SCOM 2012 R2 - The management server action account and the local system account
SCOM 2012 R2 - After installing the agent on a server, using a domain Management Server Action Account, thereafter the Health Service runs under Local System, but in the Console the action account is listed as the actual management server action account. In the second scenario, if the installation is done using Local System, the Health Service still runs under Local System account.  Please explain the differences between these two scenarios as well as any advantage(s), if any.
June 24th, 2015 3:15pm

The action account is used to gather information about, and run responses on, the managed computer (a managed computer being either a management server or a computer with an agent installed). The MonitoringHost.exe processes run under the action account or a specific Run As account. There might be more than one MonitoringHost.exe process running on the agent at any given time.
Some of the actions that MonitoringHost.exe performs include:
Monitoring and collecting Windows event log data.
Monitoring and collecting Windows performance counter data.
Monitoring and collecting Windows Management Instrumentation (WMI) data.
Running actions such as scripts or batches.

The service account for Microsoft Monitoring agent service is used for SCOM agent to store collection data into local database and send this information to management server
The SCOM agent service will run as local system no matter what action account you select.

Any action the agent takes will then spawn a monitoring host process using said action account. This means that any monitoring being done will in fact use the configured action account even though the System Center Management / Health Service is running as local system.

Roger

 

Free Windows Admin Tool Kit Click here and download it now
June 24th, 2015 11:43pm

The action account is used to gather information about, and run responses on, the managed computer (a managed computer being either a management server or a computer with an agent installed). The MonitoringHost.exe processes run under the action account or a specific Run As account. There might be more than one MonitoringHost.exe process running on the agent at any given time.
Some of the actions that MonitoringHost.exe performs include:
Monitoring and collecting Windows event log data.
Monitoring and collecting Windows performance counter data.
Monitoring and collecting Windows Management Instrumentation (WMI) data.
Running actions such as scripts or batches.

The service account for Microsoft Monitoring agent service is used for SCOM agent to store collection data into local database and send this information to management server
The SCOM agent service will run as local system no matter what action account you select.

Any action the agent takes will then spawn a monitoring host process using said action account. This means that any monitoring being done will in fact use the configured action account even though the System Center Management / Health Service is running as local system.

Roger

 

  • Marked as answer by Dee Mien 17 hours 24 minutes ago
June 25th, 2015 3:34am

The action account is used to gather information about, and run responses on, the managed computer (a managed computer being either a management server or a computer with an agent installed). The MonitoringHost.exe processes run under the action account or a specific Run As account. There might be more than one MonitoringHost.exe process running on the agent at any given time.
Some of the actions that MonitoringHost.exe performs include:
Monitoring and collecting Windows event log data.
Monitoring and collecting Windows performance counter data.
Monitoring and collecting Windows Management Instrumentation (WMI) data.
Running actions such as scripts or batches.

The service account for Microsoft Monitoring agent service is used for SCOM agent to store collection data into local database and send this information to management server
The SCOM agent service will run as local system no matter what action account you select.

Any action the agent takes will then spawn a monitoring host process using said action account. This means that any monitoring being done will in fact use the configured action account even though the System Center Management / Health Service is running as local system.

Roger

 

  • Marked as answer by Dee Mien Thursday, June 25, 2015 1:46 PM
Free Windows Admin Tool Kit Click here and download it now
June 25th, 2015 3:34am

The action account is used to gather information about, and run responses on, the managed computer (a managed computer being either a management server or a computer with an agent installed). The MonitoringHost.exe processes run under the action account or a specific Run As account. There might be more than one MonitoringHost.exe process running on the agent at any given time.
Some of the actions that MonitoringHost.exe performs include:
Monitoring and collecting Windows event log data.
Monitoring and collecting Windows performance counter data.
Monitoring and collecting Windows Management Instrumentation (WMI) data.
Running actions such as scripts or batches.

The service account for Microsoft Monitoring agent service is used for SCOM agent to store collection data into local database and send this information to management server
The SCOM agent service will run as local system no matter what action account you select.

Any action the agent takes will then spawn a monitoring host process using said action account. This means that any monitoring being done will in fact use the configured action account even though the System Center Management / Health Service is running as local system.

Roger

 

  • Marked as answer by Dee Mien Thursday, June 25, 2015 1:46 PM
June 25th, 2015 3:34am

Thanks for the helpful clarification, Rogers.  
Free Windows Admin Tool Kit Click here and download it now
June 25th, 2015 9:46am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics