vCM creates accounts - they can be changed?

A security sweep turned up two user accounts created by vCM install.

CSI_COMM_PROXY_USR

ECMSRSUser

We are currently asked that these accounts comply with the password policy, but my concern is that it would break the vCM.  Can anyone confirm this?

jddias,

You can delete the CSI_COMM_PROXY_USR account.  I replaced it with success with a domain account.  Here are the steps that I have spend my domain account work.  Notice, this is a stand alone machine of the Agent Proxy, you will need to adjust accordingly if you do this on your collector:

  1. I do Member of the local Administrators group (perhaps not necessary, he did not test without doing that)
  2. I add the domain account to the local group CSI_COMM_PROXY_SVC.
  3. Grant full control permissions to where is located the agent VCM.  In my case, I have computers of autonomous agent proxy (I do not use the collector).  You will see that the CSI_COMM_PROXY_USR had already here full control permissions.  Revoke permissions for the CSI_COMM_PROXY_USR account and grant full control to the domain account.
  4. Grant full control to the registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Configuresoft key (assuming that you are on an x 64 operating system, if not, then HKEY_LOCAL_MACHINE\SOFTWARE\Configuresoft).  Again, see you that csi_comm_proxy_usr already had permissions, withdrawing and grant full control on your domain account.
  5. Change the service account on the service Proxy Communication CM to use your domain account and the duty cycle.
    1. If the Service will not be running, check the permissions of the steps 3 & 4 above
    2. If the service remains operational, I delete the CSI_COMM_PROXY_USR account at this stage.
  6. Restart the server
  7. Log the server with your domain account.
  8. Follow the steps to create new keys of AgentProxy
  9. Import the new AgentProxy keys in the collector
  10. Update the SSH key on the ESX hosts, you can simply add the key to the servername_ssh_public_key.txt ino the keystore allowed in /home/csi_acct/.ssh on each ESX host charged that the Agent Proxy.
    1. Note, you can add several ssh keys in this file.  In our case, we have like 15 proxy agent.  We have all the keys in this file we put on each ESX host.
  11. Repeat the above for each server proxy agent that you have.
  12. On my collectors, I turn off the service Proxy Communication CM, delete the CSI_COMM_PROXY_USR account and change to the local system, and then stop the service.

This will take care of your CSI_COMM_PROXY_USR account.

The ECMSRSUser account is another story.  This account is hardcoded in VCM.  I found that documented in the release notes for the 5.3 & 5.4.  Here is the link for 5.3 notes version: http://www.vmware.com/support/vcm/doc/vcm_53_release_notes.html.  Just search ECMSRSUser on this page.  This hard-coded account is always used in 5.4.1 but, it is not any longer in the release notes.

In our case, we have a security policy against local accounts on servers, so this begs a question.  I worked with support on this when this account was first added to VCM.  While it is not supported, you can delete this account.  You just make sure you add the appropriate permissions in SSRS on your collector in the ECM Reports folder.  You can use a group of authenticated users, domain or domain accounts, which either work for your environment.  You grant Content Manager permissions.  This solution "works" for us.  Note, you will get security event anytime a SRS page is access from VCM, VCM always try to use the ECMSRSUser account, but as long as the Reporting SERVICES permissions are in place, everything still works.   I have not fully validated this continues to work with 5.4.1, so make sure you test it.  I found the account ECMSRSUser must exist if if you want to use the gui to Import/Export tool to export reports (the ecmie.exe command-line tool has not this dependency).

I submitted an enhancement request to fix this.  It can only help if others do the same.  We must consider the possibility of specifying domain accounts for those moments to install two.  At a minimum, the password for the ECMSRSUser account doesn't have to be hard-coded.

I hope this helps.

Tags: VMware

Similar Questions

Maybe you are looking for

  • Apple Watch connection icon

    My son has experimented with his new Apple Watch today, and after setting the phone down, it found the phone. Thus, he went to his watch, crept upward to display looks and got to the first to allow him to ping the phone. Top of the page it showed con

  • HP Pavilion G4 1322tx display drivers

    I need help to find a compatible driver for my laptop. Model: HP Pavilion G4 1322tx with AMD Radeon HD 7450 M (1 GB dedicated DDR3) I could not find a compatible for Windows 7 64-bit. Please help me.

  • Install Shield Wizard error-2147221164

    When trying to update my computer Instalshield I get 2147221164 error and there is no help for it, I tried the regsvr32 "C:\Windows\Downloaded Program Files\ ISUSWEB. DLL, but it failed and said the specified module is not found .do I need to fix som

  • Why all my games is late

    I just rebuilt a dell optiplex gx 280. I'm playing games like wow, defiance, rift, swtor, but with all the games on parameters down there I'm horribly late. Also, it takes some time to open all programs as well. How can I fix? Dell optiplex gx280Proc

  • Holiday calendar question simple unit 4.04

    Unit 4.04. Have a configuration of call for our business Office Manager. Their schedule is from Monday to Friday 08:00 to 17:00. Meanwhile the standard greeting plays and when that time is not in force their closed greeting plays. If I put a holiday