Symantec Access Management

Hi all,

I am trying to install EEM on a client site

The installation failed after installing the CA directory and cannot start the service, I believe the service cannot start due to windows server hardening, the local service is not accessible. When I try to start the service with another local admin account, the service started normally. But I cannot complete the EMM installation or resume the installation where it left off.

Is there anyway to bypass the error during the installation?

The security team wants to know the exact right needed to grant to the local service for this installation. Anyone can help with this?

Hopefully this Article from Microsoft will help with the permissions required to start a Windows service:
delegating control of services 

By default CA Directory (itechpoz), on an EEM install, has an Automatic startup, not a 'delayed start', and runs under to 'Local Service' account.

Make those changes and verify if the service starts.

I installed 3 times on 3 different server, everyone of them are delay start by default. Please test it yourself before marking disinformation as correct answer.

And my issue is that the service won't start when the service is login by local service, due to access denied.

cirmi02 please stop marking correct answer when that is disinformation.

Conan my apologies on this - I would strongly recommend opening support ticket for this as I think it will go deeper than what the communities can offer.   The fact you tried it on different servers and got same response is telling that this should be handled further through some diagnostics perhaps. 

Additional information please, check this techdoc title:

The Embedded Entitlements Manager (EEM) Services do not start. The following error message is written to the Windows Application Event log: "DSA_E1170 Unable to open pid file: 'Access is denied. (0x5)'"

The Embedded Entitlements Manager (EEM) Services d - CA Knowledge that delivers this solution:

Solution:

The reason for the error message is that the DSA (Directory System Agent) could not create a file in the %DXHOME%\pid folder when the service is started.

To resolve the problem, ensure that the user defined as the logon account of the above CA Directory services has write access to the %DXHOME%\pid folder. To do this:

1. Go to the Windows services dialog, right click on the service name and select Properties.
   
   
2. Click on the 'Log On' tab.
   
   
3. Verify the user specified in the 'This account' field has write access to the %DXHOME%\pid folder.
   
   
4. Restart the Services.