What are the ECATIIOC , ECATSYNC, ECATUI, and ECATMASTERSYNC accounts and what is their purpose?
The ECATIIOC, ECATSYNC, and ECATUI accounts are installed when the RSA NetWitness Endpoint database is created. The ECATMASTERSYNC account is created when multi-server is configured in the user interface. These accounts are SA type. Listed below is brief description of how they are used.
Owner of the various RSA NetWitness Endpoint agent jobs
Used to communicate actions between the UI and the the SQL Server. Also used as go-between the API server, UI, Console Server and database
Used to manage synchronization of database tables between primary and secondary servers and jobs that are related to updating data between the primary and secondary servers
Placeholder for managing IOC evaluation jobs
These accounts are internal and they cannot be deleted. It is also not possible to delete them and turn them over to Windows Authentication accounts. (Not supported by RSA Customer Support)