PAM-CMN-3619: Threat Analytics special user group cannot be updated.

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

We are trying to delete the access policy generated by the threat analytics or delete the users that are within the tap administrators group, but it is not possible. Any attempt to remove a user from the group results in error:

PAM-CMN-3619: Threat Analytics special user group cannot be updated.

Environment

Release : 4.0

Component :

Cause

This is a PAM built-in user group tied to the Threat Analytics license option, and not configurable by the PAM admin.

Resolution

When the Thread Analytics license option is added, a user group named "TAP Administrators" is created and all new or existing users with either the Global Administrator or the Operational Administrator role are automatically added to this group. Similarly, users that lose these roles are automatically removed from this group. Removing the Threat Analytics license deletes the TAP Administrators group. This is covered in documentation page Deploy Symantec Threat Analytics Server.