Symantec Endpoint Detection and Response Appliance is no longer accessible from the command line (CLI).

Products

• Endpoint Detection and Response
• Advanced Threat Protection Platform

Issue/Introduction

SEDR command line (CLI) is no longer accessible when using the 'admin' account and password.

 

At the CLI when typing in the password, it returns an error "Invalid Password".

Resolution

When logging into the CLI of the SEDR Appliance using the 'admin' account and password, but it fails due to "Invalid password", then follow the steps below.

1. Try to retype password.
   1. If that fails then try to type the password in a text editor, then copy and paste it in the CLI when prompted for the password.
       
2. If all avenues are exhausted for trying to recover the password, the only course of action is to OS_Restore the SEDR appliance or VM appliance.
3. Follow the steps for rebuilding the ATP Management console (CIU).

Steps for Rebuilding the ATP Management console (CIU):

1. Open a browser and connect to URL: https://support.broadcom.com/security/download-center
    
2. Log in to the Broadcom Support center.
    
3. Once logged into the site, then download the appropriate product.
   1. Physical appliance then download the (ISO).
   2. VM then download the (OVA or OVF).
       
4. Download Administration Guide for steps Re-imaging a physical appliance or Reinstalling a virtual appliance.
   
   URL: https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-detection-and-response/4-6.html
   Scroll to the bottom of page and select the correct Administration Guide for the version of SEDR

 

Additional Information

See also https://knowledge.broadcom.com/external/article/197322/lost-admin-cli-password.html