Error when adding or modifying a WSUS server in Patch Manager

Overview

When you add or modify a WSUS server in Patch Manager, the following error displays:

Unable to connect to the WSUS Server using the account: domain\admin. Request for principal permission failed.

Environment

• Patch Manager version 2.1.x

Cause 

• The fully-qualified domain name (FQDN) and Canonical Name fields in the Add or Modify WSUS Server window are blank or not filled out completely for the WSUS server.
• This issue can also occur when the Patch Manager service account does not have sufficient access to the WSUS server.
• Do not allow storage of passwords and credentials for network authentication GPO is Enabled at the domain level

Resolution

• Verify if Do not allow storage of passwords and credentials for network authentication GPO is Enabled on the PM server, if so then make an exception to the PM server about this policy or set the policy to either Disabled or Not Defined. 
• If you had to disable/make the change to the policy, then don't forget to reboot the PM server for the changes to take effect. This solution has been validated

Technically speaking, the Service which does the work is the "DataGrid Service" which runs as a local (NOT a domain) user account on the Patch Manager server.  This account needs NO rights to other machines unless those are granted via the Credential Ring.  If the above policy is in place, the credential ring has no access.

If the policy is kept in place, security violations can be further mitigated by adding domain users to the "EminentWare Users" role within Patch Manager and granting them no further access.  Those users do NOT have access to the Credential Ring.  Only members of the "EminentWare Security Administrators" (and higher) have access to the Credential Ring.

If the above is not applicable to your case, then continue the troubleshooting steps below:

1. Log in to the Patch Manager Admin Console as an administrator.
2. In the navigation pane, expand Enterprise > Update Services and select the WSUS server.
   
3. In the center pane, select your WSUS server.
4. In the Actions pane, click Add or Configure WSUS Server.
5. In the Add or Modify WSUS Server window, complete the Hostname or FQDN and Canonical Name fields.

   

   For the Canonical Name field, you can enter an IP address in the following format:

   \xxx.xx.xxx.xxx

6. Test the connection.

   If the connection passes, click Save. You are finished.

   If the connection does not pass, elevate the service account in Local Users and Groups.