Article Number
000001555
Applies To
RSA Product Set: NetWitness Endpoint
RSA Product/Service Type: Database
RSA Version/Condition: 4.4.x, 4.3.x, 4.2.x
Issue
What are the ECATIIOC , ECATSYNC, ECATUI, and ECATMASTERSYNC accounts and what is their purpose?
Resolution
The ECATIIOC, ECATSYNC, and ECATUI accounts are installed when the RSA NetWitness Endpoint database is created.
The ECATMASTERSYNC account is created when multi-server is configured in the user interface.
These accounts are SA type. Listed below is brief description of how they are used.
| Account Name | Description |
|---|
| ECATSYNC | Owner of the various RSA NetWitness Endpoint agent jobs |
| ECATUI | Used to communicate actions between the UI and the the SQL Server. Also used as go-between the API server, UI, Console Server and database |
| ECATMASTERSYNC | Used to manage synchronization of database tables between primary and secondary servers and jobs that are related to updating data between the primary and secondary servers |
| ECATIOC | Placeholder for managing IOC evaluation jobs |
These accounts are internal and they cannot be deleted. It is also not possible to delete them and turn them over to Windows Authentication accounts. (Not supported by RSA Customer Support)
