run as account cannot log on locally

Sailors,

I’ve set up a new SCOM environment at a customers side. Once the installation and the base configuration was finished, I let the server run and collect alerts for several days. On the next workshop day we had a lot of warnings like these and the customer asked me why:

CLEAN_run_as_account cannot log on locally

I have to admit, I was a litte bit confused in the beginning too, because I’m trying to configure my environments on the least privilege way. But then I recognized, that the customers admin has started to configure Run As Accounts on his own way and it became clearer…

If you create a Run as Account of type “Windows” and set the Distribution of this account to “less secure” this account gets distributed to every system and SCOM trys to autenticate with every “less secure” Run As Account on every system.

 

Run_As_Account_Type_Windows

You shouldn’t use “less secure” accounts at all. Work with more secure accounts and specify the servers on which you want them to be provided to.

 

Aaaaaaaaarrrrr

*Captian

Submit a comment on “run as account cannot log on locally”

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

© 2017 IT-Pirate