Symantec DLP services failed to start with error "This service account does not have the required user right "Log on a service""

Products

• Data Loss Prevention Core Package

Issue/Introduction

After a reboot or a restart of services, Symantec DLP services failed to start with error "This service account does not have the required user right "Log on a service""

Cause

This is caused by the "log on as a service" permission being removed from the service account being used to start the services.

Resolution

Grant the "Log on as a service" permission to the user used to start the services.

1. First verify the user that is used too start the service.  You can go to the properties of the service and click the "Log on" tab.
2. Next verify if this user exists in the local policy.  Screenshot below.
   1. 
3. This is where the permission is being removed from.

If you were to put in the password again for the user on the "Log on" tab in services, windows should automatically grant this permission to the service.  The issue can be that GPO or something else could be removing this permission.  To verify if its GPO, grant the permission manually using the local policy editor and then type "gpupdate /force" from a command prompt.  After its successful try and restart the service.  If it fails then its being removed by GPO.  If its confirmed GPO then the recommendation is to see if the user can be added to this permission, so GPO does not overwrite it or use a domain service account where it is added within the GPO granting it login as a service permission.