Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article describes how to enable service logon permission for System Center - Service Manager accounts. Security best practice is to disable interactive and remote interactive sessions for service accounts. Security teams across organizations have strict controls to enforce this best practice to prevent credential theft and associated attacks.
System Center - Service Manager (SM) supports hardening of service accounts, and doesn't require granting the Allow log on locally user right for several accounts, required in support of SM.
You must provide service logon permission to the following accounts that are used by SM management server and data warehouse management server.
| Account | Purpose | Service logon permission |
|---|---|---|
| Service Manager Services account | System Center Data Access Service and System Center Management Configuration service | Required |
| Service Manager Workflow account | Runs the MonitoringHost.exe process (all workflows) | Required |
| Service reporting and analysis services accounts | Reporting and analysis | Not required |
Note
We recommend that you provide service logon permission to the accounts used by various SM connectors (AD, OM, SCO, CM, VMM, exchange connectors).
Enable service logon as log on type
You can grant service logon permission in two ways:
- Domain policy: Contact your domain administrators.
- Local group policy: See Enable service logon through a local group policy.
Identify the accounts that need service logon permission
If you don't grant service logon permission to the required accounts, monitoringhost.exe doesn't run under those accounts. This condition prevents some workflows, such as SLA and SLO, from running. The Operations Manager event log records the following error event:
The Health Service couldn't log on the RunAs account XXXXXXX for management group XXXX because it hasn't been granted the Log on as a service.
Here's a sample error:
Enable service log on through a local group policy
Follow these steps:
Sign in with administrator privileges to the computer from which you want to provide Log on as Service permission to accounts.
Go to Administrative Tools and select Local Security Policy.
Expand Local Policy and select User Rights Assignment. In the right pane, right-click Log on as a service and select Properties.
Select Add User or Group option to add the new user.
In the Select Users or Groups dialog, find the user you want to add and select OK.
Select OK in the Log on as a service Properties to save the changes.
Change logon type from a default value
The default logon type is Service log on. After a new installation of SM or an upgrade, the logon type is Service log on by default.
You can change the default logon type by using the following steps:
Sign in with administrator privileges to the computer from which you want to provide Log on as Service permission to accounts.
Run
gpedit.msc.Under Computer Configuration, expand Administrative Templates.
Select System Center – Operations Manager.
Right-click Monitoring Action Account Logon Type, select Edit, and select Enabled.
Choose Logon Type from the dropdown menu.
