5.3

The Local System account named NT AUTHORITY\System has unrestricted access to all local system
resources. This account is a member of the Windows Administrators group on the local machine, and a
member of the SQL Server sysadmin fixed server role. If the NT AUTHORITY\System account does not
have access to the VCM installation binary files (possibly because someone removed the account or
inherently removed access), the installation will result in an “access denied” error in the first step. Details
of this error are not stored in the VCM error log. The solution is to grant access to the NT
AUTHORITY\System account from the installation source directory (right-click the folder, select the
Security tab, and then make sure the user or user’s group has Full Control of the file/folder). Then run the
installation again.
NOTE The network authority account can be changed later in VCM at Administration | Settings |
Network Authority.
Default Collector Services Account
The default services authority account must be specified during the installation process. This account,
which may not necessarily be the system administrator’s, must exist in the Local Administrators group on
the Collector machine. In addition, this account must not be a LocalSystem account.
IMPORTANT If the password for your services account changes, you must also change the password in
both the Services Management and Component Services DCOM Config consoles.
To change your services password in the Services Management console, click Administrative Tools |
Services. Locate all of the services that use the services account to log on. Right click each of these services,
then select Properties. Click the Log On tab, and then update the password field to reflect your new
password.
To change your services password in the Component Services DCOM Config console, click
Administrative Tools | Component Services. Expand the Component Services node, then select
Computers | My Computer | DCOM Config. Right click the LicenseDcom file, then select Properties.
Click the Identity tab, and then update the password field to reflect your new password.
VMware Application Services Account
The VMware Application Services Account must be a domain user. Because this account will have full
administrative authority for the CSI_Domain database, it should never be used as a VCM login or for any
other purpose.
VCM Remote Virtual Directory
The VCM Remote Virtual Directory account must be specified during the installation process. This account
should not be the same account you used for your Default Network Authority Account and/or your
Default Services Account to reduce the chances of a security risk to those accounts.
NOTE The service account can be changed later if necessary using the IIS Management console.
vCenter Configuration Manager Installation and Getting Started Guide
14 VMware, Inc.