Symantec EDR Scheduled Report Generation Fails

Products

• Endpoint Detection and Response

Issue/Introduction

• Symantec EDR scheduled report fails intermittently.
• Symantec EDR scheduled report fails to complete.

Environment

EDR 4.6

Cause

EDR is unable to recognize the user account used to create the report.  This could happen if the user account was created with the role of 'user' or even 'controller' first and then changed at a later date to 'admin.'

Resolution

Option 1: Create a new schedule using a user that has always existed with the 'admin' role

1. Login as the default admin user.
2. Remove the existing scheduled report.
   
   1. You may optionally create a new user account with the 'admin' role or use an account that has always existed with the role of 'admin'
   2. Logout
   3. Login with the new account created with the 'admin' role or proceed with the default admin account which has the 'admin' role.
3. Create a schedule for a new report to replace the existing report that is no longer working correctly.
4. Monitor the status of this new report.

Option 2: Reboot the EDR appliance.

1. Login to the EDR command line interface.
2. Type 'reboot' and press enter.

 

Additional Information

See the EDR documentation on 

• Symantec EDR user roles 
• Adding local user accounts