Logon errors after changing the default Admin username.

Products

• Endpoint Protection

Issue/Introduction

After changing the default Admin account's username in the Symantec Endpoint Protection Manager (SEPM), errors are periodically received stating that an incorrect username and password was supplied to the SEPM, even when no logon attempt was made. These errors coincide with notification conditions being reached on the SEPM.

The scm-server logs will show errors such as the following:

2016-05-14 02:13:54.720 THREAD 30 SEVERE: The administrator's user name or password is incorrect. Type a valid user name or password. in: com.sygate.scm.server.task.notification.EmailHelper

com.sygate.scm.server.util.ServerException: The administrator's user name or password is incorrect. Type a valid user name or password.

    at com.sygate.scm.server.task.ScheduledReportingHelper.doIntegratedLogin(ScheduledReportingHelper.java:664)

    at com.sygate.scm.server.task.notification.EmailHelper.doMail(EmailHelper.java:130)

    at com.sygate.scm.server.task.notification.EmailWorker.doAction(EmailWorker.java:51)

    at com.sygate.scm.server.task.notification.ActionPerformer.takeActions(ActionPerformer.java:211)

    at com.sygate.scm.server.task.SecurityAlertNotifyTask.processResponses(SecurityAlertNotifyTask.java:5031)

    at com.sygate.scm.server.task.SecurityAlertNotifyTask.processResponses(SecurityAlertNotifyTask.java:4957)

    at com.sygate.scm.server.task.SecurityAlertNotifyTask.processResponses(SecurityAlertNotifyTask.java:4936)

    at com.sygate.scm.server.task.SecurityAlertNotifyTask.contentOutOfDate(SecurityAlertNotifyTask.java:3827)

    at com.sygate.scm.server.task.SecurityAlertNotifyTask.processNotifications(SecurityAlertNotifyTask.java:1040)

    at com.sygate.scm.server.task.SecurityAlertNotifyTask.execute(SecurityAlertNotifyTask.java:571)

    at com.sygate.scm.server.task.MonitoredTimerTask.run(MonitoredTimerTask.java:41)

    at java.util.TimerThread.mainLoop(Timer.java:555)

    at java.util.TimerThread.run(Timer.java:505)

Cause

The SEPM maintains the old user name in some parts of the database until the next successful logon. This causes the errors in the logs when notifications are triggered.

Resolution

This issue ls resolved in Symantec Endpoint Protection 14.0.

If it is not possible to upgrade to a newer version, as a workaround, logging into the account which has been changed will cause the errors to stop.