Share via

SCOM action accounts - install agent

David Zemdegs 1,596 Reputation points
2022-04-12T23:17:12.887+00:00

According to the docs, discovery and installation of the agent is done by the 'Management Server Action Account'. But the docs do not say where to find or how to create such an account.
In my accounts section, I have two action accounts - one is a domain service account and the other is the builtin system account. Is one of these the 'Management Server Action Account?'. If one is then it needs to be a local administrator on all my servers in order to install the agent?
Currently I have to supply my own account to discover and install and was looking to set up another account to do that but the docs arent clear on how to do that.
Thanks
David

System Center Operations Manager
System Center Operations Manager
A family of System Center products that provide infrastructure monitoring, help ensure the predictable performance and availability of vital applications, and offer comprehensive monitoring for datacenters and cloud, both private and public.
1,602 questions
0 comments

6 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. George Moise 2,361 Reputation points Microsoft Employee
    2022-04-13T07:20:31.21+00:00

    If you want to identify the Default Action Account for a specific Management Server / Agent in SCOM (meaning the credentials that the Health Service on that server will use by default to run it's workflows, unless another profile is specified on the workflow), you can go to Administration --> Run As Profiles --> open the Default Action Account profile and then in the Run As Accounts tab of that pop-up, you can search for your Server and see which Run As Account is mapped as Default Action Account for the Server.

    Indeed, is a bad security practice to provide Local Administrator permissions of the SCOM Action Account (which is probably the default action account on your Management Servers) on the servers you target with the discovery wizard. The recommendation here is to specify alternative credentials in the Discovery Wizard and use an account with Local Admin persmissions.

    BR,
    George

    1 person found this answer helpful.
    0 comments
  2. Andrew Blumhardt 10,051 Reputation points Microsoft Employee
    2022-04-13T03:26:49.193+00:00

    I believe you are correct. The action account needs to be local admin for remote install. It is common to use alternate credentials with the deployment wizard when this is not the case. That or deploy the agent using SCCM.

    0 comments
  3. David Zemdegs 1,596 Reputation points
    2022-04-13T03:36:12.867+00:00

    So by default, which action account does it use? There is nothing in my console that specifically says 'Management Server Action Account'.

    0 comments
  4. Andrew Blumhardt 10,051 Reputation points Microsoft Employee
    2022-04-13T03:48:59.29+00:00

    If you look at the RunAs account configuration in the Administration workspace, it is the only configured domain account. This will be the default account used for all SCOM actions.

    0 comments
  5. David Zemdegs 1,596 Reputation points
    2022-04-13T04:14:53.49+00:00

    So you either give that account admin access to all servers or you add another account which has that access as an action account?

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.