EPO Services Not Starting after admin Password Change 1

[lhuegele]

We had a long-time IT person leave the company this week so all of our administrative passwords had to change. Now both the Epolicy Orchistrator Event Parser service and the Epolicy Orchistrator Server service won't start even though we've updated the service LogOn information with the new password.

The Server service requires the event parser to be running, but when we try to start it we get this error:

Could not start the McAfee ePolicy Orchestrator 3.0 Event Parser service on Local Computer. The service did not return an error. This could be an internal Windows error or an internal service error.

Has anyone else had this problem or do you have any ideas? Thanks in advance for any help!

Larry

 

[jbrackett]

Sounds like something we had happen several months back. Similar situation, only ours was a former IT manager who was terminated. He didn't leave it alone and we didn't take the threat seriously until he slid into our system and thumbed our noses at our shoddy security.

Needless to say, we are considerably more conscientious these days.

After changing all the passwords on servers and services, ePO quit working. Turns out there is a configuration file within ePO that has to have passwords changed also. I'm not at work at the moment, but will post the name of the file when I get in tomorrow.

_{"The Crystal Wind is the storm, and the storm is data, and the data is life. You have been slaves, denied the storm, denied the freedom of your data. That is now ended; the whirlwind is upon you . . . . . . Whether you like it or not."}

^{"Trent the Uncatchable" in The Long Run by Daniel Keys Moran}

 

[lhuegele]

Thanks I appreciate that!

Larry

 

[theboyhope]

Cfgnaims.exe innit?

 

[jbrackett]

theboyhope,

Yes, that's it.

lhuegele,

Below is a copy of the solution I wrote up for our help desk database. I've obviously had to change a couple of internal references, but there should be plenty for you to go on.
_____________________________________

Security Lockdown Procedures - Special considerations
Problem: "ePO not working since security lockdown"

Solution:
1. Navigate to "D:\Program Files\Network Associates\ePO\3\CfgNaiMs.Exe" on "ePO servername".

2. Double click the "CfgNaiMs.Exe" application. This opens the "McAfee ePolicy Orchestrator Server Configuration ("ePO servername")" window.

3. Click on the "Administrator" tab.

4. Change the password to the new corp/administrator password.

5. Make sure that the "Use Windows NT authentication" button is selected.

6. Repeat steps 4 and 5 on the "Reviewer" tab.

7. Click "Apply" and Close.

8. Go to the system services. (Right click "My Computer" and select "Manage". Go to "Services and Applications\Services")

9. On the right side of the screen is a list of all services running on the machine. Click the top of the "Log On As" column to alphabetically sort according to this category. Look for services accessed by the "domain name/Administrator" account. The items to start are "McAfee ePolicy Orchestrator 3.0 Event Parser" and the "McAfee ePolicy Orchestrator 3.0 Server".
Right click on each of these and select "Start".

10. Close the Management Console.


That should do it.

Hope it helps. Best of luck.

_{"The Crystal Wind is the storm, and the storm is data, and the data is life. You have been slaves, denied the storm, denied the freedom of your data. That is now ended; the whirlwind is upon you . . . . . . Whether you like it or not."}

^{"Trent the Uncatchable" in The Long Run by Daniel Keys Moran}

 

[jbrackett]

In looking back over my post, I guess I should point out that step 1 assumes that you've installed ePO on a "D" partition. If not, change accordingly.

_{"The Crystal Wind is the storm, and the storm is data, and the data is life. You have been slaves, denied the storm, denied the freedom of your data. That is now ended; the whirlwind is upon you . . . . . . Whether you like it or not."}

^{"Trent the Uncatchable" in The Long Run by Daniel Keys Moran}

 

[lhuegele]

Thank you jbrackett. I appreciate the help!

 

[jbrackett]

Not a problem. Glad I could help.

_{"The Crystal Wind is the storm, and the storm is data, and the data is life. You have been slaves, denied the storm, denied the freedom of your data. That is now ended; the whirlwind is upon you . . . . . . Whether you like it or not."}

^{"Trent the Uncatchable" in The Long Run by Daniel Keys Moran}

 

[simonjcook]

I had a similar issue with the Event Parser not starting and returning a totally unhelpful error message.

In my instance the password never expires flag had been removed from the service account and consequently the password had expired.

I only discovered this when logging in with the service account interactively and was asked to change the password... aahhhhhh.... that's why...

Regards

Simon J Cook

< Keyboard Error - Press F1 to continue >