Deploying ACC into Windows - Local Account for service - change password on next logon

[Gilberto De Cam]

Hello,

We are deploying the ACC using SCCM on Windows devices.

Everything is installed perfect but the service never starts by the error "Logon failure".

We could confirm that the local account created has enable "change password on next logon".

We read at a "best practice document" mentioning that the parameter "Password never Expire" can be set at acc installer, but we have not been able to find it at any documentation.

Any suggestion how to in a centralized way on the describe environment we can ensure that the local account created is able to login?

[Parag_Sanyashiv]

Hi Gilberto,

ServiceNow Document doesn't have the exact configuration, below is what is provided by ServiceNow regarding the user:

You can use the OOTB user creation while installing the agent and then check the configuration of that user create and follow it for a domain user so that it can be applied to all the agents and you end up with a single global user.

Regards,

Parag Sanyashiv

[SeverinLauniau · Accepted solution]

Hi @Gilberto De Cam ; there is still a gap in the Windows installation page indeed. You can find all the parameters in the release notes in the store app page: https://store.servicenow.com/sn_appstore_store.do#!/store/application/deb59787c317030039a3553a81d3ae...

For reference, msiexec parameters:

• ACC_MID=string
• ACC_API_KEY=string
• ACC_ALLOW_LIST=True|False
• START_SERVICE=True|False
• LOCALUSERNAME=SYSTEM|LOCALSERVICE|domain\gMSA$|string
• LOCALUSERPASSWORD=string
• ISDOMAIN=0|1
• DOMAIN=string
• PASSWORD_NEVER_EXPIRES=True|False

[pratik0306]

Hi @Gilberto De Cam 

May i know what permissions were given for the account to deploy the agents from SCCM?

and also in the documentation it was written that a default user and group gets created so wanted to know about this as well

[SeverinLauniau]

@pratik0306 : I would recommend assigning either Local SYSTEM, Local Service or a gMSA account. Avoid the servicenow user account, since user accounts aren't normally designed to run Windows Services. If you go with gMSA, you normally need "Logon As a Service" and "Debug Programs" privileges. "Debug Programs" is to retrieve the full path of running processes along with their parameters. You can find more information in the KB1122613 in the webinars, as well as some command line samples in the git repository.

Séverin