Error: “Logon failure: unknown user name or bad password” when adding a Service Account (4298516)

When trying to add a Service Account in the Data Governance module, you receive an error message:

^{Logon failure: unknown user name or bad password}

During the time the error is displayed, the following is logged in the Data Governance Service Log:

^{Message: Exception being mapped for transmission of type System.ComponentModel.Win32Exception, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=xxxxxxxxxxxxxxxx
Severity: Error
Category: Translated Exception, Error
  Thread: (4696)
  Values:
     exceptionMessage - Logon failure: unknown user name or bad password
     ServerIdentity - NT AUTHORITY\SYSTEM
     ClientIdentity - \
     AuthorizationProtocol - NTLM
     ClientImpersonationLevel - Impersonation
     Exception - System.ComponentModel.Win32Exception (0x80004005): Logon failure: unknown user name or bad password
   at Quest.Titan.Common.Native.Security.LogonUser(String username, String domain, String password, Int32 loginType, Int32 logonProvider)
   at Quest.Titan.Server.InternalServices.ServiceAccounts.LogonServiceAccount(String userName, String userDomain, String password, Boolean invokeServiceRight)}

The Data Governance service is unable to update the database with the credentials provided.

There are three possible causes for this behavior:

1. The provided credentials are invalid.
2. The database authentication credentials provided for the Data Governance service are invalid or have insufficient permissions.
3. The Identity Manager database is encrypted, and the encryption key file was not provided (or updated) in Data Governance.

Cause 1:  The provided credentials are invalid.

• Validate the credentials of the service account by using it to login to your Data Governance service host machine.

Cause 2: The database authentication credentials are invalid/have insufficient permissions.

• Validate the account used to connect to your Identity Manager database has the required minimum permissions.  The minimum permissions are available in the Deployment Guide, under the "Deployment requirements" section, in the "Data Governance Edition minimum permissions" topic.
• Test the credentials by authenticating to your Identity Manager database.  The DGE installation wizard has a "Test" option while specifying the credentials for the database, should you not have direct access to the database.

Cause 3: The encryption key has not been updated on the Data Governance server.

• Obtain your new/updated encryption key file and supply it to the Data Governance service via PowerShell command.
• First add the PowerShell snap in (add-pssnapin) quest.datagovernance; from your Data Governance service host.
• Depending on your version, use the PowerShell command to apply the new/updated encryption key.  Use "Get-Help" to see a list of available parameters to the command.
  • Version 7.0.1 and older: "Set-QIdentityManagerKey"
  • Version 7.0.2 and newer: "Set-QEncryptionOptions"