I'm working on a Powershell script to update service accounts on named SQL instances in a failover cluster. I'm trying to use the SMO and WMI to update this so that I can update the service account on the active node and have it populated to the other passive nodes (as would happen if I updated manually in the configuration tools). I'm getting hung up on trying to execute the script on my local machine but updating a remote server. The error I see appears to be security related based on my Google searches and is successful if I run the script locally on the remote machine with elevated permissions (as administrator).
The code:
[reflection.assembly]::LoadWithPartialName("Microsoft.SqlServer.SqlWmiManagement") | Out-Null
$mc=New-Object -TypeName Microsoft.SqlServer.Management.Smo.Wmi.ManagedComputer "SQLHOST01"
$srvcs= $mc.Services | Where {$_.name -like "*INSTANCE01*"} | Where {$_.Type -like "Sql*"}
$srvcs | ft name,servicestate,serviceaccount
foreach ($s in $srvcs){
$s.SetServiceAccount("FOO\Bar","strongpass")
}
Error:
Exception calling "SetServiceAccount" with "2" argument(s): "Set service account failed. "
At line:11 char:5
+ $s.SetServiceAccount("FOO\Bar","strongpass")
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : FailedOperationException
Using: Windows 2008 R2 (remote) SQL 2008 R2 (remote) Windows 7 with SQL 2012 sqlps module (local)
Update: The account I am executing the script under has administrator rights on the remote machine.
The primary question here is how can I make my call from the client machine act as if it were running under elevated permissions on the remote machine?
SC_MANAGER_ALL_ACCESSright to access the Service Control Manager, and there are other rights you'll need for the specific services in question. msdn.microsoft.com/en-us/library/windows/desktop/… shows the rights you might need. The easiest way to get around this is to ensure the account you are running the app under has Administrator access to the remote server in question. – Max Vernon Nov 28 '12 at 23:30