Microsoft Workplace Community Blog

Font size: +
2 minutes reading time (319 words)

Recovering SCCM Administrator Access

In my test environment, I deleted the account I installed SCCM with. Unfortunately, I had not given any other account admin rights and therefore I had locked myself out of SCCM. However, in the SQL database you can easily give another account the rights to get back into SCCM. It can happen that an administrator leaves a company and his account is deleted. There may still be plenty of admins with access, but possibly not the account with all the rights, which can get you into trouble.

Application Microsoft System Center Configuration Manager (SCCM) 
Location
On-premise installation
Topic
SCCM Admin Account

In this Blog

In the blog I explain step by step how you can regain administrator access to SCCM. To modify the admin account you need SQL administrator rights on the SQL database or at least on the database where SCCM is installed. After performing these steps another account will have full Administrator rights in SCCM.


Locate objectSID
New Administrator

first we look up the objectSID of the new admin that we are going to use for SCCM

  1. Opening ADSIEdit.msc.
  2. Locate the user, right click properties.
  3. Find the objectSID; dubbel click the objectSID to see the value in hexadecimal format,
  4. Copy objectSID; remove all spaces.

Microsoft SQL Server Management Studio Part 1
RBAC Admin objectSID info old admin

  • Open SQL Management Studio and execute the following query. 
  • use CM_LID (LID is my site code)
  • select AdminID,AdminSID,LogonName,DisplayName from RBAC_Admins
  • The account that is now displayed is the old admin account. In my demo it is the same account just with the wrong objectSID.

Microsoft SQL Server Management Studio Part 2
Change SID Admin objectSID

  • Open SQL Management Studio and execute the following query
  • use CM_LID (LID is my site code)
  • update RBAC_Admins set AdminSID=0x01050000000000051500000038C9954BC563ECFC64643DFE84040000
  • select AdminID,AdminSID,LogonName,DisplayName from RBAC_Admins
  • The account that is now update with the new objectSID.

×
Stay Informed

When you subscribe to the blog, we will send you an e-mail when there are new updates on the site so you wouldn't miss them.

Default file associations Intune
Setup Windows Autopilot and add existing devices
 

Comments (0)

Rated 0 out of 5 based on 0 voters
There are no comments posted here yet

Leave your comments

  1. Posting comment as a guest.
Rate this post:
0 Characters
Attachments (0 / 3)
Share Your Location