HP OpenView Operations Administrator's Reference - filibeto.org

About OVO Security
About Security in OVO Operations
506
Why DCE Logins Fail
Generally, the initial DCE login will fail in only the following situations,
❏ Primary Account is on the Management Server
After installation (or after running for the first time in authenticated
mode) if opc_sec_register.sh was executed on the management
server to create the managed node account. In this case, the local
keytab file does not exist. To create the local keytab file, you have to
execute opc_sec_register.sh locally on the managed node.
❏ Local Keytab was Removed or Corrupted
Keytab file of the managed node was removed or corrupted.
❏ Password Expired While the Control Agent was Not Running
Password of the managed node expired while the control agent was
not running. As a result, the control agent is unable to login and
generate a new password.
You can rectify any of these problems by creating a primary account
manually.
Creating a Primary Account Manually
If the DCD login fails, you can log in on the managed node and run
opc_sec_register.sh manually:
Disabling the Primary Account
It is possible to simply disable or even remove the opc-agt-adm account
using standard DCE utilities. However, if you disable or remove the
opc-agt-adm account, the automatic password recovery process will be
compromised. An automatic password recovery process that is
compromised does not affect automatic password generation while the
agent is running and password expiration is enabled.
Chapter 12