Return
-
Title
Is it possible to change the password for services and tasks on a AD member server when the domain account password is reset? -
Description
Is it possible to change the password for services and tasks on a AD member server when the domain account password is reset?
When "Change password for Windows Services started by this account?" or "Change password for Scheduled Tasks started by this account?" is enabled on a domain account on a Windows Active Dir system, it is possible for member servers using this account for services/tasks to be updated?
What does the "DA Changes" agent do? -
Resolution
Yes, in order to do this select the managed account on the "Windows Active Dir" system and select the "Dependents" tab. On the Filter select "Not Dependent", then select the "Results" tab. Toggle all the systems that use this managed account for services/tasks to "Dependent" and save.
The DA Change agent is responsible for updating the service/task passwords on the dependent systems, ensure the agent is enabled in /admin | Automation Engine | Auto Mgt Agent | DA Change.Note, if you do a manual "Reset Password" on the managed account, the debug output will not show the task/services being updated on the Dependent systems. However, the update will be added to the "DA Change" queue. The logs will show in the "Change Log" in /admin | Automation Engine | Auto Mgmt Agent | Change Log tab.To update services/task password, WMI calls are used. For more information on the port requirement see KB "Ports used by "Windows" or "Windows AD" platforms"Dependents Tab (Windows Active Dir system only)Visible for PPM ISAs only. If the account managed by TPAM PPM is a Windows domain account (ie. the system is defined as Windows Active Dir), services running on domain member systems using this account can also be managed in terms of password changes.DA ChangeIf enabled, the domain account agent looks for services that must have their password changed because they rely on a managed account.