Data Loss Prevention

Dear,

I have some workstation with the following warrning, Active Directory user group resolution failed
according to this KB https://support.symantec.com/en_US/article.TECH186331.html

Active Directory permissions conflict with Symantec Data Loss Prevention permissions. Also, Active Directory may be missing attributes.

Verify that the credentials that are passed to the agent have necessary permissions to extract logged-in user information from Active Directory.

You cant tell me whats permissions are necessary for the instalation of the agent?
The user I am using for the installation is the workstation administrator

Perhaps the user account you are using does not have permission to read the Active Directory.  Workstation admin does not necessarily mean automatic priviledges in AD.

 

Does this work on other workstations?  Are you using the same account?

 

Just some thoughts...

 

Will

I cant tell you if using the same acount for all instalation, in my Workstation the instalation was with a domain admin, the only nessesary is that permissions on ad ?

Can we initiate this thread again? We are seeing the same error. What could be the issue?

All,

This error is nothing to be concerned about. This happens with all Agents, especially when they are coming out of sleep mode or are NOT connected to the VPN or company network.

For example..

Laptop is not connected to the Wifi or corporate network. It will try to authenticate to a AD server, but it can't get to it, so it will error out. This happens a lot to machines that are coming out of sleep mode or have not conected to the network yet.

If you reboot a computer that is already connected to the network you will not see this issue. Though if it goes to sleep and comes back you will see errros on a disconnection (not shutdown) and then an AD error.. 

If this happens even after a clean reboot, and connected to the network, I would be concerned.. though I never see that.

Good Luck

Ronak

PLEASE MARKED SOLVED WHEN POSSIBLE

I can see this for machine on the network. I did not check locally on the endpoint but pinging the machine was able to resolve and online.

This is a minor Event and can be ignored.. it will not effect the agent. Unlesee there are some AD Group Based policies, and it won't get a good update to the AD info until a reboot or AD authneitcation whenon line... this happens more often than a policy change would.

Good Luck

Ronak

PLEASE MARKED SOLVED WHEN POSSIBLE