Error: "You either have insufficient permissions to access this application or your user credentials are not refreshed." when attempting to open the Symantec Mail Security for Microsoft Exchange (SMSMSE) when CMAF permissions not set correctly

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

When you try to use the console SMSMSE the following message appears and the console does not open:

You either have insufficient permissions to access this application or your user credentials are not refreshed. Try logging off and logging in again to reload the user credentials.

Conditions

• Windows account logged in is either a member of the SMSMSE Admins or SMSMSE Viewers group.

1. On the Windows task bar of a Domain Controller, click Start > All Programs > Administrative Tools > Active Directory Users and Computers.
2. Right-click the user for which you need to change permissions, and then click Properties.
3. In the Properties window, on the Members Of tab, verify SMSMSE Admins or SMSMSE Viewers is in the list, if neither are there, add the appropriate group for the permissions you would like to grant this user.
4. Click OK.
5. Click OK. 

• The SMSMSE CMAF directory does not have SMSMSE Admins and SMSMSE Viewers as Security permissions .

1. On the SMSMSE console computer open Windows Explorer to the following folder (default location):

32-bit system: C:\Program Files\Symantec\CMaF
64-bit system: C:\Program Files (x86)\Symantec\CMaF
 

2. Right click the 2.0 folder (or other version number) and select Properties.
3. Select the Security tab.  If the groups SMSMSE Admins and SMSMSE Viewers are not present then this condition is met.

 

• Running a Microsoft procmon log shows an Access Denied to the CMAF directory:

24:44.7    Symantec.Cmaf.UI.exe    9912    CreateFile    C:\Program Files (x86)\Symantec\CMaF\2.1\SMSMSEUITraceOutput.log    ACCESS DENIED    Desired Access: Generic Write, Read Attributes, Disposition: OpenIf, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: n/a, ShareMode: Read, AllocationSize: 0

Cause

SMSMSE installer is not adding SMSMSE groups to the CMAF permissions.

Resolution

This issue is fixed in SMSMSE 6.5.8.

Workaround

Add security permissions manually.

1. On the SMSMSE console computer open Windows Explorer to the following folder (default location):

32-bit system: C:\Program Files\Symantec\CMaF
64-bit system: C:\Program Files (x86)\Symantec\CMaF
Windows 7: C:\Program Files\Symantec\CMaF
 

2. Right click the 2.0 folder (or other version number) and select Properties.
3. Select the Security tab and click the Edit... button which shows the Permissions dialog box.
4. Click the Add... button to display the Select Users, Computers, Service Accounts, or Groups dialog box.
5. Enter the following to the Enter the object names to select textbox:

SMSMSE Admins
SMSMSE Viewers

6. Click the OK button to close the Select Users, Computers, Service Accounts, or Groups dialog box.
7. Click the SMSMSE Admins username in the listbox and click the Full Control checkbox in the Allow column in the Permissions area.
8. Click the SMSMSE Viewers username in the listbox and click the Full Control checkbox in the Allow column in the Permissions area.
9. Click the OK button to close the Permissions dialog box.
10. Click the OK button to close the Properties dialog box.

Log off and log on again to use the SMSMSE console.