Fix Login Issues with Trellix ePO Using Windows Authentication

This article will discuss how to “fix unable to login to Trellix ePO with Windows authentication”. This user right determines which users and groups can connect to the computer over the network. Remote Desktop Services are not affected by this user right. Please see ‘Trellix ePolicy Orchestrator Installation on Windows Server“. How to fix “Disable SQL Auto Close: Auto Close is enabled for both ePO and ePO Events Databases“.

If you are having this issue in your environment, you can double-click all the steps highlighted below to ensure you are not been impacted by a group policy or improper login format. By default, all users should be able to log in except configured otherwise in your environment.

Note: A user with Windows authentication can still log on to the ePO console after the user is deleted from Active Directory. This is because the change in authentication method isn’t applied immediately. After all, the ePO on-premise server caches the logon authentication for 30 minutes.

Therefore, after a while. The changes are applied and the user will not be able to log on using the AD user credentials. This is because the cache will be deleted within 30 minutes thereby preventing the AD user from logging on to the ePO console.

You may want to see how to encrypt your Data with Trellix Data Encryption and how to upgrade Trellix ePolicy Orchestrator. How to Manage BitLocker and FileVault with Trellix Native Encryption.

Why was this error Prompted?

When you try to log on to the ePO console with a Windows-authenticated user account using the correct password. The login attempt fails.

This could be as simple as not using the right login format “domain\username”. Or because of the Active Directory security groups of which the user is a member. Do not inherit the Network Logon Security Policy necessary to authenticate the ePO user as a domain user. As such, you should also double-check on the ePO on-premise server to see if there is a policy preventing it.

Note: In ePO 5.10 CU15 and later. The ePO Audit log message is updated to not report “incorrect password” when the correct password is entered. If the login fails due to the Group Policy Settings, the ePO Audit log reports “Invalid Credentials.”

To address and narrow this issue to reflect our suggested fix when the errors are similar to the below.

The ePO login screen reports “You have provided invalid credentials.”
The ePO Audit log reports “Failed Logon for user “domain\username” from IP address: xxx.xxx.xxx.xxx due to incorrect password.”
Failed Logon for user “User” from IP address: xxx.xxx.xxx.xxx due to user auto-creation failure
The Windows Event Viewer reports Windows Event ID 4625 – “An account failed to log on. The user has not been granted the requested logon type at this machine. Logon type 3.”

The solution to accessing Trellix ePO with Windows authentication

Perform the steps below to grant permission to the user “Access This Computer From the Network” security policy.

Note: This step assumes that you have configured the ePO server to allow login from users when at least a permission set is assigned to the AD group on ePO. Please see “ePO Server Settings: Trellix ePO AD integration and ENS Agents Installation“.

Log into the ePO Application Server interactively or via RDP and launch the gpedit.msc.

Navigate to Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, Local Policies, User Rights Assignment.

Select Access This Computer From the Network. Click Add User or Group. Enter the object names to select in the section, type the name of the User or Group that needs permission, and click Check Names to verify whether the name is correct.

Click OK after adding the user or group. Alternatively, you could also use the Local Security Policy to achieve this.

Expand the local Policies and click on User Right Assignment. You can also add the group from here.

local-security-policy-Access-This-Computer-From-the-Network

Note: When grayed out as shown below. Then some GPO policies are in place and you need additional privileges.

Here is a similar error “Unable to log on to the ePO console (Active Directory user in ‘Protected Users Security Group‘). Or are you having an issue logging on to the ePO on-premises with an Active Directory user?

Access the Trellix ePO URL and Self-Service URL

If you still cannot cannot access the URL. You will need to see the Windows Event Logs. See some Audit logon events. When logging in to a Trellix portal using domain authentication, you’ll need to provide the correct format for the username.

Note: The Account logon events are generated on domain controllers for domain account activity and on local servers as well for local account activity.

If the username is not in this format domain\username. You will get the below error in the Windows Event Log. The Logon failure event code “4625”.

A logon attempt was made with an unknown user name or a known user name with a bad password. Please see how to access the “Selfservice Recovery and perform Trellix BitLocker and fileVault Recovery“

			
Event 4625. An account failed to log on.
Subject:
    Security ID:        NULL SID
    Account Name:        -
    Account Domain:        -
    Logon ID:        0x0
Logon Type:            3
Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:        tester
    Account Domain:        tdadottechdirectarchivedotcome
Failure Information:
    Failure Reason:        Unknown user name or bad password.

		

Therefore, to fix this issue, access the Trellix self-service portal. Type the domain username prefixed with the domain name “domain\user”. Then, type the password and click Login.

I hope you found this article useful on “Fix unable to login to Trellix ePO with Windows authentication”. Please feel free to leave a comment below.