topic Re: ESM service account rights in General Topics

ESM service account rights

Retired Member — Thu, 21 Jan 2016 13:05:24 GMT

When I try to install the ESM core and console with a service account that does have the logon as a service rights but not administrator rights, I keep running into issues. As I don't like to grant full admin rights to a service account on a box I'd like to know the exact rights needed for this service account. Can someone provide them?

Re: ESM service account rights

pankaku — Thu, 21 Jan 2016 13:16:58 GMT

Are you trying to configure user-id agent or user-id agentless?

Refer the following doc:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Agentless-User-ID/ta-p/62122

https://live.paloaltonetworks.com/t5/Configuration-Articles/User-ID-Agent-Setup-Tips/ta-p/54755

Hope this helps!

Re: ESM service account rights

Retired Member — Thu, 21 Jan 2016 13:25:43 GMT

neither, TRAPS Endpoint Management Core and Console

Re: ESM service account rights

Retired Member — Fri, 29 Jan 2016 08:35:35 GMT

I know that the service account needs dbo rights on the TRAPSDB, but still don't know why the service account needs to be local admin on the server... Especially since we can remove that right after the install/upgrade.