Administrator Guide

How service accounts are managed
Dell Hybrid Cloud System for Microsoft includes a password reset script that you can use to change passwords for the following service
accounts:
• <Prex>-Fabric
• <Prex>-System
• <Prex>-SVC-SQL
• <Prex>-SVC-VMM
• <Prex>-SVC-OM
• <Prex>-SVC-SPF
• <Prex>-SVC-SMA
It is recommended that you run the MCPasswordReset script to reset the passwords for these service accounts whenever you are alerted
to do so by System Center Operations Manager. These accounts are described in User accounts and groups that are added by default.
IMPORTANT: Read this entire section before you run the script.
Starting with the Microsoft update version 1603A, the Operations Manager alert for password expiration is raised 14 days before passwords
expire, rather than three days as in previous releases. To view remaining time before the next password expiration without waiting for an
alert, run the following command in Windows PowerShell on the Console VM:
Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} –Properties
"DisplayName", "msDS-UserPasswordExpiryTimeComputed" | Select-Object -Property
"SAMAccountName",@{Name="ExpiryDate";Expression={[datetime]::FromFileTime($_."msDS-
UserPasswordExpiryTimeComputed")}}
For each account, the MCPasswordReset script does the following:
• Automatically generates a new password.
• Updates the credentials that are stored in SMA with the new password.
• Changes the password for each account in AD DS.
• Each runbook that is run by the MCPasswordReset script also updates the passwords in related management components. This
includes the Windows services and the Run As accounts, and all local passwords that are required by the Windows Azure Pack portals
for administrators and tenants.
Important information about the password reset script
Keep the following points in mind about the MCPasswordReset script:
• The MCPasswordReset script is fairly disruptive. It restarts many services, and results in some downtime of management infrastructure
components. Consider running it within a planned maintenance window.
• The MCPasswordReset script works when all Dell Hybrid Cloud System for Microsoft infrastructure VMs and services are running
normally (that is, not in maintenance mode), and Dell Hybrid Cloud System for Microsoft service account passwords described at the
start of this section are not expired and are in sync. Recovering from a condition when one or more Dell Hybrid Cloud System for
Microsoft service account passwords are expired is not the purpose of this script.
• Operations Manager sends the following alert to customers when passwords are about to expire.
Alert Name: Run As Account(s) Expiring Soon
Alert Description: One or more Run As account passwords are expiring soon. Update the passwords for Run As accounts to prevent
problems with monitoring. To update your Run As account passwords, please update the passwords using the procedures described in
the How service accounts are managed section of the Administrators Guide.
124
Security