Service Account Rotation Settings

How It Works #

The SecureAnyBox server changes the passwords for so-called service accounts. These accounts are used to start and run system services, scheduled tasks, IIS application pools, and to authenticate default or Autologon accounts. After each password change, all configurations on all Windows servers and computers must be updated synchronously (with minimal delay) so that the correct new password is used the next time the system is started.

Password changes for accounts in Active Directory are handled by the LDAP agent, which does not require installation but is part of the SecureAnyBox server; each instance of the agent simply needs to be configured.

Configuration changes on servers and computers where service accounts are used are handled by SecureAnyBox agents, which must be installed and provided with the generated configuration. The agent then runs as a system service and ensures that changes are implemented based on information it receives via a secure communication channel from the SecureAnyBox server.

The agent also enables the rotation of local accounts, typically the Administrator account. This document does not address the configuration of this rotation; rather, it is disabled to prevent changes from occurring during the initial status assessment—that is, the process of identifying all used AD and local service accounts and reporting them to the SecureAnyBox server, where you can work with the information.

This document walks you through all the steps you need to take—from assessment to initiating and running rotation, and finally, if necessary, stopping rotation and preserving current passwords for administrative purposes.

1. Viewing the License and Checking Limits #

In the user interface, open the License page and, in the Endpoints section, verify that you have a sufficient (unlimited) number of licenses for endpoints and agents.

2. Configuring Credentials for Password Changes in AD #

Unlike standard credentials intended only for reading or synchronization, these credentials are used to actively rotate and change passwords in Active Directory. For this reason, it is necessary to correctly configure the search scope and the appropriate permissions for the account being used.

First, you need to download the PowerShell script to create an AD user with the appropriate permissions. The script can be downloaded from the LDAP Agent Manager Account Setup Guide page, which is accessible from the Credentials form.

Preparing Active Directory using the script #

• Log in to the domain controller (or Schema Master) and prepare the secureanybox_agent_ad_setup.ps1 script.
• In the PowerShell console, run the script with permissions to bypass execution policies:

PowerShell.exe -ExecutionPolicy UnRestricted -File secureanybox_agent_ad_setup.ps1

• SecureAnyBox Manager account: The script automatically creates a SecureAnyBox Manager account (e.g. CN=secureanyboxPrahaPswdMgr,...) and generates a random password. Note: You can leave the default fixed account name for rotation in the script, or you can modify the account name directly in the script parameters to comply with your organization’s standards.
• Permissions to Change Passwords: The script assigns the necessary permissions in AD to the created account to directly change passwords (Reset Password / Change Password) for managed accounts.
• Scope (Search Base) Settings: When running the script or during subsequent configuration, set the Search Base to include both all managed service accounts and the group that controls rotation.
• Upon completion, the script will output the configuration values to the console for entry into the interface. At the same time, a file named secureanybox_agent_ad_setup_params.txt will be created, containing the details of the newly created SecureAnyBox account. The file is created in the same folder as the PS1 script.

Configuring the form in SecureAnyBox #

Go to Administration Interface → Configuration → Credentials and fill in the parameters:

• Name: A unique name for the credential (e.g. PRAHA_AD_ROTATE_PSWD).
• SecureAnyBox Account: The distinguished name (DN) of the account created by the script (e.g. CN=secureanyboxPrahaPswdMgr,CN=Users,DC=praha,DC=firma,DC=cz).
• SecureAnyBox Account Password: The generated password for the SecureAnyBox account.
• Directory Service: Select Active Directory.
• Server Address / Port / SSL: Enter the domain controller details (e.g. dc01.tdp.cz, port 636, SSL checked).
• LDAP Search Base: The path to the search container (scope) that encompasses both the managed service accounts and the control group (e.g. DC=praha,DC=firma,DC=cz or the appropriate parent OU).

Before saving, verify that the settings are correct by clicking Test, then click OK to save.

3. Initial Agent Configuration (for Windows) #

In the user interface, go to the Agent Configuration page and click the Add Configuration button. Create a new configuration in which the MS Windows platform must be enabled (leave the other platforms—Linux, macOS, and LDAP—disabled).

Next, configure the settings in the individual configuration tabs:

General #

• Configuration Mode: Check the “Configuration Mode” option (The agent will contact the SecureAnyBox server regularly even if no password changes are pending). This mode ensures that agents on endpoints maintain a regular connection with the SecureAnyBox server and report their current status even during periods when no password rotation is taking place.

MS Windows #

• Manage Local Passwords: OFF (leave unchecked to disable rotation of local accounts).
• Update Autologon Password: DISABLED (leave unchecked).

Agent-Managed Accounts #

• Check the following options: Manage service accounts, Manage scheduled task accounts, and Manage IIS application pool accounts.
• DN of the agent-managed accounts group: Enter the DN (distinguished name) of the group in Active Directory (e.g. CN=PRAHAserviceUsers,CN=Users,DC=praha,DC=firma,DC=cz).

How to find the group’s DN #

Using PowerShell (fastest) #

On any machine with the RSAT/Active Directory module, run the following command:

Get-ADGroup -Identity "PRAHAserviceUsers" | Select-Object DistinguishedName

Using the graphical interface (ADUC) #

1. Open Active Directory Users and Computers (dsa.msc).
2. In the top menu, select View → Advanced Features.
3. Find the group, open its Properties, and go to the Attribute Editor tab.
4. Find the distinguishedName attribute, double-click the value, and copy the value from the String Attribute Editor window.

Service accounts #

• System service names: Set the regular expression (REGEX) to select all services by entering the value: /.*.*/

Scheduled tasks #

• Scheduled Tasks Folder Name: Enter the folder name (e.g. SAB).
• Identification text: Text added to the description of a scheduled task in the operating system to explicitly identify tasks whose passwords are actively managed and rotated by the agent. This string serves as a security and informational flag for system administrators (e.g. [Active_Rotation_SecureAnyBox]).

IIS Application Pools #

• IIS Application Pools Names: Set a regular expression (REGEX) to select all application pools by entering the value: /.*.*/

After completing the setup, save the configuration and apply the changes to the SecureAnyBox server configuration to save the new agent configuration.

4. LDAP Agent Configuration #

To enable communication and password rotation in Active Directory, create and configure an LDAP agent instance in the SecureAnyBox interface:

Creating an LDAP Agent Instance #

• Go to SecureAnyBox → Agent Configuration → LDAP Agent Configuration.
• Click the + Add LDAP Agent button.

Setting Parameters #

• Credentials: Select the credentials created in step 2 (e.g. PRAHA_AD_ROTATE_PSWD).
• Agent Configuration: Select the agent configuration created in step 3.
• Directory Service: Select Active Directory.

Saving the LDAP Agent #

Save the form by clicking the OK button and then applying the changes to the SecureAnyBox configuration.

5. Download the Agent, the XML Configuration, and Prepare for Distribution Using GPO #

Go to SecureAnyBox → Downloads. On the MS Windows tab, download the SecureAnyBox Agent installer for MS Windows (secureanybox-agent-4.0.0.msi) and the agent configuration file in XML format.

Prepare a GPO for bulk deployment of the agent to endpoints by following these steps:

Preparing a Shared Folder (NETLOGON / Sysvol) #

• Copy the downloaded agent installer (secureanybox-agent-4.0.0.msi) and the XML configuration file to a shared folder accessible to all target computers in the domain (e.g. \\your.domain\NETLOGON\SecureAnyBox\).
• Ensure that the Domain Computers accounts have read access to this folder.

Creating and Configuring a GPO #

• On a domain controller, open the Group Policy Management Console (gpmc.msc).
• Create a new GPO (e.g. Deploy_SecureAnyBox_Agent) and link it to the organizational unit (OU) containing the target endpoints.

Make sure that in the Security Filtering section of the form, the Domain Computers group is present, and on the Delegation tab, the Domain Computers group is granted the Read / Apply group policy permission.

To verify the permissions for the Domain Computers group, go to the Delegation tab and click the Advanced button.

Select the Domain Computers group and check that the group has the appropriate permissions (Read and Apply Group Policy).

Right-click the new GPO object and select Edit.

Configuring Automatic Software Installation #

Navigate to the Computer Configuration → Policies → Software Settings → Software Installation tree.

Right-click, select New → Package, and select the MSI installer from a shared UNC network path (e.g. \\your.domain\NETLOGON\SecureAnyBox\secureanybox-agent-4.0.0.msi).

Select Assigned as the assignment type.

In the properties of the created package, on the Deployment tab, check the box for “Ignore language when deploying this package.”

Network Configuration on the Target Endpoint #

Within the same GPO, navigate to the Computer Configuration → Administrative Templates → System → Logon tree.

Locate the “Always wait for the network at computer startup and logon” setting and set it to Enabled.

Import the Registry Settings for the Agent #

In the Group Policy Management Editor, navigate to the tree: Computer Configuration → Preferences → Windows Settings → Registry.

Copy the secureanybox-agent.xml file (downloaded from the SecureAnyBox server) to the clipboard.

Right-click on Registry and select Paste from the context menu.

In the prompt that appears, confirm the import of items from the clipboard by clicking the Yes button.

After restarting the target endpoints or running the gpupdate /force command, the SecureAnyBox agent will be installed automatically, including the copying of the downloaded XML configuration.

6. Installation and Verification Using SecureAnyBox Agent Monitor #

To diagnose and verify that the SecureAnyBox Agent is communicating properly on the endpoint, you can use the SecureAnyBox Agent Monitor utility.

• Download and installation: From the Downloads page in the SecureAnyBox interface, download the SecureAnyBox Agent Monitor tool and run it directly on the target endpoint.
• Checking Communication: Open the running SecureAnyBox Agent Monitor application. The tool clearly displays agent events from the Windows Event Viewer. Use it to verify that, after startup, the agent is communicating properly with the SecureAnyBox server, sending requests regularly, and reporting no error states.

7. Verifying Agent Operation and Connection #

After the agent is installed on the endpoint, it sends a registration request (handshake) to the SecureAnyBox server’s registration URL.

On the Endpoints page, verify that the endpoint is registered and actively communicating with the SecureAnyBox server.

Automatic Registration #

• After installation and configuration, the agent sends a registration request (handshake) to the SecureAnyBox server’s registration URL.
• In the user interface, on the Endpoints page, verify that the endpoint has a status of Registered and is actively communicating with the server.
• Automatic registration after configuration validation may take up to 10 minutes.

Manual Registration Options #

• If the endpoint does not have direct access to the SecureAnyBox server for an automatic handshake, you can register it manually.
• Click the Register Endpoint button and fill in the required parameters (Agent Configuration, Operating System, Endpoint Name, Specified IP Address, Time Zone).

Troubleshooting Registration Failures #

• Incorrect or Changed Configuration: Ensure that the agent configuration on the endpoint exactly matches the configuration stored on the SecureAnyBox server.
• Endpoint name change: If the endpoint name has changed, delete the original registration on the Endpoints page and wait up to 10 minutes for automatic re-registration.
• HTTPS Certificate Trust: If the endpoint can access the SecureAnyBox server but communication fails, verify that the SecureAnyBox server’s HTTPS certificate has been imported as trusted on the endpoint.

8. Agent Accounts #

After registering at least two agents on endpoints, go to the Agent Accounts overview in the user interface (User Interface → SecureAnyBox → Agent Accounts). This overview displays all service accounts that SecureAnyBox Agents have detected on endpoints according to the rules specified in the Agent Configuration.

Expected Status After Registration #

Since the designated user group in Active Directory is completely empty at this stage, the Password Rotation column for all reported accounts should show that they have not been rotated (or that the operation did not take place).

Types of Reported Accounts #

• AD accounts: Accounts for which, after being assigned to a managed group (the group specified in the agent configuration), passwords will be rotated using SecureAnyBox.
• Accounts that are neither local nor in AD: Accounts for system services, scheduled tasks, or IIS application pools that match the regular expression set in the agent configuration but cannot be managed by the agent.

Aggregation and Resolution #

If the same service account is used on multiple endpoints simultaneously, it will be displayed separately in the overview for each specific endpoint.

Filtering and Display Settings #

• By default, all accounts from all configurations are displayed.
• Use the Select Configuration button to limit the list to a specific agent configuration.
• Use the filters in the column headers to filter data by target type (services, tasks, IIS pools), target ID, username, account type (AD/Local), endpoint, rotation status, settings status, or management status (Yes/No).

9. Agent Accounts Users #

The Agent Accounts Users overview (User Interface → SecureAnyBox → Agent Accounts Users) displays an aggregated summary of all service accounts managed by agents across all configurations.

Expected Status After Registration #

Since the specified user group in Active Directory is currently empty, all accounts should display the status “No” in the Rotated column in this step.

Aggregation and Account Details #

• Unlike the Agent Accounts overview, this report lists individual accounts only once for each configuration, even if they are used on multiple endpoints simultaneously.
• For each account, its type (AD / Local) and, if applicable, its LDAP DN are displayed.

Usage and Management Tracking #

• Used column: Displays the total number of times the account has been used. Icons are used to distinguish usage across different target types (system services, scheduled tasks, IIS application pools). If an account is marked as “Used,” it means that the SecureAnyBox Agent detected it on the endpoint. To the right of the “Used” column, the number of services, scheduled tasks, or IIS pools for which the account is used on endpoints is displayed.
• Managed column: Displays the total number of targets where the agent actively manages the account, also broken down by target type. For an account to be managed, it must be added to the AD group specified in the agent configuration.
• Rotated column: Indicates the account rotation status (not yet rotated at this stage).

Filtering and Functions #

• Accounts can be filtered by username, account type, LDAP DN, and rotation status.
• The Refresh button updates the report’s content and loads the latest data.
• The Save Current User Passwords button allows you to save the currently valid passwords for managed accounts to a new Security Vault (treasury). The permissions of the logged-in user apply when saving.

Change User Account #

For a managed account, you can schedule a change of the user account under which the relevant targets are run. In the row of the desired account, open the Actions menu and select Change user account to…

• For an Active Directory account, enter the fully distinguished name (FDN) of the new account.
• For a local account, enter the name of the new local account.
• A change is only possible between accounts of the same type. An Active Directory account can therefore only be changed to another Active Directory account, and a local account only to another local account.
• After the change is scheduled, the agents perform the change in two passes. In the case of an Active Directory account, the LDAP Agent changes the password of the new account. The SecureAnyBox Agent on individual endpoints then sets the new user account and its password for all relevant targets in which the original account is used.
• The change is performed on all endpoints and for all relevant targets, i.e. System Services, Scheduled Tasks, and IIS Application Pools.
• In the first pass, the password of the new account is rotated and its use for the relevant targets is scheduled. In the second pass, the change is completed and the new user account including its password is set for individual targets.
• After the change is successfully scheduled, the target account is displayed in the Scheduled change to column.

10. Adding an Account to an AD Group, Initiating Account Rotation by the SecureAnyBox Agent #

Before rotation begins, the status of AD accounts in the Agent Accounts report is as follows:

• Password Rotation column: NOT ELIGIBLE — meaning the user is not eligible for password rotation; the reason is listed in the Message column.
• Status column: The value is SKIPPED.

To start automatic management and password rotation for a specific account, add this user account (AD candidate) to the appropriate domain group in Active Directory, whose distinguished name (DN) was specified in the agent configuration (e.g. CN=PRAHAserviceUsers,CN=Users,DC=praha,DC=firma,DC=cz).

The change will take effect the next time the LDAP agent is started. If you want to start account rotation and enrollment immediately, you can manually start the LDAP agent by clicking the Execute button for the specific LDAP agent in the list (SecureAnyBox → Agent Configuration → LDAP Agent Configuration).

11. Starting Rotation and Reporting #

After executing the LDAP agent (scheduled or manually), check the status on the Agent Accounts page:

• Password Rotation column: For a user added to a managed group in Active Directory, the status changes to ROTATED — this means the password has been successfully rotated in Active Directory.
• Status column: It changes to PENDING — this means the system is waiting for the SecureAnyBox Agent on the given endpoint to apply the new password to the relevant services, tasks, or IIS pools.

To complete the rotation, you must wait for the SecureAnyBox Agent to communicate with the SecureAnyBox server. This takes approximately 10 minutes. To speed up the rotation, you can manually restart the SecureAnyBox Agent directly on the endpoint (restart the SecureAnyBox Agent service).

You can also track the progress in the overview using color coding:

• Yellow: The operation is waiting to complete / is in progress (WAITING status).
• Green: Both the rotation and password setup on the target were successful.
• Red: The operation failed (the error details reported by the agent are displayed in the Message column).

12. Determining the Current Password #

• You typically need the password if you want to make a change to an endpoint, service, task, etc. For example, to change the start time of a scheduled task. Windows requires you to enter the correct current password to authorize the change. For normal automated operation, there is no need to retrieve the password.
• After the rotation is successfully completed, click the “Rotated” or “Set” status in the Agent Accounts overview.
• The currently valid generated password will be displayed in the open dialog box.
• You can copy the password using the Copy to Clipboard button.

13. Saving Valid Passwords to the Safe Box #

The Save Current User Passwords button (in the Agent Account Users report) allows you to save the currently valid passwords for managed accounts to the Safe Box. This is useful, for example, when you finish testing functionality after stopping password rotation.

Procedure for Safely Storing Passwords After Stopping Rotation #

1. First, stop password rotation (see section 14. Stopping Rotation). It is necessary to first pause the automatic generation of new passwords so that the final, unchanging passwords are stored in the Safe Box.
2. Save passwords to the Safe Box:
   • Go to the Agent Managed Account Users report.
   • Click the Save Current User Passwords button.
   • The system will then save all currently valid passwords of the managed accounts into the Safe Box.

Why Use This Functionality? #

This procedure is ideal, for example, upon completing the testing of the functionality or if the customer decides not to use automatic password rotation until full project implementation.

Thanks to this step, the system reaches a fully secured and maintainable state:

• Uniqueness: Every endpoint and every service account has its own unique, strong password generated.
• Availability without licenses: All passwords are securely stored in the Safe Box, from which authorized users can repeatedly retrieve or look them up at any time, even without an active license for the system.

14. Stopping Password Rotation #

For domain accounts managed via Active Directory, stopping rotation is performed exclusively by modifying group membership:

Removing from a Group in Active Directory #

• Open the Active Directory Users and Computers console.
• Locate the managed user account and remove it from the managed AD group (the group whose DN is specified in the agent configuration, e.g. CN=PRAHAserviceUsers,...).

Apply Changes #

After the next scheduled run of the LDAP agent (or after manually starting it via the Execute button in Administration → Configuration → LDAP Agents), the system will register the removal of the account from the group and suspend automatic password rotation.

Verification #

In the Agent Accounts overview, verify that rotation is suspended and that the account is no longer marked as actively managed.