EBS Administration Console Returns “Monitoring Data Not Available” After the Administrator Account Password is Changed or Expires
[Today's post comes to us courtesy of Ed Walters and Mark Stanfill]
By default, the Windows Server 2008 Default Domain Policy sets passwords to expire every 42 days. This includes the built-in Administrator account as well if it has not been manually modified. Changing the default administrator's password requires the extra steps described in this article to make sure that continuity is maintained between the services.
If you have not changed your password in the last 42 days, you will receive a login prompt indicating that you must update the Administrator's password:
System Center Essentials (SCE) does not automatically synchronize passwords from Active Directory; this step must be done manually. If you do not manually update the administrator's password in SCE after changing it in AD, SCE agents will stop reporting back to the SCE database. This in turn results in the EBS Administration Console displaying this error:
Errors On Page
There are problems displaying the data on this page:
Monitoring Data Not Available
A problem on server <SERVERNAME> prevents monitoring of Windows Essential Business Server. Verify that the server is running. If you recently corrected an issue on the sever, please wait for the data on this page to refresh. If this issue continues, contact Microsoft Support.
This issue can also occur any time the administrator's password is changed manually before password expiration.
Note: In the screen shot above, the Security Server is specified, but you may see all three EBS Servers mentioned.
By default, System Center Essentials uses the account that EBS was installed with (usually the built-in domain Administrator account) as its “Run As Account” and “Data Warehouse Action Account”. If you installed EBS using a different account, obviously the account name will be different, but the same principles apply.
Other errors you may see in this state are documented in this article:
Steps to Correct This Error
1. Reset your Administrator account’s password to the password used before it expired (i.e the "old" password). Log off and log back on.
Note: You must change this password in Active Directory Users and Computers, Explorer, or from a command line. You will not be able to change the password from the EBS Administration Console if you are logged in as that account.
Note: If password history is enabled, you must use Active Directory Users and Computers or the "net user username password" command line to change the user's password to the original password.
2. In the SCE Console, reset the administrator password to the old password for all DOMAIN\Administrator entries under Type: Action Account and also for the Data Warehouse Action Account under Type: Windows
Important: Do not modify any other account entries
You may see an additional entry for DOMAIN\Administrator (Alternate Account) . Change this entry's password to the old password as well.
Do this by first clicking on Start, All Programs, System Center Essentials 2007, then System Center Essentials 2007 Console. In the console, click on the yellow gear icon in the lower left-hand corner:
This will take you to the Administration tab of the console. Once there, click on Run as Accounts.
3. Restart these 3 services:
-
- OpsMgr Config Service
- OpsMgr Health Service
- OpsMgr SDK Service
4. Wait 5 minutes and then restart the OpsMgr Health Service on the Security Server and Messaging Servers.
5. Wait 5 minutes and then launch the EBS Administration Console to verify that the error message(s) no longer appear.
If any of the servers still aren’t reporting after the steps above, flush the health state
Note: If all 3 EBS servers are not reporting, perform these steps on Management Server first. Other computers may not report until Management Server is healthy.
To flush the Health State on the Management Server:
1. Open the SCE console
2. Select the Monitoring tab
3. Open the Operations Manager Folder
4. Select the Management Server folder.
5. Select Management Server Health State
6. Select the Management Server in the right middle pane.
7. Select Flush Health Service State and Cache on the right hand side under Health Service Tasks.
8. Verify the server name.
9. Select Run. A Task Status window will appear returning the status of the task. You can safely click Close to let this task run until it completes.
This will take several minutes (20-30 minutes is not uncommon). The presence of a 2110 event in the Operations Manager event log shows that the client is reporting:
To flush the Health State on Messaging and Security Servers:
1. Open the SCE console
2. Select the Monitoring tab
3. Open the Operations Manager Folder
4. Select the Agent folder.
5. Select Agent Health State
6. Select the Server you would like to flush the cache on in the right middle pane.
7. Select Flush Health Service State and Cache on the right hand side under Health Service Tasks.
8. The Run Task for Flush Health Service State and Cache window will appear showing the server it will flush the cache on.
You can safely click Close at this point. This may take several minutes. After the 2110 Event updates in Event Viewer, re-check the EBS Administration Console.
The Correct Way to Change the Administrator Password in EBS
Once the servers are reporting, you may change the Administrator password. On changing, make sure to update all DOMAIN\Administrator entries under Type: Action Account and also for the Data Warehouse Action Account Type: Windows in SCE as well. Restart all 3 OpsMgr services on the Management Server after updating.
In a default EBS configuration, you must change the password every 42 days. This blog post covers how to change the Runas and Data Warehouse account:
How to Change the SCE Run As and Data Warehouse Accounts in EBS
There are three places you must update the password:
1. Active Directory
2. The Action Account in SCE
3. The Data Warehouse Action Account in SCE
To change the account's passwords in SCE, use these steps:
- First change the password in Active Directory.
- Navigate in the SCE Console to Administration\Security\Run As Accounts.
- Double-click the entry for DOMAINNAME\Administrator under Type: Action Account and select the Account tab.
- Type the new password in both the Password: and Confirm password: fields.
- Click Apply and OK.
- Repeat steps 1-4 for any DOMAIN\Administrator (Alternate Account) entries you have under Type: Action Account.
- Repeat Steps 1-4 under Type: Windows for the Data Warehouse Action Account.
- Restart these 3 services:
- OpsMgr Config Service
- OpsMgr Health Service
- OpsMgr SDK Service
You may delete the duplicate Run as account if desired (this step is not strictly necessary). Find the account not marked as the default action account (indicated on the "Run As Profile" tab of the account) and delete it. You can safely rename DOMAIN\Administrator (Alternate Account) to Domain\Administrator on the General tab of the run as account properties if desired. Restart the OpsMgr services to verify that the settings are enabled.
After the account passwords are successfully updated and services restarted, you may change the Run As accounts manually if you wish. We'll post complete instructions to this blog shortly on how to do this.