This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
According to the docs, discovery and installation of the agent is done by the 'Management Server Action Account'. But the docs do not say where to find or how to create such an account.
In my accounts section, I have two action accounts - one is a domain service account and the other is the builtin system account. Is one of these the 'Management Server Action Account?'. If one is then it needs to be a local administrator on all my servers in order to install the agent?
Currently I have to supply my own account to discover and install and was looking to set up another account to do that but the docs arent clear on how to do that.
Thanks
David
Thanks - Ill probably use MEMCM to deploy the client.
Im still puzzled as per my original question.
"According to the docs, discovery and installation of the agent is done by the 'Management Server Action Account'. "
I know that the default action account used on clients to run monitors and rules is the Local System account. But thats not the account used to install the agent. That, according to the docs, is the 'Management Server Action Account'. When looking in the console at the action accounts, none of them say 'Management Server Action Account'.
What's even more confusing is that the domain based action account description says that it runs the rules when that is not true - its the local system account. So what is the domain based action account used for?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 31%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
That's because there actually is only one "Default Action Account" RunAs profile.
That profile defines the default accounts used to run workflows on the agents, when no specific other RunAs is defined.
On regular monitored servers, this account is usually Local System.
On Management Servers (which also run the agent), it's usually a domain account. So the "Manager Server Action Account" is the account defined for the Management Servers in the "Default Action Account" profile.
You can see the differences between Management Servers and regular monitored servers by having a look at the RunAs accounts listed inside the Default Action Account profile.
And I will definitely agree that using "account" in the name of a profile is confusing.
Thanks - The Default Action account profile lists the local system account.
But there is no Default Installation account.
The discovery wizard separates the installation from the account that runs the healthservice rules etc.
So what is the 'Default installation account' used by the discovery wizard?
Well the default installations account is the account listed in the default action account profile for the management servers.
So if the management servers are associated with the local system account inside the default action account profile, then management servers' local system account is your default installation account (and will obviously have no permission on the servers you're trying to push the agent to)