How do we reset SQLMonitor service account credentials?

cnwilson

Is there any way to update the service account's password without a full reinstall of the WebServer and Base Monitors? Our security regulations are requiring us to rotate the password regularly. Even though I can update the credential for SQL Monitor Base Monitor in Services and the service starts up successfully, it will still give "Incorrect service account credentials" when any user attempts to login to the portal. The SQL Monitor Web Service shows it is running as Local System.

We are not using IIS to host the Web Server, just the built-in Kestrel feature, and we are using a Windows AD account for all authentication to database hosts as well as running the Base Monitor services. We are on SQL Monitor version 12.1.50.8232.

cnwilson

I had followed instructions on https://documentation.red-gate.com/sm12/troubleshooting/can-t-log-in-to-sql-monitor-with-active-directory/incorrect-service-account-credentials but had no luck. Another member of our team followed those steps and got it working. I believe I may have reinserted those [settings] table records too quickly or not restarted services when I first attempted.

Either way we are back in working order now and I'll know to clear those tables out each time we reset the service account credentials moving forward. Thanks again for the help ATurner.

cnwilson

Forgot to add: I did attempt to update any credentials found in Credential Manager, but the only one for RedGate was SQL_Monitor_Installer_Account. The service account is also not locked in Active Directory and does have Administrator rights to the base monitor host servers. Most of the documentation I can find on this is acting as if the service account is locked out when you receive "incorrect service account credentials."

ATurner

Hi cnwilson

You will also need to update the connection string. In the same data connection string mentioned here https://documentation.red-gate.com/sm/maintaining-and-upgrading-sql-monitor/maintaining-sql-monitor/moving-the-sql-monitor-database you should see the account and be able to change the password. 

cnwilson

The credentials do not appear to be stored anywhere in that configuration file. The connection string has Integrated Security = True, so there is no location to update the password. I can update this to False and specify if that is what you mean. Ours below (with our servername changed):

<connectionStrings>

    <add name="DataConnectionString" connectionString="Data Source=%%%.%%%.com;Initial Catalog=RedGateMonitor;Integrated Security=True;Max Pool Size=500;Connect Timeout=15;Encrypt=True;Trust Server Certificate=True;Packet Size=4096"/>

  </connectionStrings>

ATurner

Hi cnwilson

I may have misunderstood, are you talking about the account that is used to communicate with the database? or the one the base monitor or web server runs under? 

cnwilson

Technically we use it for both, but I mean the account running base monitor AND web server. I can separate it out from the account used to read and write to the SQL database used if needed.

Judging from some other screenshots I've seen, is it possible that some more recent versions are showing the proper account in Windows Services for the Web Monitor service? Ours has it as Local System even though the Base Monitor does show the proper AD account.

Thank you for the help ATurner!

ATurner

Hi cnwilson

In this case with using integrated authentication it will be using the base monitor account. So if you change the account running the base monitor service it will change the account connecting to the database.