HTTP Status 404 when opening the Enforce UI after installing Windows updates on the Enforce server.

Products

• Data Loss Prevention Enforce
• Data Loss Prevention

Issue/Introduction

After installing the April 2019 Windows updates on the Enforce server the Enforce Console throws a 404 error upon launch.
The TNSListener service will not start.
Removing those updates does not restore normal operations.

 

Log Name:      Application
Source:        VSS
Event ID:      8230
Task Category: None
Level:         Warning
Computer:      DomainController1
Description:  Volume Shadow Copy Service error: Failed resolving account Oracle with status 1376.
Check connection to domain controller and VssAccessControl registry key.
Operation:   Gathering Writer Data  
Executing Asynchronous Operation Context:  
Execution Context: Requestor  
Current State: GatherWriterMetadata
Error-specific details: 
Error: NetLocalGroupGetMemebers(Oracle), 0x80070560, The specified local group does not exist.

Environment

Symantec Data Loss Prevention (DLP) Enforce Server
Single Tier

Cause

The Windows update caused some unknown corruption.

Resolution

1. Launch regex.
2. Backup the registry first.
3. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
4. Take a screen shot of the DWORD-key that corresponds to the account name in the events (Oracle).
5. Delete the DWORD-key that corresponds to the account name in the events (Oracle).
6. Restart the server.
7. Add the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl\Oracle DWORD-key back into the registry.
8. Restart the server.

If the TNSlistener service (Default OracleServiceProtect) is working and there are no errors in the console then the OracleVssWriterProtect can be disabled as DLP does not utilize this service.

Alternatively, these messages from VSS can be safely ignored.