Unknown User (displayed during preboot if a shutdown occurred while applying a large number of users)

Technical Articles ID: KB85650
Last Modified: 2024-01-06 09:59:12 Etc/GMT

Environment

Drive Encryption (DE) 7.x

For details of DE-supported environments, see KB79422 - Supported platforms for Drive Encryption 7.x.

Problem

Users are unable to successfully authenticate at preboot on one system when using the correct password. The same user ID can authenticate successfully on a different system.

A DE emergency boot fails to resolve the problem when using DETech recovery media.

MfeEpe.log (section 1) records the following error:

INFO	StatusService	Policy enforcement has completed
INFO	UserLib	Writing user index
INFO	DRIVER	Session notification: EPEPC_DRIVER_SESSION_STANDBY
INFO	DRIVER	Session notification: EPEPC_DRIVER_SESSION_CONSOLE_DISCONNECT
INFO	LoggingService	===========================
INFO	AuditService	Service Started successfully
INFO	StatusService	Service Started successfully

The above log example is missing several expected messages after the log entry Writing user index.

The following example includes the expected entries in that section of the MfeEpe.log:

INFO	StatusService	Policy enforcement has completed
INFO	UserLib	Writing user index
INFO	DRIVER	Session notification: EPEPC_DRIVER_SESSION_STANDBY
INFO	DRIVER	Session notification: EPEPC_DRIVER_SESSION_CONSOLE_DISCONNECT
INFO	MfeEpeCredentialProviderServiceV2	MfeEpeCredentialProviderServiceV2c84fe7fe-1baa-11e5-833c-8086f2daf5e2 initialized successfully
INFO	MfeEpeCredentialProviderServiceV2	Service Started Successfully
INFO	MfeEpeCredentialProviderServiceV2	Service Stopped Successfully
INFO	EpoPlugin	userHandler: handling UserUpdatesAndAcknowledgement response
INFO	StatusService	Updating Drive Encryption users

MfeEpe.log (section 2) records the following error:

INFO	EpoState	== Start of policy enforcement ==
INFO	StatusService	Policy enforcement has started
INFO	EpoPlugin	enforceUserPolicy: Dispatching enforce policy event.
INFO	EpoPlugin	policyHandler: handling EnforcePolicy event
INFO	EpoPlugin	policyHandler: checking for machine ID/ePO server change.
INFO	EpoPlugin	userHandler: handling AddLocalDomainUsers event
INFO	EpoPlugin	userHandler: handling AddLocalDomainUsers response
INFO	EpoPlugin	userHandler: processing user updates/requests
WARNING	MfeEpePcEncryptionProviderPlugin	MfeEpePcEncryptionProviderPlugin ..\..\..\Src\EpeGenUserHandler.cpp: EPE_gen_user_handler::get_updated_users: 530: [0xEE050014] Could not read \Users\updated.pb from the PBFS: expected identifier UpUs but found üpÝ
INFO	EpoPlugin	epoAudit: dispatching audits to AgentHandler
ERROR	EpoPlugin	userHandler: failed to perform user updates: [0xEE010002] [0xEE050014] Could not read \Users\updated.pb from the PBFS: expected identifier UpUs but found üp
ERROR	StatusService	Failed to process a batch of user data received

The above section of the MfeEpe.log shows that the PreBoot File System (PBFS) is corrupted.

Cause

A hard system shutdown occurs while the McAfee Agent is applying the user details to the preboot file (\Users\updated.pb). This action can cause the PBFS to become corrupted.

The chances of this occurring is small, but the chances increase when you try to assign a large number of users to a single client.

WARNING: Assign only the required users that will access the client. The following FAQs are included in KB79784 - FAQs for Drive Encryption 7.x.

Can I now handle a larger number of users in preboot?
The preboot environment has now been improved to support more than 5,000 users without perceptible performance degradation during preboot authentication. The previous limit was a maximum of 250 users in preboot. You can now safely provision all users to share desktops, which enables any user to use any system.
What is the recommendation for the number of users assigned for preboot authentication?
The general recommendation remains unchanged. Assign only the minimum number of users for preboot authentication.

Solution

To resolve this issue, you must perform a manual removal using DETech and then reactivate DE on the client.

NOTE: For instructions about how to perform an emergency boot and recovery with the DE (Standalone) boot disk, see the DETech User Guide PD24871.

Contact Technical Support if you need assistance with the recovery.

For product documents, go to the Product Documentation portal.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Knowledge Center

Unknown User (displayed during preboot if a shutdown occurred while applying a large number of users)

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Unknown User (displayed during preboot if a shutdown occurred while applying a large number of users)

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title