CiscoWorks: How to change casuser name to something else?

[raza555]

Hi,

Due to our company policy, GPO applied on server, casuser is not allowed as a local administrator... Active Directory team says that if we change "casuser" name to any other name as per company policy, then they will be able to make it permanently local administrator.

Are we able to change "casuser" name to anything else...

Also can we use any other service than TASK SCHEDULER, as its also not allowed in GPO. Currently we are unable to make scheduled backups as TASK SCHEDULER is disabled.

Thanks..

[Marvin Rhoads]

I highly doubt it would be possible to change casuser - it is hardcoded into lots of bits under the hood of LMS. Even if you were able to hack it out, it would likely break anytime you upgraded any of the LMS compoenent and would be at best an unsupported (and indeed unsupportable) installation.

Similarly, the task scheduler function is pretty integral to, well, scheduled tasks under windows. That would be like saying can I set up cron jobs without using cron.

I'd say either: a. manage to get an exemption from the problematic GPOs or b. get your server removed from the domain and institute a local adminstration regime that addresses the intent of the requirements implicit in the GPOs.

If neither of those are feasible, I'd seriously consider moving your server to Unix (or a Linux VM via the soft appliance route).

[STEFFEN NEUSER]

In situations of having very restrictive organsiational policies, I would suggest: remove the LMS server from the Windows-Doamin (not DNS domain!!!) and let it run as a standalone server out of your GPO's. LMS is definitly not the only application in the world that need special background users or special system settings as DEP off, exclusions for AV / Windows-Update and some more. Some of desired restrictions from security departments fits for pure and easy operation system services such as file/print/Webservice only and will break the technical prerequisites that more complex applications can survive.

Scheduled LMS backups are working inside the application using the LMS-Job-scheduler without the need for Windows TASK SCHEDULER

Steffen

[Martin Ermel]

to keep things clear, casuser does not need to be a member of the local administrator group it is a member of its own group, named "casusers"; It is just necessary to install LMS as a local administrator so that all necessary settings can be made during installation! But be aware that GPOs can overwrite the necessary rights for casuser (or casusers) and can be responsible for "sudden" problems a week or a month after a successfull and running installation.

casuser can not be renamed.

most of the scheduled jobs are maintened LMS internally and do not need "Task Scheduler" or "at"; the only periodic jobs I know of are logrotsch.bat and backupsch.bat to maintain logfile rotation and the database backup respectively. I would just try to set up these jobs in an alternative scheduler (btw. which one are you using ??). The only consequence I can imaging is that LMS can not report on the status of these jobs...

Both .bat files are only wrappers around the .pl skripts doing the real job.

You should get the permission to enable the task scheduler for a test, setup both jobs in the GUI like you need. When you have done this, open a DOS box, just type "at" and copy the command you see and use it for your own scheduler Then unconfigure the settings in the GUI

Another possibility that comes into my mind is to tweak windows, so that the "at" command points to your own scheduler. You should play with doing this before or after setting up the Job in the GUI (I would start with "after")

But be aware that this is not supported and Cisco TAC can reject any help befor you have reverted these settings.

you alway can make backups with just using the command line:

http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.1/user/guide/admin/appendixcli.html#wp1029527