Can ERPM manage its own service account?

[Chris]

Q: Can ERPM manage its own service account?

A: Yes and no. The account used for the deferred processing service cannot be automatically managed because implementing a new service account password requires restarting the service, this will cause the job to be stopped and left in a locked state during the job run. Jobs which are locked must have their locks manually removed before they can be re-run. This will leave the job in an unfinished and indeterminate state. If a separate account (separate from the deferred processing service) is used to run the website COM object, this can be managed without impact.

There are other methods however.

Another method which can be employed mirrors configurations seen with Microsoft's system center application and works for domain joined systems.

The setup is to add the ERPM host system computer account in the domain to a domain group. This group in turn has been granted access (as required in the install docs) to the target systems. Meaning in some cases, the domain group would be added to the administrators groups on target systems. This domain group is also given the required permissions on the MS SQL database (there are no changes required when using Oracle). The deferred processing service, instead of being an actual user is configured to run as LocalSystem. The host system is then restarted to reflect the new changes in the domain privileges and memberships.

The COM object must still run as a user account but can be safely managed by ERPM without impacting the ERPM system.