Service level accounts and security policy

Question

Hello Experts,
We would like to roll out production environment at a customer. The documentation does not provide very good solution for the scenario when service level accounts are changing.
Customer's security policy requires all administrative accounts to be named e.g. firstname.lastname@domain. Generic productadmin@domain which are not identifiable can not be used on production servers.
It is understood that the BPC application server runs using the permissions granted to the user ID which was used during installation (access to the Windows AD, SQL Server &c.
If specific domain user is also member of local administrators group, he/she can indstall the product. However, if this particular account is made redundant and the administrator's role is appointed to another employee, the latter can not access the system with administrative rights.
Moreover, if the BPC administrator's account is disabled for whatever reasons, the system fails.
Is there any good suggestions for this kind of scenario?
Thanks

Answer 1

Thanks Scott,
This is what I have suggested but the problem is that the customer's policy does not allow anonymous accounts controlling their production systems, the administrative accounts can only be personal accounts like firstname.lastname@domain.
It seems that the only solution is to use administrator's personal credentials and in case those change, they need to go through the Ops guide and change everything manually.
Lucikly there is a bit simpler way to do this. Instead of manually changing credentials for every COM+ app as Ops Guide suggests, you can olny change three of those:
OsoftDatabaseADMIN
OsoftDatabaseSYSADMIN
OsoftDatabaseUSER
Then use Service Manager password reset function and it will update all COM+ apps in one go.