Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My company supports a number of windows services which use integrated security/windows authentication to manage their connections to the database. So these windows service all run with a special domain account. We are under new rules to reset these passwords every 90 days. Are there tools or ways to automatically have these windows service passwords updated across a number of different services in a farm?

share|improve this question
6  
If those servers are running W2K8R2 then it sounds like a perfect use case for managed service accounts. –  joeqwerty Jul 19 '12 at 21:38
    
The specific version of Windows and your domain and forest functional levels would also be good information to have. Although, actually, I'm not sure what you're asking - are you asking how to automate the changing of "service account" passwords in AD, or how to automate updating the credentials put in to run a service as a specific account, as in through services.msc? (Or both?) –  HopelessN00b Genius of network Jul 19 '12 at 22:20
    
It looks like Joe provided exactly what I was looking for. Managed service accounts. –  chris Jul 19 '12 at 22:56
    
As an additional information: managed service accounts were restricted to a single machine with Windows Server 2008R2. Group managed service accounts will be available with Windows Server 2012 allowing the use of a single service account over several machines. –  syneticon-dj Jul 20 '12 at 9:53
    
you can use local virtual accounts for this purpose too. –  tony roth Jul 20 '12 at 18:26
add comment

1 Answer

There are managed service accounts on Windows Server 2008 R2 and even better capabilities in Windows Server 2012. If you can, use these. http://technet.microsoft.com/en-us/library/hh831782.aspx

There are also commercial tools that will help you manage service accounts. They will work with older platforms where managed service accounts are not supported and will also help manage service accounts in legacy applications, COM+, configuration files and more.

Another thing these tools can do is find all the service accounts on the network and all the places they are being used. Basically lots of automation.

The tool that I have experience with is Thycotic Secret Server but there are other tools that do this too.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.