Change Management Account Password

[sgoetz]

Hey All

I have to change our management account password and I am not entirely sure of the correct process. This is what I think needs to happen, but I want to verify before I break anything.

1) Create a policy with management account option -> Specify new password -> Scoped to all machines
2) Advance Search -> All machines -> Action -> Edit the Management Account Information

Let me know if I'm missing something here.

Thank you!

Shawn

[mm2270 · Accepted solution]

@sgoetz You only need option 1 really. I would not use Option 2 because all that does is change the management account password stored in the database for all selected machines. Its not reaching out to the Macs in the selection and changing them there. The local management account on each Mac still needs to get its password revolved to the new one or they won't match, which the policy in option #1 will take care of.

If you do #2, you'd have issues using Casper Remote to push commands or packages to them, if that's something you use.

[sgoetz]

Thank you @mm2270. So will option 1 update the DB so JAMF knows the new password?

[mm2270]

Yes, once the policy runs successfully on each Mac, it will perform an update against the database to let it know what the new password is now. So, everything should be in sync.

[sgoetz]

@mm2270 awesome thank you!!

[sgoetz]

@mm2270 So it seems that running the policy to update Management Account does not update the account information for imaging. I haven't tested URL enrollment yet. But Im guessing I need to manually update the Images Management Account for all Images, and URL enrollment.

[mm2270]

Hi @sgoetz Sorry, I'm a little confused. What exactly do you mean by the account information for imaging? Do you mean the account that your NetBoot or Casper Imaging setup uses when it creates the management account on each Mac? Just not sure what it is you mean by that.

[sgoetz]

Hey @mm2270 So when you build a configuration to image with, there is a tab for Management Account. I just did a test image, and it set our Management Account to the old password instead of the new one. So thats why I think I need to go through all of our Image Configurations and update that Tab manually.

[mm2270]

Yes, that is correct. That account password is stored hardcoded into the configuration. The process we discussed above is a policy aimed at existing set up computers, not the imaging setup. The former cannot effect the latter. So you will need to update your CI imaging configuration(s) to use the new password.

Sorry that wasn't clear, but I thought that was a known thing. They are two separate items.

[sgoetz]

Hey @mm2270

No worries. This is actually the first time I've ever gone through this process so its all new to me!!

Thank you for all your help on this!!

Shawn

[acaveny]

Hi,

I know this is an older thread, but I'm having the same issue. A management account password was set in the JSS by a previous employee, and it was not documented. Furthermore, we found that the policy for this is set to an Ongoing Execution Frequency with a Recurring Check-in. So machines are getting hammered away by this policy over and over again at every checkin.

My question is what did you set your Triggers and Execution Frequencies at in order to ensure everything got migrated to the new password? My gut is saying set the Trigger to "Login" and the Frequency to once a week. Just wondering if there's a best practice out there for this.

Thanks!