How to update passwords for Service Accounts in SCOM

If you use domain service accounts in SCOM with passwords, on occasion you may be forced to change those passwords.  This will be a step by step guide on updating those passwords.

High level overview:

• Stop the SCOM services on all SCOM servers and delete the HealthService cache
• (Optional) Stop any 3rd party services that connect to the SDK (connectors, integrations)
• Stop the SQL Server Reporting Services service on the SCOM report server role.
• Change the password for each service account in AD
• Update the password for the SCOM windows services.
• Start the DAS/SDK and Config services.
• Update the password for the SCOM action and RunAs accounts in the SCOM console.
• Update the password for the SCOM reporting account in SSRS
• (Optional) Update the password for any connectors, 3rd party services, IIS app pools, or custom RunAs accounts.
• Start the remaining SCOM Services on all SCOM servers

Step By Step:

Our guide will ASSUME you have 4 typical SCOM service accounts:

• DOMAIN\scomaa – Management Server Action Account
• DOMAIN\scomdas – System Center Data Access (SDK) account
• DOMAIN\scomread – Data Warehouse Reporting Reader account
• DOMAIN\scomwrite – Data Warehouse Reporting write account

If you only used one or two accounts for these roles – that’s fine.  You instructions will only vary slightly.

1.  Stop the SCOM services on all SCOM servers. 

This will reduce the chances of an account lockout depending on your account lockout policy.

On each SCOM Management server, stop the following services:

• Microsoft Monitoring Agent
• System Center Management Configuration
• System Center Data Access Service

PowerShell:

Stop-Service Healthservice
Stop-Service cshost
Stop-Service OMSDK

At this point, we should flush the cache on each management server so the Healthservice will build a new cache when it starts back up.

Browse to where SCOM was installed, and delete or rename the “Health Service State” folder under \Program Files\Microsoft System Center\Operations Manager\Server\ folder.

2.  (Optional) Stop any 3rd party services that connect to the SDK (connectors, integrations)

This could be an Alert Update connector, a product connector, custom 3rd party integrations to SCOM, or anything that connects to the SCOM SDK.

3.  Stop the SQL Server Reporting Services service on the SCOM report server role.

PowerShell:

Stop-Service SQLServerReportingServices
#OR
Stop-Service ReportServer #SQL 2016 and earlier

4.  Change the password for each service account in AD

PowerShell:

$sstring = ConvertTo-SecureString -AsPlainText 'qwert@12*345' -Force
Set-ADAccountPassword -Identity scomaa -reset -NewPassword $sstring

$sstring = ConvertTo-SecureString -AsPlainText 'qwert@12*345' -Force
Set-ADAccountPassword -Identity scomdas -reset -NewPassword $sstring

$sstring = ConvertTo-SecureString -AsPlainText 'qwert@12*345' -Force
Set-ADAccountPassword -Identity scomread -reset -NewPassword $sstring

$sstring = ConvertTo-SecureString -AsPlainText 'qwert@12*345' -Force
Set-ADAccountPassword -Identity scomwrite -reset -NewPassword $sstring

5.  Update the password for the SCOM windows services.

On each SCOM management server, update the password for the following services:

• System Center Management Configuration
• System Center Data Access Service

PowerShell:

$service = gwmi win32_service -filter "name='cshost'"
$service.change($null,$null,$null,$null,$null,$null,$null,'qwert@12*345')

$service = gwmi win32_service -filter "name='OMSDK'"
$service.change($null,$null,$null,$null,$null,$null,$null,'qwert@12*345')

6.  Start the DAS/SDK and Config services.

On each SCOM management server, start the following services:

• System Center Management Configuration
• System Center Data Access Service

PowerShell:

Start-Service cshost
Start-Service OMSDK

7.  Update the password for the SCOM action and RunAs accounts in the SCOM console.

Open the SCOM console.

Administration > RunAs Configuration > Accounts

Under Type: Action Account, open the properties for the Management Server Action Account and update the password.

Under Type: Windows, open the properties for the Data Warehouse Action Account and update the password.

Under Type: Windows, open the properties for the Data Warehouse Report Deployment Account (if present) and update the password.

PowerShell:

$UserName = "OPSMGR\scomaa"
$Password = ConvertTo-SecureString -AsPlainText 'qwert@12*345' -Force
$NewCred = new-object System.Management.Automation.PsCredential $UserName,$Password
Get-SCOMRunAsAccount -Name "OPSMGR\scomaa" | Update-SCOMRunAsAccount -RunAsCredential $NewCred

$UserName = "OPSMGR\scomwrite"
$Password = ConvertTo-SecureString -AsPlainText 'qwert@12*345' -Force
$NewCred = new-object System.Management.Automation.PsCredential $UserName,$Password
Get-SCOMRunAsAccount -Name "Data Warehouse Action Account" | Update-SCOMRunAsAccount -RunAsCredential $NewCred

$UserName = "OPSMGR\scomread"
$Password = ConvertTo-SecureString -AsPlainText 'qwert@12*345' -Force
$NewCred = new-object System.Management.Automation.PsCredential $UserName,$Password
Get-SCOMRunAsAccount -Name "Data Warehouse Report Deployment Account" | Update-SCOMRunAsAccount -RunAsCredential $NewCred

8.  Update the password for the SCOM reporting account in SSRS

On the SCOM Reporting role server, open the Report Server Configuration Manager application.

Connect to the reporting instance.

Select the Service Account, and update the password, and click APPLY.

You should be prompted to start the service at this point.  This will reconfigure SSRS with the updated password and restart the services.

Next, select Database.  Choose “Change Credentials”.  On the Credentials screen – enter back in your account for the Data Warehouse Report Reader account, and input the updated password.

Next, select the Execution Account in Report Server Configuration Manager, and update the password:

You may close the SQL Report Server Configuration Manager now.

9.  (Optional) Update the password for any connectors, 3rd party services, IIS app pools, or custom RunAs accounts.

I have a Product Connector service that runs under the DAS/SDK account credential, so I will update this now.

You can likely start these services as well now, as the DAS/SDK service is already running.

10.  Start the SCOM Services on all SCOM servers

At this point, we can start the remaining service: Microsoft Monitoring Agent on all SCOM servers.

PowerShell:

Start-Service HealthService

Health review

At this point we should check the OperationsManager event logs on all the Management servers for errors.

Also inspect the Monitoring > Operations Manager > Management Group Health dashboard.  Make sure SCOM is healthy.  Resolve any errors.

Troubleshooting

Sometimes, when we reset the password for the Management Server Action Account – you will see duplicate “Alternate” accounts get created. 

If this happens, you need to go in the console to Administration > Run As Configuration > Profiles  and open the properties for the Default Action Account Profile.

Make sure non of the accounts are using the “Alternate Account”.  If they are – change them.

You can now delete any “Alternate Accounts” that exist.

Sometimes you will need to update the password again using the console for the Management Server Action Account if the management servers are still logging errors.  Wait for a config update (event 20125) and this should clear all the errors.