PureConnect

 View Only
Discussion Thread View
  • 1.  CIC Service account password change

    Posted 05-10-2018 16:40
    Hello,

    Just looking for some guidance on changing the password for the CIC service account used to install CIC.  Is there anything to worry about when changing the password?  Will anything break?  I don't think so but I couldn't find a good answer online and thought I'd ask.

    Thanks!

    ------------------------------
    Thomas Maher

    ------------------------------


  • 2.  RE: CIC Service account password change

    Posted 05-11-2018 07:37
    You will need to run the Identity portion of Setup Assistant on both PureConnect/CIC servers and also update the password on any other servers that use this account to start services.

    ------------------------------
    David Currier
    cpi.solutions
    ------------------------------



  • 3.  RE: CIC Service account password change

    GENESYS
    Posted 05-11-2018 10:00
    Yes, some things will break if you do not do as David advises.

    First change the user's password on the domain, then use log into the IC server as that domain user and run Identity, then change the service account password on other servers that use it to run an IC service.

    ------------------------------
    George Ganahl
    Principal Program Manager
    Genesys
    ------------------------------



  • 4.  RE: CIC Service account password change

    Posted 05-11-2018 10:38
    Hey, Thomas!

    Changing the IC Service account password (ICAdmin) is a pain, so I always suggest taking steps to avoid it, if possible. As already mentioned, you will need to re-run Setup Assistant (this will run in component mode, so chose "Identity") on the IC Servers themselves (do NOT be tempted to manually change the password in the Services control panel).

    In addition, any server where the IC Service account is used / referenced will need updating. Media Servers, SIP Proxies, CCSs (If you are a Dialer site) and so on. It is unlikely you will be able to do this with absolutely no service interruption (so plan for an outage) although if you have Switchover on your IC Servers (and CCSs, if present) as well as n+1 redundancy in your Media Servers (at each site) you might stand a chance.

    My usual advice to my students is to exempt the IC Service account from password change policies. This, naturally, is a security concern, so I also recommend mitigating that by removing Interactive Login rights for the user. This, in turn, will cause problems if you routinely use the account for day to day administration of your system. I would therefore recommend that once you have the system installed, you create accounts for your support team and give them the IC Role of Administrator. From that point on, you administer the system using your own account, and not the IC Service account. This has the side benefit of having the audit logs correctly show who made what change. (Know who to hit when things go wrong!!!)

    Along similar lines, while discussing this matter, I also strongly oppose the practice of opening an RDP session to the IC Server in order to run IA, Attendant etc. These are client applications and should be installed on your client machine and run from there! (If you are not sure how to do this, look at the shares published from the IC Server. There is one each containing the installs for Client (agent) apps (2 of these, 32 bit and 64 bit), Business Manager (Supervisor) apps and Server Manager (Administration) apps. It's the last of these that you need.)

    Anyway, I hope this helps. Probably more than you initially thought you needed to know, but hopefully enough to enable you to meet you ongoing needs in an efficient manner!


  • 5.  RE: CIC Service account password change

    Posted 05-11-2018 11:48
    I was researching this a while back and reached out to support. They directed me to these KB articles:
    https://my.inin.com/products/selfhelp/kb/Lists/KnowledgeBase/DisplayKB.aspx?ID=686&Source=https%3A%2F%2Fmy%2Einin%2Ecom%2Fproducts%2Fselfhelp%2Fkb%2FPages%2Fdefault%2Easpx%3FView%3D%7BDEE896E2-9298-4811-A781-7BC027D854C4%7D%26FilterField1%3DEntryID%26FilterValue1%3DQ144904500900125&ContentTypeId=0x0100BC7B80188A53F14EA868B7C68AB5686E

    Change the IC Service Account or Password in Switchover Environment

    Description:
    This KB Article explains how to change the IC service account or password in IC switchover pair.
    Solution:

    Note: Before the change, please make sure you have the credentials of the IC user with Administrator role or associate the new IC Service Account to the IC user with Administrator role in "IA>User Configuration>NT Domain User". You will need it later to launch IC Applications such as Switchover Control Panel.

    In this scenario it is assumed that Server A is the current Active Primary Server and Server B is the current Active Backup Server. After the IC service account's domain user/password has been changed , the following steps will need to be completed.

    1. Login to Server B with the new IC Service account.
    2. Run IC Setup Assistant > Identity. Enter the password of the new IC Service account and select Next until Commit.
    3. Reboot Server B when the process of the IC Setup Assistant has completed.
    4. Start Interaction Center service on Server B and make sure it is the Active Backup Server.
    5. Launch Switchover Control Panel and hit the Switch button to make a manual switch request. Server B has become the Active Primary Server.
    6. Repeat Steps 1-4 on Server A.
    7. To have Server A runs as the Active Primary Server, do a manual switchover using Switchover Control Panel and reboot Server B. Make sure the Interaction Center service on Server B starts in Backup mode.



     Dialer:
    https://my.inin.com/products/selfhelp/kb/Lists/KnowledgeBase/DisplayKB.aspx?ID=695&Source=https%3A%2F%2Fmy%2Einin%2Ecom%2Fproducts%2Fselfhelp%2Fkb%2FPages%2Fdefault%2Easpx%3FView%3D%7BDEE896E2-9298-4811-A781-7BC027D854C4%7D%26FilterField1%3DEntryID%26FilterValue1%3DQ138177924805418&ContentTypeId=0x0100BC7B80188A53F14EA868B7C68AB5686E

    How to reconfigure Dialer after ICAdmin Domain Account password change

    Description:
    The following procedure should be followed outside of normal business hours when changing the ICAdmin domain account (NT) password. Dialer uses the ICAdmin account when it connects from the ODS to the CCS through Notifier. The only change needed is to update the Log On information in the Interaction Center service Log On properties.
    Solution:

    1. In the Windows Services applet on both the ODS and CCS, set the Startup type for the Interaction Center service to Manual
    2. Change the ICAdmin password in Active Directory
    3. Shut down the CCS and ODS server (or servers, if using a switchover pair)
    4. Start up the CCS server
    5. Log into the CCS server using the new credentials
    6. In the Windows Services applet, change the Log On credentials for the Interaction Center service to be the new ICAdmin account


    7. Start the Interaction Center service on the CCS
    8. Start up the ODS server
    9. Log into the ODS server using the new credentials
    10. Open Setup Assistant and run the Identity portion using the new credentials
    11. Shut down the ODS server
    12. If using a switchover pair, repeat steps 8-11 for the second ODS
    13. Start the ODS server and log in
    14. Start the Interaction Center service on the ODS and ensure everything comes up normally
    15. If a switchover pair is in place, repeat steps 11 and 12 for the second ODS



    hope this helps.

    ------------------------------
    Scott Williams
    Missouri Higher Education Loan Authority
    ------------------------------



  • 6.  RE: CIC Service account password change

    Posted 05-11-2018 12:50
    So, both a pain and not without an outage.....


  • 7.  RE: CIC Service account password change

    Posted 03-01-2021 21:05
    Edited by Shane Jenkins 03-01-2021 21:37
    This is a few years old but our team is going to look to reset the ICAdmin AD account very soon. Question, will running setup assistant on the backup server in our switch pair cause hard downtime/outage? We don't have a test switch pair to test this against. I know that running setup assistant on the primary will lead to downtime. 

    Any other suggestions/tips?

    I believe Media Servers are setup to use the IC Admin Notifier creds and not AD, so I'm hopeful we have nothing to worry about in regards to Media servers.

    Any other tips or specific services/server types we need to pay attention to are greatly appreciated. I have my fingers crossed that we'll not encounter an outage/downtime associated with this. I also have a support ticket open on this and thus far gotten no response after the initial we have your ticket.

    Many thanks,

    ------------------------------
    Shane
    SAIC
    ------------------------------



  • 8.  RE: CIC Service account password change

    Posted 03-01-2021 21:43
    Shane,

    Changing the backup will not cause an outage, but when you work on the Primary, you will cause a switchover, which may impact operations. (Albeit for a short period)

    The Media Servers (etc.) connect to the IC Server using IC Credentials,, you are correct, however the windows service they run under is an AD account. So, changing the password..... See my earlier advice on how to update Media Servers without downtime.

    I would try to schedule a maintenance window if you can, if not then do this during "quiet hours" and do it as quickly as possible! If it were me, I would arrange to complete an update to the latest release of IC, applying of Patches (both IC and MicroSoft) and so on at the same time since those procedures have similar reboot / outage requirements.

    HTH


Need Help finding something?

Check out the Genesys Knowledge Network - your all-in-one access point for Genesys resources