Enterprise Administration Guide › Implementing Shared Accounts › How to Set Up Password Consumers › Password Consumer Example: Windows Scheduled Task

Password Consumer Example: Windows Scheduled Task

Windows Scheduled Task and Windows Service password consumers help you automate password changes for service accounts. Service accounts are internal accounts used by Windows services. For example, if you configure a scheduled task to regularly check for software updates, the scheduled task uses a service account to log in to the endpoint and perform the task.

You can create Windows Scheduled Task and Windows Service password consumers only on Windows Agentless endpoints. You do not need to install CA ControlMinder on the endpoint to use Windows Service and Windows Scheduled Task password consumers.

You can create Windows Service password consumers only for services that are run by accounts for which you can change the password. For example, you can create a password consumer for a service that is run by your computer's Administrator account; you cannot create a password consumer for a service that is run by the NT AUTHORITY\Local Service account.

In the following example, the system administrator Steve wants to create a password consumer for a scheduled task that checks for software updates on a Windows endpoint named win456. The scheduled task uses the win456\ServiceAdmin account to log in to the endpoint.

Steve does the following in CA ControlMinder Enterprise Management:

1. Steve creates a password policy named 30days. The password policy specifies that CA ControlMinder Enterprise Management changes the password for service accounts every 30 days and that the password can be changed only on Sundays between 1 a.m. and 3 a.m.
2. Steve creates a Windows Agentless endpoint named win456.
3. Steve uses the service account discovery wizard to discover the win456\ServiceAdmin account on the win456 endpoint, and applies the 30days password policy to the service account.
4. CA ControlMinder Enterprise Management creates a Windows Scheduled Task password consumer using the following parameters:
   • Name—UpdateTask (C:\WINDOWS\Tasks\UpdateTask.bat) at win456
   • Consumer Type—Windows Scheduled Task
   • Application Path—C:\WINDOWS\Tasks\UpdateTask.bat
   • Privileged Account—win456\ServiceAdmin
   • Endpoints—win456

   Steve has created the password consumer. Each time that CA ControlMinder Enterprise Management changes the password for the win456\ServiceAdmin account, the JCS logs in to the win456 endpoint and changes the password of the software update scheduled task. If the password change does not succeed, Steve can use the Synchronize Password Consumers task to retry the password change.