How to work around accounts locked by an AppAssure Core due to password changes. (4038236)

How to work around accounts locked by an AppAssure Core due to password changes.

You notice that the account you are using to protect AppAssure agents is consistently blocked. You determine that the cause is an account password change. The cores is still holding the previous credentials and locks the account every time the core service starts due to attempting to connect to the protected agents multiple times.

You want to be able to change the account credentials without locking the account again.

Warning: All scripts provided in this article are meant to be used as examples are not supported. 

Apparently there is no good solution to this issue, especially if the locked account is used by different other applications as well. It is not possible to change the account password while the core service is offline as it is encrypted and the account will be locked if the core service is started.

However, a workaround exists. The solution is replacing the username for the credentials and default metadata credentials, which are held in plain text with a dummy user. After this operation and starting the core service, all affected agents can be repared via bulk protect to push the new credentials.

To work around the issue please do the following:

1. Stop the core service and unlock the account.

2. Run the attached script on the core with the issue. 
The script needs powershell 3.0 or later (it checks the powershell version automatically). Once a supported powershell version is found, a user prompt asks for the desired replacement username and a gridview control opens up, allowing selecting the agents to process.
After the agents are selected, the new user name is applied both on the credentials and metadata credentials on each previously selected agent.
The progress of the operation is shown on the screen.

3. Start the core service, wait for the repository check to end and use bulk protect to repair the agents.

The code for the script is shown below between horizontal lines and attached to this KB. 

_______________________________________________________________________

<#
.Synopsis
This script allows changing the current username for multiple protected servers while the core service is stopped. Bulk protection is needed.
The issue occurs when the user password has expired and the core locks the authentication user.

#>

cls
Write-Host "Change Credentials/DefaultMetadataCredentials Account For Selected Agents`r`n-------------------------------------------------------------------------`r`nIf the password for the UserAccount has changed, AppAssure may lock that account while trying to connect to the protected servers.`r`nA way of solving the issue is replacing the current user acount on the core with a dummy account and then repair the installation via bulk protect`r`nThis script addresses this issue by allowing changing the user account wityh a dummy one while the ciore service is stopped.`r`n" -f green
$psversion = $psversiontable.Item("psversion")
if($psversion.major -lt 3){ Write-Host "Powershell version $($psversion.major).$($psversion.minor) has been found.`r`nPowershell Version 3.0 or later is needed.`r`nPlease upgrade powershell. Exiting..."; exit}
$account = Read-Host "Dummy Account User Name"
#get-agents
$rootpath = "registry::HKEY_LOCAL_MACHINE\SOFTWARE\AppRecovery\Core\Agents"
[array]$agentpaths= (get-childitem -Path $rootpath).name
$agents=@()
foreach($ax in $agentpaths){
$agentline=[pscustomobject]@{agentname=(get-itemproperty -Path registry::$ax -Name displayname).displayname;currentusername=(get-itemproperty -Path "registry::$ax\Credentials" -Name username).username;currentdefaultmetadatausername=(get-itemproperty -Path "registry::$ax\MetadataCredentials\DefaultCredentials" -Name username).username;agentpath=$ax}
$agents += $agentline
}
$agents = $agents | Out-GridView -Title "Select the Agents to process" -PassThru
if(!($agents)){Write-Host "Canceled...";exit}
foreach($a in $agents){
$ag=$a.agentname
Write-Host "`r`n$($ag)" -f Yellow
$credentialpath = "registry::$($a.agentpath)\Credentials"
$metacredentialpath="registry::$($a.agentpath)\MetadataCredentials\DefaultCredentials"
Set-ItemProperty -Path $credentialpath -Name UserName -Value $account
Write-Host "Default Username: $((get-itemproperty -Path $credentialpath -Name username).username)"
Set-ItemProperty -Path $metacredentialpath -Name UserName -Value $account
Write-Host "Default Metadata Username:$((get-itemproperty -Path $metacredentialpath -Name username).username)"
}

________________________________________________________________________

Changeagentusername