Could not obtain information about Windows NT group/user 'DOMAIN\USERNAME' (in eventparser.log and the ePolicy Orchestrator console fails to display managed product events)

Technical Articles ID: KB87582
Last Modified: 2023-07-25 09:37:05 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.x

Problem

Managed product events don't appear in the ePO console, and the ePO event debug folder fills up with .xml files. In addition, the ePO eventparser.log displays the following error:

source\server.cpp(1110): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
source\server.cpp(1173): Failed to process file C:\PROGRA~2\McAfee\EPOLIC~1\DB\Events\12345678-901a-23bc-4567-de890fg1234.xml.
epoevents_dao.cpp(350): Exception class std::out_of_range, what()=PostCommonEvent: cache lookup returned invalid reference.
epoevents_dbinfo.cpp(163): COM Error 0x80040E14, source=Microsoft OLE DB Provider for SQL Server, desc=Could not obtain information about Windows NT group/user 'DOMAIN\USERNAME', error code 0x5., msg=IDispatch error #3092, msg=IDispatch error #3092

Cause

This issue can occur for the following reasons:

The account that the ePO server uses to manage its database doesn't have the correct SQL user schema assigned. See "Solution 1."
The database owner isn't set to sa, or more specifically is set to an account that no longer has access rights to the ePO database. See "Solution 2."

Solution 1

Assign the correct SQL user schema to the account that the ePO server uses to manage its database:

Stop the ePO services:
1. Press Windows+R, type services.msc, and click OK.
2. Right-click the following services and select Stop:
  
  McAfee ePolicy Orchestrator x.x.x Application Server
  McAfee ePolicy Orchestrator x.x.x Server
  McAfee ePolicy Orchestrator x.x.x Event Parser
Open Microsoft SQL Server Management Studio.
Type the username and password information for the account specified and click Connect.
Expand Databases, your ePO database (where the default name is ePO_<ePO_server_name>), Security, Users.
Right-click the dbo account and select Properties.
Make sure that the account has dbo in the Default schema for the database.

NOTE: If you use an NT account to authenticate to the ePO database, make sure that the account has Local Admin rights on the ePO server.
Start the ePO services:
1. Press Windows+R, type services.msc, and click OK.
2. Right-click the following services and click Start:
  
  McAfee ePolicy Orchestrator x.x.x Application Server
  McAfee ePolicy Orchestrator x.x.x Server
  McAfee ePolicy Orchestrator x.x.x Event Parser

Solution 2

Verify that the database owner is set to sa:

Stop the ePO services:
1. Press Windows+R, type services.msc, and click OK.
2. Right-click the following services and select Stop:
  
  McAfee ePolicy Orchestrator x.x.x Application Server
  McAfee ePolicy Orchestrator x.x.x Server
  McAfee ePolicy Orchestrator x.x.x Event Parser
Open Microsoft SQL Server Management Studio.
Type the username and password information for the account specified and click Connect.
Expand Databases, right-click your ePO database (where the default name is ePO_<ePO_server_name>), and select Properties.
Check the owner field. If not set to sa, execute the following query against the ePO database by right-clicking the database and choosing New Query:

exec sp_changedbowner 'sa'
Start the ePO services:
1. Press Windows+R, type services.msc, and click OK.
2. Right-click the following services and click Start:
  
  McAfee ePolicy Orchestrator x.x.x Application Server
  McAfee ePolicy Orchestrator x.x.x Server
  McAfee ePolicy Orchestrator x.x.x Event Parser

Related Information

For detailed information about required SQL permissions, see KB75766 - SQL permissions needed to install and use ePolicy Orchestrator.

To review a similar issue, see KB86071 - Principal "dbo" does not exist (ePolicy Orchestrator console fails to display managed product events).

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Could not obtain information about Windows NT group/user 'DOMAIN\USERNAME' (in eventparser.log and the ePolicy Orchestrator console fails to display managed product events)

Environment

Problem

Cause

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Could not obtain information about Windows NT group/user 'DOMAIN\USERNAME' (in eventparser.log and the ePolicy Orchestrator console fails to display managed product events)

Environment

Problem

Cause

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Choose your region

Title

Title