Control Compliance Suite

Hi all, during some configuration testing for CCS 9.0 we have made a misconfiguration and accidentaly removed Administrator account from CCS Administrators Role, and other Roles that the account held. Unfortunately, as this was a test installation we do not currently have any other members in this Role so now we are kind of locked out of the capabilities of the server. Is there a way to return the role of CCS administrator to at least one account? Thanks Evangelos

Have you tried a software repair to see if that puts the Admin account back in there.

I thought the account you install it with is placed in the ccs administrators group though it sounds like you might have logged on to the box under the admin account itself.


I know I'm sorta grasping at straws but thats the only thing I can think of. I'd suggesting calling in to the support line 800-797-8411 to run it by them ..I'm sure this isn't the first time it has happened

Unfortunately this is not the case. The account was erased when I tried to remove administrators from the policy approver role group, but I did not notice that the check box in the CCS Administrators group has also been checked. So, when I selected remove from role, the program removed the accounts from both policy approvers and CCS Administrators (and from all other groups). So now I resulted to have only one account in policy approver group.

We are trying to repair the installation with no luck, as the installer crashes. It would work if we could find where in the DB/filesystem/registry the permissions and roles are stored, but we did not manage to find this information.

It seems that it will result to setting the entire installation from scratch...

Sorry that you may have to re-install from scratch


If I could make a suggestion. Install the software with an account that is in the admin group....either an account from your domain you can add in (if setup that way) or create a local account that is in the admin group. Then add both the administator and the local account in just so you have another account if needed


For example in active directory I have a admin group that is also a par of the ccs administrators role as well as a service account. That way I can easily make sure there is access to the admin area...just a thought

good luck with the rest of the eval

Thank you for the assistance. The strange thing is that the software allowed me to simply empty all the accounts from the CCS Administrator Role group without stopping me. For example, in AD you cannot delete the Administrator acount,. while in CCS you can easily be left without an administrator. I believe that this should be marked as a bug.
 
We made a last try to repair the installation and got this message:
"An error occured while starting the Symantec Application Server Service; Reason for failure: The specified directory service attribute or value does not exist.

   at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
   at System.DirectoryServices.DirectoryEntry.Bind()
   at System.DirectoryServices.DirectoryEntry.RefreshCache(String[] propertyNames)
   at Symantec.CSM.Directory.LdapOperations.NodeExists(String strNodeDN)
   at Symantec.CSM.Directory.Directory.ObjectExists(String strDN)
   at Symantec.CSM.SecureStorage.ADAMSecureStorage..ctor(String server, String userName, String password)
   at Symantec.Appserver.Server.Server.CheckForLocalCreds()
   at Symantec.Appserver.Server.Server.start(Boolean clientSideManifest, String share, EventWaitHandle shutdownEvent)
   at Symantec.Appserver.Server.ServiceStartup.Main(String[] args)"

If you have any last ideas, it would be great.

Thank you once again for your assistance.