4 Replies Latest reply on Nov 23, 2015 7:44 PM by tkinkead

    mc afee event parser not running


      Good Day everyone, i am an IT administrator on a Company and we are using EPO 5.1 mcafee anti virus and DLP for our domain Computers. One of our co-worker leave the company who is in-charge on handling the EPO server which i am not familiar ..To add delegation on AD policies I change his Domain password after changing Domain password i can access EPO page for more than 2 days but now i cannot access it.(https://<servername>:8443/core/config) I checked mc afee services and found out that event parser was not running and cant be run manually..now i am aware that he use his Domain account  on EPO to create link on SQL server..and i want to add his account always locked out when epo server was running..i try to bring back again his old password but still i cant run epo event parser...Is there anyone experienced this scenario?and how can I resolved this problem?hoping for your help....

        • 1. Re: mc afee event parser not running

          So, it sounds like you need to reset the account ePO user to access the database, but can't get into the GUI to do so, right?  I'd suggest setting up a separate service account that connects from the ePO application to the database.


          First, go to this directory:


          [ePO install directory]\Server\conf\orion


          Open db.properties.  This file includes database configuration information.


          Replace db.user.domain and db.user.name with the account you want to use to connect to SQL server.  Change the "db.user.passwd.encrypted.ex2" filed to "db.user.passwd" and replace the password with the cleartext password of the account you're going to use to connect to the DB.  Save the file and restart the ePO services.


          Now, reconnect to ePO on the <servername>:8443/core/config URL.  Configure the same account again through the GUI, and save the changes.  This is an important step, because it will update the db.properties file and replace the cleartext password with the encrypted password. 


          That should cover it.

          • 2. Re: mc afee event parser not running

            I change db.properties accordingly on my domain account but it didn't work...but i try to reset password of my co-worker that already resigned and edit password on epo db.properties, now i can open the page/console...i think i must create epo domain user separately to link db.account so that this problem wont happen again for future system admin  on this company

            • 3. Re: mc afee event parser not running

              Thank you very much Sir tkinkead it saved my time....hoping you may help more others...GOD BLESS....

              • 4. Re: mc afee event parser not running

                I would strongly recommend you edit your posts to remove all sensitive information; it's extremely common for attackers (or even malicious co-workers) to read forums like this looking for sensitive information, like your password. 


                In any case, sounds like you figured it out, glad I could help.