DC Agent has insufficient permissions

Web Security Help | Web Security Solutions | Version 7.8.x

DC Agent may have been installed as a service using the Guest account, equivalent to an anonymous user to the domain controller.

In order to perform domain discovery (required for DC Agent to create and maintain the dc_config.txt file), or to perform computer polling, the Websense DC Agent service requires domain admin permissions. In some environments (typically very large enterprise networks), DC Agent requires enterprise admin permissions.

If you have disabled domain discovery and computer polling, and are just using domain controller polling while maintaining the dc_config.txt file manually, DC Agent can run as any network user with read access to the domain controller.

To grant DC Agent domain admin privileges:

On the DC Agent machine, create a user account with a descriptive name, like WsUserID. This account exists only to provide a security context for DC Agent when it requests information from the directory service.

Assign the new account domain admin privileges in all domains.

Assign the same password to this account in all domains.

Set the password to never expire.

Make a note of the user name and password.

Open the Windows Services tool:

Windows Server 2012: Server Manager > Tools > Services

Windows Server 2008 R2: Start > Administrative Tools > Services

Scroll to the Websense DC Agent service, right-click the service name, and then select Stop.

Right-click the service name again, select Properties, and then click the Log On tab.

Select This account, and then enter the account name and password that you created for DC Agent. Some domains require that the account name be entered in the format domain\username.

Click OK to return to the Services tool.

Right-click the service name again, and then select Start.

Close the Services tool.

You may also need to assign User Service the same administrative privileges as DC Agent.