Installing RSCD agents in a replicated domain controller environment
To install RSCD agents in a Windows replicated domain controller environment, you set Domain Controller Security Policies on one domain controller and then install RSCD agents in the correct sequence on all domain controllers.
In some situations it might be advisable to create a unique user for the Domain Controllers or each Domain Controller, as there are situations where member servers could cause the domain level BladeLogicRSCD account to lock. You can create this alternate account to use in place of BladeLogicRSCD (a user that is automatically created when you install the RSCD agent) either before or after agent installation. This is a known issue with certain utilities that run through the RSCD agent, as the utility first tries to authenticate to the domain with the credentials of the user that is running the utility, which in this case is the member server's BladeLogicRSCD account.
If you want to create a single account for each domain controller (instead of the default single account for all domain controllers), or if you want to use an alternate account name that differs from the default BladeLogicRSCD, you can perform the procedure described in this topic. Performing the installations in this way ensures that the BladeLogicRSCD account does not become locked during replication attempts by the domain controllers.
The password for the BladeLogicRSCD user or an alternate user of non-domain controller machines is generated at run time. However in the case of a domain controller, the BladeLogicRSCD user or alternate user is assigned a password from a fixed set of passwords. Contact BMC Support for your default password. BMC recommends that you change the default password as per your company's password policies. For steps on changing the password, see Changing-the-BladeLogicRSCD-account-password-on-domain-controllers.
Before you begin
During RSCD agent installation, you map a client user to a local user on the target server. Make sure that the local user to which you are mapping is a direct member of the Builtin\Administrators group and you do not map to the BladeLogicRSCD account.
Preparing an alternate user name for the agents in the Windows system
When creating an alternate user name for the RSCD agent, limit the length of the user name to a maximum of 20 characters. By design, the agent fails to create the account if you use more than 20 characters.
Installing RSCD agents in a replicated domain controller environment with the default, alternate, or per-server account name
On a domain controller, perform the following steps to set Domain Controller Security Policies for the BladeLogicRSCD user account (or any other equivalent account that you use for running the agent in the domain):
- Start the Group Policy Management Console (GPMC).
- In the GPMC console tree, right-click Default Domain Controllers Policy, and then click Edit.
- In the Group Policy Management Editor window, in the console tree, go to Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/User Rights Assignment.
- In the details pane, double-click Deny logon locally.
- Ensure that the Define these policy settings check box is selected, and then click Add User or Group.
- Type the name of the account that you want to deny the ability to log on locally (BladeLogicRSCD or any other equivalent account that you use for running the agent in the domain). As an alternative, click Browse to locate the account with the Select Users, Computers, or Groups dialog box, and then click OK.
- After you have the account name entered, click OK in the Add User or Group dialog box, and then click OK in the Deny Log on Locally Properties dialog box.
Repeat for User Right Log on as a batch job.
- If you use a unique account name per domain controller, each account name must be present in the above policies.
- Continue with the relevant task:
Installing with the default account
Install the RSCD agent on the PDC emulator.
- After the default account is created, force replication from Active Directory Sites and Services to the other domain controllers.
- Install the RSCD agent on the other domain controllers.
Installing or modifying an existing installation with an alternate or per-server account
- If the RSCD agent is already installed and running on the target Domain controller(s), stop the RSCD service (see Starting-and-stopping-the-RSCD-agent).
- On the PDC emulator in the domain, add (if this is a fresh installation) or modify (pre-existing installation) the registry value HKEY_LOCAL_MACHINE\SOFTWARE\BladeLogic\RSCD Agent\BladelogicRSCDUser. The registry value should be of type REG_SZ (string value), and be set to the desired account name.
- If you will be using the same account name on other domain controllers in the domain, complete the following steps:
- On the other domain controllers in the domain, add or modify the same registry value and use the same account name as on the PDC emulator.
- Install the RSCD agent or start the RSCD service on the PDC emulator.
- After the service has started and the service account exists, force replication to the other domain controllers from the Active Directory Sites and Services menu.
- Install or start the the RSCD agent on the other domain controllers.
- If you will use a unique account name for each domain controller, complete the following steps:
- On the other domain controllers in the domain, add or modify the same registry value and use the unique account name.
- Install or start the RSCD agent on each domain controller after making the registry change (there is no concern about replication or order here as each system gets its own account).