign this message is missing.  This seems to only be happening on Windows 7 (64bit), it does not affect XP, Vista (32 or 64bit), or Windows 7 (32bit).

OTHER QUESTIONS

back to top

1.  Question:  How can I set up my personal computer to be able to login with my CAC (like my government computer)?

Answer:  From what I've been able to figure out over the years, you will need a Domain Controller running smart card authentication.  This way you can put the correct settings in your user accounts that will tell your computer through Group Policy that it has to use a CAC to be able to logon to it. 

More information:  Unless your computer is joined to the domain/forest from which the card was issued, you can't use the card for logon.  Smart card logon to a Windows system requires Kerberos authentication and in a work group environment you don't have or use Kerberos.   Your computer would have to be connected to the DoD domain for the initial logon at which time the logon credentials are cached. You would then be able to logon without a connection to the DoD network.  Your home computer is not joined to one of the DoD domains, so you'll never be able to use your CAC for login.

My personal thoughts:  It is not worth the money to have to set up your own domain controller server at your house for one computer to be able to logon to a personal laptop with a CAC.  I would not want that either because I only have 1 CAC, and I am using 2 computers at a time almost all of the time.  So, one is using my CAC (my work computer) and the other is a normal logon and password.

If you figure out a way of doing this without the need of a domain controller, please contact me or [better yet], send me documentation how you did it, since I get this question every once in a while.  I'll gladly publish it on this website.

2. Question:  Are Individual Ready Reserve (IRR) Soldiers eligible for a Common Access Card (CAC)?

Answer:  IRR Soldiers are issued the Armed Forces of the United States Geneva Conventions Identification Card (Reserve) (Green). If on active duty orders for 31 days or longer the IRR Soldier can get a CAC.

Members being released from active duty with a Military Service Obligation (MSO) are part of the IRR and will be issued the green Reserve ID cards.

2a. Question:  Are retirees and family members eligible for a Common Access Card (CAC)?

3.  Question:  My PBUSE worked the other day, now it does not work anymore.

Information: Changes were recently made to the PBUSE Enterprise configuration to increase SSL encryption security, per DoD requirements.  These changes are needed to support the upcoming System Accreditation.

Answer:   Users accessing PBUSE using a Tier I built system are not impacted.   For users using a non-issued PBUSE work station configuration, you must change the web browser settings in order to access PBUSE.  Click on this link to read the instructions on how to change your computer's Security Settings.  These actually mirror the same settings shown at the AKO Solutions page #4

THE WORD SIGN IS GRAY

back to top

The ideas on this website are from my personal experience.  My "official" response is to send all XP & Vista users to the Army Publishing Directorate so they know about all of the problems with this program.  You can call:  703-428-0545 or email: apdfcmp@conus.army.mil  (If you are using Windows 7, they will NOT help you), you will have to try my ideas.

1.  Problem:  Unable to sign forms because the Sign box stays gray (even after downloading the latest DoD Certificates following the instructions on the DoD Certs page). 

Cure1:  Verify that you do have ActivClient & ApproveIt installed AND the computer has been restarted.

Cure2:  Verify that you installed ApproveIt AFTER Lotus Forms or PureEdge, if not, uninstall ApproveIt, restart computer, install again, then restart one more time.

Cure3:  Try signing this form.  If you can, then your software is installed correctly.  This is common when using MyForms and the form was routed to you as a copy instead of as an original.  When this happens, you cannot sign the form.  You HAVE to have the form routed to you as an original, if not you will not be able to sign it.  You can verify if this is the problem by clicking on this sample form and attempt to sign any of the 3 possible places at the bottom of this form.  If your digital signature works there, you know what to do now.

Cure4: If you have recently updated to Lotus Forms, please look above

Cure5:  The DA 4651 [is one form] that IF signed out of order will make the word Sign gray for all signatures above the one already signed.

Cure6:  Follow these instructions provided by the US Army Publishing Directorate

Cure7: Follow these instructions provided by LTC Wilkinson

Cure8:  If you are using ApproveIt 6.1, try restarting your computer first and retesting before trying Cure9

Cure9:  Uninstall Approve It 5.8.2, 5.9, or 6.1, Install ApproveIt 5.7.3   (Using Instructions below).  PLEASE NOTE:  ApproveIt 6.1 is the only version that will work with Lotus Forms, so this option is not available with Lotus Forms.

Downloading ApproveIt 5.7.3:  Visit  https://www.us.army.mil/suite/folder/14339407  you will be auto approved once you authenticate with your AKO account. Download the file titled:  ApproveIt 5.7.3.zip Very important to follow Instructions below  (NOTE:  If you are using Lotus Forms, only ApproveIt 6.1 will work, all older versions will not).

Instructions:  Once at the Approve It 5.7.3 download link, save the file to your computer.  Uninstall Approve It 5.8.2, 5.9, or 6.1 And delete the ApproveIt folder (located at C:\ProgramFiles\) or C:\ProgramFiles(x86) on a 64 bit system, then restart your computer (make sure the download is complete first).  Once restarted, Right click the zip file and select EXTRACT.  After extracting, select the setup.exe (if you don't see the extensions, it will be the one that is 56KB in size) from the folder it just made.  Give it about 2-3 minutes, verify the installation by going to Add/Remove Programs (XP), or Programs and Features (Vista & 7).  Once you see Approve It 5.7.3 listed, restart your computer.  It should work fine now.