Symantec VIP some user accounts are unable to authenticate with certain administrator accounts, while other administrator accounts work fine

Products

• VIP Service

Issue/Introduction

Administrators are unable to authenticate with elevated privilege accounts, but the other administrator accounts work fine.

Cause

Users must qualify for the User Store Filter. Testing some user accounts succeeds, where problem accounts do not succeed, despite both being members of the same User Store Filter group.

Problem was identified as other administrator accounts in a different OU container in Active Directory that does not reside under the "Base DN" of the User Filter.

Resolution

Solution - Either of the following options will resolve this issue:

1. Raise the 'Base DN' to incorporate both OU containers where the admin objects reside in Active Directory
2. Create a second User Store and modify the 'Base DN' to include the second set of administrator account objects

Additional Information

Help with configuring the User Filter and Base DN settings can be found in this Knowledge Base article:  https://knowledge.broadcom.com/external/article?articleId=163791