1 Add the account as an administrative user
SoftwareCentral connects to the site server as this account, so the account must be an administrative user of the site. It is the account created in Create an Active Directory User.
-
Right-click Administrative Users from the Security folder in the Administration Navigation pane
and select Add User or Group from the context menu. The wizard Add as a Configuration Manager administrative user opens.
Configuration Manager console (external product): right-click Administrative Users and choose Add User or Group. -
Click Browse and add the SCCM_SWC_ADMIN user created in
Create an Active Directory User.
Configuration Manager console (external product): the account appears in User or group name. Click Add next to Assigned security roles for the next step. -
Click Add, select Full Administrator and click OK.
Configuration Manager console (external product): Full Administrator is ticked. The other roles are listed for a custom choice. -
Select All instances of the objects that are related to the assigned security roles and click OK.
Configuration Manager console (external product): the option All instances of the objects that are related to the assigned security roles is selected.
2 Give it a role
Full Administrator is the simple choice (step 3 above). If you do not want to grant the service account full administrative permissions, create a custom security role with the permissions below instead.
| Object | Permissions |
|---|---|
| Application | Read; Modify; Delete; Create; Approve; Move Object; Modify Folder; Run Report; Modify Report |
| Application Group | Read; Modify; Delete; Set Security Scope; Create; Approve; Move Object; Modify Folder |
| Boot Image Package | Read; Modify; Delete; Create; Move Object; Modify Folder |
| Collection | Read; Modify; Delete; Remote Control; Modify Resource; Delete Resource; Create; View Collected File; Read Resource; Move Object; Deploy Packages; Deploy Client Settings; Modify Folder; Deploy Applications; Modify Collection Setting; Deploy Task Sequences; Run Script; Notify resource; Modify Client Status Alert |
| Computer Association | Read; Delete; Create; Move Object; Modify Folder; Recover User State; Run Report; Modify Report |
| Configuration Item | Read; Modify; Delete; Create |
| Distribution Point | Read; Copy to Distribution Point |
| Distribution Point Group | Read; Copy to Distribution Point |
| Folder Class | Read; Modify; Delete; Create |
| Package | Read; Modify; Delete; Create; Move Object; Modify Folder; Run Report; Modify Report |
| Phased Deployments | Read; Modify; Delete; Create |
| Query | Read; Modify; Delete; Create; Move Object; Modify Folder |
| Site | Read; Import Computers |
| SMS Scripts | Read; Modify; Delete; Create; Move Object; Modify Folder; Approve |
| Software Metering Rule | Read; Modify; Delete; Create; Move Object; Modify Folder; Modify Report |
| Software Update Group | Read; Modify; Delete; Create; Move Object; Modify Folder |
| Software Update Package | Read; Modify; Delete; Create; Move Object; Modify Folder |
| Task Sequence Package | Read; Modify; Delete; Create; Move Object; Modify Folder; Modify Report |
| User Device Affinities | Read; Modify; Delete; Create; Modify Report |
3 Choose the scope
In the last step of the wizard, select All instances of the objects that are related to the assigned security roles and click OK (picture in section 1). The other option, Only the instances of objects that are assigned to the specified security scopes or collections, limits the account to the scopes and collections you pick.
4 Best practice
- Use the same account everywhere. SCCM_SWC_ADMIN is the account the SoftwareCentral application pool runs as, and it is the account that reads the ConfigMgr database and talks to the site server. See Configure the application pool.
- Use a custom role only when Full Administrator is not allowed. If you do, give the role exactly the permissions in the table in section 2, no more.
- Keep the scope at All instances. An account with a narrower scope cannot see ConfigMgr objects outside it, so SoftwareCentral cannot see them either.
- Do not use a person's own account. If that person leaves or changes the password, the application pool and SoftwareCentral's ConfigMgr connections stop working.
- A separate SCCM account needs its own password. If you enter an account in SCCM Server Username under Settings › General Settings › Server Configuration, that account must be a different account from the application pool user. Enter its password in SCCM Server Password and leave both empty to use the application pool user.
5 Troubleshooting
These messages are written to the SoftwareCentral log when SoftwareCentral cannot connect to the site server.
| Symptom | Cause | What to do |
|---|---|---|
| Log: "Failed to authenticate at server" followed by the server name | The account is not an administrative user of the site, or the password of the account in SCCM Server Password is wrong. | Check section 1 and the SCCM Server Username and SCCM Server Password settings. |
| Log: "Failed to connect to server" followed by the server name | The site server could not be reached or the connection failed for another reason. | Check the name in SCCM Server and that the SoftwareCentral web server can reach that server. |