Service Accounts used in Different OSB Projects

Hi,
In the project I'm working on, we need to have a service account used by different OSB projects. We are using fn-bea:lookupBasicCredentials to lookup the service account. The problem is, the same service account may be under different paths in the different environments we have. Is there a way to use something like a relative path to refer to this service account so we don't have to worry about the environment our code is deployed?
Thanks in advance

Please refer -
How to get ip number in WSDL instead of host name?
Why do you want to have IP instead of host name?
Regards,
Anuj

Similar Messages

HT1420 Possibility to use 1 Computer - configured with 2 user accounts - each account uses a different Apple-ID for iTunes authorization ?

I wonder if it is possible to use 1 Computer (Macbook Pro)
- configured with 2 (ore even more) user accounts (i.e. me + my kid)
- and each user account has a different Apple-ID (account) for iTunes purchases & iTunes authorization ?
I woud think that is fine in terms of the underlying license agreement refereing to re-download purchased movies, shows, apps, etc.
However, it seams that there is that miraculous 90 days restriction, which I don't understand, and which allows me only to "authorise" the Computer under one or the other account. The switch is unfortunatelly only possible every 90 days ?!?
Thanks anybody for help
Oliver

The 90 day association doesn't stop you authorising an account, it only stops you from using another account for iTunes Match or automatic downloads or redownloading its past purchases : http://support.apple.com/kb/HT4627
There are a few methods listed on this page for how you could do it e.g. multiple user acounts, same iTunes but you having separate playlists, separate iTunes libraries : http://support.apple.com/kb/HT1495

SQL Server services accounts using Managed Service Accounts

Hi guys,
Need your feedback on something, is it wiser to use Managed Service Accounts or normal domain accounts to run SQL Server services? MSA's only work in a single computer, so for every environment I would need to create a new set of sql services accounts.
If I create a single account wouldn't it be simpler? For instance domain\sqlservices and set it on every service and every environment (dev, qa and production)

Hi
It is a good question but the answer is not black or white. The answer is depend like most configuration questions.
I recommend you to use
Google to find blogs about the issue.
You can start from this links, which are great starting point for you question:
Best Practices For Using SQL Server Service Accounts
Book Online
Ronen Ariely
[Personal Site] [Blog] [Facebook]

Service Account used to installed Synchronization

Hi All,
We have FIM installed and want to export the key, I have used the account running the service "Forefront Identity Manager Synchronization Service", it does not have the right to export the key, Is there is a way to find by which service account
it got installed.
Thanks and Regards,
Raja Village Syc

Raja,
The installation of the FIM synchronization engine adds the installing account to the FIMSyncAdmins group. I would expect that account to have these permissions.

SQl engine service account in different trusted domain from server?

Is it possible to use an SQL service account from a different, but still trusted, domain than the one to which the server is joined? If so, are there any nonstandard configuration settings I need to use?
I've got this setup running, but when I try to connect with an account from any domain other than the one to which the server is joined, I get the following error:
Login failed for user 'SERVICEACCOUNTDOMAIN\account'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors.
I've created the SPN in the service account's domain, and verified there is both connectivity and a valid trust relationship. The users I'm testing also have logon permissions for the server.

Hi AccuMegalith,
Firstly, it is possible to use an SQL Server service account from a different, trusted domain. We need to note the following configuration.
For more details, please review this article:
Security Account Delegation.
1. The service account must be trusted for delegation on the domain controller.
The following options in Active Directory Users and Computers must be specified in order for delegation to work:
•The Account is sensitive and cannot be delegated check box must not be selected for the user requesting delegation.
•The Account is trusted for delegation check box must be selected for the service account of SQL Server.•The
Computer is trusted for delegation check box must be selected for the server running an instance of Microsoft SQL Server
2. The service account must have SPNs registered on the domain controller. If the service account is a domain user account, the domain administrator must register the SPNs.
Login failed for user 'SERVICEACCOUNTDOMAIN\account'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors.
Secondly, regarding to above error message, it means that SQL Server was able to authenticate you, but weren't able to validate with the underlying Windows permissions.
It could be caused by that the Windows login has no profile or that permissions could not be checked due to UAC. Please perform the following steps to troubleshoot this issue. For more details, please review this
blog.
1. Run SQL Server Management Studio (SSMS) as administrator and disable UAC.
2. Check if that login is directly mapped to one of the SQL Server logins by looking into the output of sys.server_principals.
3. If the login is directly mapped to the list of available logins in the SQL instance, then check if the SID of the login matches the SID of the Windows Login.
Thanks,
Lydia Zhang
If you have any feedback on our support, please click
here.
Lydia Zhang
TechNet Community Support

Service account for Windows Update sync

Hi all,
I would like to know if it's possible to change service account used by WSUS 2008R2 SP1 to sync with Windows Update servers, and if so how.
Thanks. Have a good day.
FXE

Hi,
Do you want to use the different account for the WSUS management? Is so, that account must be a member of either the WSUS Administrators or the local Administrators security
groups on the server on which WSUS is installed in order to use the WSUS console.
The related KB:
Step 4: Configure and Synchronize WSUS
http://technet.microsoft.com/en-us/library/cc708455(v=ws.10).aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Sharepoint 2013 Service accounts

Hi,
My current client has SharePoint 2010 and 2013, for all the web application and service application they have been using only one account, which is think is not suggested by Microsoft (correct me if i am wrong)
i agree that each admin have their own point of view, but will the below explanation suffice and can this be suggested to the client and suggest them to use dedicated applications pools for different web applications.
As all the web-application pools are running under the same account there is a possibility that the account might get locked due to which the other site collection, which are running under the same application pool ID, will also be getting the error
message "Service unavailable" by maintaining different application pools, other web applications/site collections will not be effected.
Please advise.
Satyam.

The accidental locking of an account is probably the LAST concern, since that suggests that lockout policies are effectively blocking attackers.
The primary concerns focus around the permissions granted to the accounts, and how they're used... this is why different architectures and environments will have different service account use/reuse/isolation requirements.
Scott Brickey
MCTS, MCPD, MCITP
www.sbrickey.com
Strategic Data Systems - for all your SharePoint needs

SQL 2012 service accounts best practice

I'm installing SQL Server 2012 for ConfigMgr 2012 r2 and I wonder what is the best practice for SQL service accounts.
During the installation of SQL Server, in the server configuration/Service accounts menu I'm allowed to configure following service accounts: SQL Server Agent, SQL Server Agent Database Engine, SQL Server Reporting Services, SQL Server Browser.
Do I have to create separate domain user (not admin) accounts for each service and configure service principal name (SPN) for all of them?
For example: Domain user account named SQLSA for SQL Server Agent, another domain user account
SQLADBE for SQL Server Agent Database Engine etc.

During the installation of SQL Server 2012, the user is prompted to provide service account
credentials. The default service accounts suggested vary depending on whether SQL Server
2012 is installed on a computer running Windows Vista or Windows Server 2008 or on a computer
running Windows 7 or Windows Server 2008 R2. On computers running Windows Vista
or Windows Server 2008 operating systems, the following default service accounts are used:
- NETWORK SERVICE Database Engine, SQL Server Agent, Analysis Services,
Integration Services, Reporting Services, SQL Server Distributed Replay Controller,
SQL Server Distributed Replay Client
- LOCAL SERVICE SQL Server Browser, FD Launcher (Full-Text Search)
- LOCAL SYSTEM SQL Server VSS Writer
On computers running Windows 7 or Windows Server 2008 R2 operating systems, the following
default accounts are used:
- Virtual Account or Managed Service Account Database Engine, SQL Server Agent,
Analysis Services, Integration Services, Replication Services, SQL Server Distributed
Replay Controller, SQL Server Distributed Replay Client, FD Launcher (Full-Text Search)
- LOCAL SERVICE SQL Server Browser
- LOCAL SYSTEM SQL Server VSS Writer
For Windows 7 and Windows Server 2008 R2, you can use a Managed Service Account
(MSA) or a Managed Local Account. The differences between these account types are as
follows:
- Managed Service Account (MSA) This special kind of domain account managed
by a domain controller is assigned to a single member computer and used for running
services. The MSA password is managed by the domain controller. MSAs can register
a Service Principal Name (SPN) with Active Directory. MSAs use a $ name suffix; for
example, CONTOSO\SQL-A-MSA$. You must create the MSA prior to running SQL
Server Setup if you want to use an MSA with SQL Server services.
- Virtual Accounts or Managed Local Accounts These virtual accounts can access
the network in a domain environment and are used by default for service accounts
during SQL Server 2012 setup when run on Windows 7 or Windows Server 2008 R2.
Such accounts use the NT SERVICE\<SERVICENAME>format. You don’t need to specify
a password when using virtual accounts with SQL Server 2012 because this is handled
automatically by the operating system.
You should run SQL Server services, using the minimum possible user rights, and use an
MSA or virtual account when possible. If you are manually configuring service accounts, use
separate accounts for different SQL Server services. If it is necessary to change the properties
of service accounts used for SQL Server 2012, use SQL Server tools such as SQL Server
Configuration Manager. This ensures that all necessary dependencies are
updated, which does not happen if you use only the Services console.
Although you can configure domain accounts as service accounts, this strategy requires
more effort because you must ensure that service account passwords are changed regularly.
You must also manage SPNs, which are required for Kerberos authentication.
Best regads
P.Ceglie

Difference Between Service Account and User Account

What is the Difference Between Service Account and User Account

Hello Mohit,
Basically there are two types of approches which you should understand.
In many environments, administrators prefer to simply create a domain user account and assign appropriate privileges to it. Then this user account is used in order to start a specific service on a computer.
In that case there is really no difference between a user account and the so called service accounts. Since this service account is simply a domain user, all the task related to managing the domain users apply to it. For example you
should keep the password up to date manually. Some environment move step forward and assign
Deny Logon Locally of this type of service account in order to enhance the security.
The second concept is Managed Service Accounts. There are plenty of differences between a Managed Service Account and a User Account.
The Display Icon is different from a view perspective.
The type of object is different.
Managed service accounts password management is automatic.
You can not create Managed Service Accounts using GUI. They are only created using Powershell.
You can refer to link below for more inormation:
Service Accounts Step-by-Step Guide
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

TS1717 Itune Match not happy as I have used 2 different email address ID's how do I combine them into one?

Itunes unhappy, Match issues! I think it is because I have used two accounts on different emails. Can I pull the two together to make just one account?

Open Accounts preferences in System Preferences. Click on the lock icon and authenticate. Under the user list click on the Add [-] button button to create a new user account for yourself or your father (whoever is not the existing account owner.) Configure the account with a separate username and password.
Now each of you should have a separate account on the computer. You can each sync your iDevices into completely separate accounts using completely different Apple IDs.

MIRO Error-Can not post to mat.account & using overhead cost centre &.

Dear Colleagues,
On MIRO,users have come across this error where they can not post to a particular G/L account using 2 different cost centres(219 & 220).
We have some validations on OB28 but although one particular step menitons this message as I stated above,the prerequisite of that step seem to be referring to G/L IN VAL_Plant No_16 AND Cost Center IN VAL_Plant No_17.
Whereabouts I need to maintain this G/L account/Cost Centre Combination?II had a look at OME9/OKB9 but couldn't get any resolution looking over there...
All Help appreciated.
PAPJ1.

I had to tweak the types of error messages on OB28 temporarily,to allow for these postings to go through and it worked!.
PAPJ1

Service Applications - Service Account Auto Changing

Each time I create a service application, SP is auto-changing the service account used for the application pool identity. I set it as SP_Services in the UI of CA, then suddenly when I go back and look it has auto-changed it to SP_Farm. How
can I stop it from doing this?

I just figured out that when you open the properties from the Service Applications list it shows the SP_Farm account, but that actually is not correct. When I go to Security > Configure Service Accounts, it shows the correct service account.
I assume this means it just isn't displaying correctly in the properties page (although that is weird). When I run Get_SPServiceApplicationPool it also shows the correct ProcessAccountName, so that must be it. Though, when I go to Application Pools
under IIS it doesn't show up.

Service account with DOT

Hi,
Is it possible to make a user account to service account using ktpass if there's a dot in user name e.g. the user account is : sap.bo.
Is it possible?
Thanks

Use the following syntax for the service account:
<DOMAIN>\sap.bo instead of sap.bo(at)SERVER1.COM
the command should look like this:
ktpass -out vinsso.keytab -princ BOBJCentralMS/sap.bo.server1.com(at)SERVER1.COM -mapuser <DOMAIN>\sap.bo -pass password -kvno 255 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT
Replace <DOMAIN> with the name of the Windows AD domain your service account is defined in.
Regards,
Stratos

Is it recommended practice to add SCCM service accounts to the Domain Admins group?

I am working with an external consultant that is recommending that all of the SCCM service accounts be added to the Domain Admins group. I am not the SCCM engineer, I am the AD guy, this is the reason I am questioning this methodology. I have
read several articles that seem to provide the appropriate configuration options for all of the SCCM accounts so I see no need to allow these accounts to have Domain Admin level access to the environment. I don't see a reason for ANY of the service accounts
to have Domain Admin, let alone all of them. I have referenced several TechNet articles but there does not seem to be definitive guidance around this. Could anyone assist with settling this? Thanks in advance.

No, there's absolutely no reason for the service accounts to be domain admins.
All of the required service accounts used in a SCCM environment can be given the proper permissions given their purpose.
Example: Join Domain Account can be given the permissions to join computer objects in the very specific OU in AD, and nothing else.
Network Access Account only need read access to your distribution points.
Client Push Account needs local administrative permissions on your clients.
What i'm trying to say is. None of any of the service accounts needs to be domain admin. Hope that helps.
Martin Bengtsson | www.imab.dk

HT4436 Can I sign up for iCloud using a different iPhone

I lost my iPhone just now. I haven't turn in the iCloud feature from my phone. Now, when I try to log in to find my iPhone app with my apple ID it's saying that apple ID is valud but no iCloud account. How do I sign up for an iCloud account using a different iPhone or computer?

If you want to sign in to your existing iCloud account on the other device follow this steps...
iPhone/iPad: Settings > iCloud or Settings > Mail, Contacts, Calendars > Add Account... > iCloud
Mac: System Preferences > iCloud or System Preferences > Mail, Contacts, Calendars > + to add an account... > iCloud

Service Accounts used in Different OSB Projects

Similar Messages

Maybe you are looking for