search

hmscott4 / AlertManagement

Manage SCOM Alerts
2 stars 3 forks source link

Consider Adding a RunAs profile #42

Closed hmscott4 closed 3 years ago

hmscott4 commented 3 years ago

With SCOM 2019, Service Accounts can now be Group Managed service accounts. Potentially, this means that they will authenticate to remote servers as the machine name. Consider adding a Run As profile to the MP and running the scripts as the Run As profile. Examples:

<TypeDefinitions>
    <SecureReferences>
      <SecureReference ID="Microsoft.OpsMgr.AlertManagement.RunasProfile" Accessibility="Public" />
    </SecureReferences>
</TypeDefinitions>

<DataSourceModuleType ID="SCOM.Alert.Management.Assign.Rule.DataSource" Accessibility="Public" Batching="false" RunAs="Microsoft.OpsMgr.AlertManagement.RunasProfile">

If the admin does not assign an account to the profile, then nothing changes (it will run as the default). The account should be a member of the SCOM Admins group, but it might be enough to be a member of an advanced operators group.

hmscott4 commented 3 years ago

Fixed.