The logon is from an untrusted domain and can't be used with Windows authentication

Technical Articles ID: KB94641
Last Modified: 6/28/2021

Environment

McAfee ePolicy Orchestrator (ePO) 5.10.x

Problem

The installation of an ePO 5.10 cumulative update fails.

The error below is recorded in the ePOUpdate.log file:

error: Failed to get connection..ConnectionError: Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.

The errors below are recorded in the ePOUpdater.yyyy.mm.dd.hr.min.logs file:

info: Successfully read parameters from db.properties
info: Successfully got connection
info: Query execution was successful
info: Successfully got connection
info: Query execution was successful
error: Failed to get connection..ConnectionError: Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.
error: Failed to connect to database
info: Failed to find ePOVersion

The ePO console page shows the error below.

Permissions Error!
You do not have permisssions to acces ePO database
inimum_Privileges

Cause

The Windows user is not an OWNER of the ePO database.

Solution

Verify the DB_owner permissions in the ePO Core and the EPO_Events databases.

Option 1 - Log on to SQL Management Studio with the same user found in the DB.properties file:

Navigate to the DB.properties file is located in the <ePO_install_folder>\server\conf\orion folder.
Edit the file with Notepad.
Locate the user connecting the database from console. It is either SQL or Windows.
Select the ePO Core database, then right-click, and select Properties.
Under the General category, you see the column OWNER. The column shows the user, who is the actual owner of the database.
Perform the same for the ePO Events database to verify the owner.

Option 2 - Run a query

Select the ePO core database, right-click, and select New Query.
Paste the SQL script provided below, and click EXECUTE.

DECLARE
@Maindbname varchar(200)=db_name(),
@EventDBName varchar(200) =db_name()+'_events',
@SQL nvarchar(max);

SET @SQL = 'USE '+ QUOTENAME(@Maindbname) +' ;
IF NOT EXISTS (SELECT 1 FROM sys.syslogins WHERE name=SUSER_NAME() AND (sysadmin=1))
BEGIN
DECLARE @result TABLE (Res TINYINT);
DECLARE @mp_id int =(SELECT principal_id FROM sys.database_principals WHERE name=SUSER_NAME());
IF NOT EXISTS (SELECT 1 FROM SYS.DATABASES WHERE SUSER_SNAME(owner_sid)=SUSER_NAME() and database_id=db_id())
BEGIN
IF NOT EXISTS (SELECT 1 FROM sys.database_role_members AS drm
JOIN sys.database_principals AS dp ON dp.principal_id = drm.role_principal_id AND dp.name=''db_owner''
WHERE drm.member_principal_id = CONVERT(varchar(30),@mp_id)
)
BEGIN
INSERT INTO @result(Res) VALUES (1);
END
END
END;'

SET @SQL = @SQL + 'USE '+ QUOTENAME(@EventDBName) +' ;
IF NOT EXISTS (SELECT 1 FROM sys.syslogins WHERE name=SUSER_NAME() AND (sysadmin=1))
BEGIN
SET @mp_id = (SELECT principal_id FROM sys.database_principals WHERE name=SUSER_NAME());
IF NOT EXISTS (SELECT 1 FROM SYS.DATABASES WHERE SUSER_SNAME(owner_sid)=SUSER_NAME() and database_id=db_id())
BEGIN
IF NOT EXISTS (SELECT 1 FROM sys.database_role_members AS drm
JOIN sys.database_principals AS dp ON dp.principal_id = drm.role_principal_id AND dp.name=''db_owner''
WHERE drm.member_principal_id = CONVERT(varchar(30),@mp_id)
)
BEGIN
INSERT INTO @result(Res) VALUES (2);
END
END
END;
SELECT ISNULL(SUM(RES),0) AS Output
FROM @RESULT;
'
EXECUTE sp_executesql @SQL

The query results must be zero.

NOTE: If the results are 1, 2, 3 it is due to the reasons as below.

1: Issues in Core database with DB_Owner, is not aligned with the same user logged into SQL Management Studio.
2: Issues in Events database with DB_Owner, is not aligned to the same user logged into SQL Management Studio.
3: Issues in both databases (ePO Core and Events) with DB_Owner, is not aligned to the same user logged into SQL Management Studio.

To change the database owner

Stop the ePO services. If you have remote agent handlers, repeat the process below for all Agent handlers.
1. Press the Windows key + R.
2. Type services.msc into the field and press Enter.
3. Right-click each of the following ePO services and click Stop:
  
  McAfee ePolicy Orchestrator #.#.# Application Server
  McAfee ePolicy Orchestrator #.#.# Event Parser
  McAfee ePolicy Orchestrator #.#.# Server
4. Close the services window.
Log on to SQL Management Studio.
1. Expand Databases.
2. Select the ePO Core or the ePO Events database (whichever is having the problem), right-click and select properties.
3. In the left pane, click Files.
4. Under Owner, click Browse, and select the correct user. As matching in the DB.properties file, then click OK.
  
  NOTE: If the issue is with both the ePO Core and Events database, repeat the above steps.
Start the ePO services. If you have remote agent handlers, repeat the process below on the Agent handlers.
1. Press the Windows key + R.
2. Type services.msc into the field and press Enter.
3. Right-click each of the following ePO services and click Start:
  
  McAfee ePolicy Orchestrator #.#.# Application Server
  McAfee ePolicy Orchestrator #.#.# Event Parser
  McAfee ePolicy Orchestrator #.#.# Server
4. Close the services window.

Affected Products

ePolicy Orchestrator 5.10.x
Upgrade/Migrate

Languages:

This article is available in the following languages:

English United States
Japanese
Chinese Simplified

Knowledge Center

The logon is from an untrusted domain and can't be used with Windows authentication

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

The logon is from an untrusted domain and can't be used with Windows authentication

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title