DC Agent: ERROR_ACCESS_DENIED

Topic 51025 | DC Agent Troubleshooting | 12-Oct-2015


Applies To:	TRITON AP-WEB and Web Filter & Security, v8.0.x, v8.1.x

This error appears when the Websense DC Agent service does not have sufficient permissions to perform its required tasks.

To a domain controller, an anonymous account is equivalent to a Windows Guest account. If DC Agent is configured to use an anonymous account, and the domain controller has been set not to give the list of user logon sessions to an anonymous user, then DC Agent is unable to retrieve logon information.

DC Agent uses the NetSessionEnum call, which may fail depending on your Local Security Policy or Trust Relationship configuration.

User Service uses NetUserGetGroups, which requires domain administrative rights.

To address this issue, create an account domain controller read privileges for DC Agent to use when requesting user logon information from the directory service.

If DC Agent is configured to perform domain discovery or computer polling, the service must run as an account with domain or enterprise admin privileges.

Updating DC Agent permissions

On the DC Agent machine, create a user account with a descriptive name, like WsDcAgent. This account exists only to provide a security context for DC Agent when it requests information from the directory service.

Assign the new account domain administrator privileges in all domains.

Assign the same password to this account in all domains.

Set the password to never expire. This account exists only to provide a security context for accessing directory objects.

Make a note of the user name and password so that you have it when you get to step 5.

Open the Windows Services tool (from the Server Manager > Tools or Start > Administrative Tools menu).

Scroll to the Websense DC Agent service, right-click the service name, and then select Stop.

Double-click the service name, and then select the Log On tab.

Select This account, and then enter the DC Agent account name and password that you just created. Some domains require that the account name be entered in the format domain\username.

On the General tab, click Start to start the service, then click OK.

Close the Services tool.

You may also need to assign the same set of administrative privileges to User Service.