Setting up a Windows service account for BEMS

A service account is a Windows account that runs the services for BEMS. The BEMS service account must be a member of the local Administrators group on the computer that you install BEMS on, and it must have the Log on as a service permission. The service account must also have permission to access the Microsoft SQL Server unless you are using direct SQL Server authentication.

For the required service account, "BEMSAdmin" is recommended. You can use the same Windows service account to install all of the BEMS service modules. For example, bemsadmin@example.com. Make sure the service account has the appropriate administrative privileges for all the BEMS service modules that you plan to install and configure. Permissions for individual service modules may not require the same privilege level as others.

Important: If you're environment runs on-premises Skype for Business and uses the same service account for the Connect and Presence services, you must give the service account the RTCUniversalReadOnlyAdmins rights.
Verify that you have created a Microsoft Active Directory account for the BEMS service account.
  1. On the taskbar, click Start > Administrative Tools > Computer Management.
  2. In the left pane, expand Local Users and Groups.
  3. Navigate to the Groups folder.
  4. In the right pane, double-click Administrators.
  5. Click Add.
  6. In the Enter the object names to select field, type the name of the service account (for example, BESAdmin).
  7. Click OK.
  8. Click Apply.
  9. Click OK.
  10. On the taskbar, click Start > Administrative Tools > Local Security Policy.
  11. In the left pane, expand Local policies.
  12. Click User Rights Assignment.
  13. Configure the Log on as a service permission for the service account.
Optionally, Change the BEMS service account password.