O no I forgot my SCOM account passwords!!

25 May

 

Problem:

O no I forgot my SCOM account passwords!! I don’t know the password of the Data Access, Data Reader and Writer account anymore. Resetting it in AD will force me to do a lot of tweaking to correct the accounts in SCOM.

Don’t worry we will find them for you.

Analyse:

 

SCOM stores the account passwords in the “Run AS Configuration -> Accounts” section. This account information is linked to a “Run As profile”. This Run as Profile can be assigned to a SCOM Workflow (Rule/Monitor/Task…) so that this workflow is going to run under the account security context.

 

Nice but we still can’t see the password on the accounts.

 

Solution:

 

But we can also do other things with the Run As profile. We can just assign them as a parameter to for example a script. In the script we can readout the account information and find our lost password.

In SCOM we can use the secure script provider (vbscript) aka “Microsoft.Windows.ScriptWriteAction”. The secure script provider streams the run as information as an input stream to the VBScript. So if you read this input stream at top of your script you will get the account information. This can be tricky sometimes.

See an example below:

<WriteActions>

<WriteAction ID=”sc” TypeID=”Windows!Microsoft.Windows.ScriptWriteAction”>

<ScriptName>ScriptName.vbs</ScriptName>

<Arguments />

<ScriptBody><![CDATA[ Set oAPI = CreateObject(“MOM.ScriptAPI”)

Set oArgs = WScript.Arguments

 

password= WScript.StdIn.ReadLine()

Call oAPI.LogScriptEvent(“ScriptName.vbs”, 101, 2, “Debug password = ” & password)

]]></ScriptBody>

<SecureInput>$RunAs[Name=”RUNAS_PROFILE_1″]/UserName$ $RunAs[Name=” RUNAS_PROFILE_1″]/Password$</SecureInput>

<TimeoutSeconds>300</TimeoutSeconds>

</WriteAction>

</WriteActions>

 

Using the SecureInput parameter we can provide the Run as account information. For getting the UserName we use :

$RunAs[Name=”RUNAS_PROFILE_1“]/UserName$

And for the password we use

$RunAs[Name=”RUNAS_PROFILE_1“]/Password$

The RUNAS_PROFILE_1 is the internal name of the Run as profile in SCOM. You can use Powershell “Get-SCOMRunAsProfile” to get the internal names.

I hear you thinking, this is way too old, this is VBScript, we WANT PowerShell! And I agree completely.

So for PowerShell we can use the normal PowerShell script provider aka “Microsoft.Windows.PowerShellProbe”. We don’t have to apply a secureinput parameter but just very simple supply the RunAs as a normal parameter. And this will do the trick.

<ProbeAction ID=”Probe” TypeID=”Windows!Microsoft.Windows.PowerShellProbe”>

<ScriptName>DisplayCerdentials.ps1</ScriptName>

<ScriptBody><![CDATA[Param(

$USERNAME,

$PASSWORD

)

 

# output the input paramters

Write-Output “UserName: $USERNAME”

Write-Output “Password: $PASSWORD”

 

# end script

 

]]></ScriptBody>

<SnapIns />

<Parameters>

<Parameter>

<Name> USERNAME </Name>

<Value>$RunAs[Name=”MSDL!Microsoft.SystemCenter.DataWarehouse.ActionAccount”]/UserName$</Value>

</Parameter>

<Parameter>

<Name> PASSWORD </Name>

<Value>$RunAs[Name=”SC!Microsoft.SystemCenter.DatabaseWriteActionAccount”]/Password$</Value>

</Parameter>

 

</Parameters>

<TimeoutSeconds>300</TimeoutSeconds>

<StrictErrorHandling>true</StrictErrorHandling>

</ProbeAction>

 

Now we make a simple workflow for example a task and add use this probeaction.

Concussion

 

You see it’s very simple to get account information that’s stored in the run as accounts / profiles. If this is good is up to you.

To make it even easier I created a MP that will display the most important account information (so the usernames and passwords).

You simply import the MP and select the Managementserver target and press the special task “GetRunAsCredentials”.

The account information will be displayed in the task output.

 

Download link for the Management Pack:

https://onedrive.live.com/redir?resid=A6ECD6E173E79D82!137890&authkey=!AEuYWi5Z6etHxno&ithint=file%2cxml

NOTICE: Please remember that the task output is stored in the SCOM Databases so it can be traced back not very secure I think. So use this only in emergencies. Or change the PowerShell script to write it to a file!!

 

Happy SCOMMING!

Michel Kamp

Touching SCOM

https://michelkamp.wordpress.com

 

 

 

Advertisements

2 Responses to “O no I forgot my SCOM account passwords!!”

  1. CdM September 30, 2016 at 17:20 #

    Would it work for a different RunAsAccount? I tried it out to get a SQL RunAsAccount but it did not work (blank).

  2. Channdeep Singh (@SQL_Singh) September 26, 2017 at 04:29 #

    This worked fine. Great help. Awesome work. Many thanks.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: