The Add-SCOMRunAsAccount cmdlet adds a Run As account to a management group.
A Run As account enables users to specify the necessary permissions for use with rules, tasks, monitors, and discoveries targeted to specific computers on an as-needed basis.
System Center - Operations Manager distributes the Run As account credentials to either all agent-managed computers (the less secure option) or only to computers that you specify (the more secure option).
By default, all new accounts have the more secure distribution option.
To modify the account distribution policy, use the Set-SCOMRunAsDistribution cmdlet.
Examples
Example 1: Add a Windows Run As account
PS C:\>Add-SCOMRunAsAccount -Windows -Name "Contoso.Windows -Description "Account used for monitoring the Contoso domain" -RunAsCredential (Get-Credential)
This command adds a Run As account that uses Windows authentication.
This example adds a Run As account that uses Community String authentication.
The first command prompts the user to enter the community string for the account and stores the input as a secure string in the variable named $CommunityString.
The second account creates the account and specifies the string stored in $CommunityString as the community string for the account.
Example 3: Add a Basic Authentication Run As account
This example adds an SNMP version 3 account that specifies context, authentication protocol, and privacy protocol.
The first command gets the SNMP version 3 privacy protocol and key for the account and assigns them to the variable named $Auth.
The second command gets the SNMP version 3 privacy protocol and key for the account and assigns them to the variable named $Privacy.
The third command creates the account, uses the credentials stored in $Auth for the authoring protocol and key, and uses the credentials stored in $Privacy for the privacy protocol and key.
Example 10: Add an SCX monitoring account with sudo elevation
This example adds an SCX maintenance account that does not have privileged access by specifying a user name and password and a superuser account for elevation.
The first command prompts the user to enter the password, converts the user input to a secure string, and stores the password in the $SuPassword variable.
The second command creates the account by specifying the password that is stored in $SuPassword as the superuser password.
Parameters
-ActionAccount
Indicates that the account is an action account.
An action account specifies credentials that the MonitoringHost management process uses to perform monitoring activities.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
ActionAccount
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-AuthProtocolAndKey
Specifies a PSCredential object that includes the Simple Network Management Protocol (SNMP) authentication protocol and key.
To obtain a PSCredential object, use the Get-Credential cmdlet.
If this parameter appears, the cmdlet must also specify the UserName and Passphrase parameters.
Specify the protocol name MD5 or SHA for the Username parameter and the key for the Passphrase parameter.
Parameter properties
Type:
PSCredential
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SnmpV3
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Basic
Indicates that the Run As account is a Basic Authentication account, which uses basic web authentication.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
Basic
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Binary
Indicates that the Run As account is a Binary Authentication account, which uses authentication that the user defines.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
Binary
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-CommunityString
Indicates that the Run As account is a Community String account, which uses community string authentication in Simple Network Management Protocol (SNMP) version 2.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
CommunityString
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-ComputerName
Specifies an array of names of computers.
The cmdlet establishes temporary connections with management groups for these computers.
You can use NetBIOS names, IP addresses, or fully qualified domain names (FQDNs).
To specify the local computer, type the computer name, localhost, or a dot (.).
The System Center Data Access service must be started on the computer.
If you do not specify a computer, the cmdlet uses the computer for the current management group connection.
Parameter properties
Type:
String[]
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-Confirm
Prompts you for confirmation before running the cmdlet.
Parameter properties
Type:
SwitchParameter
Default value:
False
Supports wildcards:
False
DontShow:
False
Aliases:
cf
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-Context
Specifies the SNMP version 3 context.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SnmpV3
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Credential
Specifies the user account under which the management group connection runs.
Specify a PSCredential object, such as one that the Get-Credential cmdlet returns, for this parameter.
For more information about credential objects, type Get-Help Get-Credential.
If you specify a computer in the ComputerName parameter, use an account that has access to that computer.
The default is the current user.
Parameter properties
Type:
PSCredential
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-Description
Specifies the account description.
If this parameter does not appear, the default is the display name.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Digest
Indicates that the Run As account is a Digest Authentication account, which uses standard digest web authentication.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
Digest
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Name
Specifies the account name.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
DisplayName
Parameter sets
(All)
Position:
1
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Passphrase
Specifies the Secure Shell (SSH) key passphrase for cross-platform maintenance accounts.
Parameter properties
Type:
SecureString
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SCXMaintenanceSSHKeyNoPrivSu
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyNoPrivSudo
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyPriv
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Path
Specifies the path to the binary data file or SSH key.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
Binary
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyNoPrivSu
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyNoPrivSudo
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyPriv
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-PrivacyProtocolAndKey
Specifies a PSCredential object that stores the SNMP privacy protocol and key.
To obtain a PSCredential object, use the Get-Credential cmdlet.
If you specify this parameter appears, you must also specify the UserName and Passphrase parameters.
Specify the protocol name AES or DES for the Username parameter, and the key for the Passphrase parameter.
Parameter properties
Type:
PSCredential
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SnmpV3
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Privileged
Indicates that the cross-platform maintenance account has privileged access.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SCXMaintenanceUserPassPriv
Position:
Named
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyPriv
Position:
Named
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-RunAsCredential
Specifies the credential for the Run As account.
Parameter properties
Type:
PSCredential
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
User
Parameter sets
Windows
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
Basic
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
Digest
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
Simple
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
ActionAccount
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMonitoring
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceUserPassNoPrivSu
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceUserPassNoPrivSudo
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceUserPassPriv
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-SCSession
Specifies an array of Connection objects.
To get Connection objects, use the Get-SCOMManagementGroupConnection cmdlet.
If this parameter is not specified, the cmdlet uses the active persistent connection to a management group.
Use the SCSession parameter to specify a different persistent connection.
You can create a temporary connection to a management group by using the ComputerName and Credential parameters.
For more information, type Get-Help about_OpsMgr_Connections.
Parameter properties
Type:
Connection[]
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-SCXMaintenance
Indicates that the account is a cross-platform maintenance Run As account.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SCXMaintenanceUserPassNoPrivSu
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceUserPassNoPrivSudo
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceUserPassPriv
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyNoPrivSu
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyNoPrivSudo
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyPriv
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-SCXMonitoring
Indicates that the Run As account is a Basic Authentication account, which uses basic web authentication.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SCXMonitoring
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Simple
Indicates that the account is a Simple Authentication Run As account.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
Simple
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-SnmpV3
Indicates that the account is an SNMP version 3 Run As account.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SnmpV3
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-String
Specifies the account community string.
Parameter properties
Type:
SecureString
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
CommunityString
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Su
Indicates that the cross-platform maintenance account uses superuser elevation to perform privileged actions.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SCXMaintenanceUserPassNoPrivSu
Position:
Named
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyNoPrivSu
Position:
Named
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Sudo
Indicates that the cross-platform account uses sudo elevation to perform privileged actions.
The sudo program enables users to run programs that have the security permissions of another user account.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SCXMonitoring
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-SuPassword
Specifies the superuser password for a cross-platform maintenance account.
Parameter properties
Type:
SecureString
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SCXMaintenanceUserPassNoPrivSu
Position:
Named
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyNoPrivSu
Position:
Named
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-UserName
Specifies the user name for the account.
This parameter is valid only for SNMP version 3 and cross-platform maintenance accounts.
Otherwise, use the RunAsCredential parameter.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
SnmpV3
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyNoPrivSu
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyNoPrivSudo
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
SCXMaintenanceSSHKeyPriv
Position:
2
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-WhatIf
Shows what would happen if the cmdlet runs.
The cmdlet is not run.
Parameter properties
Type:
SwitchParameter
Default value:
False
Supports wildcards:
False
DontShow:
False
Aliases:
wi
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-Windows
Indicates that the account is a Run As account for Windows, which uses Windows credentials for authentication.
This is the default account type if the cmdlet does not specify a different type.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
Windows
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
about_CommonParameters.