{"id":295,"date":"2017-03-02T17:53:45","date_gmt":"2017-03-02T23:53:45","guid":{"rendered":"https:\/\/kevinjustin.com\/blog\/?p=295"},"modified":"2019-12-20T10:45:15","modified_gmt":"2019-12-20T14:45:15","slug":"why-not-to-use-local-system-for-your-core-scom-accounts","status":"publish","type":"post","link":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/","title":{"rendered":"Why not to use Local System for your core SCOM accounts"},"content":{"rendered":"

\"say-what-logo1\"<\/p>\n

Stay with me here, this is for the SCOM management group installation<\/p>\n

 <\/p>\n

So first, let’s research and figure out what the experts are doing, and what the install guides exist.<\/p>\n

Researching\u00a0expert published documentation helps us understand the options, and we can dive into some of the\u00a0reasons why.<\/p>\n

 <\/p>\n

SCOM Security<\/strong><\/h4>\n

\"scom-kh-securityblogcapture\"<\/p>\n

(KH\u00a0blog<\/a>\u00a0)<\/p>\n

 <\/p>\n

 <\/p>\n

SQLRights and roles<\/strong><\/h4>\n

\"scom-sql_accountrightsmapping\"<\/p>\n

(KH blog here<\/a> to download the XLS (applies for 2012,2016 as well)<\/p>\n

 <\/p>\n

Experts separate out the various functions into dedicated ID’s<\/strong><\/p>\n

 <\/p>\n

The reason for multiple ID’s is to lower the risk (less vulnerability if one ID is locked out, expired, disabled)<\/p>\n

— If you use one ID for all SCOM functions, and something happens to the ID, your SCOM environment stops working.<\/p>\n

— There’s always some associated risk with either scenario for LocalSystem or ID’s (decrypt RunAs ID’s UK blog<\/a> )<\/p>\n

If that is a concern, here is some great advice from Kevin Holman<\/p>\n

    \n
  1. Control who has access to SCOM<\/li>\n
  2. Control who has access to the servers using RunAs accounts, that are monitored by SCOM.<\/li>\n<\/ol>\n

    If you have lost control of local admin on a server, you are compromised, and I am not sure how gaining access to a RunAs account is no worse in some sense.<\/p>\n

    By the way \u2013 this is the entire reason \u201cmore secure\u201d was introduced in SCOM 2007R2, to limit distribution of credentials only to servers that required it, to limit the potential for a local attack.<\/p>\n

     <\/p>\n

    Another option (not recommended) is using\u00a0Local System<\/strong><\/p>\n

    — Cannot login to system to verify access concerns (quite honestly is why someone might sanction this approach)<\/p>\n

    — Scripts run as local system can be terminated, allowing a command window with Local System access<\/p>\n

    — Depending on which services LocalSystem is used, this could grant elevated privileges (like a Domain Controller DC)<\/p>\n

    \"localsystemaccount\"<\/a><\/p>\n

    — If ‘Local System’ was used for the core SCOM environment,\u00a0a change\u00a0made to the Local Security Policy, or group policy can\u00a0break the environment.<\/p>\n

    Local Security Policy snapshot<\/strong><\/p>\n

    \"localsystem-localsecuritypolicy\"<\/p>\n

    Security Options<\/strong><\/p>\n

    \"localsystem-securityoptions-localsecuritypolicy\"<\/p>\n

    Group Policy<\/strong><\/p>\n

    Locking down protocol blog here<\/a><\/p>\n

    \"gpo-snapshot-technetwebsite\"<\/p>\n

     <\/p>\n

     <\/p>\n

     <\/p>\n

    Hope this helps you decide the ‘how to’ set up your environment<\/p>\n

     <\/p>\n

     <\/p>\n

    Related documentation<\/strong><\/p>\n

    2019 Kevin Holman Deployment Guide<\/a><\/p>\n

    2016 Kevin Holman Deployment Guide<\/a><\/p>\n

    2012 R2 Kevin Holman Deployment Guide<\/a><\/p>\n

    Planning 2019 SCOM deployment Guide<\/a><\/p>\n

    Planning 2016 SCOM deployment Guide<\/a><\/p>\n

    2012 Technet Deployment Guide<\/a><\/p>\n

    2007R2 Technet Deployment Guide<\/a><\/p>\n

     <\/p>\n

     <\/p>\n

     <\/p>\n","protected":false},"excerpt":{"rendered":"

    Stay with me here, this is for the SCOM management group installation   So first, let’s research and figure out what the experts are doing, and what the install guides exist. Researching\u00a0expert published documentation helps us understand the options, and we can dive into some of the\u00a0reasons why.   SCOM Security (KH\u00a0blog\u00a0)     SQLRights … Continue reading “Why not to use Local System for your core SCOM accounts”<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[51,133,162,163,195,196,210,316,320,342,454],"class_list":["post-295","post","type-post","status-publish","format-standard","hentry","category-best-practice","tag-authentication","tag-domain","tag-faststart","tag-fasttrack","tag-install","tag-installation","tag-local-system","tag-provision","tag-quickstart","tag-scom","tag-training"],"yoast_head":"\nWhy not to use Local System for your core SCOM accounts - Kevin Justin's Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why not to use Local System for your core SCOM accounts - Kevin Justin's Blog\" \/>\n<meta property=\"og:description\" content=\"Stay with me here, this is for the SCOM management group installation   So first, let’s research and figure out what the experts are doing, and what the install guides exist. Researching\u00a0expert published documentation helps us understand the options, and we can dive into some of the\u00a0reasons why.   SCOM Security (KH\u00a0blog\u00a0)     SQLRights … Continue reading "Why not to use Local System for your core SCOM accounts"\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/\" \/>\n<meta property=\"og:site_name\" content=\"Kevin Justin's Blog\" \/>\n<meta property=\"article:published_time\" content=\"2017-03-02T23:53:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-12-20T14:45:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/03\/say-what-logo1.jpg\" \/>\n<meta name=\"author\" content=\"Kevin Justin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kevin Justin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/\"},\"author\":{\"name\":\"Kevin Justin\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#\\\/schema\\\/person\\\/213cdc5c6c3f2a1d9e8417c07440972d\"},\"headline\":\"Why not to use Local System for your core SCOM accounts\",\"datePublished\":\"2017-03-02T23:53:45+00:00\",\"dateModified\":\"2019-12-20T14:45:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/\"},\"wordCount\":409,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2017\\\/03\\\/say-what-logo1.jpg\",\"keywords\":[\"authentication\",\"domain\",\"faststart\",\"fasttrack\",\"install\",\"installation\",\"local system\",\"provision\",\"quickstart\",\"SCOM\",\"Training\"],\"articleSection\":[\"Best Practice\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/\",\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/\",\"name\":\"Why not to use Local System for your core SCOM accounts - Kevin Justin's Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2017\\\/03\\\/say-what-logo1.jpg\",\"datePublished\":\"2017-03-02T23:53:45+00:00\",\"dateModified\":\"2019-12-20T14:45:15+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#\\\/schema\\\/person\\\/213cdc5c6c3f2a1d9e8417c07440972d\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/#primaryimage\",\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2017\\\/03\\\/say-what-logo1.jpg\",\"contentUrl\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2017\\\/03\\\/say-what-logo1.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2017\\\/03\\\/02\\\/why-not-to-use-local-system-for-your-core-scom-accounts\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why not to use Local System for your core SCOM accounts\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/\",\"name\":\"Kevin Justin's Blog\",\"description\":\"Operational monitoring tools including System Center, Azure Monitor\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#\\\/schema\\\/person\\\/213cdc5c6c3f2a1d9e8417c07440972d\",\"name\":\"Kevin Justin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g\",\"caption\":\"Kevin Justin\"},\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/author\\\/kejustin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why not to use Local System for your core SCOM accounts - Kevin Justin's Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/","og_locale":"en_US","og_type":"article","og_title":"Why not to use Local System for your core SCOM accounts - Kevin Justin's Blog","og_description":"Stay with me here, this is for the SCOM management group installation   So first, let’s research and figure out what the experts are doing, and what the install guides exist. Researching\u00a0expert published documentation helps us understand the options, and we can dive into some of the\u00a0reasons why.   SCOM Security (KH\u00a0blog\u00a0)     SQLRights … Continue reading \"Why not to use Local System for your core SCOM accounts\"","og_url":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/","og_site_name":"Kevin Justin's Blog","article_published_time":"2017-03-02T23:53:45+00:00","article_modified_time":"2019-12-20T14:45:15+00:00","og_image":[{"url":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/03\/say-what-logo1.jpg","type":"","width":"","height":""}],"author":"Kevin Justin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kevin Justin","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/#article","isPartOf":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/"},"author":{"name":"Kevin Justin","@id":"https:\/\/kevinjustin.com\/blog\/#\/schema\/person\/213cdc5c6c3f2a1d9e8417c07440972d"},"headline":"Why not to use Local System for your core SCOM accounts","datePublished":"2017-03-02T23:53:45+00:00","dateModified":"2019-12-20T14:45:15+00:00","mainEntityOfPage":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/"},"wordCount":409,"commentCount":0,"image":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/#primaryimage"},"thumbnailUrl":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/03\/say-what-logo1.jpg","keywords":["authentication","domain","faststart","fasttrack","install","installation","local system","provision","quickstart","SCOM","Training"],"articleSection":["Best Practice"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/","url":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/","name":"Why not to use Local System for your core SCOM accounts - Kevin Justin's Blog","isPartOf":{"@id":"https:\/\/kevinjustin.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/#primaryimage"},"image":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/#primaryimage"},"thumbnailUrl":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/03\/say-what-logo1.jpg","datePublished":"2017-03-02T23:53:45+00:00","dateModified":"2019-12-20T14:45:15+00:00","author":{"@id":"https:\/\/kevinjustin.com\/blog\/#\/schema\/person\/213cdc5c6c3f2a1d9e8417c07440972d"},"breadcrumb":{"@id":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/#primaryimage","url":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/03\/say-what-logo1.jpg","contentUrl":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2017\/03\/say-what-logo1.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/kevinjustin.com\/blog\/2017\/03\/02\/why-not-to-use-local-system-for-your-core-scom-accounts\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/kevinjustin.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Why not to use Local System for your core SCOM accounts"}]},{"@type":"WebSite","@id":"https:\/\/kevinjustin.com\/blog\/#website","url":"https:\/\/kevinjustin.com\/blog\/","name":"Kevin Justin's Blog","description":"Operational monitoring tools including System Center, Azure Monitor","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kevinjustin.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/kevinjustin.com\/blog\/#\/schema\/person\/213cdc5c6c3f2a1d9e8417c07440972d","name":"Kevin Justin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4c2a0d1189dd1ad7f305cf08aa9c5e2d4cc8fc26fde7ca573d3fd7e75520334e?s=96&d=mm&r=g","caption":"Kevin Justin"},"url":"https:\/\/kevinjustin.com\/blog\/author\/kejustin\/"}]}},"_links":{"self":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts\/295","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/comments?post=295"}],"version-history":[{"count":2,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts\/295\/revisions"}],"predecessor-version":[{"id":6543,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts\/295\/revisions\/6543"}],"wp:attachment":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/media?parent=295"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/categories?post=295"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/tags?post=295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}