Configure and Repair Agents: credentials problem

[Scott_278]

Trying to repair the trust relationship on some Windows servers with "Configure and Repair Agents". The problem is that the repair is only successful when the account used to run the SIM service on the CMS has admin rights to the target server. In other words, the Configure and Repair Agents setting is not using the credentials I configure it to use.

I've tried a couple of things. First, I tried using the local administrator credentials which is common to all our servers. I left the DOMAIN field blank (I think this worked in previous versions of SIM when using multiple targets). Second, I used my domain account which is a member of the local administrators group on all the servers. This failed too.

What DID work was to use the credentials of the domain account which the SIM service runs under, and I had to add that account to the local Administrator's group on the target servers.

In the cases where this fails, I get the same error: "HP Systems Insight Manager was unable to copy the HP Repair Tool executable over to the target system. Verify that target system has sufficient disk space."

I wonder if there is some XML file I need to edit or something?

[Rich Purvis]

When this feature works it is really great. However, there were some initial issues when it first came out in that it was dependent on the SSH install and if that had issues it would not work. Since then a lot of those problems have been cleared up, are you using HPSIM 5.0 or later? The only requirement should really be that the ID be in the local Administrator group or at least it works best in that configuration. You shouldn't have to use the same ID that HPSIM is running under.

-Rich

[Scott_278]

I'm running 5.0 SP4.

I tried six different scenarios noted below. In all scenarios, I only tried to repair the Trust - nothing else. The HPSIM and OpenSSH Server service on the CMS are both running under the same domain service account.

Scenario 1:
Credentials used: local administrator on target server
SIM Service Account: Not member of local Adminstrators group
Result: HP Systems Insight Manager was unable to copy the HP Repair Tool executable over to the target system. Verify that target system has sufficient disk space.

Scenario 2:
Credentials used: local administrator on target server
SIM Service Account: Is a member of local Adminstrators group
Result: Successful

Scenario 3:
Credentials used: domain account and a member of local Administrators group
SIM Service Account: Not member of local Adminstrators group
Result: HP Systems Insight Manager was unable to copy the HP Repair Tool executable over to the target system. Verify that target system has sufficient disk space.

Scenario 4:
Credentials used: domain account and a member of local Administrators group
SIM Service Account: Is a member of local Adminstrators group
Result: Successful

Scenario 5:
Credentials used: SIM service account
SIM Service Account: Not member of local Adminstrators group
Result: (Different) HP Systems Insight Manager was unable to connect to the target. Retry with administrator credentials for this target.

Scenario 6:
Credentials used: SIM service account
SIM Service Account: Is a member of local Adminstrators group
Result: Successful

I think this is a bug, but would like validation from someone else before I call it in.

[Joel Rubenstein]

It turns out that the successful execution of this tool depends not only on the credentials you supply but also the rights that the SIM service account has. So even though you may supply valid credentials for the remote node if the SIM service account does not have access to the node the task will fail.

[Scott_278]

What exactly do you mean by "it turns out"? That is the behavior I am seeing, but I don't see that requirement anywhere in the documentation. What do I need to provide credentials for if SIM is going to use it's own credentials anyway?

Worse yet, I found that the credentials you provide are irrelavent. I added the SIM service account to the local administrators group on the target, but provided completely invalid credentials. But the repair was still successful. That is scary, undocumented behavior.

[Joel Rubenstein]

I agree it should not work this way. I suggest you open a support case with HP so that a formal product defect can be entered.

[Scott_278]

That's the confirmation I was looking for. Thanks, I will post the case number when I get it.

[Aspi Jasoomani]

Hi Scott,

Did you get this issue with the SIM Configure and Repair Agents resolved.

I am facing exactly the same problem and would like to know how your problem was resolved - without having to add the HP SIM account credentials in to the Local Administrator group for each managed machine.

Do let me know. Thanks

[Scott_278]

Interesting that you replied today. I just informed HP today that after almost one year, I am no longer willing to work on this case. They claim they have development resources actively engaged and working on the problem. I did had several meetings with Support and Development on the phone to verify the behavior I claim, but no resolution had been found. HP claims there is one more customer with the same behavior, and they also claim the developers have tested out some debugging code with that customer, but the details have not been analyzed yet. Funny they work with the other customer but not me who opened the case initially.

I am very displeased with the support I received from high-level escalations, and the lack of communication from escalations and the development team. You'd figure after 1 year there would be some type of progress, but there is absolutely none.

Now that I have a different job, I don't care anymore what happens with this product. It has potential, but support is terrible. I hope you have better luck than I did.

[Scott_278]

For future reference, my case number was 3214060161.