Changing a Service account to Interactive

[BlakeDawes]

Hey Everyone! 

Im needing some guidance on moving a user that was accidentally created as a service account. We are needing them to be a Interactive account. I cant seem to figure out a easy way of doing this. 

[erwinlindemann]

Hi Blake,

Please look into the Active Directory (AD) Group Policy settings configured for the user account on your server.

For a service account, 'Deny log on locally' may have been configured in Active Directory for preventing the account from logging into the system interactively.

For updating a domain policy, you will need an account having admin privileges in AD though. Check the following site, please:

https://www.itprotoday.com/strategy/restricting-interactive-user-logons 

[BlakeDawes]

This is for users on Flexnet manager, could i just delete the user and re-add them? 

[erwinlindemann]

You should not have to modify any settings inside of FlexNet Manager Suite (FNMS). FNMS relies on the Windows OS and on Active Directory for authenticating a user account when the user tries to log into the system.

Modifications done to user account configuration settings in Active Directory (AD) should be transparent for any application (like FlexNet) that uses AD for authentication.

[BlakeDawes]

So this is the only way that we can change a user from a Service account to a Interactive account? Flexnet does not have the ability to change it in some user settings? 

[erwinlindemann]

Well - technically, you can update the service user account status in FNMS from "Enabled" to "Disabled".

Changing the user account status in FNMS will prevent the service account user from logging into the FNMS Web UI. It will not impact the FNMS application, as the service user account can still authenticate against AD, and can still log into the Windows operating system and run Windows services and Batch Jobs.

This is generally not how you would disable a service account. By definition, you want to prevent a service user account from logging into the Windows OS.

So if you use the text book approach, the answer is no. You should check and change the policy settings in Windows and/or in Active Directory.

[BlakeDawes · Accepted solution]

I see, we want the user to use Flexnet but they are just needing to be on a interactive account setup and not a Service account set up. 

I was able to find this guide and give it to my team so they are work on it. https://community.flexera.com/t5/FlexNet-Manager-Knowledge-Base/Changing-a-Service-Account-into-an-Interactive-Account/ta-p/1937

Thank you for all your help!

[ChrisG]

You have found the appropriate KB article here for your need. Hopefully the steps described in there help your team get the required change made.

For clarity and to avoid potential future confusion, the earlier comments in this thread about user rights assigned through Active Directory policy settings are not directly related to what you're seeking to do here. Active Directory policy settings do not influence what FlexNet Manager Suite considers to be a "service" operator account (used for accessing internal FlexNet Manager Suite APIs) or "interactive" operator account (used by a human to access the FlexNet Manager Suite web UI).