Steps to change the password of the Foglight agent account without locking out the SQL Server agents (using Agent Status and Credentials dashboards) (4308764)

When a common password is used for multiple FMS systems, then the password change must be done for all agents sharing the same AD account at the same time.

Collections are done every second and with hundreds of agents there can be a millisecond of difference between each agent trying to make the connections.

If the password change is not managed, then any single account can lock out the account because agents run constantly hitting the AD account.

As the number of agents using a single AD credential increases, the more critical it is to

The quickest means to prevent account lockups is to stop the OS account from being use and reset the agents and credentials. There isn't a way to easily determine which agent is causing the lockout because the logs will quickly fill up with error messages.

1. Navigate to Administration | Agents | Agent Status
2. Stop all SQL Server and WindowsAgents (any agents that are using that user ID)

To update the SQL Server agent passwords (DB connections)

1. Make sure ID is not locked out and nothing is locking the account out in the environment.
2. Navigate to Administration | Agents | Agent Status
3. Highlight all database agents in the FMS that are using the userid (the properties of only one database agent type at a time can be updated)  
4. Edit properties for ALL of these SQL Server agents
5. Update the password.
6. Turn off OS monitoring for these database agents
7. Click the Save button
8. Activate all of the database agents (all of them at once or groups of a few agents at a time)
9. After all of the database agents are enabled. Wait to confirm that the AD account is not locked out.

KB 4301974 includes a groovy script to make a mass update for the password in all SQL Server agents on the FMS. This could be done in place of steps 3-5.

To update OS credentials

1. In Administration | Agents | Agent Status, confirm the WindowsAgents using the same userid are still disabled
2. Navigate to Administration | Credentials, click Manage Credentials
3. Select the notepad icon next to each of the credentials in the list that use the userid to edit the Credential Properties
4. Update the AD password in the popup, and then click the Save button
5. Repeat this for all of the credentials in the lockbox to set all credentials to use the new password.
6. Navigate to Administration | Agents | Agent Status
7. Highlight all database agents in the FMS that are using the userid (the properties of only one database agent type at a time can be updated)  
8. Edit properties for ALL of these database agents of the same type
9. Turn on OS monitoring for these database agents in Agent Status Properties
10. Click the Save button
11. Turn on one WindowsAgent
12. Wait 5-15 minutes to confirm the lockout is not happening.
13. Continue turning on groups of WindowsAgents, confirming that the AD lockout does not occur.