Houston Security User Group

 View Only
Expand all | Collapse all

Admin User Name or Password Is Incorrect

dsmith1954

dsmith1954Jul 09, 2012 09:05 AM

  • 1.  Admin User Name or Password Is Incorrect

    Posted Jul 02, 2012 12:43 PM

    I'm logged in to the SEPM console. I click Admin and then Servers. The log at the bottom of the page shows several entries for this error every two minutes: "The administrator's user name or password is incorrect. Type a valid user name or password. [Site: Sitename] [Server: SEPMServerName]"

    I'm logged on with the SEPM default admin account, so I know it isn't that account. AD Sync is enabled, but not for this account. I checked all the Directory Server information for all of the domains listed, and they are all correct. Sync w/AD is set for every 24 hours, so I don't have a clue as to what is causing the errors.

    These SEPM errors aren't very helpful, other to say that there is a problem. SEPM Event Log in Windows shows nothing. However, the Security Event log shows that there was an attempt to do credential validation on the admin account and failed with error code 0xc0000064. And, at the same time, it logs on the admin account and runs:

    \Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin\SysUtil.exe

    I can't seem to find anything about this error when I search Connect.



  • 2.  RE: Admin User Name or Password Is Incorrect

    Posted Jul 02, 2012 12:53 PM

    When an alert is triggered, it looks like a batch or executable file is set to run. Check for this under your alerts. You should see the below option checked on one or more of them:

     



  • 3.  RE: Admin User Name or Password Is Incorrect

    Trusted Advisor
    Posted Jul 02, 2012 01:41 PM

    Hello,

    Is there any Replication set?

    Check these Articles:

    Unusual log entries and connection failures when replicating sites after upgrading to Symantec Endpoint Protection 12.1

    http://www.symantec.com/docs/TECH161475

    Unable to add re-add replication partner using Active Directory/LDAP administrator

    http://www.symantec.com/docs/TECH164880

    Hope that helps!!

     



  • 4.  RE: Admin User Name or Password Is Incorrect

    Posted Jul 02, 2012 02:02 PM

    No replication. Single server, v12.1 RU1 MP1. db is on a different server.



  • 5.  RE: Admin User Name or Password Is Incorrect

    Posted Jul 02, 2012 02:07 PM

    Not sure what this has to do with getting login failures in the Admin section, but I checked anyway. None of our notifications run batch/executibles, and those selections are all unchecked.



  • 6.  RE: Admin User Name or Password Is Incorrect

    Trusted Advisor
    Posted Jul 02, 2012 02:31 PM

    Hello,

    Could you check if there are 2 Domains with the same SEPM?

    SEPM > Admin > Domains

    Also, could you Run the Management Server Configuration Wizard and check if the database is properly set with SEPM.

    Hope that helps!!



  • 7.  RE: Admin User Name or Password Is Incorrect

    Posted Jul 02, 2012 02:47 PM

    Yes, there is more than one domain setup in SEPM.

    The database is setup properly or I wouldn't be able to manuever around the console. I can also see that on the Servers tab.

    I checked SQL Reporting Services also, and they are working - the Home page in SEPM shows up and refreshes.

    Since this thing runs on Apache, I decided to re-start the SEPM Webserver service, which in turn restarted the SEPM service. I thought that did it. I had been error free for over 15 minutes, and then they started up again.

    10 errors per minute... At least that's all that shows in SEPM



  • 8.  RE: Admin User Name or Password Is Incorrect

    Posted Jul 03, 2012 07:39 AM

    Check in Monitors > Logs > System Logs to see if you can get more details about these connection issues (who, when, where).

    Second step would be to disable anything that requires authentifications (notifications, scheduled reports) and see if it helps. You might need to check as well if the account used to connect to AD is still correct and password did not change.

    Then, please double-check with your colleagues if some of them may try to authenticate via Web or remote Java console.

    Finally, I would suggest you to collect logs and open case with Symantec Support for deeper analysis.

     



  • 9.  RE: Admin User Name or Password Is Incorrect

    Posted Jul 04, 2012 02:16 AM

    Hi,

    Try to repair the SEPM or upgrade the new version of SEPM



  • 10.  RE: Admin User Name or Password Is Incorrect

    Posted Jul 09, 2012 09:04 AM

    Nothing in the logs about failed logins - anywhere.

    No scheduled reports require authentication. They all run under the service account.

    Service Account still works - I can get into the SEPM console, and the service is running.

    None of the administrators have a failed login attempt showing in SEPM.

    Opening a case with support is such a pain, but it looks like I'll need to do that to get rid of the errors.



  • 11.  RE: Admin User Name or Password Is Incorrect

    Posted Jul 09, 2012 09:05 AM

    SEPM is the latest version already.



  • 12.  RE: Admin User Name or Password Is Incorrect

    Posted Aug 07, 2012 09:13 AM

    Still getting this error. System logs showed nothing, but then I checked Server Activity logs and found this:

    com.sygate.scm.server.util.ServerException: The administrator's user name or password is incorrect. Type a valid user name or password. at com.sygate.scm.server.task.ScheduledReportingHelper.doReportingLogin(ScheduledReportingHelper.java:508) at com.sygate.scm.server.task.ScheduledReportingTask.execute(ScheduledReportingTask.java:246) at com.sygate.scm.server.task.MonitoredTimerTask.run(MonitoredTimerTask.java:22) at java.util.TimerThread.mainLoop(Timer.java:512) at java.util.TimerThread.run(Timer.java:462)

    The mention about ScheduledReportingTask reminds me that I haven't received a scheduled report in a while. Hasn't been high on my priority list, so I haven't checked on it.

    I can run Quick Reports reports, but Scheduled Reports do not run. I would think that they run under the same service account, but don't know for sure.

    I've created a new Scheduled Report to run in 5 minutes. We'll see if I have to re-create all scheduled reports...

     



  • 13.  RE: Admin User Name or Password Is Incorrect

    Posted Aug 07, 2012 08:42 PM

    Have you tried this:

    c:\Program Files\Symantec\Symantec Endpoint Protection Manager\Tools\resetpass.bat

    to reset the password ?



  • 14.  RE: Admin User Name or Password Is Incorrect

    Posted Aug 09, 2012 08:37 AM

    resetpass.bat doesn't exist. Maybe they removed it in 12.1 RU1 MP1?



  • 15.  RE: Admin User Name or Password Is Incorrect

    Posted Aug 09, 2012 08:52 AM

    Still there. Try:

    C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Tools



  • 16.  RE: Admin User Name or Password Is Incorrect

    Posted Aug 09, 2012 10:00 AM

    That folder doesn't exist. I installed to the D: drive but resetpass.bat doesn't exist on either C: or D: in any folder.

    At any rate, the admin password isn't the problem. Running scheduled reports is the problem. Quick Reports run fine. Home page displays correctly. Monitors page displays correctly. All of those use SQL Server Reporting Services to display information.

    Checking the details of this error in the System:Server Activity logs shows the following message:

     

    Event type:
    Event description:
    Error message:
    Error code:
    Stack trace:

     Maybe my upgrade went bad?



  • 17.  RE: Admin User Name or Password Is Incorrect
    Best Answer

    Posted Aug 09, 2012 10:53 AM

    Finally called Support. Ugh! First line was useless. Second level actually solved the issue.

    The problem was with the host file on the server. Even though it hasn't been modified in 2 years, there was an entry for the IP address of the server, and the ::1 address, in addition to the 127.0.0.1. Once I removed the IP address and ::1 address, scheduled reports started flowing.



  • 18.  RE: Admin User Name or Password Is Incorrect

    Posted Aug 10, 2012 03:59 AM

    Yes it is still there, please try it and let me know how you go ?

    [please remove the -1 mark for the reply it looks bad on my post]



  • 19.  RE: Admin User Name or Password Is Incorrect

    Posted Aug 10, 2012 04:00 AM

    ok, so the SEP v 12.1 must not have IPv6 reference or feature enabled at all ?



  • 20.  RE: Admin User Name or Password Is Incorrect

    Posted Aug 10, 2012 08:20 AM

    IPv6 is turned off on all of our servers when they install it. It's in the image like that. If your network doesn't run IPv6, then there's no need to have it turned on. It doesn't get you anything.



  • 21.  RE: Admin User Name or Password Is Incorrect

    Posted Aug 10, 2012 08:21 AM

    And, it slows down applications that don't know how to deal with IPv6.



  • 22.  RE: Admin User Name or Password Is Incorrect

    Posted Aug 14, 2012 09:17 AM

    Thanks for the feedback Smith, yes you are right in this case.