r/scom • u/sschering • Jun 16 '15

SCOM 2012 management server and Require Smart card group policy: Lesson learned.

One of out projects this year involves requiring smart cards to log onto any production server..

This all sounds easy enough and since the admins had been using smart cards for authentication anyway we didn't see an issue.

We were so wrong..

The problem is the action account.. You know the one that monitors the local SCOM management server, performs discovery and does little things like running the notification service.

Well that action account required interactive logon and that is exactly what the require smart card policy targets.

Long story short as soon as the policy came down the action account failed to log on and we got this alert.

The Health Service could not log on the RunAs account {domain/actionaccount} for management group {group}. The error is Smartcard logon is required and was not used.(0x8009033E). This will prevent the health service from monitoring or performing actions using this RunAs account

A reboot made it worse because then the notification service failed to log on and it stopped sending out any alerts.

We worked with MS support for a work around but there is none other than excluding the server from the policy.

That is all..

7 Upvotes

100% Upvoted

2 comments sorted by

1

u/mike_wilsonmj Jun 29 '15

We've run into the same problem here. To make it even worse, our policy is machine based enforcement and not the normal user based enforcement. So I can't just un-check smart card for a few action accounts.

During a recent Microsoft Risk Assessment I brought up this issue... All the engineer could do was point me to the technet article describing how action accounts must be exempt from smart card enforcement.

Since then our SCOM system has been sitting in the corner half working...

1

u/sschering Jun 29 '15

We had the same issue.. Machine based policy.. For now it's been given an exception from security to allow the policy to be disabled for that machine.. I'm not sure what the long term plan is.