I'm still not clear on this. When I installed Operations Manager 2007 R2 I created domain accounts for Action, SDK, and DW R/W. They all have just domain user rights, setup according to documentation. During install I specified the action account. Now that everything is up and running I see two action accounts in SCOM. My domain account and Local System Action Account. How does Local System Action Account differ? When should I use each? My domain account is the default action account so I assume I'm going to run into issue's installing agents unless it make it a local admin on every computer I want to monitor. Before I might possibly make the domain account a domain/enterprise admin I want to know how the Local System Action Account works.

If you are not using the account, then it isn't being used. If you are using it, then you will see the account used to run certain workflows according to the run-as associations you make. In general LocalSystem has some advantages, but some disadvantages. First, it never expires. It is able to do nearly everything a local administrator can do. However it is sandboxed and can only access local resources via local access methods. It cannot access the network in any way. Microsoft Corporation

So is Local System assuming the SCOM local system account or the local system account on the remote managed machine? I have my domain account set to never expire so I don't see that being an advantage. Can anyone tell me real world scenarios where I'd want to use one over the other?

Domain accounts that never expire and have locked down are probably just as good. The advantage local system will always have is that it CANNOT make network requests of any sort- so a rogue workflow introduced maliciously by tricking your admin to import a managemnet pack could never get elevated privileges to do remote logon actions, etcMicrosoft Corporation

Here are more information regarding OpsMgr account: http://blogs.technet.com/b/kevinholman/archive/2008/04/15/opsmgr-security-account-rights-mapping-what-accounts-need-what-privileges.aspxPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

During install I specified the action account. I assume you mean the management server action account? If so, this account is used for running actions from the management servers in your domain (push install for example). The local system account is the account which is default used to run the agent on the remote server (and can reside in any domain, trusted or untrusted).Regards, Marc Klaver http://jama00.wordpress.com/