Change the DMSA/MSA Accounts (step-by-step)
Eventually, you might need to change the DMSA or MSA accounts or account passwords. Generally, you change these accounts for either of these reasons:
-
The security policies of an enterprise require the passwords, or the usernames and passwords, of important accounts to be changed periodically.
-
Changes to the Windows network require servers to be moved to a new Windows domain.
Because important services run under the DMSA and MSA accounts, you must follow specific procedures to change the these accounts or their passwords.
Follow these steps to change the usernames and passwords of the DMSA and MSA accounts:
Procedure

Step 1 of 13 associated with changing the DMSA or MSA, or both.
In this step, you ensure the existing DMSA and MSA accounts have SysAdmin rights on the computer running SQL Server.
If these accounts do not currently have SysAdmin rights on the computer running SQL Server, provide them with these rights now.
See the Technologies, Security, and Network Integration Deployment Guide for details about the SQL server rights required for the MSA and DMSA accounts.

Step 2 of 13 associated with changing the DMSA or MSA, or both.
In this step, you must create new Windows accounts and provide these accounts with the necessary Windows access rights:
-
If you are changing the MSA account, create a new Windows account in the domain to serve as the MSA.
-
If you are changing the DMSA account, create a new Windows account in the domain to serve as the DMSA.
-
Assign the appropriate Windows access rights to the new account(s) you have created.
See the Technologies, Security, and Network Integration Deployment Guide for details about the Windows access rights required by the MSA and DMSA accounts.

Step 3 of 13 associated with changing the DMSA or MSA, or both.
In this step, you ensure the new accounts can log in to the computer running SQL Server as SysAdmins.
-
If you created a new Windows account to serve as the MSA in the previous step, define that account as an SQL Login with SysAdmin Rights.
-
If you created a new Windows account to serve as the DMSA in the previous step, define that account as an SQL Login with SysAdmin Rights.
See the Technologies, Security, and Network Integration Deployment Guide for details about the SQL Server rights required by the MSA and DMSA accounts.

Step 4 of 13 associated with changing the DMSA or MSA, or both.
In this step, you assign database permissions to the account(s) you have created.
Assign the database permissions automatically or manually.

You can use the Database Permissions Configuration Tool to automatically assign the required database permissions to the DMSA or MSA accounts, or both.
This procedure is summarized below. For detailed information about each step of the procedure, see the SQL Server Installation and Upgrade Guide.
Procedure
-
Access the Database Permission Configuration Tool.
-
Verify tool user credentials.
-
Verify Windows Powershell functionality.
-
Run the Database Permissions Configuration Tool.

If you do not want to automatically assign the database permissions to the DMSA or MSA accounts (or both), you can manually assign them.
Manually assigning database permissions requires that SQL permissions are set for DMSA or MSA for each instance of a computer running SQL Server.
This procedure is summarized below. For detailed information about each step of the procedure, see the SQL Server Installation and Upgrade Guide.
Procedure
-
Verify user credentials.
-
Set account permissions.
-
Modify SQL credential object.
-
Assign MSDB permissions.
-
Modify database user name.

Step 5 of 13 associated with changing the DMSA or MSA, or both.
In this step, you do the following:
-
Specify the new MSA account as the account that runs the report server service and the account used to connect to the Reporting Services Server role in the Data Center that provides reporting services for Workforce Management (WFM), Scorecards, eLearning, Coaching, Customer Feedback, Interactions and Speech Analytics products. database.
-
Backup the SSRS encryption keys (you will restore these keys in a subsequent step in this procedure).
Perform this procedure from the server that hosts the Reporting Services server role Entity that contains a logical, predefined set of components (system software or certified third-party software) deployed in the Data Center and Site Zones that provide specific functionality for the system..
Procedure
-
Launch the Reporting Services Configuration Manager.
(Usually located at Start > All Programs > Microsoft SQL Server 2008 R2 > Configuration Tools.)
-
In the Reporting Services Configuration Connection window:
-
Ensure that the Server Name and Report Server Instance fields specify the values appropriate for the computer running SQL Server that hosts the Reporting Services database.
-
Click Connect.
-
-
In the left-pane, select Service Account.
-
Select Use another account.
-
In the Account (Domain\user) field, enter the domain\username of the MSA account.
-
In the Password field, enter the password of the MSA account.
-
-
Click Apply.
-
In the Backup Encryption Key window, complete these fields:
-
File Location - Specify the file name and location of the file that will contain the backup encryption key.
-
Password/Confirm Password - Type a password to protect the file from unauthorized access. The password must be at least 8 characters, include a combination of uppercase and lowercase alphanumeric characters, and at least one symbol character.
-
-
In the SQL Server Connection Dialog, you must specify the credentials of an account that has permission to access the Reporting Services database. The MSA account has this permission. Complete the fields as noted below:
-
Server Name: - Specify the name of the computer running SQL Server that hosts the Reporting Services database.
-
Credentials Type - Select one of the following from the drop-down box.
-
Current User - Integrated Security - Select this option if you are currently logged into Windows using an administrator account that has the permission to access the Reporting Services database. If you select this option, you do not need to enter a user name and password.
-
SQL Server Account - Select this option to specify the credentials of an account that has permission to access the Reporting Services database. If you select this option, enter the username and password for this account in the fields provided.
-
-
-
Click OK.

Step 6 of 13 associated with changing the DMSA or MSA, or both.
In this step, you verify that the Watchdog application is not repeatedly starting failing services on any of the servers in the enterprise.
Procedure
You must perform this procedure on every server in the enterprise.
-
From the Windows desktop on a managed server Server that is managed by the Enterprise Manager application., use the System Tools to turn off the Watchdog application.
-
Verify that none of the services monitored by the Watchdog application are failing. If any services are failing, you must correct the problem causing the services to fail.
-
When you are sure that none of the services monitored by the Watchdog application are failing, use the System Tools to restart the Watchdog application.
-
Repeat steps 1 through 3 on every server in the enterprise.

Step 7 of 13 associated with changing the DMSA or MSA, or both.
In this step, you use the Alarm Dashboard to resolve all active alarms in the system.
Procedure
-
Click System Monitoring > System Monitor > Alarm Dashboard.
-
Resolve every active alarm that appears in the Enterprise Alarms pane.
-
Click on an alarm in the Enterprise Alarm pane.
-
In the Details pane, review the Corrective Action: for the alarm.
-
Perform the corrective action steps for the alarm.
-
Click on an alarm again in the Enterprise Alarm pane.
-
Click on Servers to display the Servers pane.
-
In the Servers pane, click the Acknowledge icon
to acknowledge the alarm.
-
Repeat steps a. through f. for every alarm in the Enterprise Alarms pane.
-
-
Allow the system to stabilize by ensuring that none of the alarms recur. Do not continue to the next step until you feel certain that none of the alarms will recur.

Step 8 of 13 associated with changing the DMSA or MSA, or both.
In this step, you change the Database Management Account or Management Service Account credentials on the Enterprise Settings screen.
-
Select System Management Module that allows performing suite-wide system management activities from a single, Web-based application, the Enterprise Manager. > Management > Enterprise Settings.
-
In the Installations tree (left-hand pane), select the Enterprise node.
-
Perform the appropriate procedure(s) below:
-
If you are changing to a new MSA account, change these two settings in the Management Service Account section:
-
Username - Enter the username associated with the Windows account you created to serve as the MSA.
-
Password - Enter the password associated with the Windows account you created to server as the MSA.
-
-
If you are changing to a new DMSA account, change these two settings in the Database Management Account section:
-
Username - Enter the username associated with the Windows account you created to serve as the MSA.
-
Password - Enter the password associated with the Windows account you created to server as the MSA.
-
-
Click Save and Apply to Children.
Procedure

Step 9 of 13 associated with changing the DMSA or MSA, or both.
In this step, you must review the active alarms again and restart any services that are indicated in any new active alarms. To do this, repeat 7. Resolve all active alarms in the system to resolve any active alarms.

Step 10 of 13 associated with changing the DMSA or MSA, or both.
In this step, you perform steps to assure the system is operating properly following the credential change to the Management Service Account or database management Server that hosts the Database platform and is used for remote SQL deployments in L3 deployments and higher. account, or both.
Procedure
-
Verify that you can record and playback Process of selecting a recorded interaction, playing it back to listen to the call, and viewing the content of the interaction on the screen. a new interaction In Speech Analytics, an interaction represents a single part of the contact between one employee and the same customer. In Text Analytics, an interaction is the communication session between one or more employees and the same customer with a unifying contextual element. in Quality Monitoring.
-
Verify that you can perform an evaluation Form used to review employee performance for a specific interaction, which evaluates proficiency in handling interactions and delivering services to a customer. on the new interaction.
-
Ensure that the alarm statuses are green and that all jobs have succeeded in the agent job monitor on the computer running SQL Server.
-
Verify that you can generate a QM report that includes the new interaction.

Step 11 of 13 associated with changing the DMSA or MSA, or both.
In this step, you have the option to remove the old accounts you are no longer using.
The new DMSA and MSA accounts are now fully set up and the system is operating. Optionally, you can remove the previous accounts from the computer running SQL Server and from the Windows Domain.

Step 12 of 13 associated with changing the DMSA or MSA, or both.
In this step, you have the option to remove SQL SysAdmin from the new DMSA or MSA accounts you are now using.
Earlier in this procedure, you provided the DMSA or MSA account with SQL SysAdmin privileges.
The SQL SysAdmin privileges are only required by these accounts during the first time server installation, and when you are changing the DMSA/MSA accounts to new accounts.
Following the first successful Enterprise Manager distribution, you can remove the SQL SysAdmin permission from the DMSA or MSA user account.
During future service pack and hotfix installations, SysAdmin privileges will need to be re-instated. This is also the case whenever changing the MSA or DMSA accounts.

Step 13 of 13 associated with changing the DMSA or MSA, or both.
In this step, you restore the SSRS encryption keys that you backed up when you performed Step 5. Change the SSRS Service User.
For details the procedure to restore the encryption keys, see the Workforce Optimization Maintenance Guide.