Truesight Server Automation (TSSA): How to remove BladeLogicRSCD user using chapw command?

Truesight Server Automation (TSSA): How to remove BladeLogicRSCD user using chapw command?

Knowledge Article

Article Number

000239617

Old Article Number

000166954

Article Type

FAQ/Procedural

Title

Truesight Server Automation (TSSA): How to remove BladeLogicRSCD user using chapw command?

Summary

How to delete BladeLogicRSCD user using chapw commad?

Product

BladeLogic Server Automation - Configuration Module

Component

BladeLogic Server Automation

Applies to

Neutral

Question

As mentioned in the product documentation there may be situations where It is required to remove the BladeLogicRSCD service account from managed servers.

This is typically necessary when organizational policies prohibit the creation of local service accounts. In such cases, instead of utilizing User Principal Mapping (UPM) to communicate with target servers, an Automation Principal will be employed for Windows User Mapping.

Answer

To remove the BladeLogicRSCD user:

Steps:
1. Configure the NSH client to use a NSH Proxy.
2. Configure Automation Principal and assign it to the role(s) managing the target system(s)
3. Login with blcred and become the role with the AP assigned and start the nsh shell.
4. Run chapw -d <target host>.

Alternatively run a NSH Script Job:
1. Create an empty type 1 (runscript) NSH Script.
2. In the Script tab add the command chapw -d ${NSH_RUNCMD_HOST}
3. Create a NSHScript Job based on the above script and run it against the required target hosts as a role using an AP to communicate with the targets.
4. This disables UPM for these target systems, so only roles that are setup to us an Automation Principal will be able to managed these systems.

This should automate the deletion of the BladeLogicRSCD user.

To re-enable used of the BladeLogicRSCD account:
1. Create an empty type 1 (runscript) NSH Script.
2. In the Script tab add the command chapw -e ${NSH_RUNCMD_HOST}
3. Create a NSHScript Job based on the above script and run it against the required target hosts as a role using an AP to communicate with the targets.

Attachment(s):