Description

This article contains the steps to update the Vault Service account password from the EVBAAdmin page.

Updating the Vault Service account password from the EVBAAdmin page

1. Open the EVBAAdmin page with admin privileges.
2. Click on the Service Account tab.
   
3. In the Update Accelerator Service Account section:
   1. Enter the username (domain/username format) and the password in the respective fields.
   2. Click Update.
      
4. Reboot the Accelerator server.

Possible Warnings in the Application Event Log for Event ID 1309 and Event ID 1310:

Log Name:      Application
Source:        ASP.NET 4.0.30319.0
Event ID:      1309
Task Category: Web Event
Level:         Warning
Keywords:      Classic
Description:
Event code: 3005 
Event message: An unhandled exception has occurred. 
Event time: ...
Event time (UTC): ...
Event ID: ...
Event sequence: ...
Event occurrence: 1 
Event detail code: 0 
 
Application information: 
    Application domain: /LM/W3SVC/...
    Trust level: Full 
    Application Virtual Path: / 
    Application Path: \SupervisionApi\ 
    Machine name:
 
Process information: 
    Process ID: X
    Process name: w3wp.exe 
    Account name: IIS APPPOOL\SupervisionApi 
 
Exception information: 
    Exception type: HttpException 
    Exception message: Login failed for user '\'.
   at System.Web.HttpApplicationFactory.EnsureAppStartCalledForIntegratedMode(HttpContext context, HttpApplication app)
   at System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers)
   at System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context)
   at System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context)
   at System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext)

Login failed for user '\'.
   at Symantec.EnterpriseVault.DatabaseAccess.EVSqlBase.Do[T](Func`1 action)
   at Symantec.EnterpriseVault.DatabaseAccess.EVSqlBase.Do(Action action)
   at Symantec.EnterpriseVault.DatabaseAccess.EVSqlConnection.Open()
   at KVS.Accelerator.Common.ConfigurationDBUtils.GetConfigSetting(String configKey)
   at KVS.Accelerator.Common.ConfigurationDBUtils.GetProductType()
   at KVS.Accelerator.Common.TasksModuleInfo.get_ProductTypeInstalled()
   at Veritas.Supervision.ApiEndpoint.Web.FilterConfig.RegisterGlobalFilters(HttpFilterCollection filters)
   at Veritas.Supervision.ApiEndpoint.Web.WebApiApplication.Application_Start()
 
Request information: 
    Request URL: http://localhost:82/api/appsettings/producttype 
    Request path: /api/appsettings/producttype 
    User host address: 127.0.0.1 
    User:  
    Is authenticated: False 
    Authentication Type:  
    Thread account name: IIS APPPOOL\SupervisionApi 
 
Thread information: 
    Thread ID: X
    Thread account name: IIS APPPOOL\SupervisionApi 
    Is impersonating: False 
    Stack trace:    at System.Web.HttpApplicationFactory.EnsureAppStartCalledForIntegratedMode(HttpContext context, HttpApplication app)
   at System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers)
   at System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context)
   at System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context)
   at System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext)

Log Name:      Application
Source:        ASP.NET 4.0.30319.0
Event ID:      1310
Task Category: Web Event
Level:         Warning
Keywords:      Classic
Description:
Event code: 3008 
Event message: A configuration error has occurred. 
Event time: ...
Event time (UTC): ...
Event ID: ...
Event sequence: ...
Event occurrence: 1 
Event detail code: 0 
 
Application information: 
    Application domain: /LM/W3SVC/...
    Trust level: Full 
    Application Virtual Path: / 
    Application Path: \SupervisionApi\ 
    Machine name:
 
Process information: 
    Process ID: X
    Process name: w3wp.exe 
    Account name: \
 
Exception information: 
    Exception type: ConfigurationErrorsException 
    Exception message: An error occurred executing the configuration section handler for system.web/identity.
   at System.Web.HttpRuntime.FirstRequestInit(HttpContext context)
   at System.Web.HttpRuntime.EnsureFirstRequestInit(HttpContext context)
   at System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context)

Could not create Windows user token from the credentials specified in the config file. Error from the operating system 'The user name or password is incorrect.
' (\SupervisionApi\web.config line 53)
   at System.Web.Configuration.IdentitySection.InitializeToken()
   at System.Web.Configuration.IdentitySection.get_ImpersonateToken()
   at System.Web.Configuration.IdentitySection.ValidateCredentials()
   at System.Web.Configuration.IdentitySection.GetRuntimeObject()
   at System.Configuration.RuntimeConfigurationRecord.GetRuntimeObjectWithRestrictedPermissions(ConfigurationSection section)
   at System.Configuration.RuntimeConfigurationRecord.GetRuntimeObject(Object result)
 
Request information: 
    Request URL: http://localhost:82/api/appsettings/producttype 
    Request path: /api/appsettings/producttype 
    User host address: 127.0.0.1 
    User:  
    Is authenticated: False 
    Authentication Type:  
    Thread account name: \
 
Thread information: 
    Thread ID: X
    Thread account name: \
    Is impersonating: False 
    Stack trace:    at System.Web.HttpRuntime.FirstRequestInit(HttpContext context)
   at System.Web.HttpRuntime.EnsureFirstRequestInit(HttpContext context)
   at System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context)

Possible entries in a DTrace log of the W3WP process:

[1234]    (w3wp)    <5678>    EV-L    {EVSqlBase.ShouldExcludeSqlException} Error 'Login failed for user '\'.' is not transient. 'EVSqlConnection: DB: Data Source=<sql_server_fqdn,port>;Initial Catalog=;Integrated Security=True;Max Pool Size=200;Connect Timeout=120;Load Balance Timeout=30' will not be retried</sql_server_fqdn,port>

[1234]    (w3wp)    <5678>    EV-L    {EVSqlBase.ShouldRetry} Error 'Login failed for user '\'.' is excluded. 'EVSqlConnection: DB: Data Source=<sql_server_fqdn,port>;Initial Catalog=;Integrated Security=True;Max Pool Size=200;Connect Timeout=120;Load Balance Timeout=30' will not be retried</sql_server_fqdn,port>

[1234]    (w3wp)    <5678>    EV-H    {EVSqlBase.LogFailureAndThrow} Failed to execute 'EVSqlConnection: DB: Data Source=<sql_server_fqdn,port>;Initial Catalog=;Integrated Security=True;Max Pool Size=200;Connect Timeout=120;Load Balance Timeout=30' - This command was not retried - Error Error Code: 18456 / 80131904 - Severity 14 - Login failed for user '\'.</sql_server_fqdn,port>

How to manually update the VSA credentials for Thin Client/Web UI access (CFT-5521)

1. Open an administrative/elevated command prompt at the root of the newest .NET Framework folder on the Accelerator server (.NET Framework 4 is used in the example):

1.1. Click Start | Right-click Command Prompt | Click Run as administrator.

1.2. Change directory to the %Windir%\Microsoft.NET\Framework\v4.x folder.

2. Decrypt the existing Vault Service Account (VSA) credentials:

2.1. Confirm the path of the Accelerator Server installation folder. The default path is C:\Program Files (x86)\Enterprise Vault Business Accelerator. The file needing to be decrypted is in this path under different paths depending on the web application(s) you have installed.

2.2. At the command prompt, enter and execute the following command with the correct path (default path used in the example).

2.2.1.  For Surveillance (formerly Compliance Accelerator):

aspnet_regiis.exe -pdf "system.web/identity" "C:\Program Files (x86)\Enterprise Vault Business Accelerator\SupervisionApi"

2.2.2.  For Enhanced Auditing:

aspnet_regiis.exe -pdf "system.web/identity" "C:\Program Files (x86)\Enterprise Vault Business Accelerator\AuditingApi"

2.2.3.  For Discovery Accelerator:

aspnet_regiis.exe -pdf "system.web/identity" "C:\Program Files (x86)\Enterprise Vault Business Accelerator\eDiscoveryApi"

A successful decryption will list the following message:

Decrypting configuration section...
Succeeded!

2.3. Leave the command prompt open, as we will need to re-encrypt the identity information soon.

3. Edit the VSA credentials:

3.1. Open the web.config file under \SupervisionApi\ for CA or \AuditingApi\ for Enhanced Auditing or \eDiscoveryApi\ for DA using Notepad. The user credentials will be listed in plain text in the <identity> tag under system.web. Here is an example of a decrypted tag: 

<identity impersonate="true" userName="EVLAB\evsvc" password="ThisIsMyNewPassword" />

3.2. Edit the VSA password to provide the new credentials.

3.3. Save and close the web.config file.

4. Encrypt the new Vault Service Account (VSA) credentials:

4.1. At the command prompt, enter and execute the following command with the correct path (default path used in the example).

4.1.1.  For Surveillance (formerly Compliance Accelerator):

aspnet_regiis.exe -pef "system.web/identity" "C:\Program Files (x86)\Enterprise Vault Business Accelerator\SupervisionApi"

4.1.2.  For Enhanced Auditing:

aspnet_regiis.exe -pef "system.web/identity" "C:\Program Files (x86)\Enterprise Vault Business Accelerator\AuditingApi"

A successful encryption will list the following message:

Encrypting configuration section...
Succeeded!

4.2. Verify the credentials are encrypted by opening the web.config file using Notepad and reviewing the <identity> tag again. Here is an example of how it looks when encrypted:

<identity configProtectionProvider="RsaProtectedConfigurationProvider">
      <EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
        xmlns="http://www.w3.org/2001/04/xmlenc#">
        <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" />
        <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
          <EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
            <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" />
            <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
              <KeyName>Rsa Key</KeyName>
            </KeyInfo>
            <CipherData>
              <CipherValue>vgiRtgqZ/k0RE7wRTzC9brZyiVkFev1+J6Hl/SuqX8gjZ/WMnnCgvnIfnB9hP9D+94i7ObRCFXmt5raa10A5bvBCN9vPM+1QkWHprSPTtz8FVyPUA097FDTCSTpokGsluqRIWslfX/b5ntP0oDsUqM/XKKdm/wp7UNbCoa6qm3eglCPHFuNJckG14eAKzpXHTsCUdGK+zYbULeayMjUJ5qI+rKrfcUHtS+Z1RkFSRA+nY1ADdzNWixBqkWTt8DDlQR6FHTGFKKbFWl7JYbBjLfMsVibSi4u44Wsyst9bgR4SB/UkcFIRXnEhrRW01IAkYOg1z78ISom1GCt2vmOmlw==</CipherValue>
            </CipherData>
          </EncryptedKey>
        </KeyInfo>
        <CipherData>
          <CipherValue>dRGJnm+jAjkJ+gcwcsuV8kTyrxJ2l3J2xpvtEGDHwe1VsG+hriGUJddQZTrBndCNdBsccur+HqsQDDbRP2K9vrF+/VDENZoG9rmoNz9D2bgukfbhc6OVzxh/BKEfRhMV</CipherValue>
        </CipherData>
      </EncryptedData>
    </identity>

4.3. Close the Command Prompt window.

5. If you haven't already, update the VSA credentials on the appropriate Accelerator product services.

5.1. Update the services in the Services.msc console, if not already done:

5.1.1. Right-click the Enterprise Vault Accelerator Manager Service, click on Properties, then update the VSA credentials in the Log On tab and click on OK.

5.1.2. Right-click the Enterprise Vault IR Classifier Service (CA 14.3 and newer), click on Properties, then update the VSA credentials in the Log On tab and click on OK.

5.1.3. Right-click the Enterprise Vault IR Model Builder Service (CA 14.3 and newer), click on Properties, then update the VSA credentials in the Log On tab and click on OK.

5.2. Either reboot the Accelerator server (recommended) or restart the services from the Services.msc console as follows:

5.2.1. Stop the Enterprise Vault Accelerator Manager Service.

5.2.2. Stop the Enterprise Vault IR Classifier Service (CA 14.3 and newer).

5.2.3. Stop the Enterprise Vault IR Model Builder Service (CA 14.3 and newer).

5.2.4. Restart the IIS Admin Service.

5.2.5. Start the Enterprise Vault Accelerator Manager Service.

5.2.6. Start the Enterprise Vault IR Classifier Service (CA 14.3 and newer).

5.2.7. Start the Enterprise Vault IR Model Builder Service (CA 14.3 and newer).