can we add report server service account, server configuration account to cyberark in order to change the password for every 30days and will it get updated automatically without any issues and services will be up after these changes.

Question

can we add report server service account, server configuration account to cyberark in order to change the password for every 30days and will it get updated automatically without any issues and services will be up after these changes.

Thakur, Sumana 20

Hi All,

As per Account onboarding and remediation effort for Active Directory privileged accounts, we need to add service accounts to the CyberArk so that password will be updated for every 30 days. we have tried to update it in development environment earlier, but the application services were down for longer duration, and it impacted the business partners. can we add the accounts to CyberArk without effecting the application.

Report Server Service Accountreportserver.PNG

2)Server Configuration accountserverconfig.PNG

please find the attachment of images and suggest me to proceed further.

Regards,

Sumana

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,541 Reputation points Moderator

2023-09-11T22:25:30.65+00:00

Hello @Thakur, Sumana ,please rovide more details about your currenty CyberArk + Azure AD Azure DevOps setup or environment: What features are enabled, how was it set, what are the current running paremeters? Also, what does updating the devlopment environment encompase? Do you know why where the application services for longer duration? What applications are those?
Thakur, Sumana 20 Reputation points

2023-09-20T14:40:40.5066667+00:00

Hi Revilla,

Thank you for your response, please find the details below.

Our current existing Azure DevOps Version is "Azure DevOps Server 2019 update 1.1" on-premises. Earlier it was Team Foundation Server 2017, later we upgraded it to Azure DevOps Server 2019 update 1.1.

“We are using CyberArk to manage the domain service account password to ensure security compliance with periodic password updates. CyberArk can rotate/change password for domain service accounts but for this use case we have dependency on Azure DevOps Application. So, in order to update password for service account which is used at time of Azure DevOps application install and server configuration – which is one time configuration. Is there any possibility or additional steps that can be performed to ensure the account password is updated and in sync with password in Active directory.

– If there is a process that can be used to update password on Azure DevOps application side i.e. Azure DevOps Server configuration (through some command line, utility, scripts or UI (if any)).”

please let us know about it.

Regards,

Sumana
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,541 Reputation points Moderator

2023-09-20T19:57:51.15+00:00

Ok my understanding is that you want to ensure Azure DevOps Server service account password are in sync with CyberArk? Correct? Is there any dependency on Azure AD or Azure DevOps Service? If there is please detail it.

Thakur, Sumana 20

Hi Revilla,

Thank you for your response, please find the details below:

These accounts do not have dependency on Azure AD, but We are using one domain account as the service account for Azure DevOps Server (Server Configuration Account) which is (TFSServiceAccount)and the data sources account for SQL Server Reporting Services (Report Server Service Account) which is (TFSReportsAccount)

Both these accounts has full control as admin on the servers (application tier and data tier) and they run below services on both tiers.

Service name
Code Coverage Service
Azure DevOps Server Web Services
SQL Server Reporting Services (MSSQLSERVER or InstanceName if using a named instance)
Report Web Service
Visual Studio Team Foundation Build Service Host (if Team Foundation Build is installed)
Visual Studio Team Foundation Background Job Agent
Visual Studio Test Controller
Visual Studio Test Agent
Analysis Server (MSSQLSERVER or InstanceName if you are using a named instance)
SQL Server Browser
SQL Server (MSSQLSERVER or InstanceName if using a named instance)
SQL Server Agent (MSSQLSERVER or InstanceName if using a named instance)
Account Service (CollectionName)

If we try to make any changes to the existing accounts passwords, all services will be down.

Is it recommended to change password of these accounts for every 30 days time period?

If it is recommended to do so, what steps we need to follow to update the password and make sure all services are up and running without affecting the existing environment.

please let me know about it.

Thank you for your support and coordination.

Regards,

Sumana

Thakur, Sumana 20 Reputation points

2023-10-03T10:39:22.42+00:00

Hi Revilla,

i have shared details below, could you please suggest me to proceed further.

Regards,

Sumana

Answer accepted by question author

0 additional answers

Your answer

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,541 Reputation points Moderator

2023-09-11T22:25:30.65+00:00

Hello @Thakur, Sumana ,please rovide more details about your currenty CyberArk + Azure AD Azure DevOps setup or environment: What features are enabled, how was it set, what are the current running paremeters? Also, what does updating the devlopment environment encompase? Do you know why where the application services for longer duration? What applications are those?
Thakur, Sumana 20 Reputation points

2023-09-20T14:40:40.5066667+00:00

Hi Revilla,

Thank you for your response, please find the details below.

Our current existing Azure DevOps Version is "Azure DevOps Server 2019 update 1.1" on-premises. Earlier it was Team Foundation Server 2017, later we upgraded it to Azure DevOps Server 2019 update 1.1.

“We are using CyberArk to manage the domain service account password to ensure security compliance with periodic password updates. CyberArk can rotate/change password for domain service accounts but for this use case we have dependency on Azure DevOps Application. So, in order to update password for service account which is used at time of Azure DevOps application install and server configuration – which is one time configuration. Is there any possibility or additional steps that can be performed to ensure the account password is updated and in sync with password in Active directory.

– If there is a process that can be used to update password on Azure DevOps application side i.e. Azure DevOps Server configuration (through some command line, utility, scripts or UI (if any)).”

please let us know about it.

Regards,

Sumana
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,541 Reputation points Moderator

2023-09-20T19:57:51.15+00:00

Ok my understanding is that you want to ensure Azure DevOps Server service account password are in sync with CyberArk? Correct? Is there any dependency on Azure AD or Azure DevOps Service? If there is please detail it.
Thakur, Sumana 20 Reputation points

2023-09-28T14:48:03.3566667+00:00

Hi Revilla,

Thank you for your response, please find the details below:

These accounts do not have dependency on Azure AD, but We are using one domain account as the service account for Azure DevOps Server (Server Configuration Account) which is (TFSServiceAccount)and the data sources account for SQL Server Reporting Services (Report Server Service Account) which is (TFSReportsAccount)

Both these accounts has full control as admin on the servers (application tier and data tier) and they run below services on both tiers.

Service name

Code Coverage Service

Azure DevOps Server Web Services

SQL Server Reporting Services (MSSQLSERVER or InstanceName if using a named instance)

Report Web Service

Visual Studio Team Foundation Build Service Host (if Team Foundation Build is installed)

Visual Studio Team Foundation Background Job Agent

Visual Studio Test Controller

Visual Studio Test Agent

Analysis Server (MSSQLSERVER or InstanceName if you are using a named instance)

SQL Server Browser

SQL Server (MSSQLSERVER or InstanceName if using a named instance)

SQL Server Agent (MSSQLSERVER or InstanceName if using a named instance)

Account Service (CollectionName)

If we try to make any changes to the existing accounts passwords, all services will be down.

Is it recommended to change password of these accounts for every 30 days time period?

If it is recommended to do so, what steps we need to follow to update the password and make sure all services are up and running without affecting the existing environment.

please let me know about it.

Thank you for your support and coordination.

Regards,

Sumana
Thakur, Sumana 20 Reputation points

2023-10-03T10:39:22.42+00:00

Hi Revilla,

i have shared details below, could you please suggest me to proceed further.

Regards,

Sumana

Answer 1

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,541 Moderator

Hello @Thakur, Sumana and thanks for reaching us. Currently, Azure Devops Server is not supported on Microsoft QnA. To obtain support from the community please post your question here: https://developercommunity.visualstudio.com/AzureDevOpsServerTFS

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.

Share via

can we add report server service account, server configuration account to cyberark in order to change the password for every 30days and will it get updated automatically without any issues and services will be up after these changes.

0 additional answers

Your answer