Error: "...services require user rights" or "...cannot read the user rights" during installation or configuration
search cancel

Error: "...services require user rights" or "...cannot read the user rights" during installation or configuration

book

Article ID: 161826

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

During the installation or configuration of Symantec Endpoint Protection Manager (SEPM), you see a warning that indicates that the appropriate user rights are not assigned to Endpoint Protection Manager services. 

 

You see one of the following warning messages:

Note: While the services for Endpoint Protection Manager might run at startup, it is only a temporary state until the domain policies are enforced.

Warning #1

Warning #2
Symantec Endpoint Protection Manager services require user rights in Windows security policies. The management console cannot run until you assign user rights to the services in the specified policies: Symantec Endpoint Protection Manager cannot read the user rights that are specified in the Windows Security Policies on this computer. The management console cannot run if user rights are not assigned to Symantec Endpoint Protection Manager services.
This message either contains the user rights that the required services do not have, and the policies that do not have the rights, or you can click Show Details for this information.

You have options to correct policies and try again, cancel the installation, or continue with the warnings present.

For new installations, another message appears advising you that based on the type of database you subsequently choose additional user rights may be required.		 You have options to continue or cancel the installation.
Example of message seen during installation (click to enlarge):
Missing rights during installation

(The highlighted text appears only during a new installation.)		 Cannot read rights during installation
Example of message seen after configuration (click to enlarge):
Missing rights after configuration Cannot read rights after configuration
Example of message seen after upgrade (click to enlarge):
Missing rights after upgrade Cannot read rights after upgrade

Cause

The Endpoint Protection Manager installer automatically adds the required rights to local security policies. However, if the computer that hosts Endpoint Protection Manager is a part of a domain, then domain policies override local policies. See Related Articles for more information on group policy precedence.

The alert during installation indicates that domain policies are enforcing the privileges from the domain controller and do not contain the required user rights for Endpoint Protection Manager. The Endpoint Protection Manager installer cannot assign user rights to domain security policies. Therefore, you must take manual action.

The following table summarizes Endpoint Protection Manager's security policy requirements for Windows Server 2008 / Windows 7 or later:

SEPM Configuration User Right Services to be added

SEPM with
embedded database

*12.1.x - 14.3 MP1

 Logon as Service
(SeServiceLogonRight)		 NT SERVICE\semsrv
NT SERVICE\semwebsrv
NT SERVICE\SQLANYs_sem5
NT SERVICE\semapisrv *

SEPM with Default SQL Express Server database

*14.3 RU1 and later

Logon as Service
(SeServiceLogonRight)

 NT SERVICE\semsrv
NT SERVICE\semwebsrv
NT SERVICE\MSSQL$SQLEXPRESSSYMC
NT SERVICE\semapisrv *
SEPM with Microsoft SQL
Server database; SQL authentication		 Logon as Service
(SeServiceLogonRight)		 NT SERVICE\semsrv
NT SERVICE\semwebsrv
NT SERVICE\semapisrv *
SEPM with Microsoft SQL
Server database; Windows authentication		 Logon as Service
(SeServiceLogonRight)		 NT SERVICE\semsrv
NT SERVICE\semwebsrv
NT SERVICE\semapisrv *
Replace a Process Level Token
(SeAssignPrimaryTokenPrivilege)		 NT SERVICE\semwebsrv

* indicates the service was added for version 14.

Endpoint Protection Manager services on operating systems earlier than Windows Server 2008 R2 / Windows 7 use the Network Service, for which default domain policies include privileges. You should ensure that any security policies used on the Endpoint Protection Manager computer do not have the Network Service removed.

Note: These accounts need to be present only if you have defined any of the user rights in the policies. If any of the user rights are in a "Not Defined" state, you do not have to explicitly enable them or add Endpoint Protection Manager accounts. If you have not defined any user right, Endpoint Protection Manager will not include that user right in the alert.

Resolution

Warning #1: "...services require user rights in Windows security policies..."

This warning message indicates that domain group policy objects (GPOs) are restricting which rights are assigned to virtual service accounts.

To learn more see If user rights are missing.

Warning #2: "...cannot read the user rights that are specified..."

This warning message indicates that the installer may not be able to determine whether the correct rights are assigned to virtual service accounts in domain GPOs.

To learn more see If user rights cannot be determined.

Note: You must be a domain administrator, or coordinate with your domain administrator, to make changes to the affected domain GPOs.

If you are upgrading Endpoint Protection Manager from a previous version, the warning might prompt you to add Endpoint Protection Manager services to policies. Click Try Again to review the policies again during the installation.

You must log in as a domain administrator to use this option. If you do not log in as a domain administrator, you can either cancel the installation and log back in with domain administrator credentials, or you can continue with the installation and update the policies after the upgrade is completed.

To perform some of the steps below, you must install Group Policy Management Console (GPMC) on the machine where you install Endpoint Protection Manager. For more information see, Install the GPMC on Microsoft.com.

If user rights are missing

Perform the following tasks to successfully complete the Endpoint Protection Manager installation:

  1. Identify the service accounts, user rights assignments, and domain GPOs you need to modify
  2. Change the domain policies and propagate them to the computer
  3. Recheck the policies or restart the services for Endpoint Protection Manager

There will be additional log entries in one of the following log locations depending on when the warning message appears:

  • New installations: %temp%\windowspolicyreviewer.log
    Note: if you do not see the log file in this folder, search for the log file by name.
  • Configuration wizard: SEPM_Installation_Folder\tomcat\logs\install_log.out
  • Upgrade wizard: SEPM_Installation_Folder\tomcat\logs\Upgrade-0.log

SEPM_Installation_Folder represents the installation folder for Endpoint Protection Manager. By default, this folder is C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager (64-bit operating system) or C:\Program Files\Symantec\Symantec Endpoint Protection Manager (32-bit operating system).
 

I. Identify the service accounts, user rights assignments, and domain GPOs you need to modify

From the alert message, make note of the missing service accounts. With the alert window active, press Control-C to copy the text of the message, which you can then paste it into a document. If you encounter this message in the configuration wizard or the upgrade wizard, click Show Details to get more information.

  • The virtual service accounts
  • The domain GPOs
  • The user rights assignments required

For example, the alert message may read:

Group policy setting SeServiceLogonRight in 'New Group Policy Object-testB' does not contain [NT SERVICE\semsrv, NT SERVICE\semwebsrv, NT SERVICE\SQLANYs_sem5, NT SERVICE\semapisrv]

Note: In this example, the user rights appear in green, the domain GPOs in blue, and the virtual service accounts in red.

The required user rights are as follows:

  • SeAssignPrimaryTokenPrivilege (Replace a process level token): Required by NT SERVICE\semwebsrv only while installing Endpoint Protection Manager with a Microsoft SQL Server database using Windows authentication.
  • SeServiceLogonRight (Logon as a service): Required by all services. (NT SERVICE\SQLANYs_sem5 is not required if you install Endpoint Protection Manager with a Microsoft SQL Server database.)

You must ensure that for the GPOs listed, all of the accounts listed are present in all of the user rights assignments mentioned. For new installations, you can refer to the table above for more information about required rights needed for either database type to avoid additional warnings after configuration.
 

II. Update the domain policies and propagate them to the computer

Note: When you install Endpoint Protection Manager for the first time, its services are not yet present on the computer. Therefore, virtual accounts that correspond to Endpoint Protection Manager services are not active yet. For a new installation, you can click Continue in the alert that appears during installation. Another warning appears at the end of the configuration wizard, so you can update domain policies using the steps below after configuration finishes.

Make the appropriate changes to the necessary domain GPOs with the Group Policy Management Console on your Active Directory server, or work with your domain administrator to make these changes. See Create and Edit a Group Policy Object on Microsoft.com to learn how to edit group policies.

To update the domain policy, follow these steps:

Note: These steps are for the Windows Server 2012 Server Manager. Other versions of Windows may vary slightly.

  1. Open Group Policy Management Console (GPMC).
  2. Locate the policy name mentioned in the alert box.
    Typically, it appears under the node Group Policy Objects, under your domain tree.
     
     
     
  3. Right-click the policy, and then click Edit to open the Group Policy Editor for this policy. 
  4. Browse to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
    This lists all of the user assignments.
     

     
  5. Locate the user rights mentioned in the alert, and add the accounts mentioned in the alert.
    These accounts are created locally on the Endpoint Protection Manager computer after configuration or upgrade finishes. However, they are virtual service accounts without predetermined SIDs, so you can add them to domain GPOs before they are created on the Endpoint Protection Manager computer.
     

     
  6. Click OK.
    Note: After you update domain policies, ensure that the Endpoint Protection Manager computer receives and applies them.
  7. On the Endpoint Protection Manager computer, open an elevated command prompt (run cmd.exe as Administrator), and enter the following command:

    gpupdate /force

    This command refreshes all domain policies on this computer.
  8. Restart all the SEPM services

    For reference see Stopping and starting the management server service

III. Recheck the policies or restart the services for Endpoint Protection Manager

  • If you see the warning during installation and the Endpoint Protection Manager installer is paused at the Warning pane, click Try Again. If the installer previously rolled back, launch it again.

    Note: if you click Continue, the installer ignores the warnings. You still need to correct the user rights in the domain policies for the installation to work correctly.
     
  • If you see the warning during configuration or during an upgrade, click Finish to start Endpoint Protection Manager. The changes you make ensure that Endpoint Protection Manager runs reliably. If necessary, you can restart the Endpoint Protection Manager services using the Service Control Manager.
     
  • As an additional verification, you can also reconfigure Endpoint Protection Manager after you apply the group policies on the Endpoint Protection Manager computer. The Management Server Configuration Wizard reviews the updated policies again.

    You must ensure that you see the message "Configuration Completed" without any warnings in the final panel before you click Finish.

If user rights cannot be determined

When Endpoint Protection Manager cannot read the domain policies, it does not provide the missing user rights in the alert message. In this instance, you (or your domain administrator) should manually inspect the domain policies based on the user rights assignments guidelines provided above, and ensure all required rights apply to Endpoint Protection Manager services.

If you are satisfied that the domain policies meet the appropriate criteria, click OK to continue with the installation, and then ignore the subsequent warning messages during the configuration or upgrade wizard.

How to check domain policies manually

You can manually check for the presence of required accounts and privileges before you begin a new installation or upgrade.

To check domain policies manually, follow these steps:

  1. Log on to the Endpoint Protection Manager computer using domain admin credentials.
  2. Open a command prompt (cmd.exe) and enter the following command:

    Gpresult /scope computer /f /x c:\gpresult.xml

    This command writes the results of the command to a new file, gpresult.xml, at the root of the C: drive. The Endpoint Protection Manager installer uses this command to retrieve the Windows domain policies. If this command fails, then the domain policy check fails during installation.
  3. Open C:\gpresult.xml and search for the privileges listed in the requirements noted above, under Cause.

If you do not find the privileges, then the domain GPOs do not enforce them. You do not need to make a change to domain GPOs.

If you find the privileges, but they do not contain any of the Endpoint Protection Manager accounts, then you must add them into the corresponding policy.

To determine which domain policy to modify, follow these steps:

  1. Open the gpresult.xml file.
  2. Navigate down the following XML tree to where you previously found the required privilege, to the Identifier tag:

    <Identifier>
    PrivilegeName

    Where PrivilegeName is SeServiceLogonRight or SeAssignPrimaryTokenPrivilege.
  3. Note the value given within the Identifier tag. For example:

    ​{31B2F340-016D-11D2-945F-00C04FB984F9}

  4. Navigate the following XML tree, to the Identifier tag:

    ​<Identifier>

  5. Search for the identifier value found in Step 2.
  6. Navigate up the tree to the Name tag, which encloses the name of the policy you must modify.

    <Name>PolicyName
     
  7. You can now open the Group Policy Management Console (GPMC) and add the Endpoint Protection Manager accounts with the required privileges, as noted above.

Note: If the domain policies check out, it may be that other software processes, such as backup software or the Syslog agent, are using or locking some files related to Symantec Endpoint Protection Manager at the time of the upgrade. To launch the upgrade process once the other software process is no longer running, you can enter the following command in a command window:

"C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin\upgrade.bat"

This command uses the default installation path, so adjust the command to match the installation path in your environment.

Technical reference

For more information, see the following Microsoft technical articles:

Powered by Wolken Software