problem:

Error message:

"Symantec Endpoint Protection Manager services require user rights in Windows domain security policies.  The management console cannot run until you assign user rights to the services in the specified policies:

Group policy setting SeServiceLogonRight in 'Default Domain Controllers Policy' does not contain account(s) [NT SERVICE\semsrv, NT SERVICE\semwebsrv]

Click Cancel to exit the installer.  Click Try Again to have the installer recheck the domain policy settings. Click Continue if you are certain that the domain policies do not override local policies on this system.

Based on your databse configuration later, you may need to assign additional user rights."

solution:




Open command prompt, run "sc showsid semsrv" and "sc showsid semwebsrv" and copy the SIDs.




Open Group Policy Management, Default Domain Controllers Policy




Computer Configuration > Policies > Windows Settings > Security Settings > User Rights Assignment




Open "Log on as a service" and click Add User or Group, paste the SIDs one at a time.  Click OK, and close GPM.




Run gpupdate /force, then click Try Again on the Symantec Installer.




 




Sources:




https://support.symantec.com/en_US/article.TECH228988.html




http://peter-kline.com/?p=139