Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 23 replies
  • Subscribers 3 subscribers
  • Views 8899 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SEC 5.5.1 launch error : The user "domain\account" is not assigned to any subestates.

Mihai Sandu

Hello, 

When I try to launch the SEC I get the "subestates" error message.

My domain account is a member of the Sophos Full Administrators local group.

I have looked around the dbo.UserSubEstates, dbo.Users, dbo.SubEstates......and it should all be good. 

It seems that no matter what i change /modify ....the error message wont go away. ( i have created a "test" subestate in the database...mapped my account to it....still same error).

 

Does anyone have an idea on what the next step would be ? I need to get this fixed and launch this console.

 

Thank you.

 

 



This thread was automatically locked due to age.
  • 0 in reply to Mihai Sandu

    Hello Mihai,

    I think you need to contact Support.
    But before that - you said that with the Sophos Console Administrators group it works as intended? That is, if you remove a domain account from this group you get the must be a member? If you assign the role and sub-estate to the SCA group - same no sub-estate error?

    Christian

  • 0 in reply to QC

    If you assign the role and sub-estate to the SCA group - same no sub-estate error?

    Answer : yes, for the domain accounts same error. If I use a local account in this group ...it works for the local group.

     

    It's like no matter what local group I use on the server, Sophos only knows or takes into account local accounts. It cannot process domain accounts. 

     

    If I add a domain account only in the Full Admin or the Test Admin groups without adding the account also in the SCA group...then i have the other error message with " must be a memmber of the SCA group". Then I add it also to SCA...and voila....i get again the sub-estate error for this domain account.

     

    Mihai

  • 0 in reply to Mihai Sandu

    Hello Mihai,

    aha! Looks like the sub-estate logic uses a different function to assess group membership. Only Support (or Development) could tell if this is indeed the case - and what the cause for the failure could be. There's a trace/debug functionality that could give more insight but last time I used it was years ago and I no longer have the details how to enable it. Support should be able to provide them.

    Christian 

Unfiltered HTML