Manage SolarWinds Platform Service Accounts

_system

This account is automatically generated by the Configuration Wizard. It is specifically used for internal communication between SolarWinds services. The password is randomly generated and encrypted by a certificate stored on the SolarWinds Platform. It is primarily used between SolarWinds Information Service v3 and SolarWinds Orion Module Engine service to communicate to SolarWinds Cortex service via its HTTP API. The account requires admin privileges.

Steps to reset or rebuild the account:

1. To remove the account and credentials, run the following SQL commands against the SolarWinds Platform database:
   
   -- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.
--
DELETE FROM [dbo].[Accounts] WHERE [AccountID] = '_system'
--
DELETE FROM [dbo].[CredentialProperty] WHERE [CredentialID] = (SELECT [ID] FROM [dbo].[Credential] WHERE [Name] = '_system')
--
DELETE FROM [dbo].[Credential] WHERE [Name] = '_system'
    
2. Run the Configuration wizard to recreate them.

Erlang cookie

The main purpose of the Erlang.cookie is to secure and authenticate communication between RabbitMQ nodes in a high availability (HA) cluster.

The RabbitMQ server uses Erlang as a virtual machine and usually runs on the main polling engine. When HA is enabled, the RabbitMQ server also runs on the backup server and a RabbitMQ cluster is created.

In an HA setup, the Erlang cookie file needs to be the same on all members of the main polling engine pool. This is accomplished by storing the encrypted cookie value in the database credential store.

More information can be found in the RabbitMQ documentation: https://www.rabbitmq.com/clustering.html#erlang-cookie (©Copyright 2007-2020 VMware, Inc., available at https://www.rabbitmq.com/, obtained on February 3, 2021)

Steps to reset or rebuild the account:

To reset the Erlang cookies, see the following procedures:

• Full RabbitMQ Reset in Orion Platform products
• RabbitMQ - SWIS Issues - Failed to connect to Broker

JobEngine

The Job Engine router TCP endpoint credentials are generated by the Configuration Wizard. This account is used for internal communication between the JobEngine service and the SolarWinds services that use it (for example, the Collector and Business Layer services).

Steps to reset or rebuild the account:

To reset this account, administrators must delete records from the database and run the Configuration Wizard to recreate them.

1. To remove the credentials, run the following SQL commands against the SolarWinds Platform database:
   
   -- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.
--
DELETE FROM [dbo].[CredentialProperty] WHERE [CredentialID] = (SELECT [ID] FROM [dbo].[Credential] WHERE [Name] = 'JobEngine')
--
DELETE FROM [dbo].[Credential] WHERE [Name] = 'JobEngine'
2. Run the Configuration Wizard on the main polling engine and all additional polling engines, because the credentials are also stored in c:\programdata\SolarWinds\JobEngine.v2\ucdat1.xml and must be synchronized.
   Running the Configuration Wizard automatically restarts services.
   
   Note: There is no bulk method for running the Configuration Wizard. It must be run manually.

This is a SQL database user without a login and without a password. It is a member of the OIP DB role.

It is used in the OIP Client to collect and send Orion Improvement information from the Orion database in read-only mode with limited access to sensitive tables.

The Orion Linux Agent daemon runs under a local dedicated 'swiagent' user account and 'swiagent' group that is created when the agent is first installed. This is a least-privileged account and cannot be used to authenticate to the system remotely via methods such as SSH. It is also possible to change the user account the Linux Agent daemon runs under, but this is not recommended and not officially supported at this time. Note that any non-local Linux system monitoring requires additional credentials to be specified when it is initially configured through the Orion web interface. For example, the monitoring of MySQL, JBoss, PostgreSQL, etc. all require additional credentials to be specified because the account the Agent daemon runs under does not have sufficient privileges to monitor these types of applications.

The Windows Agent service runs under the local system account. This the same account used to run virtually all native and non-native Windows services. While the account the Orion Windows Agent service runs under can be changed, this has not been thoroughly tested, is not recommended, and not officially supported at this time. Note that any non-local Windows OS system monitoring requires additional credentials to be specified when it is initially configured through the Orion web interface. For example, monitoring MSSQL, Oracle, Exchange, etc. all require additional credentials to be specified because the local system account that the Agent service runs under does not have sufficient privileges to monitor these types of applications.

Steps to reset or rebuild the account:

N/A

RabbitMQ

RabbitMQ is a third-party (open source) message broker software shipped with the SolarWinds Platform. It acts as a “middleman” and accepts messages from Orion components (producers) and delivers them to other Orion components (consumers). To connect to RabbitMQ, every producer and subscriber needs a username and password.

The fixed username "orion" and a randomly generated password are generated when the Configuration Wizard initially runs. They are stored in the Orion credential store. This account is given superuser access within RabbitMQ.

There is also a RabbitMQ management console that allows users to monitor and manage RabbitMQ from a web browser using the same credentials.

If there is any suspicion that RabbitMQ server is compromised, rebuild the account as described below.

Steps to reset or rebuild the account:

To rebuild the RabbitMQ user account, follow the instructions in these KB articles:

• Full RabbitMQ Reset in Orion Platform products
• RabbitMQ - SWIS Issues - Failed to connect to Broker

This is a SQL database user without login and without a password. It is a member of the Reporting role.

It is used by the SolarWinds Platform to execute SQL queries for Reports that use SQL Query Datasources. The user is limited to querying/reading non-sensitive data only from the SolarWinds Platform (SolarWindsOrion) database.

This non-administrator account with no privileges is created automatically to speed up starting the website when accessing the Web Console for the first time after restarting the server or running the Configuration Wizard.

Steps to reset or rebuild the account:
If you delete the account, Configuration Wizard restores it. The account expires 10 minutes after the Website Maintenance or after the Configuration Wizard. The password changes after each usage.
If you do not want to use the account and you are ok with the slow start of the website, delete the account and clear the Enable Cold Start setting:

1. In the Web Console, click Settings > All Settings and then click Web Console Settings.
2. Search for the Enable Cold Start box, clear it, and submit your changes.

The Web Console starts more slowly when run for the first time but the WebsiteMaintenance_user account will not appear anymore.

DPAServiceUser_....

This account is used to establish a federated SWIS connection between Database Portfolio Analyzer (DPA) and the Orion Platform.

Steps to reset or rebuild the account:

The password is generated and users cannot choose or change it. However, if there is a need for a new service account with a new password, you can:

1. Remove the integration between the Orion Platform and the DPA server. (See Remove integration with a DPA server manually.)
2. Remove the service accounts.
3. Re-integrate the DPA server. A new service account with a new password will be created.

__DPA.Service.Account_...

DPAIM creates a service account in DPA and these are the credentials for it. It is created during the integration process because it needs to establish a communication channel without storing admin credentials (needed for integration initialization).

Steps to reset or rebuild the account:

The password is generated and users cannot choose or change it. However, if there is a need for a new service account with a new password, you can:

1. Remove the integration between the Orion Platform and the DPA server. (See https://support.solarwinds.com/SuccessCenter/s/article/Remove-integration-with-a-DPA-server-manually.)
2. Remove the service accounts.
3. Re-integrate the DPA server. A new service account with a new password will be created.

EocSystemAccount-X

This is a system account used by EOC to gather information from remote instances. It is created on remote instances.

Steps to reset or rebuild the account:

Removing the site associated with the system account from EOC should remove the account. Then you can re-add the site, and a new account will be created. See Add a SolarWinds Site to EOC in the EOC Administrator Guide.

If the method above doesn't work, an alternative option is to delete the account from the database and re-add the EOC site. The following script is an example:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.
--
DELETE FROM [dbo].[Accounts] WHERE [AccountID] = 'EocSystemAccount-...'
--
DELETE FROM [dbo].[CredentialProperty] WHERE [CredentialID] = (SELECT [ID] FROM [dbo].[Credential] WHERE [Name] = 'EocSystemAccount-...')
--
DELETE FROM [dbo].[Credential] WHERE [Name] = 'EocSystemAccount-...'

EocSubscription

(Present on remote instances.) This account is used to authenticate remote sites communicating back to EOC about possible schema changes (for example, when a custom property has been added). The password for this account is created dynamically each time SWIS is started in EOC.

Steps to reset or rebuild the account:

Restart SWIS on the EOC side. This generates new credentials on each EOC site.

Container Monitoring

Container Monitoring within the SolarWinds Platform requires an Admin Account. For more information, see:

• Monitor containers in the Orion Platform
• Container monitoring requirements

Kubernetes resources created:

• Namespace: orion
• ServiceAccount: orion-account
• ClusterRole: orion-role
• ClusterRoleBinding: orion-role-binding
• Service: orionaggregator-service

​Steps to reset or rebuild the account:

To remove the resources listed above:

1. Go through the add container service wizard, and select Kubernetes.
2. When the first step of downloading the manifest is complete, run this command instead of the create command (delete instead of create):
   sudo kubectl delete -f orion-kubernetes.yaml
3. Go through the creation process again.​​​​​

Windows local system account

root privileges (sudo) on Linux

root privileges on OSX

There is no need to change passwords due to the type of accounts used. This information is applicable to the discovery scanners and agents.

Steps to reset or rebuild the account:

N/A

STMServiceUser_randomstring

This service account is used to sync license information between SRM and STM (SRM Profiler). The password generated for a service account is a random password when the integration is set up and exchanged between SRM and STM (SRM Profiler) using their SWIS credentials.

Steps to reset or rebuild the account:

To reset or change the password, disable and enable integration to re-generate a new service account password. See:

• Disable integration between SRM and SRM Profiler
• Integrate SRM and SRM Profiler

If integration with STM (SRM Profiler) is not enabled, any Orion accounts starting with "STMServiceUser_" can be safely removed.

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.
--
DELETE FROM [dbo].[Accounts] WHERE [AccountID] like 'STMServiceUser_%'

VMANServiceUser_

This service account is used for VMAN to VMAN Appliance (legacy Linux-based VM appliance) integration. During the creation of the first account, the Orion Service account is also created.

Steps to reset or rebuild the account:

If integration with the legacy VMAN appliance is not used, simply delete all Orion accounts starting with "VMANServiceUser_":

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.
--
DELETE FROM [dbo].[Accounts] WHERE [AccountID] like 'VMANServiceUser_%'

If integration with the VMAN appliance is used, disable integration with the VMAN appliance, delete the account 'VMANServiceUser_' (using the steps above), and then enable integration again.

WHDNotificationUser_

This service account is used by WHD to integrate with the SolarWinds Platform and create tickets in WHD from alerts. The account is used to subscribe to alerts.

Steps to reset or rebuild the account:

The username and password are dynamically generated when a new source is created. To reset the password, delete and recreate the source in WHD under SolarWinds integration.

whd

When WHD is installed, it also installs a PostgreSQL server that is used in case the client wants to use the embedded database option. During the installation, a PostgreSQL user is created with the username 'whd' and password 'whd'.

Steps to reset or rebuild the account:

Connect to the PostgreSQL server with the user 'whd' and change the password by issuing the following SQL command:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.
--
ALTER USER whd WITH ENCRYPTED PASSWORD 'password'

LocalSystem account

The Windows account 'LocalSystem' is used to run the Tomcat service behind WHD as a Windows Service. The same account is also used to run the embedded PostgreSQL server as a service.

Steps to reset or rebuild the account:

N/A

AesKeyIVCredentials

This is the AES Key and Initialization Vector for AES algorithm. It is used to encrypt and decrypt user recordings in the Orion database.

Steps to reset or rebuild the account:

To recreate the AES key, complete the following steps. (Note: All historical data from all transactions will be lost.)

1. Export all WPM recordings to files from the Web Console.
2. Delete all WPM recordings through the Web Console.
3. Run the following SQL script in Microsoft SQL Studio on the SolarWinds Orion database.
   
   -- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.
--
DELETE FROM [SolarWindsOrion].[dbo].[CredentialProperty]
WHERE CredentialID IN (SELECT [ID] FROM [SolarWindsOrion].[dbo].[Credential] WHERE CredentialOwner = 'SEUM')
--
DELETE FROM [dbo].[Credential] WHERE CredentialOwner = 'SEUM'
4. Run the Configuration Wizard, which will recreate the AES Key and Initialization Vector Credentials in the Orion database.
5. Import the WPM recordings that you previously backed up to files.

SEUM-User-#

These Windows accounts are created on each machine where the WPM player is installed. They are used by the WPM agent for playbacks. Passwords are randomly generated by default, require local admin privileges, and are stored locally in the C:\ProgramData\SolarWinds\SEUM\Data\AgentSettings.dat file.

They can be replaced with domain accounts, and SolarWinds recommends deploying dedicated WPM player machines per WPM location.

Steps to reset or rebuild the account:

• For domain accounts, passwords can be changed by AD administrators.
• To replace domain accounts with a new set of them, see Use local domain accounts as SEUM-User accounts.
• To reset passwords for SEUM-User-# accounts password, see Manage SEUM-User accounts in WPM.

To remove all SEUM-User accounts and recreate them:

1. Open services.msc.
2. Stop the WPM Playback Player service.
3. Open the properties of the WPM Playback Player service and disable it.
4. Restart the WPM Player location machine.
5. In the Computer Management window, navigate to Local Users and Groups > Users, and then remove all SEUM-User-# accounts.
6. In the C:\Users\ folder, remove all SEUM-User-# folders.
7. If you want to set a known password (not random) for all SEUM-User-# accounts:
   1. Run Notepad as administrator.
   2. Open the SolarWinds.SEUM.Agent.Service.exe.config file in the following location:
      C:\Program Files (x86)\SolarWinds\Orion\SEUM\Player\
   3. Set the workerUserPasswordOverride attribute value in the agentConfiguration section to the known password you want to set to all SEUM-User-# accounts.
8. In services.msc, enable and start the WPM Playback Player service.
   Accounts are recreated with a new password (random or known).
9. Add SEUM-User-# accounts to the local administrator's group.
10. For deprecated recordings, see this KB article as well to disable the automatic detect setting: WPM transaction is slow or fails during playback in Orion Web Console but works in WPM Recorder.

SolarWinds-SEUM-Users

This local group is created automatically and contains the SEUM-User-# accounts used for WPM players during playback.

Steps to reset or rebuild the account:

To change the group name:

1. Stop the WPM Playback Player service.
2. Run Notepad as administrator.
3. Open the SolarWinds.SEUM.Agent.Service.exe.config file in the following location:
   C:\Program Files (x86)\SolarWinds\Orion\SEUM\Player\
4. Edit the workerUserGroup attribute value in the agentConfiguration section.

1. Stop the WPM Playback Player service.
2. In the Computer Management window, navigate to Local Users and Groups > Groups, and then remove the group "SolarWinds-SEUM-Users".
3. Follow the instructions for resetting SEUM user passwords in Manage SEUM-User accounts in WPM to recreate the group (you need to either delete SEUM-User-# accounts or change their password to force recreation of it).