Configure Endpoint Protection Manager administrator accounts to use Active Directory authentication

Products

• Endpoint Protection

Issue/Introduction

You want to use Active Directory accounts to log in to Symantec Endpoint Protection Manager (SEPM).

Resolution

To configure an SEPM administrator account to use Active Directory authentication, both Step A and Step B are required.

• Step A: Configure the SEPM to communicate with the Active Directory server(s).
• Step B: Configure a SEPM administrator account to use directory authentication.

Note: Repeat Step B for every account which needs to use Active Directory authentication.

Step A: Add the Active Directory Server to the SEPM

1. Log in to the SEPM.
2. Click Admin > Servers.
3. Right-click your SEPM's machine name (top-left).
4. Click Edit the server properties.
5. Click Directory Servers > Add.
6. Enter a name to identify your Active Directory server.
7. Select Active Directory next to Server Type.
8. Enter the Active Directory server IP Address or Hostname.
   
   Note: If using a Secure Connection, specify the FQDN address of the directory server.  Do no specify an IP address, or DNS Alias.  If you must use an IP address, check the box to disable certificate verification.  (14.3 RU6 and later)
   
   
9. Enter a static Active Directory username and password (that will not change) so the SEPM can communicate with the Active Directory server.
10. Click OK. The SEPM will test the Directory Server information to confirm that it works properly.

Step B: Create a new SEPM Administrator account

1. Click Admin > Administrators > Add an administrator.
2. Under General, enter a User name for the new administrator account. This will be the user name used to login to the SEPM.
3. Enter a full name for the new administrator account. This is used for informational purposes only.
4. Under Access Rights, select the appropriate rights for the administrator. (for a new Admin with Limited Access, at least one authority has to be selected in the Access Rights section so that the pop-up saying "All the access rights are disabled" doesn't appear)
5. Under Authentication, leave the Current admin password, New Password, and Confirm new password fields blank.
6. Select Directory Authentication.
7. In Directory Server, select the Active Directory server configured in Step A-6.
8. In Account Name, enter the account name as it appears in Active Directory.
9. Click Test Account, you should see "Directory account authenticated."
10. Click OK.
11. Enter the password for the SEPM administrator account currently logged in, to complete the creation of the Administrator account.

Testing the newly created account:

1. Log off of the SEPM, if logged in.
2. Use the User name entered in Step B-2. User names are case sensitive.
3. Use the Active Directory password for the Active Directory account specified in Step B-8.
4. Leave the Domain field blank. (This field expects a SEPM domain and not an Active Directory domain).

WARNING

Do not use the built-in SEPM System administrator account called: admin when setting up Active Directory Authentication, doing so can prevent logon access to SEPM with "Authentication Failure" error. Lockout issues can occur when changing the Active Directory account, upgrading Active Directory, changing Active Directory mode, and when removing SEPM(s) as a replication partner.

SEPM Active Directory Authentication is only supported for an administrator account that has been created in SEPM by clicking "Add an administrator."

Note: The SEPM administrator name you created/added is taken from SEPM database while the password is taken from Active Directory.

Note: There is no such dependency of Domain Functional Level/Forest Functional Level from AD to SEP.