We cannot program Defender soft token to any AD user.

Hi Martial,

What version of Defender are you using?

When you installed Defender, did the account used for installation have the required group memberships of Domain Admins, Schema Admins, and Enterprise Admins?

- If not, please re-run the Defender installation with an account that has the above group memberships

Is the service account a member of Domain admins? if not, please make sure that the service account is a local admin on the server that has the Defender Management portal installed and also delegate AD permissions as per the KB article below:

https://support.oneidentity.com/kb/4292085/how-to-run-the-delegation-wizard-and-delegate-defender-permissions

Thanks!

Hi Tawfiq

thanks for your reply.

The service account is member of all the require AD group and also memeber of local Administrtor group.

When configuring the service account on the management portal I got this error

ErrorUnable to validate the System Service Account user's logon privileges (Accès refusé). Please ensure that
you have the correct rights to perform this action.

Unable to modify the file security for the reports configuration file (Attempted to perform an unauthorized operation.). Please ensure that the System Service Account has read access.
Configuration

the defender version have installed his 6.2

is it possible to have your mail to send you anyfurther information??

This can occur in the following scenarios:

1. If the operating system is using non-English 

2.  Local Administrators group has been renamed

3. Local administrators group have objects that are orphaned (example members shows SID (eg S-1-5-21-1234567890...)

4. Local administrators group have user objects or groups that belong to a different domain that the service account does not have read permissions.

Related KB:
https://support.oneidentity.com/defender/kb/4209930/error-specified-user-account-for-management-portal-service-account-is-not-a-member-of-the-local-administrators-group-on-the-system

Hi just to have information from you.On the client environment a domain upn has been configured.

when connecting to remote server we did with the normal domain name.

but on the defender installation workthrough at the step of choosing the domain admins group on the screen the defaut domain admin group point to upn

example domain : bank.exellence.group\defadmin for login

during defender installation we see G_EXCELLENCE\domain admins

This can be a cause thus why we cannot program token for user??

I,have installed defender on two others client enviroment.everything work fine

Hi just to have information from you.On the client environment a domain upn has been configured.

when connecting to remote server we did with the normal domain name.

but on the defender installation workthrough at the step of choosing the domain admins group on the screen the defaut domain admin group point to upn

example domain : bank.exellence.group\defadmin for login

during defender installation we see G_EXCELLENCE\domain admins

This can be a cause thus why we cannot program token for user??

I,have installed defender on two others client enviroment.everything work fin

Hi Martial,

It would be best to open a service request and provide the logs to investigate the issue further.

Thanks!