Agent Action Account on a Domain Controller

[martit01]

Is it possible to push the SCOM agent to a Domain Controller? I'm having
difficulty doing this because the Agent Action Account is suppose to be a
member of the local Administrators group, but this isn't possible to do on a
DC.

Thanks

[Manish Godse [MSFT]]

You can use different action and "push" accounts. Can you describe what
issue you are running into?
--
Thanks,


This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Post by martit01
Is it possible to push the SCOM agent to a Domain Controller? I'm having
difficulty doing this because the Agent Action Account is suppose to be a
member of the local Administrators group, but this isn't possible to do on a
DC.
Thanks

[martit01]

Sorry, instead of Agent Action Accont, I meant Management Server Action
Account (MSAA)
I'm trying to deploy the SCOM agent to a domain controller using the
discovery wizard through the SCOM console. When I've done this in the past to
non-Domain Controller servers, I alway added the MSAA account to the local
administrators group on the server, which gives the needed permissions to
install the agent.

However, since DC's don't allow any local administrator groups to be added,
I don't understand how I'm suppose to grant the Domain controller permissions.

Thanks

Post by Manish Godse [MSFT]
You can use different action and "push" accounts. Can you describe what
issue you are running into?
--
Thanks,
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Post by martit01
Is it possible to push the SCOM agent to a Domain Controller? I'm having
difficulty doing this because the Agent Action Account is suppose to be a
member of the local Administrators group, but this isn't possible to do on a
DC.
Thanks

[Pavel Řepa, MCTS SCOM]

Hello martit01,

for deploy the SCOM agent to a domain controller by using the discovery
wizard through the use of SCOM console, you must use account with Domain
Admins permissions for discovery (Administrator Account) and Local System for
Agent Action Account.

For monitoring Active Directory you must create RunAs Account and set RunAs
Profile "Active Directory Based Agent Assignment Account" for work with him.


Pavel Repa, MCTS SCOM
--
System Center Specialist
http://pavelrepa.spaces.live.com/...

Post by martit01
Sorry, instead of Agent Action Accont, I meant Management Server Action
Account (MSAA)
I'm trying to deploy the SCOM agent to a domain controller using the
discovery wizard through the SCOM console. When I've done this in the past to
non-Domain Controller servers, I alway added the MSAA account to the local
administrators group on the server, which gives the needed permissions to
install the agent.
However, since DC's don't allow any local administrator groups to be added,
I don't understand how I'm suppose to grant the Domain controller permissions.
Thanks

Post by Manish Godse [MSFT]
You can use different action and "push" accounts. Can you describe what
issue you are running into?
--
Thanks,
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Post by martit01
Is it possible to push the SCOM agent to a Domain Controller? I'm having
difficulty doing this because the Agent Action Account is suppose to be a
member of the local Administrators group, but this isn't possible to do on a
DC.
Thanks

[Ron Hagerman]

Post by martit01
Is it possible to push the SCOM agent to a Domain Controller? I'm having
difficulty doing this because the Agent Action Account is suppose to be a
member of the local Administrators group, but this isn't possible to do on a
DC.
Thanks

What we did was, we just dropped one of the domain admins in the Ops Mgr
admins role and allowed him to deploy his own agents with his credentials.

Another option is to have the domain admins do a manual agent install
and then approve the agent in the SCOM console.