Failed to launch On-Demand Scan Task due to authentication error

[Former Member]

Hi Admin,

I have issue full scan with McAfee Endpoint Security Threat Prevention, please help me.

McAfee version:
+ EPO 5.9.1
Client installed:
    + McAfee Agent 5.5.1.342
    + Endpoint Security Threat Prevention: 10.6.1.1550
    + Endpoint Security Platform: 10.6.1.1449

My issue is when client meet schedule full scan it can't lauch On-Demand Scan. And I have check log in file:
OnDemandScan_Activity.log: 
10/7/2019 11:39:07 AM mfetp(5696.15352) <SYSTEM> MaSpb.ODS.Activity: LogOnUser() failed with 1909 error
10/7/2019 11:39:07 AM mfetp(5696.15352) <SYSTEM> MaSpb.ODS.Activity: Failed to launch On-Demand Scan Task due to authentication error. TaskID = MA_RunNow_317_{63e3b3c4-e8bc-11e9-1eac-d69a655a2d35} Error=298: Too many posts were made to a semaphore.

EndpointSecurityPlaform_Errors.log:
11/12/2019 11:26:14.318 AM mfetp(5996.16024) <SYSTEM> MaSpb.MaSpb.Error (lpc_EnforceTask.cpp:1501): LogOnUser() failed. Error=1909: The referenced account is currently locked out and may not be logged on to.
11/12/2019 11:26:14.392 AM mfetp(5996.16024) <SYSTEM> MaSpb.MaSpb.Error (lpc_EnforceTask.cpp:1318): Failed running : "C:\Program Files\McAfee\Endpoint Security\Threat Prevention\amcfg.exe" /ODS /Task MA_RunNow_317_{8ddb3dfa-0504-11ea-195c-6354ac1bb591} /AUTHERROR as user : XXX, domain : YYY Error=298: Too many posts were made to a semaphore.

Please, help me.
Thanks a lot !
Quan.

[Former Member]

Good morning @Former Member 

Thank you for sharing those extracts.

Within your ENS ODS Task, do you have credentials saved? If yes, I would ask you to remove them and try to run the task again.

From the extract shared, it looks like the user account you have saved in the task is currently locked out and may not be logged on to because it was removed or similar.

[AdithyanT]

Hi @Former Member,

Thank you for your post! Excellent work with the log excerpts! Added to what my colleague has mentioned, May I know if the task was actually a scheduled task or a run now task deployed from the ePO?

MA_RunNow_317_{63e3b3c4-e8bc-11e9-1eac-d69a655a2d35} --> Seems to point a possible run now task. Perhaps you created this for testing purpose?

[Former Member]

Hi Adithyant & Chealey,

My problem is:
EPO system have assigned client task full scan monthly. In addition clients completed, Periodic I filter clients not completed full scan &  run client task now.

One of those clients show as above.

Best regards,
Quan.

[Former Member]

Hi @Former Member 

Did you follow the already provided steps? As suggested, it would seem that you have credentials in the task which either didn't work on this machine or the account specified was locked out at the time of the scan.

[AdithyanT]

Hi @Former Member,

That makes sense! @Former Member has already provided the solution and I believe you need to look into the Run now task's username and password section. It is best to leave that blank!

Please let us know how this goes.

[Former Member]

Yes Chealey & AdithyanT,

I will check Run now task's username and password again.

Thanks for your suggestion.
Quan.

[AdithyanT]

Hi @Former Member,

Thank you for trying it. Please keep us posted on how it goes 🙂