This article describes how to update the password for the Okta Active Directory (AD) Agent Service directly within the Windows Services console.
- Okta Classic Engine
- Okta Identity Engine (OIE)
- Active Directory (AD) integrations
- AD agent
How is the Okta AD agent service account password updated?
In this video, learn how to change the Okta Active Directory agent service account password, or follow the steps below.
The following steps describe how to update the Okta AD Agent service account password on the Windows server where the agent resides.
- Navigate to Start, select Run.
- Enter
services.mscand select OK. - Locate the Okta AD Agent service.
- Right-click the service and select Properties.
- Select the Log On tab.
- Enter the new password and select Apply, then select OK.
- Right-click the service and select Restart to apply the changes.
- Make sure to update the password on all AD Agents servers in the org.
NOTE: This process should be used to update the password for the existing service account only. Do not use this method to change the service account username. To use a different service account for the Okta AD Agent, it will be necessary to reinstall the agent. Because the configuration file is linked to the original user profile, changing the username via Properties on the service causes the Okta AD agent to stop with the following errors:
- In Services, when trying to start the Okta AD Agent service:
The Okta AD Agent service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs.
- In Okta AD Agent logs:
Could not load encrypted configuration settings. The configuration file was probably encrypted by another user. Reinstall the agent to fix this issue.
Could not start the agent. Reason: All instances failed to initialize.
If Desktop Single Sign-on (SSO) is in use and service account passwords are rotated, ensure that the corresponding Desktop SSO credentials are also updated. Okta recommends maintaining a dedicated service account for Desktop SSO, separate from the account used by the Okta AD agent.
