SMS: Changing the SMSClient_<SiteCode> Password Can Cause Account Lockouts (227033)

SYMPTOMS

This article describes potential problems that can occur when Systems Management Server (SMS) version 2.0 is deployed in a domain that has the account lockout policy enabled. The default setting for account lockout is to lock the account after five incorrect logon attempts with an incorrect password and to unlock the account after waiting one half hour.

If the Client Connection account (SMSClient_SiteCode) password is changed in User Manager for Domains, the account is locked out. The SMS 2.0 clients store the password for this account locally and attempt to use the old password until the client is updated with the new password. The client updates the local copy of the password when the install process is run by running Smsls.bat or Smsman.exe.

Until every client has run the installation process and updated the password, the SMSClient_SiteCode account is locked out shortly after it is re-enabled. If the client cannot connect to the Client Access Point (CAP), it tries every hour. The client never becomes aware of the new passwords until it runs the install process. After 60 days without being able to contact the CAP, the client uninstalls itself.