"Local System" Deployment and double hop scenarios

Hi all,
I was wondering if some of you have implemented a good solution dealing with the fact that all ConfigMgr 2012 Applications got executed in local system context and that there is no good solution to execute them with other credentials. We checked the options
in a TS to run with different credentials as well as Network Access Accounts (winrm, remoting)
Both solutions doesn't fit our requirements. We usually deploy some infrastructure components or roles using ConfigMgr 2012. Many of these applications use Cmdlets provided by the vendor to install and configure. Some of these Cmdlets connect back to other
infrastructure components and produce a double hop scenario. Citrix infrastructure components are a good sample.
As it is not allowed to impersonate a user by local system, it's really hard to find a good solution which still allows "natural" powershell scripts without several hacks.
I'think we have found a good solution for creating PSCredentials in our scripts and use them to invoke the commands, but we still see the double hop issue then.
My question is:
- Do you guys face the same issues in real life? How do you deal with "local system" and "domain accounts" used for SW Distribution?
- Do you use CredSSP ? Any hints or suggestions regarding this?
- Any other cool idea to impersonate or address double hop ?

Hi Sebastian,
>no good solution to execute them with other credentials.
>allows
"natural" powershell scripts without several hacks.
There is no perfect solution to including credentials, but there are some good options out there. One is to use a Task Sequence to deploy your application with the "Run
Command Line" step which allows you the option to "Run this step as the following account". Another option is to include
the password with the PowerShell script.
Both options allow you to remove the hop of executing as Local System by default. Both options have the same drawback that the password is not really securely stored
(they are encrypted somewhat reversibly).
> different credentials as well as Network Access Accounts
The Network Access Account is (and should be) only used for downloading content from the distribution point. It is not used to execute things locally on the managed device.
>Do you use CredSSP ? Any hints or suggestions regarding this?
Are there any specific problems you are having with CredSSP
that arent explained here?
I hope that helps,
Nash
Nash Pherson, Senior Systems Consultant
Now Micro -
My Blog Posts
If you found a bug or want the product to work differently,
share your feedback.
<-- If this post was helpful, please click the up arrow or propose as answer.

Similar Messages

Running a cscript.exe as LOCAL SYSTEM account and IE cache corruption for that account.

When running a cscript.exe wsf file that references a script that retrieved from the internet is it possible that some sort of IE cache corruption or permissions issue in
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows will cause the script to fail to retrieve the external resource?
Also, is there some sort of known condition that will cause the permissions on C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows to not be set to any valid user?

The system profile is set to be protected. It should not be modified.
You cannot run a file downloaded from the Internet. It is tagged (blocked) and cannot be used until it is unblocked.
PowerShell has a CmdLet that does this: Unblock-File <filename>
¯\_(ツ)_/¯

Total System Slowdown - and Double-Digit Safari CPU Usage

Got a white first-gen MacBook that's slowing to a crawl. Activity Monitor shows everything in single digits or below, except Safari -- which is up around 50 - 60.
Any ideas as to how I can fix this? Running Safari 3.2.1.
Thanks.
-- J

I just stumbled across this post, searching for a reason for my MacBook to be so slow. When I opened Activity Monitor, I find that Safari (version 4) is using 142 MB real memory. What the heck??? I have one window, one tab open, so that can't be the problem. Any thoughts on how I can correct this???
Thanks!!!

Create DB link between my local system and remote system

Hi,
I need help to create DB link between my local system Database and remote system database both the database are oracle.
Please check the script which i have written is correct or not. Its giving me error sql command not ended properly
create public database link MERU_PROD_LOCAL_PROD
CONNECT TO SUDHIR
identified by sudhir123
using (DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS =
(COMMUNITY = tcp.world)
(PROTOCOL = TCP)
(Host = 23.23.150.144)
(Port = 1521)
(CONNECT_DATA = (SERVICE_NAME = sudhir)
I am executing this command in my local system connecting to the remote database link. Please suggest me is this method correct.
Thanks
Sudhir

Hi Hilton,
I fixed that issue. Now i am creating the DB link this ways please check is this proper or not
create or replace database link meru_prod_local_prod connect to portal identified by Oracle!123 using 'MERUPROD';
remote machine
User Name: portal
Password : Oracle!123
MERUPROD is the tnsora entry
It gives error as
Error starting at line 1 in command:
create or replace database link meru_prod_local_prod connect to portal identified by Oracle!123 using 'MERUPROD'
Error at Command Line:1 Column:18
Error report:
SQL Error: ORA-00922: missing or invalid option
00922. 00000 - "missing or invalid option"
*Cause:
*Action:

FMS Developer Ed & Local System account

Is it only possible to run the FMS service as the Local
System account in Windows Server 2003? I tried to change the Log On
params to a user with privileges to another server's share but the
service won't start up afterward. And in the info box in the FMS
Admin app there is a little tiny tooltip within the popup message
that says something about "License info". I changed the user back
to Local System account and the service started up right away. I'm
trying to test an app's ability to access a different path that's
set in the application.xml <VirtualDirectory><Streams>
node.
So, is it a limitation of the FMS Developer edition or is it
something on our end? I thought the only limitation was 10
conncections.

... i have unchecked that from there and again after some minutes say 10 -15 minutes it gets locked ...
Hi,
Perhaps you can look into these areas for stored (and expired) password:
Check to see if there are any Services that is running using the affected administrator account.
Check to see if there are any Scheduled Tasks running using the affected administrator account.
Hope that helps.
Cheers,
Tas Chew

Oracle 10g on Windows 2003: Can't start with any account but Local System

Fresh install of Oracle 10g on Windows 2003. I install as a member of the local admin group and everything works great. The various services are starting as Local System, though, and I'd prefer to set them up to start as a specific domain user account.
When I make that change, however, I can't get any of the Oracle related services to start. I've added this domain user to the local ora_dba group on my server, given it the ability to log on as a batch job and log on as a service in the local security policy. Doesn't seem to help.
I saw a thread that implied using a domain user account wasn't supported (didn't seem right to me, but what the hell), so I created a local user account and tried that. Same result.
Something I'm missing?
Thanks.

What is missing, I suspect, is reading the installation docs.
http://docs.oracle.com
If that doesn't work then come back and ask specific requestions referencing the appropriate document and naming the actual version you are trying to install (ps 10g is a marketing name not a version number).

Installation and deployment of operating system, applications and patches in Unix environment

Is it possible to use Configuration Manager 2012 (or 2012 R2) to perform remote installation of operating system, applications and patching in a Unix environment?
Balaji Kundalam

ConfigMgr does not support Operating System Deployment for non-Windows OS flavors.
You can use the ConfigMgr client on a Unix device to install applications and to instruct the device to install patches. Basically, the client will download files and run a script against them. If there is a patch manager in your flavor of *nix, you
can run a script to install the patches.
See the supported operating systems here:
http://technet.microsoft.com/en-us/library/gg682077.aspx#BKMK_SupConfigLnUClientReq
I hope that helps,
Nash
Nash Pherson, Senior Systems Consultant
Now Micro -
My Blog Posts
If you've found a bug or want the product worked differently,
share your feedback.
<-- If this post was helpful, please click "Vote as Helpful".

How do I take the zoom feature off my MacBook Pro? I have already went to System Preferences and turned "zoom" off in the Universal Access. I saw where someone said to use THREE fingers to double click... ??? Double click what? And 3 fingers?

Can someone help me?How do I take the zoom feature off my MacBook Pro? I have already went to System Preferences and turned "zoom" off in the Universal Access. I saw where someone said to use THREE fingers to double click... ??? Double click what? And 3 fingers?

What really cheeses me off here is that Apple isn't allowing users enough customization. With each update of iTunes (and the OS and iOS) we're forced to give up something that worked well for the way we want to use the app and make do with fewer (and lamer) options. If Apple keeps this up, they're going to start losing customers fast. I mean if this isn't fixed soon, I'm pretty sure I'm going to give up on iTunes, and then I'll probably go ahead and get a Galaxy when I need to replace my iPhone.
What I don't understand about how they won't let users delete the list of available podcasts now is why? How is this making it a better program? I can understand that not all users are capable enough to right-click on a feed and select "Show all available episodes", so I can see why they want the complete list to be the default (and, surprise, it already was). But to not give users the option to delete that list? It's inconsiderate because it makes navigating feeds with a large back catalogue really frustrating. I'm flabbergasted that no one at Apple considered all the podcast feeds that keep hundreds of episodes available when they removed this feature. It smacks of rank incompetence.
What improvement were they trying to make here anyway? There was nothing wrong to my mind about how podcasts were managed in previous versions. Whatever improvement they were trying to make here, they should have realized that many users would at least want the option to keep things the way they were.
And reverting to a previous version is no solution. I can't sync my iPhone with the new iOS without this update, and (while I do have some issues--specifically how you can't play podcasts in the Music app anymore) I do like the new iOS.

Open And Edit Word File In SharePoint Site Programmatically (Without Save On Local system)

Hi Sir ,
I am working as sharepoint developer. I have face some problem in Edit and open document file in sharepoint site programmatically. I want to open file and edit directly in sahrepoint site without save in local system,
Issue: I have upload one doc file then try to edit and open but In that case file is dowanload and save in local save.

Hello,
As i understand you want to open and update word file. Please have a look at below links:
http://mysharepointwork.blogspot.ca/2010/06/programmatically-open-and-save.html
http://howtosharepoint.blogspot.ca/2010/05/programmatically-edit-and-save-file.html
It is good place to start.
Hemendra:Yesterday is just a memory,Tomorrow we may never see
Please remember to mark the replies as answers if they help and unmark them if they provide no help

I have been taken over by a local network that has disabled my systems profiler and plug-ins. how do I break free?

I have been taken over by a local Network that has disabled my systems profiler and plug-ins. How do I break free?

If you are absolutely sure that this is the problem then you should turn the airport off.

Converting to PDF and saving to local system

I want to provide a button on the screen, onclick of which the current screen output should be converted in "pdf" format and the user should be able to save it onto his local system.
Can anyone tell me how to do it ??
what functions do i need to use to convert it to pdf and then to allow user to save on local system??

Hi,
This might be very helpful too:
http://www.go2pdf.com/
This faq is a bit what you want:
http://www.go2pdf.com/web-to-pdf.html
Eddy

Synchronisation between server and local systems

Hello guys,
I hired a Vserver running with Debian and would like to synchronise it spaced (after/before start/shutdown of my local systems and in between every 30 minutes or so) with my local systems, more precisely with my home directories or some directories I define and not the complete system.
How could that be realised best?
Should I take some programs or are there any small scripts as well that do that work?
I apologise for that stupid question but I have not any experiences with issues like backup and synchronisation.
Thank you in advance.
Last edited by orschiro (2009-06-04 23:28:31)

Hello tkdfighter,
sorry but I can't follow you. Could you please be more detailed because I don't know how the functions you speak from can help me in my case.
Basically I just have that problem because I synchronise the server from two different machines and so the archive name differ from machine to machine. I already took a look on the Wikipage but unfortunately it helped me not with that problem.
Greets
Last edited by orschiro (2009-06-16 17:56:24)

Query for Local Currency(GBP) and System Currency (USD).

Can someone help me with this query. Currently this query returns "Document Curreny" and ":System Curreny"(USD), but I need it to return "Local currency" (GBP) and "System Currency." USD. I am not sure how to change it to reflect LC & USD. This query works for DC and SC. I need LC an SC. Thanks Danielle Select T4.[SlpName] as 'Sales Employee', T0.cardname as 'Customer',T0.Docdate as 'Invoice Date', T0.docnum as 'Invoice Number', T0.Taxdate as 'Month Of Service',isnull(T0.U_AIS_DVISFSO,T3.U_AIS_DVISFSO) as 'SO#',T0.NumAtCard as 'PO#', isnull(T0.U_AIS_DVIAdvNm,T3.U_AIS_DVIAdvNm) as 'Advertiser', isnull(T0.U_AIS_DVIOpptyNm,T3.U_AIS_DVIOpptyNm) as 'Campaign',T1.Dscription,-T1.Quantity as 'Impressions',T1.Pricebefdi as 'CPM', Case T0.CurSource When 'C' Then T0.DocCur When 'L' Then T5.MainCurncy When 'S' Then T6.SysCurrncy End As 'Currency DC', Case T0.CurSource When 'C' Then -T1.TotalFrgn When 'L' Then -T1.LineTotal When 'S' Then -T1.TotalSumSy End As 'Total Bef Discount DC', Case T0.CurSource When 'L' Then -T1.[LineVat] When 'C' Then -T1.[LineVatlF] When 'S' Then -T1.[LineVatS] END As 'Vat Tax DC', Case when t1.visorder = 0 Then (Cast(Round((Case T0.CurSource When 'L' Then -T0.DocTotal When 'C' Then -T0.DocTotalFC When 'S' Then -T0.DocTotalSy End), 2) As DECIMAL(18,2))) ELSE 0 END As 'Doc Total DC', Case when t1.visorder = 0 Then (Cast(Round((Case T0.CurSource When 'L' Then -(T0.DocTotal - T0.PaidToDate) When 'C' Then -(T0.DocTotalFC - T0.PaidFC) When 'S' Then -(T0.DocTotalSy - T0.PaidSys) End), 2) As DECIMAL(18,2))) ELSE 0 END As 'Balance after Payment DC', ISNULL(T6.SysCurrncy,'USD') As 'Currency SC', -T1.TotalSumSy As 'Total Bef Discount SC', -T1.[LineVatS] As 'Vat Tax SC', Case when t1.visorder = 0 Then (Cast(Round(-(T0.DocTotalSy), 2) As DECIMAL(18,2))) ELSE 0 END As 'Doc Total SC', Case when t1.visorder = 0 Then (Cast(Round(-(T0.DocTotalSy - T0.PaidSys), 2) As DECIMAL(18,2))) ELSE 0 END As 'Balance after Payment SC', T0.docstatus, 'Credit Memo' AS TransactionType, T0.CurSource,T0.[Comments],T0.[U_InvoiceAdj], T0.[U_DV_AdjustInvReason],T1.[U_DVIInvName], T1.[U_InvoiceAdj], T1.[U_DV_AdjustInvReason] from ORIN T0 left outer join RIN1 T1 on T0.docentry = T1.docentry left outer join RDR1 T2 on T1.Baseentry = T2.docentry and T1.baseline = T2.linenum left outer join ORDR T3 on T2.docentry = T3.docentry left outer join OSLP T4 ON T0.Slpcode= T4.Slpcode Left Join OADM T5 On T0.CurSource = 'L' Left Join OADM T6 On T0.CurSource = 'S' Where T0.[DocDate] >= '[%1]' AND T0.[DocDate] = '[%1]' AND T0.[DocDate] <= '[%2]'

Hi,
Try this:
Select T4.[SlpName] as 'Sales Employee', T0.cardname as 'Customer',T0.Docdate as 'Invoice Date', T0.docnum as 'Invoice Number', T0.Taxdate as 'Month Of Service',T0.NumAtCard as 'PO#', T1.Dscription,T1.Quantity as 'Impressions',T1.Pricebefdi as 'CPM',
Case T0.CurSource
When 'L' Then T0.DocCur
When 'L' Then T5.MainCurncy
When 'S' Then T6.SysCurrncy End As 'Currency LC',
Case T0.CurSource
When 'L' Then -T1.TotalFrgn
When 'L' Then -T1.LineTotal
When 'S' Then -T1.TotalSumSy End As 'Total Bef Discount LC',
Case T0.CurSource
When 'L' Then -T1.[LineVat]
When 'C' Then -T1.[LineVatlF]
When 'S' Then -T1.[LineVatS] END As 'Vat Tax LC', Case when t1.visorder = 0 Then (Cast(Round((Case T0.CurSource When 'L' Then -T0.DocTotal When 'C' Then -T0.DocTotalFC When 'S' Then -T0.DocTotalSy End), 2) As DECIMAL(18,2))) ELSE 0 END As 'Doc Total LC', Case when t1.visorder = 0 Then (Cast(Round((Case T0.CurSource When 'L' Then -(T0.DocTotal - T0.PaidToDate) When 'C' Then -(T0.DocTotalFC - T0.PaidFC) When 'S' Then -(T0.DocTotalSy - T0.PaidSys) End), 2) As DECIMAL(18,2))) ELSE 0 END As 'Balance after Payment LC', ISNULL(T6.SysCurrncy,'USD') As 'Currency SC', -T1.TotalSumSy As 'Total Bef Discount SC', -T1.[LineVatS] As 'Vat Tax SC', Case when t1.visorder = 0 Then (Cast(Round(-(T0.DocTotalSy), 2) As DECIMAL(18,2))) ELSE 0 END As 'Doc Total SC', Case when t1.visorder = 0 Then (Cast(Round(-(T0.DocTotalSy - T0.PaidSys), 2) As DECIMAL(18,2))) ELSE 0 END As 'Balance after Payment SC', T0.docstatus, 'Credit Memo' AS TransactionType, T0.CurSource,T0.[Comments] from ORIN T0 left outer join RIN1 T1 on T0.docentry = T1.docentry left outer join RDR1 T2 on T1.Baseentry = T2.docentry and T1.baseline = T2.linenum left outer join ORDR T3 on T2.docentry = T3.docentry left outer join OSLP T4 ON T0.Slpcode= T4.Slpcode Left Join OADM T5 On T0.CurSource = 'L' Left Join OADM T6 On T0.CurSource = 'C' Where T0.[DocDate] >= '[%1]' AND T0.[DocDate] <= '[%2]'
Thanks & Regards,
Nagarajan

Clarifications on EBP-SUS and MM-SUS Scenario

Hi !
We are planning to implement EBP-SUS and MM-SUS in one Client . Request you to help us on the following issues.
1. While the outbound messages will not have a problem from MM & EBP, how do we route inbound messages to MM & EBP effectively. Should be handle it in XI ?? If ues, what is the best criteria .
2. Since both the config guides for MM-SUS and EBP-SUS scenarios include transactions for transferring Vendor & Comapny Code data, how do we check duplication.For ex : if we transfer a Vendor from R/3 and subsequently try to transfer the same vendor from EBP , is there any inbuilt duplicate check ?
3. In MM-SUS, an ASN created in SUS creates an inbound delivery is created in MM. What would happen in case of EBP-SUS i.e when an ASN is created for an EBP PO ? We are on extended classic scenario ?
4.If you do a confirmation in EBP-SUS, will a GR be generated in both EBP and subsequently in MM.
Request yr help pl.
Regards

Hi
Welcome to world of SRM.
I guess, you must have got enough details in the SRM guides.
Anyways, better to understand the basics first,, before going in detail. I hope this will answer all your queries.
Refer to these links ->
Supplier Enablement
http://help.sap.com/saphelp_srm50/helpdata/en/cd/0e343e47fd6b2ee10000000a114084/frameset.htm
SUS-EBP Scenario
http://help.sap.com/saphelp_srm50/helpdata/en/06/0f343e47fd6b2ee10000000a114084/frameset.htm
SUS-MM Scenario
http://help.sap.com/saphelp_srm50/helpdata/en/39/0f343e47fd6b2ee10000000a114084/frameset.htm
Supplier Self-services
http://help.sap.com/saphelp_srm50/helpdata/en/25/99b13c48740d55e10000000a114084/frameset.htm
Procurement
http://help.sap.com/saphelp_srm50/helpdata/en/8e/e5623c046a9b67e10000000a11402f/frameset.htm
Users in SRM user Management
http://help.sap.com/saphelp_srm50/helpdata/en/cd/6313513813554e941a02a91540c29e/frameset.htm
Please try this SAP OSS notes as well to get System architecture details->
Note 982871 - Consulting services: supplier integration in SRM
963000 - Usage and release of SRM as AddOn to ECC in ERP2005
868192 - Consulting solution: SUS-MM (SUS-MMSRV) service procurement
573383 - EBP and SUS deployment variants
Also do read this ->
Check whether the roles delivered by SAP meet your requirements. If not, you can create new roles and assign transactions to them. We recommend that you copy standard roles and tailor them to your requirements.
All users assigned to a respective role are then allowed to carry out the transactions. If required, you can refine the authorization check on the tab page Authorizations.
Standard SAP Single-roles
SAP_EC_SUS_ADMIN_PURCHASER (for purchasing administrators - SAP Supplier Self-Services)
SAP_EC_SUS_BIDDER (for bidders - SAP Supplier Self-Services)
SAP_EC_SUS_DISPATCHER (for dispatchers - SAP Supplier Self-Services)
SAP_EC_SUS_INVOICER (for invoicers - SAP Supplier Self-Services)
SAP_EC_SUS_ORDER_PROCESSOR (for order processors - SAP Supplier Self-Services)
SAP_EC_SUS_MANAGER (for managers - SAP Supplier Self-Services)
SAP_EC_SUS_SERVICE_AGENT (for service agents - SAP Supplier Self-Services)
If you want to use SAP Supplier Self-Services, proceed as follows:
1. Select one of the following single roles:
SAP_EC_SUS_ADMIN_PURCHASER
SAP_EC_SUS_ADMIN_VENDOR
SAP_EC_SUS_BIDDER
SAP_EC_SUS_DISPATCHER
SAP_EC_SUS_INVOICER
SAP_EC_SUS_MANAGER
SAP_EC_SUS_ORDER_PROCESSOR
SAP_EC_SUS_PRODUCT_MANAGER
SAP_EC_SUS_SAR_PROCESSOR
SAP_EC_SUS_SERVICE_AGENT
SAP_EC_SUS_SERVICE_MANAGER
2. Choose Change Roles.
3. Choose the Personalization tab page.
Note: The personalization applies to all roles, meaning the user can also create his own roles, for example copying the delivered SAP SUS roles. He can tailor these roles to his requirements by changing the SUS-specific attributes (BBP_SUS_ROLE_ATTRIBUTES).
1. Select the entry BBP_SUS_ROLE_ATTRIBUTES (SUS-specific role attributes).
2. Choose Change values.
A dialog box for maintaining SUS-specific roles appears.
3. If required, perform the following steps:
If the role should be displayed in the SUS User Management (UM) and should be able to be assigned to the relevant user by the supplier administrator, set the indicator to display the role in SUS UM.
If the user should be displayed as a service agent for the purchaser, set the Service agent indicator.
If you want to define the user as an SRM administrator, set the SRM administrator indicator. The user is then authorized to change all supplier data.
If want to assign the role SUS administrator automatically to the user during registration, set the SUS administratorindicator.
Sets the relevant indicators if you want users to receive the following notifications: Notification If Purchase Order Not Opened, Notification If Purchase Order Response Is Missing, Notification If ASN Is Missing, Notification If ConfirmationIs Missing, Notification If Invoice Is Missing,
Do let me know.
Regards
- Atul

SLD server has not been started & Only local system can be administered

Hi
After I installed the NWA sp16, I see two warning message
SLD server has not been started
Only local system can be administered
on the NWA Overview page.
I checked the SLD server is running, and I executed all the NWA scenario template files without any errors.
Can someone tell me what I might have missed?
Thanks
Justin

Hi Justin,
do you have the most topical Monitoring Setup Guide (https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/43f30e51-0a01-0010-f59a-fecea2b95b2c)? In chapter 5.6 this error is descibed.
And another thing: does your SLD run in the central monitoring system, as demanded in the Monitoring Setup Guide, chapter 5.3.1? This CTC template does only work in case of a local SLD.
Hope that helps.
Dirk

"Local System" Deployment and double hop scenarios

Similar Messages

Maybe you are looking for